diff --git a/.agents/architecture.md b/.agents/architecture.md
index dc54168311..2f0e4439f4 100644
--- a/.agents/architecture.md
+++ b/.agents/architecture.md
@@ -7,23 +7,155 @@ The Go proxy core in `core/` operates in two modes.
 Android lib mode:
 
 - Go core is compiled as a C shared library, `libclash.so`, through `go build -buildmode=c-shared` with CGO.
-- Flutter calls it via FFI through the `service` plugin.
-- Dart-side implementation: `lib/core/lib.dart` (`CoreLib`).
+- The Android `:core` module owns JNI access to the in-process library. Flutter crosses the `${packageName}/service`
+  MethodChannel through `lib/plugins/service.dart` and Android's `ServicePlugin` rather than talking to JNI directly.
+- `lib/core/lib.dart` (`CoreLib`) implements the shared Core interface, gates method calls on its connection completer,
+  initializes and synchronizes Android shared state, and closes the native service path exactly once.
+- Because Core is in the application process on Android, application RSS already includes Core memory.
 
 Desktop core mode:
 
 - Go core runs as a separate process with `CGO_ENABLED=0`.
-- Flutter communicates via JSON over socket, using a Unix socket on macOS/Linux and TCP on Windows.
-- Dart-side implementation: `lib/core/service.dart` (`CoreService`).
+- `rust_api` provides the native local-IPC primitives: a Unix domain socket on macOS/Linux and a named pipe on Windows.
+  Dart now owns the transport state, RPC correlation, process ownership, and lifecycle convergence above those primitives.
+- `lib/core/service.dart` (`CoreService`) is the composition root. It wires the IPC transport, launcher selection,
+  lifecycle controller, RPC client, and crash-event bridge; it is no longer the whole desktop implementation by itself.
+- `lib/core/desktop/transport.dart` converts native IPC frames into ready, connected, disconnected, failed, and data
+  events. A replaceable binding keeps RPC subscriptions stable when a failed or stale transport must be rebuilt.
+- `lib/core/desktop/rpc_client.dart` owns request IDs and pending completers, waits up to 10 seconds for a connection,
+  applies a three-minute default method timeout, unwraps `CoreMethodResponse`, and fails all pending calls when transport
+  disconnects or closes.
+- `lib/core/desktop/lifecycle.dart` serializes process intents and owns the authoritative desktop state machine.
+- `lib/core/desktop/launcher.dart` abstracts direct child-process and Windows Helper ownership through idempotent process
+  leases. `lib/core/desktop/helper_client.dart` is the typed loopback HTTP client for the privileged Helper.
 
 `lib/core/controller.dart` (`CoreController`) selects the implementation based on platform. `lib/core/interface.dart` defines the shared `CoreHandlerInterface`.
 
 Key Go core files:
 
 - `core/hub.go`: handler functions.
-- `core/action.go`: dispatch.
+- `core/method.go`: MethodChannel-style method-call dispatch and response envelopes.
+- `core/message.go`: non-blocking priority/bulk event queues and bounded message batching.
 - `core/lib.go`: CGO exports.
-- `core/server.go`: socket server.
+- `core/server.go`: desktop socket/named-pipe client and framed message forwarding.
+
+## Lifecycle Ownership And Convergence
+
+### Shared Flutter Layer
+
+`CoreController.start()`, `restart()`, `stop()`, and `close()` are the only shared lifecycle facade. `close()` is terminal;
+callers must not try to reuse a closed platform implementation.
+
+`CoreAction` in `lib/providers/actions/core.dart` owns the user-facing Core status and setup sequence:
+
+- `startCore()` publishes `connecting`, starts the platform Core, publishes `connected`, then initializes Core state. A
+  startup error publishes `disconnected` and displays the error.
+- `restartCore()` coalesces overlapping callers behind one worker. `_requestedRestartRevision` records newer requests,
+  while `_latestExplicitStart` retains the newest requested post-restart running intent. After the lifecycle restart and
+  `initCore()`, the worker reapplies profile/running state until it has consumed the latest revision.
+- The provider is an orchestration and presentation layer, not a process owner. Platform lifecycle code remains responsible
+  for determining whether a Core process/service is actually running.
+
+Application exit is centralized in `SystemAction` and `SystemExitCoordinator`:
+
+1. Optionally save config and clean up DNS, system proxy, and tray resources in parallel.
+2. Close the desktop window.
+3. Call terminal `CoreController.close()`.
+4. Exit the application exactly once.
+
+The coordinator is idempotent, continues later cleanup steps after an earlier error, preserves the first error for the
+caller, and uses a three-second watchdog as an emergency application-exit path. `Application.dispose()` and
+`CoreManager.onCrash()` do not independently destroy Core; this avoids competing shutdown owners.
+
+### Desktop Lifecycle
+
+`DesktopCoreLifecycle` is a latest-desired-intent reconciler, not a queue that blindly executes every request:
+
+- Public intents receive monotonically increasing revisions and target running, restarted, stopped, or closed.
+- Observable phases are `idle`, `starting`, `running`, `stopping`, `failed`, and `closed`.
+- A completed command reports `applied`, `coalesced`, or `superseded`, allowing callers and tests to distinguish a command
+  that won from one satisfied or replaced by a newer compatible intent.
+- Startup opens or replaces the IPC transport, resolves a launcher, generates a 128-bit lowercase hexadecimal session ID,
+  launches Core, and waits for the matching connection. Windows additionally verifies that the named-pipe peer PID equals
+  the process PID returned by the Helper lease.
+- Each running session retains its process owner, lease, PID, session ID, and transport connection generation. Stop waits
+  for both process-exit confirmation and the matching disconnect generation; a missing disconnect replaces the transport
+  before later starts.
+- An unconfirmed process exit is retained as an unconfirmed lease. New start/restart intents fail until ownership can be
+  cleaned up, preventing two Core instances from being treated as the active session. Terminal close may continue on a
+  best-effort basis because the application is exiting.
+- An unexpected disconnect or transport failure while running is converted to `DesktopCoreFailure`, the owned process is
+  cleaned up, and `CoreService` emits a Core crash event for the normal UI recovery path.
+
+Direct launch is used on macOS/Linux and as the Windows fallback when the privileged Helper is not ready. When the Helper
+is ready on Windows, the Helper owns the Core child and Dart owns it through a session-scoped lease.
+
+### Android Service Lifecycle
+
+Android deliberately keeps Flutter requests optimistic and the native layer authoritative:
+
+- `ServicePlugin.start()` and `stop()` acknowledge immediately after submitting intent. They do not wait for service
+  creation, VPN permission, binding, TUN establishment, or teardown.
+- `ServiceState` owns the latest `RunRequest`, shared configuration, run time, and `STOPPED`/`STARTING`/`STARTED`/`STOPPING`
+  state. Identity checks discard obsolete work. `startPreparationLock` serializes permission/setup preparation and
+  `transitionLock` serializes actual service transitions.
+- `ServiceController` owns exactly one `ManagedServiceBinding`, selects `VpnService` or `ProxyService` from `VpnOptions`,
+  binds with a five-second connection timeout, invokes `ManagedService.start()`/`stop()` off the main thread, and clears
+  binding/run-time state on failure or disconnection.
+- Generic service creation/destruction is lifecycle evidence, not user intent. New commands must flow through
+  `ServiceState.requestStart()`/`requestStop()` or the explicit system-action handlers instead of inferring intent from a
+  callback.
+
+Quick Settings, notification, revoke, and Always-on VPN paths converge on the same owner:
+
+- With a Flutter engine attached, `ServiceState.handleStartAction()`/`handleStopAction()` forward through `TilePlugin` to
+  `TileManager`, which updates normal Flutter setup state. Without Flutter, native code restores `SharedState` from
+  preferences, runs `quickSetup`, checks VPN permission, and submits the native request directly.
+- Android may create an Always-on `VpnService` through `onStartCommand()` without FlClash's bound-service path. The service
+  sends the explicit, permission-protected `VPN_START_REQUESTED` broadcast to `ServiceBroadcastReceiver`, which routes it to
+  `ServiceState.handleStartAction()` so Core/configuration and the normal binding are restored before TUN is treated as
+  ready.
+- `VpnService.onRevoke()` stops TUN/modules first, then sends `VPN_REVOKED`; the receiver only requests a stop when
+  `ServiceController` still owns an active VPN binding.
+- `ServiceBroadcastReceiver` uses `goAsync()` and an atomic one-shot completion. Normal completion or a nine-second
+  watchdog calls `PendingResult.finish()` exactly once; the watchdog releases Android's broadcast lease and does not
+  cancel or redefine the underlying lifecycle intent.
+
+## Core Protocol And Event Delivery
+
+The shared protocol uses `CoreMethodCall(id, method, arguments)` and `CoreMethodResponse(id, result, error)` in both
+directions. The envelope is the only JSON serialization layer: keep arguments, results, and event data as structured JSON
+values rather than embedding pre-encoded JSON strings. Plain domain strings, such as country codes or provider contents,
+remain strings.
+
+Go event delivery is intentionally non-blocking:
+
+- State-bearing events such as delay, loaded-provider, and geo-update use a 256-entry priority queue. Desktop process
+  crashes are generated locally by `CoreService` from lifecycle failures rather than sent through the Go queue.
+- High-volume log and request/connection events use a separate 256-entry bulk queue, so bulk floods cannot evict state.
+- A full queue evicts only its own oldest event and retries the newest event; Core work never blocks on event delivery.
+- The batcher flushes at 32 messages or every 16 milliseconds. Priority events are preferred, but one bulk opportunity is
+  guaranteed after eight priority messages to prevent starvation.
+
+Desktop RPC accepts both a single event object and batched event lists. Android and desktop listener dispatch isolate
+listener exceptions so one faulty observer does not prevent the remaining events/listeners from running.
+
+## User-Facing Core And Delay Feedback
+
+`CoreStatusButton` in `lib/views/dashboard/widgets/core_status_button.dart` is the desktop dashboard's status/restart
+surface. It is shown only outside dashboard edit mode and only when `coreLib == null`:
+
+- Provider state remains authoritative. The widget keeps a separate display-only status so a fast
+  `connecting -> connected` transition still shows at least 600 milliseconds of progress instead of flashing.
+- The hold arms only after an observed transition to `connecting`; mounting while already connecting does not invent a new
+  delay. A real `disconnected` transition cancels the hold immediately so failure is never hidden, while a long-running
+  connecting state remains visible after the timer expires.
+- Taps during the display hold or while the provider is genuinely connecting are inert. Connected/disconnected taps show
+  the appropriate confirmation and delegate restart to `CoreAction`; the widget never starts Core directly.
+
+Proxy delay testing follows the same failure-safe UI rule. `proxyDelayTest()` records an in-progress zero delay, writes the
+real result on success, and logs plus records `-1` on exceptions. `DelayTestButton` reverses its animation in `finally`, so
+an RPC failure cannot leave the control permanently spinning.
 
 ## State Management
 
@@ -71,17 +203,21 @@ Each manager in `lib/manager/` handles a specific platform concern. Desktop-only
 
 `lib/core/controller.dart` (`CoreController`) is a singleton facade over `CoreHandlerInterface`. Public methods delegate to the platform-specific interface, either Android FFI or desktop socket. It has an `@visibleForTesting` constructor and `resetInstance()` for test injection.
 
-Business logic lives in Riverpod notifier classes in `lib/providers/action.dart`:
+`lib/providers/action.dart` is the public library entry point for action
+providers. The Riverpod notifier implementations are split by responsibility
+under `lib/providers/actions/` and joined to the entry point with `part`
+directives, so consumers continue to import the same public API:
 
 - `CommonAction`: update check and common UI operations.
 - `SetupAction`: config setup and TUN management.
 - `BackupAction`: backup/restore with WebDAV sync.
-- `CoreAction`: core lifecycle, init, connect, restart, shutdown.
-- `SystemAction`: system integration, tray, exit, brightness.
+- `CoreAction`: core lifecycle, initialization, coalesced restart, and post-restart profile/running-state application.
+- `SystemAction`: system integration, tray, coordinated resource cleanup, terminal Core close, exit, and brightness.
 - `StoreAction`: profile storage operations.
 - `ThemeAction`: theme state updates.
 - `ProxiesAction`: group management and proxy selection.
 - `ProfilesAction`: profile CRUD, auto-update, import.
+- `GeoResourceAction`: geo resource updates and URL configuration.
 
 ## Platform Managers
 
@@ -110,10 +246,10 @@ Shared:
 
 `setup.dart` is the release build orchestrator:
 
-1. On Windows, pre-builds Go core via `dart run build_tool windows` and reads `core_sha256.json`.
-2. Writes `env.json` (`APP_ENV`).
-3. Passes SHA256 as `--dart-define=CORE_SHA256=$val`, embedded at compile time for Windows.
-4. Activates `flutter_distributor` for packaging.
+1. Writes `env.json` (`APP_ENV`).
+2. Activates `flutter_distributor` for packaging.
+3. Relies on the platform build hook to build the required Core artifacts before
+   the native application is linked.
 
 Go core building is handled by `build_tool`, a standalone Dart CLI in `plugins/setup/buildkit/build_tool/`.
 
@@ -121,25 +257,73 @@ Platform build hooks inside `flutter build` trigger `build_tool` automatically:
 
 - macOS: podspec script phase, `build_pod.sh`, `build_tool macos`.
 - Linux: CMake include, `buildkit/cmake/buildkit.cmake`, `build_tool linux`.
-- Windows: CMake include, `buildkit/cmake/buildkit.cmake`, `build_tool windows`. Debug passes `--dev` via `CMAKE_BUILD_TYPE`.
+- Windows: CMake include, `buildkit/cmake/buildkit.cmake`, `build_tool windows`. CMake forwards the active configuration through `BUILDKIT_CONFIGURATION`.
 - Android: Gradle include, `buildkit/gradle/plugin.gradle`, `build_tool android`.
 
-Windows helper auth:
-
-- Release: Core SHA256 is embedded in both the Flutter app and the Rust helper. The app pings the helper and verifies the token matches.
-- Debug: The Rust helper skips token verification when built in debug mode, so `flutter run` works without the SHA256 flow.
-
-`plugins/setup/` is an FFI plugin that exists only as a build harness. It carries no Dart API, only platform build hooks that trigger Go compilation. Windows builds also compile a Rust helper in `services/helper/` through `RustBuilder`.
-
-Build configuration defaults live in `build_tool/lib/src/options.dart` and can be overridden via `build_config.yaml`.
+### Setup Build Harness Plugin
+
+`plugins/setup/` is a build-time Flutter plugin, not a runtime Dart or FFI API. Its plugin shape exists so Flutter's native
+build graphs can run the Go/Rust build harness before platform consumers need the generated artifacts. Application code
+must not import or call it.
+
+Responsibilities are deliberately split:
+
+- CocoaPods, Gradle, and CMake hooks schedule a lightweight check on every native build. They do not decide which Go or
+  Rust files are stale.
+- `buildkit/build_tool/` owns target resolution, input fingerprinting, compilation, output copying, and cache validation.
+- `core/` and `services/helper/` remain source owners; `libclash/` and Android `jniLibs`/header directories are generated
+  output locations.
+- `setup.dart` remains the release/package orchestrator and does not pre-build
+  platform artifacts or pass Core integrity data into Dart.
+
+Platform outputs remain explicit:
+
+- Android builds the Go core as `c-shared`, then copies `libclash.so` and generated headers into the `:core` Android module.
+- macOS and Linux build a standalone `FlClashCore` process used by the desktop socket integration.
+- Windows builds `FlClashCore.exe` plus the Rust `FlClashHelperService.exe` privileged helper.
+
+The hooks follow rust_api/Cargokit's phony-output scheduling pattern, but setup uses its own cache because it builds both a
+Go core and, on Windows, a separate Rust helper. Per-target records live under `.dart_tool/setup_build_cache/v1/`:
+
+- Go fingerprints cover the target-specific `go list -deps` inputs inside `core/` and `Clash.Meta`, module files, effective
+  build configuration, build-tool sources, target flags, Go environment/toolchain, and Android NDK compiler details.
+- Windows helper fingerprints cover its Rust sources and manifests, Cargo/Rust
+  toolchains and flags, and the expected Core SHA256.
+- A cache hit requires the fingerprint and every recorded output's path, size, and modification state to match. It exits
+  silently without Go/Cargo compilation, output copying, or Windows `taskkill`.
+- Cache records are written only after a successful build and protected by per-target process/file locks. Missing outputs,
+  changed inputs, cache-schema changes, or `--force` rebuild only the affected target.
+- `flutter clean` removes `.dart_tool`, so the next native build performs one full core rebuild. Manual builds can bypass
+  the cache with `make core-<platform> FORCE=1`.
+
+This differs from `rust_api`: rust_api is a runtime Flutter Rust Bridge integration whose Cargokit hooks produce its native
+FFI library, while setup is only the build and packaging bridge for FlClash's external core artifacts.
+
+Windows helper integrity/version check:
+
+- The build tool constructs the Core first, calculates its SHA256, and always
+  builds the Rust Helper with release hardening and that expected hash.
+- Flutter does not embed or send the Core SHA256. Debug, Profile, and Release
+  builds use the same Helper protocol and may use TUN through the same flow.
+- `/ping` is loopback-only and requires no request token. The Helper verifies the fixed `FlClashCore.exe` beside it against
+  its embedded SHA256 before reporting readiness, and repeats verification before every launch. The response includes the
+  running Helper path and protocol header; Dart checks both against the current installation.
+- Flutter creates a 128-bit lowercase-hex session ID and uses it as the random named-pipe suffix. `/start` receives only
+  that address and session ID, validates the fixed `FlClashCore_<session>` namespace, starts the fixed Core beside the
+  Helper, and returns the same session ID plus the spawned PID. Flutter verifies both the session and named-pipe peer PID.
+- `/stop` requires the same session ID. A missing process returns `notRunning`; a different owner returns
+  `sessionMismatch` without terminating that process. Session IDs are ownership tokens for lifecycle safety, not a claim
+  that the loopback HTTP endpoints are authenticated.
+
+Build configuration defaults live in `build_tool/lib/src/options.dart` and can be overridden via a root `build_config.yaml`.
 
 Architecture detection is automatic. The `--description` flag passed to `flutter_distributor` adds arch suffixes to artifact names, such as `FlClash-0.8.93-macos-arm64.dmg`.
 
 ## Local Plugins
 
-- `setup`: build harness FFI plugin.
+- `setup`: build-time harness for Go core artifacts and the Windows Rust helper; no runtime Dart API.
 - `proxy`: system proxy configuration.
-- `rust_api`: Flutter Rust Bridge FFI plugin.
+- `rust_api`: runtime Flutter Rust Bridge FFI plugin built through Cargokit.
 - `tray_manager`: system tray fork/customization.
 - `wifi_ssid`: Wi-Fi SSID detection.
 - `window_ext`: window extensions.
@@ -150,7 +334,32 @@ Architecture detection is automatic. The `--description` flag passed to `flutter
 `services/helper/` is a Windows-only privileged helper for starting the core as admin and managing TUN. It is built with:
 
 ```bash
-cargo build --release --features windows-service
+make core-windows
 ```
 
-It uses token-based auth with the Flutter app.
+The build tool always compiles the Helper in Rust release mode after calculating
+the SHA256 of the Core produced for the active Flutter configuration.
+
+The helper owns its Windows Service Control Manager lifecycle through two elevated commands:
+
+- `FlClashHelperService.exe install` stops and removes any stale registration, creates the auto-start service for the
+  current executable path, starts it, and waits for the running state.
+- `FlClashHelperService.exe uninstall` stops the service, waits for shutdown, removes its registration, and is also used
+  by the Windows package uninstaller.
+
+The Dart layer only launches the helper's `install` command through `ShellExecuteW`; it does not compose `sc.exe`,
+`taskkill`, or `cmd.exe` command lines.
+
+In every Flutter build mode it opens the fixed Core executable beside the Helper without write/delete sharing, validates
+it against the SHA256 embedded only in the Helper, and keeps that handle open through process creation. Protocol version 5
+uses 32-character lowercase-hex session ownership:
+
+- `GET /ping` verifies Core and returns the current Helper executable path with `x-flclash-helper-protocol`.
+- `POST /start` rejects unknown JSON fields, validates `{address, sessionId}`, replaces any previously managed Core, and
+  returns `{sessionId, pid}`.
+- `POST /stop` validates `{sessionId}` and only stops the matching managed Core. A session mismatch is HTTP 409.
+- `GET /logs` exposes the bounded recent Helper/Core stderr buffer with `no-store` caching.
+
+All endpoints bind only to `127.0.0.1:47890` and do not use request-token authentication. Lifecycle safety comes from the
+fixed executable/hash, strict pipe namespace, session-scoped stop contract, and Dart-side peer-PID verification. When the
+Helper service itself shuts down, it unconditionally stops the Core process it owns.
diff --git a/.agents/commands.md b/.agents/commands.md
index 6de8c960b1..ab2ada1101 100644
--- a/.agents/commands.md
+++ b/.agents/commands.md
@@ -33,11 +33,15 @@ make core-macos ARCH=arm64
 make core-android TARGET_PLATFORM=android-arm64
 ```
 
+Core builds use setup's input fingerprint cache. Pass `FORCE=1` to bypass it,
+for example `make core-macos ARCH=arm64 FORCE=1`.
+
 The Makefile wraps `plugins/setup/buildkit/run_build_tool.sh`; prefer the `make` entry points unless debugging the build tool itself.
 
 ## Flutter Development
 
-The project is pinned with FVM.
+The project follows FVM's `stable` channel locally. Release CI pins an exact
+Flutter version separately; see `.agents/project.md`.
 
 ```bash
 fvm flutter pub get
@@ -83,6 +87,7 @@ Tests use `package:test/test.dart` for pure Dart logic and `flutter_test` for pr
 ```bash
 flutter test test/models/
 flutter test test/core/
+flutter test test/core/desktop/
 flutter test test/providers/
 flutter test test/common/
 flutter test test/database/
@@ -93,9 +98,62 @@ flutter test plugins/proxy/test/proxy_test.dart
 
 Root `flutter test` only discovers the root package's `test/` directory by default. Include bundled plugin Dart tests by passing paths explicitly, or run `flutter test` from that plugin package directory. Native plugin tests under platform folders are not run by `flutter test`.
 
+For the current Core/service architecture, useful focused checks are:
+
+```bash
+flutter test test/core/desktop/
+flutter test test/core/service_test.dart
+flutter test test/core/protocol_contract_test.dart
+flutter test test/manager/core_manager_test.dart
+flutter test test/providers/action_test.dart test/providers/system_action_test.dart
+flutter test test/widgets/core_status_button_test.dart
+```
+
+What those suites own:
+
+- `test/core/desktop/`: replaceable IPC transport, RPC request correlation/failure, direct/Helper process leases, and
+  latest-intent desktop lifecycle convergence.
+- `test/core/service_test.dart`: `CoreService` composition and terminal close behavior.
+- `test/core/protocol_contract_test.dart`: shared Dart/Go method and event-envelope compatibility, including event batches.
+- `test/providers/action_test.dart`: Core start/restart orchestration and overlapping restart requests.
+- `test/providers/system_action_test.dart`: ordered, idempotent exit cleanup and watchdog behavior.
+- `test/widgets/core_status_button_test.dart`: 600-millisecond connecting presentation hold, immediate failure display,
+  long-running connecting state, and disconnected restart.
+
+## Native Component Verification
+
+The CI Go-wrapper checks can be reproduced without CGO:
+
+```bash
+cd core
+CGO_ENABLED=0 go test .
+CGO_ENABLED=0 go vet .
+```
+
+The Windows Helper's loopback/session protocol tests are host-independent by default. Windows CI additionally enables its
+service implementation:
+
+```bash
+cargo fmt --manifest-path services/helper/Cargo.toml -- --check
+cargo test --manifest-path services/helper/Cargo.toml
+cargo test --manifest-path services/helper/Cargo.toml --features windows-service
+```
+
+The last command requires Windows for meaningful service coverage. Native Android lifecycle edits should at minimum
+compile the modules they touch; use JDK 17 in this checkout:
+
+```bash
+cd android
+JAVA_HOME=/opt/homebrew/opt/openjdk@17/libexec/openjdk.jdk/Contents/Home ./gradlew :service:compileDebugKotlin
+JAVA_HOME=/opt/homebrew/opt/openjdk@17/libexec/openjdk.jdk/Contents/Home ./gradlew :app:compileDebugKotlin
+```
+
+Always-on VPN entry, system VPN revoke, actual permission UI, and rapid device start/stop still require Android device or
+emulator validation; Kotlin compilation cannot prove those system callbacks.
+
 ## Verify
 
-CI runs these in order:
+The tag-triggered release workflow runs these root-package checks in order:
 
 ```bash
 flutter pub get
@@ -104,3 +162,10 @@ flutter test --reporter expanded
 ```
 
 Run `flutter analyze` locally before committing when practical.
+
+The workflow runs only for `v*` tag pushes; pull requests do not trigger it.
+Root analysis excludes `plugins/**`, and root tests do not discover nested
+plugin packages, so CI also validates local Flutter packages, the setup build
+tool, the Go wrapper, and Rust components from their own package directories. A
+separate Windows runner compiles and tests the helper's `windows-service`
+feature before release builds can start.
diff --git a/.agents/project.md b/.agents/project.md
index 9ca9529f7c..0d138be12f 100644
--- a/.agents/project.md
+++ b/.agents/project.md
@@ -4,8 +4,10 @@ FlClash is a multi-platform proxy client based on ClashMeta (mihomo), built with
 
 ## Version Notes
 
-- `.fvmrc` pins Flutter 3.35.7 for local development.
-- CI uses Flutter 3.41.9. These may diverge; trust CI as the source of truth for release builds.
+- `.fvmrc` follows the FVM `stable` channel for local development; it does not
+  pin an immutable Flutter version.
+- Release CI pins Flutter 3.44.4. Local `stable` may diverge, so trust the CI
+  version as the source of truth for release builds.
 - Dart SDK constraint: `>=3.8.0 <4.0.0`.
 
 ## Build Dependencies
diff --git a/.agents/rules.md b/.agents/rules.md
index fef4630916..414ffb892a 100644
--- a/.agents/rules.md
+++ b/.agents/rules.md
@@ -21,8 +21,37 @@ Generated directories are excluded from analysis:
 - `lib/**/generated/**`
 - `plugins/**`
 
+## Core API Safety
+
+- Do not expose direct filesystem deletion APIs through Core or helper IPC; use
+  a scope-specific cleanup API instead.
+- Keep the shared `CoreMethodCall`/`CoreMethodResponse` JSON envelope structurally identical across Dart, Go, JNI, and
+  desktop IPC. Do not double-encode `arguments`, `result`, or event batches.
+- Keep high-volume log/request events separate from state-bearing events in `core/message.go`; bulk backpressure must not
+  evict delay, loaded-provider, or geo-update state.
+
+## Lifecycle Rules
+
+- Desktop process ownership belongs to `DesktopCoreLifecycle`; do not start/kill `FlClashCore` from providers, widgets,
+  managers, or ad hoc exit callbacks. Acquire and release it through a `CoreProcessLease`.
+- `CoreController.close()` and platform `close()` implementations are terminal and idempotent. Application shutdown must
+  stay centralized in `SystemAction`/`SystemExitCoordinator`.
+- Android start/stop MethodChannel calls are optimistic UI commands. Keep latest-wins arbitration in native
+  `ServiceState`; do not add a Flutter completion callback that creates a second lifecycle owner.
+- Android service callbacks are not automatically user intent. Route explicit Quick Settings, Always-on VPN, and revoke
+  actions through `ServiceState` and keep `ServiceController` as the sole binding/run-time owner.
+- Every `BroadcastReceiver.goAsync()` path must finish its `PendingResult` exactly once. A watchdog may release the
+  broadcast lease, but must not cancel, reverse, or otherwise redefine the service operation.
+- Presentation smoothing such as `CoreStatusButton`'s connecting hold must remain local display state. It must not delay or
+  overwrite `coreStatusProvider`, and a real failure must bypass/cancel the hold immediately.
+
 ## Testing Rules
 
+The `core/` directory is excluded from automated coverage accounting. Do not add coverage instrumentation or coverage
+collection for code under `core/`. CI still runs `CGO_ENABLED=0 go test .` and `go vet .` to compile/check the Go wrapper;
+verify cross-language protocol behavior through shared Dart contract tests under `test/core/` and native platform build
+checks.
+
 Use `CoreController.test(mock)` to inject a mocked `CoreHandlerInterface`. Call `CoreController.resetInstance()` in `tearDown` to clean up the singleton between tests.
 
 Register fallback values for freezed params used with `any()` matchers.
@@ -35,10 +64,14 @@ notifier.update((state) => newValue);
 
 When testing freezed models with nested objects, always round-trip through `jsonEncode` and `jsonDecode`. Direct `fromJson(toJson())` fails for nested freezed types because `toJson()` stores child objects directly instead of maps.
 
+For async widgets, put visual cleanup in `finally` when the action may throw. Focused widget tests should cover success,
+failure, disposal, and any timer boundary that changes visible state.
+
 ## Generated Code
 
 Do not manually edit generated files under:
 
+- `lib/l10n/l10n.dart`
 - `lib/models/generated/`
 - `lib/providers/generated/`
 - `lib/database/generated/`
diff --git a/.agents/skills.md b/.agents/skills.md
index 09ad53e6f5..85196be1ca 100644
--- a/.agents/skills.md
+++ b/.agents/skills.md
@@ -6,8 +6,9 @@ Repo-scoped Codex skills live under `.agents/skills/*/SKILL.md`. Codex can disco
 
 - `localization`: hardcoded UI text scans, ARB updates, locale generation, and localization verification.
 - `provider-tests`: Riverpod provider, notifier, and state-management tests.
-- `ui-work`: Flutter UI, widgets, Material You styling, navigation surfaces, and user-facing interactions.
-- `core-platform`: core integration, platform managers, Go core communication, desktop/mobile behavior, and Windows helper flow.
+- `ui-work`: Flutter UI, widgets, Material You styling, navigation surfaces, async feedback, and user-facing interactions.
+- `core-platform`: Core lifecycle/process ownership, Android services, Go event delivery, desktop IPC, platform managers,
+  VPN/TUN, and Windows Helper flow.
 
 ## Authoring Notes
 
diff --git a/.agents/skills/core-platform/SKILL.md b/.agents/skills/core-platform/SKILL.md
index 02c236120d..92cdc398d2 100644
--- a/.agents/skills/core-platform/SKILL.md
+++ b/.agents/skills/core-platform/SKILL.md
@@ -1,26 +1,45 @@
 ---
 name: core-platform
-description: Use when changing FlClash core integration, platform managers, Go core communication, desktop/mobile platform behavior, or Windows helper flow.
+description: Use when changing FlClash Core integration, lifecycle/process ownership, Go event delivery, Android services, desktop IPC, platform managers, VPN/TUN, or Windows Helper flow.
 ---
 
 # Core And Platform
 
 ## When To Use
 
-Use this for changes touching `lib/core/`, `lib/manager/`, `core/`, `services/helper/`, build hooks, system proxy, tray, VPN, TUN, or platform-specific desktop/mobile behavior.
+Use this for changes touching `lib/core/`, `lib/manager/`, `core/`, `services/helper/`, Android app/service modules, build
+hooks, system proxy, tray, VPN, TUN, or platform-specific desktop/mobile behavior.
 
 ## Workflow
 
-1. Identify which boundary owns the behavior:
-   - Android lib mode: `lib/core/lib.dart`.
-   - Desktop process/socket mode: `lib/core/service.dart`.
-   - Shared facade: `lib/core/controller.dart` and `lib/core/interface.dart`.
-   - Platform lifecycle: `lib/manager/`.
-2. Route feature code through `CoreController` and `CoreHandlerInterface`; avoid direct calls to platform implementations outside their boundary.
-3. Keep desktop and mobile paths explicit.
-4. For action-layer behavior, inspect `lib/providers/action.dart` and relevant generated providers.
-5. Add or update shared Dart tests for logic that can be isolated.
-6. Manually verify native behavior when automated coverage is not practical.
+1. Identify the authoritative owner before changing behavior:
+   - Shared facade/protocol: `lib/core/controller.dart`, `lib/core/interface.dart`, and `lib/core/method.dart`.
+   - Android Core connection: `lib/core/lib.dart`, `lib/plugins/service.dart`, and Android `ServicePlugin`.
+   - Android start/stop intent: `ServiceState`; binding/process-time bookkeeping: `ServiceController`.
+   - Desktop composition: `lib/core/service.dart`; lifecycle/process ownership: `lib/core/desktop/lifecycle.dart`.
+   - Desktop IPC/RPC: `lib/core/desktop/transport.dart` and `lib/core/desktop/rpc_client.dart`.
+   - Desktop launch ownership: `lib/core/desktop/launcher.dart`; Windows Helper HTTP contract:
+     `lib/core/desktop/helper_client.dart` and `services/helper/`.
+   - Flutter orchestration: `lib/providers/actions/core.dart` and `system.dart`; UI/event observation: `lib/manager/`.
+2. Trace every entry path into that owner, including UI/provider calls, Quick Settings, notification actions, Always-on VPN,
+   revoke callbacks, application exit, and crash/disconnect recovery. Lifecycle callbacks are not implicit user intent.
+3. Preserve latest-intent semantics:
+   - Desktop revisions converge to running/restarted/stopped/closed and report applied/coalesced/superseded outcomes.
+   - Android Flutter calls stay optimistic; `ServiceState` identity-checks the latest native `RunRequest`.
+4. Route feature calls through `CoreController` and `CoreHandlerInterface`. Do not bypass desktop process leases or create a
+   second Android service binding owner.
+5. Keep JSON envelopes and event shapes identical across Dart, Go, JNI, and desktop IPC. If event traffic changes, preserve
+   the separate priority and bulk queues in `core/message.go`.
+6. Keep shutdown single-owned and terminal. `SystemExitCoordinator` sequences resource cleanup, window close, Core close,
+   and process exit; widget/manager disposal must not race it.
+7. Add or update focused tests at the narrowest layer, then run the matching commands from `.agents/commands.md`:
+   - Desktop lifecycle/transport/RPC: `test/core/desktop/` plus `test/core/service_test.dart`.
+   - Cross-language envelopes/events: `test/core/protocol_contract_test.dart` and `CGO_ENABLED=0 go test .`.
+   - Provider/exit convergence: `test/providers/action_test.dart` and `test/providers/system_action_test.dart`.
+   - Android Kotlin: compile each touched Gradle module with JDK 17.
+   - Windows Helper: Cargo format/tests; run the `windows-service` feature on Windows.
+8. Explicitly state host gaps. Always-on VPN, VPN permission, system revoke, named-pipe peer identity, and Windows Service
+   Control Manager behavior need their real platform even when portable tests pass.
 
 ## Reference Files
 
@@ -28,6 +47,19 @@ Read `.agents/architecture.md` for the current core modes, manager stack, build
 
 ## Pitfalls
 
-- Debug Windows helper auth differs from release token verification.
+- Keep the Windows Helper protocol and Core SHA256 validation identical across
+  Flutter build modes; the Helper owns executable integrity checks.
+- Protocol version 5 uses a 32-character lowercase-hex session ID. `/start` must return the submitted session and PID;
+  `/stop` must never terminate a different session; Dart must verify the connected named-pipe peer PID.
+- A desktop process lease with unconfirmed exit must remain owned until cleanup succeeds. Do not discard it and start a
+  replacement Core.
+- `CoreController.close()` is terminal. Do not call it from a reusable manager lifecycle or recover by starting it again.
+- `ServiceBroadcastReceiver.goAsync()` must finish once even on timeout; its watchdog releases the broadcast only and must
+  not become a service timeout.
+- Do not interpret service creation/destruction as start/stop intent. Always-on startup is explicit through
+  `VPN_START_REQUESTED`; revoke is explicit through `VPN_REVOKED`.
+- Keep log/request floods from evicting state-bearing Core events. Each queue may evict only its own oldest item.
+- Do not expose direct filesystem deletion APIs through Core or helper IPC; use
+  a scope-specific cleanup API instead.
 - `plugins/setup/` is a build harness, not a Dart API plugin.
 - Build hooks can trigger Go or Rust compilation indirectly through Flutter platform builds.
diff --git a/.agents/skills/ui-work/SKILL.md b/.agents/skills/ui-work/SKILL.md
index c2cab0a23b..2f94062cec 100644
--- a/.agents/skills/ui-work/SKILL.md
+++ b/.agents/skills/ui-work/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: ui-work
-description: Use when changing FlClash Flutter UI, widgets, screens, Material You styling, navigation surfaces, or user-facing interactions.
+description: Use when changing FlClash Flutter UI, widgets, screens, Material You styling, navigation surfaces, async feedback, or user-facing interactions.
 ---
 
 # UI Work
@@ -18,7 +18,12 @@ Use this for user-facing Flutter UI changes in `lib/`, including widgets, screen
 5. Prefer `const` constructors and final locals.
 6. Localize user-facing text through ARB; use `localization` when text changes are non-trivial.
 7. Add focused widget tests when behavior changes, especially for rendering states, taps, scrolling, and empty/error states.
-8. Run targeted verification:
+8. For asynchronous controls, define separately:
+   - authoritative provider/domain state;
+   - display-only state such as a minimum progress duration;
+   - tap policy while work or display holds are active;
+   - failure/disposal cleanup, normally in `finally` for animations and timers.
+9. Run targeted verification:
 
    ```bash
    flutter analyze
@@ -30,3 +35,13 @@ Use this for user-facing Flutter UI changes in `lib/`, including widgets, screen
 - Do not introduce a new visual system for one screen.
 - Do not manually edit generated localization or provider files.
 - Avoid broad layout rewrites unless the requested change requires them.
+- Do not mutate provider/domain state merely to smooth a transition. Keep presentation holds local and let real errors
+  bypass them immediately.
+- Do not leave loading animations active when callbacks throw. Test the exception path, not only the successful tap.
+
+## Current Interaction Examples
+
+- `CoreStatusButton` watches `coreStatusProvider` but keeps its 600-millisecond connecting hold locally. Taps are ignored
+  during the hold or genuine connecting state; disconnected cancels the hold immediately.
+- Proxy delay testing writes `0` while pending, the measured delay on success, and `-1` on failure. `DelayTestButton` resets
+  its animation in `finally`.
diff --git a/.github/scripts/generate_release_notes.sh b/.github/scripts/generate_release_notes.sh
new file mode 100644
index 0000000000..25fa71a6e9
--- /dev/null
+++ b/.github/scripts/generate_release_notes.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+previous_tag="${1:-}"
+output="${2:-release.md}"
+
+: > "$output"
+
+append_range() {
+  local range="$1"
+
+  git log --no-merges --pretty=format:'%B' "$range" |
+    awk '!/Update changelog/ && NF {print "- " $0 "\n"}' >> "$output"
+}
+
+current_tag=""
+while IFS= read -r next_tag; do
+  if [[ -n "$current_tag" ]]; then
+    [[ "$current_tag" == "$previous_tag" ]] && break
+    append_range "$next_tag..$current_tag"
+  fi
+  current_tag="$next_tag"
+done < <(git tag --merged HEAD --sort=-creatordate)
+
+if [[ -n "$current_tag" && "$current_tag" != "$previous_tag" ]]; then
+  append_range "$current_tag"
+fi
diff --git a/.github/scripts/generate_release_notes_test.sh b/.github/scripts/generate_release_notes_test.sh
new file mode 100644
index 0000000000..82a683afb8
--- /dev/null
+++ b/.github/scripts/generate_release_notes_test.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+generator="$script_dir/generate_release_notes.sh"
+temp_dir="$(mktemp -d)"
+trap 'rm -rf "$temp_dir"' EXIT
+
+repo="$temp_dir/repo"
+git init --quiet --initial-branch=main "$repo"
+git -C "$repo" config user.email "release-notes-test@example.com"
+git -C "$repo" config user.name "Release notes test"
+
+commit() {
+  local message="$1"
+  local date="$2"
+
+  GIT_AUTHOR_DATE="$date" GIT_COMMITTER_DATE="$date" \
+    git -C "$repo" commit --allow-empty --quiet --message "$message"
+}
+
+commit "Initial release" "2025-01-01T00:00:00Z"
+git -C "$repo" tag v1.0.0
+
+commit "First release change" "2025-01-02T00:00:00Z"
+commit "Update changelog" "2025-01-03T00:00:00Z"
+git -C "$repo" tag v1.1.0
+
+git -C "$repo" branch feature
+git -C "$repo" checkout --quiet feature
+commit $'Feature branch change\n\nFeature detail' "2025-01-04T00:00:00Z"
+git -C "$repo" checkout --quiet main
+GIT_AUTHOR_DATE="2025-01-05T00:00:00Z" \
+  GIT_COMMITTER_DATE="2025-01-05T00:00:00Z" \
+  git -C "$repo" merge --no-ff --quiet --message "Merge feature" feature
+git -C "$repo" tag v1.2.0
+
+expected="$temp_dir/expected.md"
+actual="$temp_dir/actual.md"
+printf '%s\n' \
+  "- Feature branch change" \
+  "" \
+  "- Feature detail" \
+  "" \
+  "- First release change" \
+  "" > "$expected"
+
+(
+  cd "$repo"
+  bash "$generator" v1.0.0 "$actual"
+)
+diff -u "$expected" "$actual"
+
+printf '%s\n' "stale content" > "$actual"
+(
+  cd "$repo"
+  bash "$generator" v1.2.0 "$actual"
+)
+[[ ! -s "$actual" ]]
+
+(
+  cd "$repo"
+  bash "$generator" "" "$actual"
+)
+grep -q -- "- Initial release" "$actual"
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index a33fba3d89..0078a1e476 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -18,6 +18,10 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Test release notes generation
+        shell: bash
+        run: bash .github/scripts/generate_release_notes_test.sh
+
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
         with:
@@ -34,8 +38,73 @@ jobs:
       - name: Run tests
         run: flutter test --reporter expanded
 
+      - name: Validate local Flutter packages
+        shell: bash
+        run: |
+          for package in plugins/proxy plugins/wifi_ssid plugins/window_ext plugins/setup; do
+            (
+              cd "$package"
+              flutter pub get
+              flutter analyze --no-fatal-infos
+            )
+          done
+
+      - name: Run local plugin tests
+        shell: bash
+        run: |
+          (
+            cd plugins/proxy
+            flutter test --reporter expanded
+          )
+          (
+            cd plugins/wifi_ssid
+            flutter test --reporter expanded
+          )
+
+      - name: Validate setup build tool
+        working-directory: plugins/setup/buildkit/build_tool
+        run: |
+          dart pub get
+          dart analyze
+          dart test
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.26.4'
+          cache-dependency-path: core/go.sum
+
+      - name: Validate Go core wrapper
+        working-directory: core
+        env:
+          CGO_ENABLED: 0
+        run: |
+          go test .
+          go vet .
+
+      - name: Validate Rust components
+        run: |
+          cargo fmt --manifest-path services/helper/Cargo.toml -- --check
+          cargo test --manifest-path services/helper/Cargo.toml
+          cargo fmt --manifest-path plugins/rust_api/rust/Cargo.toml -- --check
+          cargo test --manifest-path plugins/rust_api/rust/Cargo.toml
+
+  windows-helper-test:
+    name: Windows helper test
+    runs-on: windows-2022
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check format
+        run: cargo fmt --manifest-path services/helper/Cargo.toml -- --check
+
+      - name: Run Windows service tests
+        run: cargo test --manifest-path services/helper/Cargo.toml --features windows-service
+
   build:
-    needs: [ test ]
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs: [ test, windows-helper-test ]
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -149,18 +218,19 @@ jobs:
       - name: Generate
         run: |
           last_ver=$(grep -m1 '^## ' CHANGELOG.md 2>/dev/null | sed 's/^## //')
-          
-          tags=($(git tag --merged HEAD --sort=-creatordate))
-          
-          temp="NEW_CHANGELOG.md" > "$temp"
-          
+
+          mapfile -t tags < <(git tag --merged HEAD --sort=-creatordate)
+
+          temp="NEW_CHANGELOG.md"
+          : > "$temp"
+
           for i in "${!tags[@]}"; do
               curr="${tags[i]}"
               [[ "$curr" == "$last_ver" ]] && break
-          
+
               prev="${tags[i+1]}"
               range="${prev:+$prev..}$curr"
-          
+
               echo -e "## $curr\n" >> "$temp"
               git log --no-merges --pretty=format:"%B" "$range" | \
               awk '!/Update changelog/ && NF {print "- " $0 "\n"}' >> "$temp"
@@ -215,25 +285,13 @@ jobs:
           merge-multiple: true
 
       - name: Generate release.md
+        shell: bash
         run: |
-          tags=($(git tag --merged HEAD --sort=-creatordate))
-          preTag=$(curl -s "https://api.github.com/repos/chen08209/FlClash/releases/latest" | \
-          sed -nE 's/.*"tag_name": "([^"]+)".*/\1/p')
-          
-          [ -z "$preTag" ] && preTag=""
-          
-          out="release.md" > "$out"
-          
-          for i in "${!tags[@]}"; do
-            curr="${tags[i]}"
-            [[ "$curr" == "$preTag" ]] && break
-          
-            prev="${tags[i+1]}"
-            range="${prev:+$prev..}$curr"
-          
-            git log --no-merges --pretty=format:"%B" "$range" | \
-            awk '!/Update changelog/ && NF {print "- " $0 "\n"}' >> "$out"
-          done
+          pre_tag=$(
+            curl --silent "https://api.github.com/repos/chen08209/FlClash/releases/latest" |
+              sed -nE 's/.*"tag_name": "([^"]+)".*/\1/p'
+          )
+          bash .github/scripts/generate_release_notes.sh "$pre_tag" release.md
       - name: Push to telegram
         env:
           TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
diff --git a/.gitignore b/.gitignore
index c72a837e86..c3bd0c480c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -74,4 +74,5 @@ devtools_options.yaml
 
 # FVM Version Cache
 .fvm/
-.fvmrc
\ No newline at end of file
+.fvmrc
+/coverage/lcov.info
diff --git a/AGENTS.md b/AGENTS.md
index 9a5554412a..f61c913ecd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,9 +21,18 @@ Read these only when the task touches their area:
 
 ## Highest Priority Rules
 
+- When the user explicitly requests a scoped, low-risk change, inspect the relevant context and implement it directly.
+  Do not require brainstorming, design documents, implementation plans, multiple-option proposals, or repeated confirmation.
+  Ask only when material ambiguity, destructive impact, additional authority, or scope expansion could change the result.
 - Use `flutter test`, not `dart test`, because models pull in Flutter types.
 - Run code generation after modifying models, providers, or database schema.
 - Do not manually edit generated files.
+- Preserve lifecycle ownership: desktop Core process convergence belongs to `lib/core/desktop/`; Android service intent
+  arbitration belongs to `ServiceState`. UI/provider code may request a transition but must not become a second source of
+  truth.
+- Keep start/stop/restart paths latest-intent-safe. Flutter-to-Android service commands are deliberately optimistic, while
+  native state serializes the actual work; desktop lifecycle results distinguish applied, coalesced, and superseded
+  requests.
 - Follow `analysis_options.yaml`, especially single quotes, trailing commas, `child:` last, no `print()`, const/final
   preferences, and declared return types.
 - For CI parity, verify with `flutter pub get`, `flutter analyze --no-fatal-infos`, and
diff --git a/Makefile b/Makefile
index c1bef1dbb1..b97e9d4423 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,7 @@ PLATFORM ?= macos
 BUILDKIT := plugins/setup/buildkit/run_build_tool.sh
 ARCH_ARG := $(if $(ARCH),--arch $(ARCH),)
 TARGET_PLATFORM_ARG := $(if $(TARGET_PLATFORM),--target-platform $(TARGET_PLATFORM),)
+FORCE_ARG := $(if $(filter 1 true yes,$(FORCE)),--force,)
 
 .PHONY: help submodules core core-macos core-linux core-windows core-android
 
@@ -13,12 +14,13 @@ help:
 	@echo 'make core-macos ARCH=arm64'
 	@echo 'make core-android ARCH=arm64'
 	@echo 'make core-android TARGET_PLATFORM=android-arm64'
+	@echo 'make core-macos FORCE=1            # bypass setup build cache'
 
 submodules:
 	git submodule update --init --recursive
 
 core:
-	bash $(BUILDKIT) $(PLATFORM) $(ARCH_ARG) $(TARGET_PLATFORM_ARG)
+	bash $(BUILDKIT) $(PLATFORM) $(ARCH_ARG) $(TARGET_PLATFORM_ARG) $(FORCE_ARG)
 
 core-macos:
 	$(MAKE) core PLATFORM=macos
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index b64ccea8e6..5d37e8851f 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -15,21 +15,20 @@ val localProperties = Properties().apply {
     }
 }
 
-val mStoreFile: File = file("keystore.jks")
-val mStorePassword: String? = localProperties.getProperty("storePassword")
-val mKeyAlias: String? = localProperties.getProperty("keyAlias")
-val mKeyPassword: String? = localProperties.getProperty("keyPassword")
-val isRelease =
-    mStoreFile.exists() && mStorePassword != null && mKeyAlias != null && mKeyPassword != null
-
+val releaseStoreFile = file("keystore.jks")
+val releaseStorePassword = localProperties.getProperty("storePassword")
+val releaseKeyAlias = localProperties.getProperty("keyAlias")
+val releaseKeyPassword = localProperties.getProperty("keyPassword")
+val hasReleaseSigning = releaseStoreFile.exists() &&
+    releaseStorePassword != null &&
+    releaseKeyAlias != null &&
+    releaseKeyPassword != null
 
 android {
     namespace = "com.follow.clash"
     compileSdk = libs.versions.compileSdk.get().toInt()
     ndkVersion = libs.versions.ndkVersion.get()
 
-
-
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17
@@ -44,12 +43,12 @@ android {
     }
 
     signingConfigs {
-        if (isRelease) {
+        if (hasReleaseSigning) {
             create("release") {
-                storeFile = mStoreFile
-                storePassword = mStorePassword
-                keyAlias = mKeyAlias
-                keyPassword = mKeyPassword
+                storeFile = releaseStoreFile
+                storePassword = releaseStorePassword
+                keyAlias = releaseKeyAlias
+                keyPassword = releaseKeyPassword
             }
         }
     }
@@ -69,7 +68,7 @@ android {
         release {
             isMinifyEnabled = true
             isShrinkResources = true
-            if (isRelease) {
+            if (hasReleaseSigning) {
                 signingConfig = signingConfigs.getByName("release")
             } else {
                 signingConfig = signingConfigs.getByName("debug")
@@ -77,7 +76,8 @@ android {
             }
 
             proguardFiles(
-                getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro"
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro",
             )
         }
     }
@@ -93,10 +93,10 @@ flutter {
     source = "../.."
 }
 
-
 dependencies {
     implementation(project(":service"))
     implementation(project(":common"))
+    implementation(project(":core"))
     implementation(libs.core.splashscreen)
     implementation(libs.gson)
     implementation(libs.smali.dexlib2) {
diff --git a/android/app/proguard-rules.pro b/android/app/proguard-rules.pro
index 0b65f1f717..7eb34736a7 100644
--- a/android/app/proguard-rules.pro
+++ b/android/app/proguard-rules.pro
@@ -1,4 +1,4 @@
 
--keep class com.follow.clash.models.**{ *; }
+-keep class com.follow.clash.models.** { *; }
 
--keep class com.follow.clash.service.models.**{ *; }
\ No newline at end of file
+-keep class com.follow.clash.service.models.** { *; }
diff --git a/android/app/src/debug/AndroidManifest.xml b/android/app/src/debug/AndroidManifest.xml
index d9270beb6e..1fb7cc8287 100644
--- a/android/app/src/debug/AndroidManifest.xml
+++ b/android/app/src/debug/AndroidManifest.xml
@@ -1,9 +1,5 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools">
-    <!-- The INTERNET permission is required for development. Specifically,
-         the Flutter tool needs it to communicate with the running application
-         to allow setting breakpoints, to provide hot reload, etc.
-    -->
     <application
         android:icon="@mipmap/ic_launcher"
         android:label="FlClash Debug"
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index a53c6ed015..c9dba5b974 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -11,10 +11,12 @@
     <uses-feature
         android:name="android.software.leanback"
         android:required="false" />
+    <uses-feature
+        android:name="android.hardware.wifi"
+        android:required="false" />
 
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
-    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
     <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
@@ -23,15 +25,14 @@
         tools:ignore="QueryAllPackagesPermission" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <uses-permission android:name="android.permission.POST_PROMOTED_NOTIFICATIONS" />
     <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
 
     <application
-        android:name=".Application"
+        android:name=".FlClashApplication"
         android:banner="@mipmap/ic_banner"
         android:hardwareAccelerated="true"
         android:icon="@mipmap/ic_launcher"
-        android:label="FlClash">
+        android:label="@string/app_name">
         <activity
             android:name=".MainActivity"
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
@@ -68,7 +69,7 @@
         </activity>
 
         <activity
-            android:name=".TempActivity"
+            android:name=".QuickActionActivity"
             android:excludeFromRecents="true"
             android:exported="true"
             android:theme="@style/TransparentTheme">
@@ -90,7 +91,7 @@
             android:name=".TileService"
             android:exported="true"
             android:icon="@drawable/ic"
-            android:label="FlClash"
+            android:label="@string/app_name"
             android:permission="android.permission.BIND_QUICK_SETTINGS_TILE">
             <intent-filter>
                 <action android:name="android.service.quicksettings.action.QS_TILE" />
@@ -101,13 +102,13 @@
         </service>
 
         <receiver
-            android:name=".BroadcastReceiver"
+            android:name=".ServiceBroadcastReceiver"
             android:enabled="true"
             android:exported="true"
             android:permission="${applicationId}.permission.RECEIVE_BROADCASTS">
             <intent-filter>
-                <action android:name="${applicationId}.intent.action.SERVICE_CREATED" />
-                <action android:name="${applicationId}.intent.action.SERVICE_DESTROYED" />
+                <action android:name="${applicationId}.intent.action.VPN_START_REQUESTED" />
+                <action android:name="${applicationId}.intent.action.VPN_REVOKED" />
             </intent-filter>
         </receiver>
 
@@ -115,4 +116,4 @@
             android:name="flutterEmbedding"
             android:value="2" />
     </application>
-</manifest>
\ No newline at end of file
+</manifest>
diff --git a/android/app/src/main/kotlin/com/follow/clash/BroadcastReceiver.kt b/android/app/src/main/kotlin/com/follow/clash/BroadcastReceiver.kt
deleted file mode 100644
index 93e621e48e..0000000000
--- a/android/app/src/main/kotlin/com/follow/clash/BroadcastReceiver.kt
+++ /dev/null
@@ -1,29 +0,0 @@
-package com.follow.clash
-
-import android.content.BroadcastReceiver
-import android.content.Context
-import android.content.Intent
-import com.follow.clash.common.BroadcastAction
-import com.follow.clash.common.GlobalState
-import com.follow.clash.common.action
-import kotlinx.coroutines.launch
-
-class BroadcastReceiver : BroadcastReceiver() {
-    override fun onReceive(context: Context?, intent: Intent?) {
-        when (intent?.action) {
-            BroadcastAction.SERVICE_CREATED.action -> {
-                GlobalState.log("Receiver service created")
-                GlobalState.launch {
-                    State.handleStartServiceAction()
-                }
-            }
-
-            BroadcastAction.SERVICE_DESTROYED.action -> {
-                GlobalState.log("Receiver service destroyed")
-                GlobalState.launch {
-                    State.handleStopServiceAction()
-                }
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/android/app/src/main/kotlin/com/follow/clash/Ext.kt b/android/app/src/main/kotlin/com/follow/clash/Ext.kt
index 7cabf5b829..44247d1d55 100644
--- a/android/app/src/main/kotlin/com/follow/clash/Ext.kt
+++ b/android/app/src/main/kotlin/com/follow/clash/Ext.kt
@@ -17,37 +17,32 @@ import io.flutter.embedding.engine.FlutterEngine
 import io.flutter.embedding.engine.plugins.FlutterPlugin
 import io.flutter.plugin.common.MethodChannel
 import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.suspendCancellableCoroutine
 import kotlinx.coroutines.withContext
 import java.io.File
 import java.io.FileOutputStream
 import java.util.concurrent.TimeUnit
-import kotlin.coroutines.resume
 
 private const val ICON_TTL_DAYS = 1L
 
 val Application.sharedState: SharedState
-    get() {
-        try {
-            val sp = getSharedPreferences("FlutterSharedPreferences", MODE_PRIVATE)
-            val res = sp.getString("flutter.sharedState", "")
-            return Gson().fromJson(res, SharedState::class.java)
-        } catch (_: Exception) {
-            return SharedState()
-        }
+    get() = try {
+        val preferences = getSharedPreferences("FlutterSharedPreferences", MODE_PRIVATE)
+        val json = preferences.getString("flutter.sharedState", null)
+        Gson().fromJson(json, SharedState::class.java) ?: SharedState()
+    } catch (_: Exception) {
+        SharedState()
     }
 
-
 private var lastToast: Toast? = null
 
 fun Application.showToast(text: String?) {
+    if (text.isNullOrEmpty()) return
     Handler(Looper.getMainLooper()).post {
         lastToast?.cancel()
         lastToast = Toast.makeText(this, text, Toast.LENGTH_LONG).apply {
             show()
         }
     }
-
 }
 
 suspend fun PackageManager.getPackageIconPath(packageName: String): String =
@@ -55,8 +50,7 @@ suspend fun PackageManager.getPackageIconPath(packageName: String): String =
         val cacheDir = GlobalState.application.cacheDir
         val iconDir = File(cacheDir, "icons").apply { mkdirs() }
         return@withContext try {
-            val pkgInfo = getPackageInfo(packageName, 0)
-            val lastUpdateTime = pkgInfo.lastUpdateTime
+            val lastUpdateTime = getPackageInfo(packageName, 0).lastUpdateTime
             val iconFile = File(iconDir, "${packageName}_${lastUpdateTime}.webp")
             if (iconFile.exists() && !isExpired(iconFile)) {
                 return@withContext iconFile.absolutePath
@@ -80,14 +74,11 @@ private suspend fun saveDrawableToFile(drawable: Drawable, file: File) {
         drawable.toBitmap(width = 128, height = 128)
     }
     try {
-        val format = when {
-            Build.VERSION.SDK_INT >= Build.VERSION_CODES.R -> {
-                Bitmap.CompressFormat.WEBP_LOSSY
-            }
-
-            else -> {
-                Bitmap.CompressFormat.WEBP
-            }
+        @Suppress("DEPRECATION")
+        val format = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            Bitmap.CompressFormat.WEBP_LOSSY
+        } else {
+            Bitmap.CompressFormat.WEBP
         }
         FileOutputStream(file).use { fos ->
             bitmap.compress(format, 90, fos)
@@ -103,48 +94,12 @@ private fun isExpired(file: File): Boolean {
     return age > TimeUnit.DAYS.toMillis(ICON_TTL_DAYS)
 }
 
-suspend fun <T> MethodChannel.awaitResult(
-    method: String, arguments: Any? = null
-): T? = withContext(Dispatchers.Main) {
-    suspendCancellableCoroutine { continuation ->
-        invokeMethod(method, arguments, object : MethodChannel.Result {
-            override fun success(result: Any?) {
-                @Suppress("UNCHECKED_CAST") continuation.resume(result as T?)
-            }
-
-            override fun error(code: String, message: String?, details: Any?) {
-                continuation.resume(null)
-            }
-
-            override fun notImplemented() {
-                continuation.resume(null)
-            }
-        })
-    }
-}
-
 inline fun <reified T : FlutterPlugin> FlutterEngine.plugin(): T? {
     return plugins.get(T::class.java) as T?
 }
 
-fun <T> MethodChannel.invokeMethodOnMainThread(
-    method: String, arguments: Any? = null, callback: ((Result<T>) -> Unit)? = null
-) {
+fun MethodChannel.invokeMethodOnMainThread(method: String, arguments: Any? = null) {
     Handler(Looper.getMainLooper()).post {
-        invokeMethod(method, arguments, object : MethodChannel.Result {
-            override fun success(result: Any?) {
-                @Suppress("UNCHECKED_CAST") callback?.invoke(Result.success(result as T))
-            }
-
-            override fun error(errorCode: String, errorMessage: String?, errorDetails: Any?) {
-                val exception = Exception("MethodChannel error: $errorCode - $errorMessage")
-                callback?.invoke(Result.failure(exception))
-            }
-
-            override fun notImplemented() {
-                val exception = NotImplementedError("Method not implemented: $method")
-                callback?.invoke(Result.failure(exception))
-            }
-        })
+        invokeMethod(method, arguments)
     }
 }
diff --git a/android/app/src/main/kotlin/com/follow/clash/Application.kt b/android/app/src/main/kotlin/com/follow/clash/FlClashApplication.kt
similarity index 85%
rename from android/app/src/main/kotlin/com/follow/clash/Application.kt
rename to android/app/src/main/kotlin/com/follow/clash/FlClashApplication.kt
index a3320b796c..1b904458e0 100644
--- a/android/app/src/main/kotlin/com/follow/clash/Application.kt
+++ b/android/app/src/main/kotlin/com/follow/clash/FlClashApplication.kt
@@ -4,8 +4,7 @@ import android.app.Application
 import android.content.Context
 import com.follow.clash.common.GlobalState
 
-class Application : Application() {
-
+class FlClashApplication : Application() {
     override fun attachBaseContext(base: Context?) {
         super.attachBaseContext(base)
         GlobalState.init(this)
diff --git a/android/app/src/main/kotlin/com/follow/clash/MainActivity.kt b/android/app/src/main/kotlin/com/follow/clash/MainActivity.kt
index c5760d2874..e8cb6e90ba 100644
--- a/android/app/src/main/kotlin/com/follow/clash/MainActivity.kt
+++ b/android/app/src/main/kotlin/com/follow/clash/MainActivity.kt
@@ -1,37 +1,22 @@
 package com.follow.clash
 
-import android.os.Bundle
-import com.follow.clash.common.GlobalState
 import com.follow.clash.plugins.AppPlugin
 import com.follow.clash.plugins.ServicePlugin
 import com.follow.clash.plugins.TilePlugin
 import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.launch
-
-class MainActivity : FlutterActivity(),
-    CoroutineScope by CoroutineScope(SupervisorJob() + Dispatchers.Default) {
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-    }
 
+class MainActivity : FlutterActivity() {
     override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
         super.configureFlutterEngine(flutterEngine)
         flutterEngine.plugins.add(AppPlugin())
         flutterEngine.plugins.add(ServicePlugin())
         flutterEngine.plugins.add(TilePlugin())
-        State.flutterEngine = flutterEngine
+        ServiceState.attachFlutterEngine(flutterEngine)
     }
 
     override fun onDestroy() {
-        GlobalState.launch {
-            Service.setEventListener(null)
-        }
-        State.flutterEngine = null
+        flutterEngine?.let(ServiceState::detachFlutterEngine)
         super.onDestroy()
     }
-}
\ No newline at end of file
+}
diff --git a/android/app/src/main/kotlin/com/follow/clash/QuickActionActivity.kt b/android/app/src/main/kotlin/com/follow/clash/QuickActionActivity.kt
new file mode 100644
index 0000000000..f2d613edd7
--- /dev/null
+++ b/android/app/src/main/kotlin/com/follow/clash/QuickActionActivity.kt
@@ -0,0 +1,28 @@
+package com.follow.clash
+
+import android.app.Activity
+import android.os.Bundle
+import androidx.core.content.pm.ShortcutManagerCompat
+import com.follow.clash.common.GlobalState
+import com.follow.clash.common.QuickAction
+import com.follow.clash.common.action
+import kotlinx.coroutines.launch
+
+class QuickActionActivity : Activity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        when (intent.action) {
+            QuickAction.START.action -> GlobalState.launch { ServiceState.handleStartAction() }
+            QuickAction.STOP.action -> GlobalState.launch { ServiceState.handleStopAction() }
+            QuickAction.TOGGLE.action -> {
+                ShortcutManagerCompat.reportShortcutUsed(this, SHORTCUT_ID)
+                GlobalState.launch { ServiceState.handleToggleAction() }
+            }
+        }
+        finish()
+    }
+
+    private companion object {
+        const val SHORTCUT_ID = "toggle"
+    }
+}
diff --git a/android/app/src/main/kotlin/com/follow/clash/Service.kt b/android/app/src/main/kotlin/com/follow/clash/Service.kt
deleted file mode 100644
index 9385b550cc..0000000000
--- a/android/app/src/main/kotlin/com/follow/clash/Service.kt
+++ /dev/null
@@ -1,187 +0,0 @@
-package com.follow.clash
-
-import com.follow.clash.common.GlobalState
-import com.follow.clash.common.ServiceDelegate
-import com.follow.clash.common.formatString
-import com.follow.clash.common.intent
-import com.follow.clash.service.IAckInterface
-import com.follow.clash.service.ICallbackInterface
-import com.follow.clash.service.IEventInterface
-import com.follow.clash.service.IRemoteInterface
-import com.follow.clash.service.IResultInterface
-import com.follow.clash.service.IVoidInterface
-import com.follow.clash.service.RemoteService
-import com.follow.clash.service.models.NotificationParams
-import com.follow.clash.service.models.VpnOptions
-import kotlinx.coroutines.suspendCancellableCoroutine
-import kotlin.coroutines.resume
-import kotlin.coroutines.resumeWithException
-
-object Service {
-    private val delegate by lazy {
-        ServiceDelegate<IRemoteInterface>(
-            RemoteService::class.intent, ::handleServiceDisconnected
-        ) {
-            IRemoteInterface.Stub.asInterface(it)
-        }
-    }
-
-    var onServiceDisconnected: ((String) -> Unit)? = null
-
-    private fun handleServiceDisconnected(message: String) {
-        onServiceDisconnected?.let {
-            it(message)
-        }
-    }
-
-    fun bind() {
-        delegate.bind()
-    }
-
-    fun unbind() {
-        delegate.unbind()
-    }
-
-    suspend fun invokeAction(data: String, cb: ((result: String) -> Unit)?): Result<Unit> {
-        val res = mutableListOf<ByteArray>()
-        return delegate.useService {
-            it.invokeAction(
-                data, object : ICallbackInterface.Stub() {
-                    override fun onResult(
-                        result: ByteArray?, isSuccess: Boolean, ack: IAckInterface?
-                    ) {
-                        res.add(result ?: byteArrayOf())
-                        ack?.onAck()
-                        if (isSuccess) {
-                            cb?.let { cb ->
-                                cb(res.formatString())
-                            }
-                        }
-                    }
-                })
-        }
-    }
-
-    suspend fun quickSetup(
-        initParamsString: String,
-        setupParamsString: String,
-        onStarted: (() -> Unit)?,
-        onResult: ((result: String) -> Unit)?,
-    ): Result<Unit> {
-        val res = mutableListOf<ByteArray>()
-        return delegate.useService {
-            it.quickSetup(
-                initParamsString,
-                setupParamsString,
-                object : ICallbackInterface.Stub() {
-                    override fun onResult(
-                        result: ByteArray?, isSuccess: Boolean, ack: IAckInterface?
-                    ) {
-                        res.add(result ?: byteArrayOf())
-                        ack?.onAck()
-                        if (isSuccess) {
-                            onResult?.let { cb ->
-                                cb(res.formatString())
-                            }
-                        }
-                    }
-                },
-                object : IVoidInterface.Stub() {
-                    override fun invoke() {
-                        onStarted?.let { onStarted ->
-                            onStarted()
-                        }
-                    }
-                }
-            )
-        }
-    }
-
-    suspend fun setEventListener(
-        cb: ((result: String?) -> Unit)?
-    ): Result<Unit> {
-        val results = HashMap<String, MutableList<ByteArray>>()
-        return delegate.useService {
-            it.setEventListener(
-                when (cb != null) {
-                    true -> object : IEventInterface.Stub() {
-                        override fun onEvent(
-                            id: String, data: ByteArray?, isSuccess: Boolean, ack: IAckInterface?
-                        ) {
-                            if (results[id] == null) {
-                                results[id] = mutableListOf()
-                            }
-                            results[id]?.add(data ?: byteArrayOf())
-                            ack?.onAck()
-                            if (isSuccess) {
-                                cb(results[id]?.formatString())
-                                results.remove(id)
-                            }
-                        }
-                    }
-
-                    false -> null
-                })
-        }
-    }
-
-    suspend fun updateNotificationParams(
-        params: NotificationParams
-    ): Result<Unit> {
-        return delegate.useService {
-            it.updateNotificationParams(params)
-        }
-    }
-
-    suspend fun setCrashlytics(
-        enable: Boolean
-    ): Result<Unit> {
-        return delegate.useService {
-            it.setCrashlytics(enable)
-        }
-    }
-
-    private suspend fun awaitIResultInterface(
-        block: (IResultInterface) -> Unit
-    ): Long = suspendCancellableCoroutine { continuation ->
-        val callback = object : IResultInterface.Stub() {
-            override fun onResult(time: Long) {
-                if (continuation.isActive) {
-                    continuation.resume(time)
-                }
-            }
-        }
-
-        try {
-            block(callback)
-        } catch (e: Exception) {
-            GlobalState.log("awaitIResultInterface $e")
-            if (continuation.isActive) {
-                continuation.resumeWithException(e)
-            }
-        }
-    }
-
-
-    suspend fun startService(options: VpnOptions, runTime: Long): Long {
-        return delegate.useService {
-            awaitIResultInterface { callback ->
-                it.startService(options, runTime, callback)
-            }
-        }.getOrNull() ?: 0L
-    }
-
-    suspend fun stopService(): Long {
-        return delegate.useService {
-            awaitIResultInterface { callback ->
-                it.stopService(callback)
-            }
-        }.getOrNull() ?: 0L
-    }
-
-    suspend fun getRunTime(): Long {
-        return delegate.useService {
-            it.runTime
-        }.getOrNull() ?: 0L
-    }
-}
\ No newline at end of file
diff --git a/android/app/src/main/kotlin/com/follow/clash/ServiceBroadcastReceiver.kt b/android/app/src/main/kotlin/com/follow/clash/ServiceBroadcastReceiver.kt
new file mode 100644
index 0000000000..b92b808da7
--- /dev/null
+++ b/android/app/src/main/kotlin/com/follow/clash/ServiceBroadcastReceiver.kt
@@ -0,0 +1,58 @@
+package com.follow.clash
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.os.Handler
+import android.os.Looper
+import com.follow.clash.common.BroadcastAction
+import com.follow.clash.common.GlobalState
+import com.follow.clash.common.action
+import java.util.concurrent.atomic.AtomicBoolean
+import kotlinx.coroutines.launch
+
+class ServiceBroadcastReceiver : BroadcastReceiver() {
+    override fun onReceive(context: Context?, intent: Intent?) {
+        val action = intent?.action ?: return
+        val pendingResult = goAsync()
+        val finished = AtomicBoolean(false)
+        val timeout = Runnable {
+            if (finished.compareAndSet(false, true)) {
+                GlobalState.log("Broadcast handling timed out: $action")
+                pendingResult.finish()
+            }
+        }
+        mainHandler.postDelayed(timeout, BROADCAST_TIMEOUT_MILLIS)
+        GlobalState.launch {
+            try {
+                handleAction(action)
+            } catch (error: Exception) {
+                GlobalState.log("Unable to handle service broadcast $action: $error")
+            } finally {
+                mainHandler.removeCallbacks(timeout)
+                if (finished.compareAndSet(false, true)) {
+                    pendingResult.finish()
+                }
+            }
+        }
+    }
+
+    private suspend fun handleAction(action: String) {
+        when (action) {
+            BroadcastAction.VPN_START_REQUESTED.action -> {
+                GlobalState.log("System requested VPN service start")
+                ServiceState.handleStartAction()
+            }
+
+            BroadcastAction.VPN_REVOKED.action -> {
+                GlobalState.log("VPN permission revoked")
+                ServiceState.handleVpnRevokeAction()
+            }
+        }
+    }
+
+    companion object {
+        private const val BROADCAST_TIMEOUT_MILLIS = 9_000L
+        private val mainHandler = Handler(Looper.getMainLooper())
+    }
+}
diff --git a/android/app/src/main/kotlin/com/follow/clash/ServiceController.kt b/android/app/src/main/kotlin/com/follow/clash/ServiceController.kt
new file mode 100644
index 0000000000..4cec8639b8
--- /dev/null
+++ b/android/app/src/main/kotlin/com/follow/clash/ServiceController.kt
@@ -0,0 +1,227 @@
+package com.follow.clash
+
+import android.content.ComponentName
+import android.content.Context
+import android.content.Intent
+import android.content.ServiceConnection
+import android.os.Handler
+import android.os.IBinder
+import android.os.Looper
+import com.follow.clash.common.GlobalState
+import com.follow.clash.common.intent
+import com.follow.clash.core.Core
+import com.follow.clash.service.ManagedService
+import com.follow.clash.service.ProxyService
+import com.follow.clash.service.ServiceConfig
+import com.follow.clash.service.VpnService
+import com.follow.clash.service.models.VpnOptions
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.filterNotNull
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withContext
+import kotlinx.coroutines.withTimeout
+import kotlin.coroutines.resume
+
+object ServiceController {
+    private val lock = Mutex()
+    private var binding: ManagedServiceBinding? = null
+    @Volatile
+    private var runTimeMillis = 0L
+
+    suspend fun unbind() = lock.withLock {
+        clearBinding()
+    }
+
+    private fun clearBinding() {
+        binding?.unbind()
+        binding = null
+    }
+
+    fun invokeMethod(data: String, callback: ((String) -> Unit)?): Result<Unit> = runCatching {
+        Core.invokeMethod(data) { result ->
+            callback?.invoke(result.orEmpty())
+        }
+    }
+
+    suspend fun quickSetup(
+        initParams: String,
+        setupParams: String,
+    ): Result<String> = runCatching {
+        suspendCancellableCoroutine { continuation ->
+            Core.quickSetup(initParams, setupParams) { result ->
+                continuation.resume(result.orEmpty())
+            }
+        }
+    }
+
+    fun setEventListener(callback: ((String?) -> Unit)?): Result<Unit> = runCatching {
+        Core.updateEventListener(callback)
+    }
+
+    suspend fun start(options: VpnOptions, previousRunTimeMillis: Long): Long = lock.withLock {
+        ServiceConfig.updateVpnOptions(options)
+        val nextIntent = if (options.enable) {
+            VpnService::class.intent
+        } else {
+            ProxyService::class.intent
+        }
+
+        if (binding?.component != nextIntent.component) {
+            clearBinding()
+            lateinit var nextBinding: ManagedServiceBinding
+            nextBinding = ManagedServiceBinding(nextIntent) { message ->
+                handleServiceDisconnected(nextBinding, message)
+            }
+            binding = nextBinding
+            nextBinding.bind().onFailure { error ->
+                GlobalState.log("Unable to bind background service: $error")
+                clearBinding()
+                runTimeMillis = 0L
+                return@withLock runTimeMillis
+            }
+        }
+
+        val currentBinding = binding ?: return@withLock 0L
+        val result = currentBinding.useService { service -> service.start() }
+        if (result.isFailure) {
+            GlobalState.log("Unable to start background service: ${result.exceptionOrNull()}")
+            currentBinding.stopIfConnected()
+                .onFailure { error ->
+                    GlobalState.log("Unable to clean up failed background service start: $error")
+                }
+            clearBinding()
+            runTimeMillis = 0L
+            return@withLock runTimeMillis
+        }
+
+        runTimeMillis = previousRunTimeMillis.takeIf { it != 0L }
+            ?: System.currentTimeMillis()
+        runTimeMillis
+    }
+
+    suspend fun stop(): Long = lock.withLock {
+        binding?.useService { service -> service.stop() }
+            ?.onFailure { error ->
+                GlobalState.log("Unable to stop background service: $error")
+            }
+        clearBinding()
+        runTimeMillis = 0L
+        runTimeMillis
+    }
+
+    suspend fun isVpnServiceActive(): Boolean = lock.withLock {
+        runTimeMillis != 0L && binding?.component == VpnService::class.intent.component
+    }
+
+    fun getRunTimeMillis(): Long = runTimeMillis
+
+    private fun handleServiceDisconnected(
+        disconnectedBinding: ManagedServiceBinding,
+        message: String,
+    ) {
+        GlobalState.launch {
+            lock.withLock {
+                if (binding !== disconnectedBinding) {
+                    return@withLock
+                }
+                GlobalState.log("Background service disconnected: $message")
+                clearBinding()
+                runTimeMillis = 0L
+            }
+        }
+    }
+}
+
+private class ManagedServiceBinding(
+    private val intent: Intent,
+    private val onDisconnected: (String) -> Unit,
+) : ServiceConnection {
+    val component: ComponentName?
+        get() = intent.component
+
+    private val serviceState = MutableStateFlow<Result<ManagedService>?>(null)
+
+    @Volatile
+    private var isBound = false
+
+    suspend fun bind(): Result<Unit> = runCatching {
+        withContext(Dispatchers.Main.immediate) {
+            serviceState.value = null
+            isBound = GlobalState.application.bindService(
+                intent,
+                this@ManagedServiceBinding,
+                Context.BIND_AUTO_CREATE,
+            )
+            check(isBound) { "bindService() failed" }
+        }
+    }
+
+    suspend fun <R> useService(
+        connectionTimeoutMillis: Long = 5_000,
+        block: suspend (ManagedService) -> R,
+    ): Result<R> = runCatching {
+        val service = withTimeout(connectionTimeoutMillis) {
+            serviceState.filterNotNull().first().getOrThrow()
+        }
+        withContext(Dispatchers.Default) {
+            block(service)
+        }
+    }
+
+    suspend fun stopIfConnected(): Result<Unit> = runCatching {
+        val service = serviceState.value?.getOrNull() ?: return@runCatching
+        withContext(Dispatchers.Default) {
+            service.stop()
+        }
+    }
+
+    fun unbind() {
+        serviceState.value = null
+        if (!isBound) return
+        isBound = false
+        Handler(Looper.getMainLooper()).post {
+            runCatching {
+                GlobalState.application.unbindService(this)
+            }.onFailure { error ->
+                GlobalState.log("Unable to unbind background service: $error")
+            }
+        }
+    }
+
+    override fun onServiceConnected(name: ComponentName?, binder: IBinder?) {
+        runCatching {
+            when (binder) {
+                is VpnService.LocalBinder -> binder.service
+                is ProxyService.LocalBinder -> binder.service
+                null -> error("Binder is empty")
+                else -> error("Unsupported service binder: ${binder.javaClass.name}")
+            }
+        }.onSuccess { service ->
+            serviceState.value = Result.success(service)
+        }.onFailure { error ->
+            disconnect(error.message.orEmpty())
+        }
+    }
+
+    override fun onServiceDisconnected(name: ComponentName?) {
+        disconnect("Service disconnected")
+    }
+
+    override fun onBindingDied(name: ComponentName?) {
+        disconnect("Service binding died")
+    }
+
+    override fun onNullBinding(name: ComponentName?) {
+        disconnect("Service returned an empty binder")
+    }
+
+    private fun disconnect(message: String) {
+        serviceState.value = Result.failure(IllegalStateException(message))
+        onDisconnected(message)
+    }
+}
diff --git a/android/app/src/main/kotlin/com/follow/clash/ServiceState.kt b/android/app/src/main/kotlin/com/follow/clash/ServiceState.kt
new file mode 100644
index 0000000000..303b4a3879
--- /dev/null
+++ b/android/app/src/main/kotlin/com/follow/clash/ServiceState.kt
@@ -0,0 +1,299 @@
+package com.follow.clash
+
+import android.net.VpnService
+import com.follow.clash.common.GlobalState
+import com.follow.clash.models.SharedState
+import com.follow.clash.plugins.AppPlugin
+import com.follow.clash.plugins.TilePlugin
+import com.follow.clash.service.ServiceConfig
+import com.follow.clash.service.models.NotificationParams
+import com.follow.clash.service.models.VpnOptions
+import com.google.gson.Gson
+import io.flutter.embedding.engine.FlutterEngine
+import java.util.concurrent.atomic.AtomicReference
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.Deferred
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlin.coroutines.resume
+
+enum class RunState {
+    STARTED,
+    STARTING,
+    STOPPING,
+    STOPPED,
+}
+
+private const val MISSING_CONFIG_MESSAGE = "No configuration found."
+private const val INVALID_CONFIG_MESSAGE = "Invalid configuration."
+private const val VPN_PERMISSION_MESSAGE = "VPN permission required."
+private const val START_FAILED_MESSAGE = "Failed to start service."
+
+object ServiceState {
+    private val transitionLock = Mutex()
+    private val startPreparationLock = Mutex()
+    private val mutableRunState = MutableStateFlow(RunState.STOPPED)
+    private val latestRequest = AtomicReference(RunRequest(running = false))
+
+    @Volatile
+    private var sharedState = SharedState()
+
+    @Volatile
+    private var flutterEngine: FlutterEngine? = null
+
+    val runState = mutableRunState.asStateFlow()
+
+    var runTimeMillis = 0L
+        private set
+
+    private val appPlugin: AppPlugin?
+        get() = flutterEngine?.plugin<AppPlugin>()
+
+    private val tilePlugin: TilePlugin?
+        get() = flutterEngine?.plugin<TilePlugin>()
+
+    fun attachFlutterEngine(engine: FlutterEngine) {
+        flutterEngine = engine
+    }
+
+    fun detachFlutterEngine(engine: FlutterEngine) {
+        if (flutterEngine === engine) {
+            flutterEngine = null
+        }
+    }
+
+    suspend fun handleToggleAction() {
+        if (isRunningRequested()) {
+            handleStopAction()
+        } else {
+            handleStartAction()
+        }
+    }
+
+    suspend fun refresh() = transitionLock.withLock {
+        runTimeMillis = ServiceController.getRunTimeMillis()
+        mutableRunState.value = if (runTimeMillis == 0L) RunState.STOPPED else RunState.STARTED
+    }
+
+    suspend fun handleStartAction() {
+        if (isRunningRequested()) {
+            return
+        }
+        if (flutterEngine != null) {
+            tilePlugin?.handleStart()
+            return
+        }
+        loadPreferencesAndStart()
+    }
+
+    suspend fun handleStopAction() {
+        if (!isRunningRequested()) {
+            return
+        }
+        if (flutterEngine != null) {
+            tilePlugin?.handleStop()
+            return
+        }
+        GlobalState.application.showToast(sharedState.stopTip)
+        requestStop().await()
+    }
+
+    suspend fun handleVpnRevokeAction() {
+        if (!ServiceController.isVpnServiceActive()) {
+            return
+        }
+        handleStopAction()
+    }
+
+    fun requestStart(): Deferred<Boolean> {
+        val request = createRequest(running = true)
+        val result = CompletableDeferred<Boolean>()
+        val launchRequest: (Boolean) -> Unit = { shouldStart ->
+            if (!shouldStart) {
+                fail(request)
+                result.complete(false)
+            } else {
+                GlobalState.launch {
+                    result.complete(
+                        runCatching { start(request) }
+                            .onFailure { error ->
+                                GlobalState.log("Unable to process service start request: $error")
+                                fail(request)
+                            }
+                            .getOrDefault(false),
+                    )
+                }
+            }
+        }
+        appPlugin?.requestNotificationPermission(launchRequest) ?: launchRequest(true)
+        return result
+    }
+
+    fun requestStop(): Deferred<Boolean> {
+        val request = createRequest(running = false)
+        val result = CompletableDeferred<Boolean>()
+        GlobalState.launch {
+            result.complete(
+                runCatching { stop(request) }
+                    .onFailure { error ->
+                        GlobalState.log("Unable to process service stop request: $error")
+                    }
+                    .getOrDefault(false),
+            )
+        }
+        return result
+    }
+
+    fun syncSharedState(state: SharedState) {
+        sharedState = state
+        applySharedState()
+    }
+
+    private suspend fun loadPreferencesAndStart() {
+        sharedState = GlobalState.application.sharedState
+        if (sharedState.setupParams == null || sharedState.vpnOptions == null) {
+            GlobalState.application.showToast(MISSING_CONFIG_MESSAGE)
+            return
+        }
+        if (setupCore()) {
+            if (!requestStart().await()) {
+                GlobalState.application.showToast(START_FAILED_MESSAGE)
+            }
+        }
+    }
+
+    private fun applySharedState() {
+        GlobalState.setCrashlytics(sharedState.crashlytics)
+        ServiceConfig.updateNotificationParams(
+            NotificationParams(
+                title = sharedState.currentProfileName,
+                stopText = sharedState.stopText,
+                onlyStatisticsProxy = sharedState.onlyStatisticsProxy,
+            ),
+        )
+    }
+
+    private suspend fun setupCore(): Boolean {
+        applySharedState()
+        GlobalState.application.showToast(sharedState.startTip)
+        val initParams = Gson().toJson(
+            mapOf(
+                "home-dir" to GlobalState.application.filesDir.path,
+                "version" to android.os.Build.VERSION.SDK_INT,
+            ),
+        )
+        val setupParams = Gson().toJson(sharedState.setupParams)
+        return ServiceController.quickSetup(
+            initParams,
+            setupParams,
+        ).fold(
+            onSuccess = { message ->
+                if (message.isEmpty()) {
+                    true
+                } else {
+                    GlobalState.log("Unable to set up core: $message")
+                    showConfigError(message)
+                    false
+                }
+            },
+            onFailure = { error ->
+                GlobalState.log("Unable to set up core: $error")
+                showConfigError(error.message)
+                false
+            },
+        )
+    }
+
+    private fun showConfigError(message: String?) {
+        GlobalState.application.showToast(
+            message?.takeIf { it.isNotBlank() } ?: INVALID_CONFIG_MESSAGE,
+        )
+    }
+
+    private suspend fun start(request: RunRequest): Boolean = startPreparationLock.withLock {
+        if (!isCurrent(request)) {
+            return@withLock false
+        }
+        val options = sharedState.vpnOptions
+        if (options == null) {
+            fail(request)
+            return@withLock false
+        }
+        if (!prepareVpn(options)) {
+            if (appPlugin == null && isCurrent(request)) {
+                GlobalState.application.showToast(VPN_PERMISSION_MESSAGE)
+            }
+            fail(request)
+            return@withLock false
+        }
+        if (!isCurrent(request)) {
+            return@withLock false
+        }
+
+        transitionLock.withLock transition@{
+            if (!isCurrent(request)) {
+                return@transition false
+            }
+            if (runState.value == RunState.STARTED && runTimeMillis != 0L) {
+                return@transition true
+            }
+            mutableRunState.value = RunState.STARTING
+            runTimeMillis = ServiceController.start(options, runTimeMillis)
+            mutableRunState.value =
+                if (runTimeMillis == 0L) RunState.STOPPED else RunState.STARTED
+            if (runTimeMillis == 0L) {
+                fail(request)
+                return@transition false
+            }
+            isCurrent(request)
+        }
+    }
+
+    private suspend fun stop(request: RunRequest): Boolean = transitionLock.withLock {
+        if (!isCurrent(request)) {
+            return@withLock false
+        }
+        if (runState.value == RunState.STOPPED && runTimeMillis == 0L) {
+            return@withLock true
+        }
+        mutableRunState.value = RunState.STOPPING
+        runTimeMillis = ServiceController.stop()
+        mutableRunState.value = RunState.STOPPED
+        isCurrent(request)
+    }
+
+    private suspend fun prepareVpn(options: VpnOptions): Boolean {
+        val plugin = appPlugin
+            ?: return !options.enable || VpnService.prepare(GlobalState.application) == null
+        return suspendCancellableCoroutine { continuation ->
+            val callback: (Boolean) -> Unit = { granted ->
+                if (continuation.isActive) {
+                    continuation.resume(granted)
+                }
+            }
+            continuation.invokeOnCancellation {
+                plugin.cancelVpnPreparation(callback)
+            }
+            plugin.prepareVpn(options.enable, callback)
+        }
+    }
+
+    private fun createRequest(running: Boolean): RunRequest =
+        RunRequest(running).also(latestRequest::set)
+
+    private fun isRunningRequested(): Boolean = latestRequest.get().running
+
+    private fun isCurrent(request: RunRequest): Boolean = latestRequest.get() === request
+
+    private fun fail(request: RunRequest) {
+        latestRequest.compareAndSet(request, RunRequest(running = false))
+    }
+
+    private class RunRequest(
+        val running: Boolean,
+    )
+}
diff --git a/android/app/src/main/kotlin/com/follow/clash/State.kt b/android/app/src/main/kotlin/com/follow/clash/State.kt
deleted file mode 100644
index f3e1b472cd..0000000000
--- a/android/app/src/main/kotlin/com/follow/clash/State.kt
+++ /dev/null
@@ -1,205 +0,0 @@
-package com.follow.clash
-
-import android.net.VpnService
-import com.follow.clash.common.GlobalState
-import com.follow.clash.models.SharedState
-import com.follow.clash.plugins.AppPlugin
-import com.follow.clash.plugins.TilePlugin
-import com.follow.clash.service.models.NotificationParams
-import com.google.gson.Gson
-import io.flutter.embedding.engine.FlutterEngine
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.sync.Mutex
-import kotlinx.coroutines.sync.withLock
-
-enum class RunState {
-    START, PENDING, STOP
-}
-
-
-object State {
-
-    val runLock = Mutex()
-
-    var runTime: Long = 0
-
-    var sharedState: SharedState = SharedState()
-
-    val runStateFlow: MutableStateFlow<RunState> = MutableStateFlow(RunState.STOP)
-
-    var flutterEngine: FlutterEngine? = null
-
-    val appPlugin: AppPlugin?
-        get() = flutterEngine?.plugin<AppPlugin>()
-
-    val tilePlugin: TilePlugin?
-        get() = flutterEngine?.plugin<TilePlugin>()
-
-    suspend fun handleToggleAction() {
-        var action: (suspend () -> Unit)?
-        runLock.withLock {
-            action = when (runStateFlow.value) {
-                RunState.PENDING -> null
-                RunState.START -> ::handleStopServiceAction
-                RunState.STOP -> ::handleStartServiceAction
-            }
-        }
-        action?.invoke()
-    }
-
-    suspend fun handleSyncState() {
-        runLock.withLock {
-            try {
-                Service.bind()
-                runTime = Service.getRunTime()
-                val runState = when (runTime == 0L) {
-                    true -> RunState.STOP
-                    false -> RunState.START
-                }
-                runStateFlow.tryEmit(runState)
-            } catch (_: Exception) {
-                runStateFlow.tryEmit(RunState.STOP)
-            }
-        }
-    }
-
-    suspend fun handleStartServiceAction() {
-        runLock.withLock {
-            if (runStateFlow.value != RunState.STOP) {
-                return
-            }
-            tilePlugin?.handleStart()
-            if (flutterEngine != null) {
-                return
-            }
-            startServiceWithPref()
-        }
-
-    }
-
-    suspend fun handleStopServiceAction() {
-        runLock.withLock {
-            if (runStateFlow.value != RunState.START) {
-                return
-            }
-            tilePlugin?.handleStop()
-            if (flutterEngine != null) {
-                return
-            }
-            GlobalState.application.showToast(sharedState.stopTip)
-            handleStopService()
-        }
-    }
-
-    fun handleStartService() {
-        val appPlugin = flutterEngine?.plugin<AppPlugin>()
-        if (appPlugin != null) {
-            appPlugin.requestNotificationsPermission {
-                startService()
-            }
-            return
-        }
-        startService()
-    }
-
-    private fun startServiceWithPref() {
-        GlobalState.launch {
-            runLock.withLock {
-                if (runStateFlow.value != RunState.STOP) {
-                    return@launch
-                }
-                sharedState = GlobalState.application.sharedState
-                setupAndStart()
-            }
-        }
-    }
-
-    suspend fun syncState() {
-        GlobalState.setCrashlytics(sharedState.crashlytics)
-        Service.updateNotificationParams(
-            NotificationParams(
-                title = sharedState.currentProfileName,
-                stopText = sharedState.stopText,
-                onlyStatisticsProxy = sharedState.onlyStatisticsProxy
-            )
-        )
-        Service.setCrashlytics(sharedState.crashlytics)
-    }
-
-    private suspend fun setupAndStart() {
-        Service.bind()
-        syncState()
-        GlobalState.application.showToast(sharedState.startTip)
-        val initParams = mutableMapOf<String, Any>()
-        initParams["home-dir"] = GlobalState.application.filesDir.path
-        initParams["version"] = android.os.Build.VERSION.SDK_INT
-        val initParamsString = Gson().toJson(initParams)
-        val setupParamsString = Gson().toJson(sharedState.setupParams)
-        Service.quickSetup(
-            initParamsString,
-            setupParamsString,
-            onStarted = {
-                startService()
-            },
-            onResult = {
-                if (it.isNotEmpty()) {
-                    GlobalState.application.showToast(it)
-                }
-            },
-        )
-    }
-
-    private fun startService() {
-        GlobalState.launch {
-            runLock.withLock {
-                if (runStateFlow.value != RunState.STOP) {
-                    return@launch
-                }
-                try {
-                    runStateFlow.tryEmit(RunState.PENDING)
-                    val options = sharedState.vpnOptions ?: return@launch
-                    appPlugin?.let {
-                        it.prepare(options.enable) {
-                            runTime = Service.startService(options, runTime)
-                            runStateFlow.tryEmit(RunState.START)
-                        }
-                    } ?: run {
-                        val intent = VpnService.prepare(GlobalState.application)
-                        if (intent != null) {
-                            return@launch
-                        }
-                        runTime = Service.startService(options, runTime)
-                        runStateFlow.tryEmit(RunState.START)
-                    }
-                } finally {
-                    if (runStateFlow.value == RunState.PENDING) {
-                        runStateFlow.tryEmit(RunState.STOP)
-                    }
-                }
-            }
-        }
-    }
-
-    fun handleStopService() {
-        GlobalState.launch {
-            runLock.withLock {
-                if (runStateFlow.value != RunState.START) {
-                    return@launch
-                }
-                try {
-                    runStateFlow.tryEmit(RunState.PENDING)
-                    runTime = Service.stopService()
-                    runStateFlow.tryEmit(RunState.STOP)
-                } finally {
-                    if (runStateFlow.value == RunState.PENDING) {
-                        runStateFlow.tryEmit(RunState.START)
-                    }
-                }
-            }
-        }
-    }
-}
-
-
-
diff --git a/android/app/src/main/kotlin/com/follow/clash/TempActivity.kt b/android/app/src/main/kotlin/com/follow/clash/TempActivity.kt
deleted file mode 100644
index 035fa3ebb0..0000000000
--- a/android/app/src/main/kotlin/com/follow/clash/TempActivity.kt
+++ /dev/null
@@ -1,37 +0,0 @@
-package com.follow.clash
-
-import android.app.Activity
-import android.os.Bundle
-import com.follow.clash.common.QuickAction
-import com.follow.clash.common.action
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.launch
-
-class TempActivity : Activity(),
-    CoroutineScope by CoroutineScope(SupervisorJob() + Dispatchers.Default) {
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        when (intent.action) {
-            QuickAction.START.action -> {
-                launch {
-                    State.handleStartServiceAction()
-                }
-            }
-
-            QuickAction.STOP.action -> {
-                launch {
-                    State.handleStopServiceAction()
-                }
-            }
-
-            QuickAction.TOGGLE.action -> {
-                launch {
-                    State.handleToggleAction()
-                }
-            }
-        }
-        finish()
-    }
-}
\ No newline at end of file
diff --git a/android/app/src/main/kotlin/com/follow/clash/TileService.kt b/android/app/src/main/kotlin/com/follow/clash/TileService.kt
index 8fb08bfd3f..b522c22c56 100644
--- a/android/app/src/main/kotlin/com/follow/clash/TileService.kt
+++ b/android/app/src/main/kotlin/com/follow/clash/TileService.kt
@@ -3,7 +3,6 @@ package com.follow.clash
 import android.annotation.SuppressLint
 import android.os.Build
 import android.service.quicksettings.Tile
-import android.service.quicksettings.TileService
 import com.follow.clash.common.QuickAction
 import com.follow.clash.common.quickIntent
 import com.follow.clash.common.toPendingIntent
@@ -13,49 +12,50 @@ import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
 
-class TileService : TileService() {
+class TileService : android.service.quicksettings.TileService() {
     private var scope: CoroutineScope? = null
-    private fun updateTile(runState: RunState) {
-        if (qsTile != null) {
-            qsTile.state = when (runState) {
-                RunState.START -> Tile.STATE_ACTIVE
-                RunState.PENDING -> Tile.STATE_UNAVAILABLE
-                RunState.STOP -> Tile.STATE_INACTIVE
-            }
-            qsTile.updateTile()
-        }
-    }
 
     override fun onStartListening() {
         super.onStartListening()
         scope?.cancel()
-        scope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
-        scope?.launch {
-            State.handleSyncState()
-            State.runStateFlow.collect {
-                updateTile(it)
+        scope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate).also { scope ->
+            scope.launch {
+                ServiceState.refresh()
+                ServiceState.runState.collect(::updateTile)
             }
         }
     }
 
-    @SuppressLint("StartActivityAndCollapseDeprecated")
-    private fun handleToggle() {
-        val intent = QuickAction.TOGGLE.quickIntent
-        val pendingIntent = intent.toPendingIntent
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            startActivityAndCollapse(pendingIntent)
-        } else {
-            @Suppress("DEPRECATION") startActivityAndCollapse(intent)
-        }
-    }
-
     override fun onClick() {
         super.onClick()
-        handleToggle()
+        openQuickAction()
     }
 
     override fun onStopListening() {
         scope?.cancel()
+        scope = null
         super.onStopListening()
     }
-}
\ No newline at end of file
+
+    private fun updateTile(runState: RunState) {
+        qsTile?.apply {
+            state = when (runState) {
+                RunState.STARTED -> Tile.STATE_ACTIVE
+                RunState.STARTING, RunState.STOPPING -> Tile.STATE_UNAVAILABLE
+                RunState.STOPPED -> Tile.STATE_INACTIVE
+            }
+            updateTile()
+        }
+    }
+
+    @SuppressLint("StartActivityAndCollapseDeprecated")
+    private fun openQuickAction() {
+        val intent = QuickAction.TOGGLE.quickIntent
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            startActivityAndCollapse(intent.toPendingIntent)
+        } else {
+            @Suppress("DEPRECATION")
+            startActivityAndCollapse(intent)
+        }
+    }
+}
diff --git a/android/app/src/main/kotlin/com/follow/clash/models/Package.kt b/android/app/src/main/kotlin/com/follow/clash/models/InstalledPackage.kt
similarity index 85%
rename from android/app/src/main/kotlin/com/follow/clash/models/Package.kt
rename to android/app/src/main/kotlin/com/follow/clash/models/InstalledPackage.kt
index 0a6d6c7cfc..f5018332cf 100644
--- a/android/app/src/main/kotlin/com/follow/clash/models/Package.kt
+++ b/android/app/src/main/kotlin/com/follow/clash/models/InstalledPackage.kt
@@ -1,6 +1,6 @@
 package com.follow.clash.models
 
-data class Package(
+data class InstalledPackage(
     val packageName: String,
     val label: String,
     val system: Boolean,
diff --git a/android/app/src/main/kotlin/com/follow/clash/packages/PackageResolver.kt b/android/app/src/main/kotlin/com/follow/clash/packages/PackageResolver.kt
new file mode 100644
index 0000000000..0868553710
--- /dev/null
+++ b/android/app/src/main/kotlin/com/follow/clash/packages/PackageResolver.kt
@@ -0,0 +1,174 @@
+package com.follow.clash.packages
+
+import android.Manifest
+import android.content.pm.ApplicationInfo
+import android.content.pm.ComponentInfo
+import android.content.pm.PackageManager
+import android.os.Build
+import com.android.tools.smali.dexlib2.dexbacked.DexBackedDexFile
+import com.follow.clash.models.InstalledPackage
+import java.io.File
+import java.util.zip.ZipFile
+
+internal class PackageResolver(
+    private val packageManager: PackageManager,
+    private val appPackageName: String,
+) {
+    val installedPackages: List<InstalledPackage> by lazy(LazyThreadSafetyMode.SYNCHRONIZED) {
+        loadPackages()
+    }
+
+    fun getChinaPackageNames(): List<String> = installedPackages
+        .map { it.packageName }
+        .filter(::isChinaPackage)
+
+    private fun loadPackages(): List<InstalledPackage> {
+        val flags = PackageManager.GET_PERMISSIONS
+        val packages = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            packageManager.getInstalledPackages(
+                PackageManager.PackageInfoFlags.of(flags.toLong()),
+            )
+        } else {
+            @Suppress("DEPRECATION")
+            packageManager.getInstalledPackages(flags)
+        }
+        return packages.asSequence()
+            .filter { info ->
+                info.packageName != appPackageName && info.packageName != ANDROID_PACKAGE_NAME
+            }
+            .map { info ->
+                InstalledPackage(
+                    packageName = info.packageName,
+                    label = info.applicationInfo?.loadLabel(packageManager)?.toString()
+                        ?: info.packageName,
+                    system = info.applicationInfo?.let { applicationInfo ->
+                        applicationInfo.flags and ApplicationInfo.FLAG_SYSTEM != 0
+                    } == true,
+                    internet = info.requestedPermissions
+                        ?.contains(Manifest.permission.INTERNET) == true,
+                    lastUpdateTime = info.lastUpdateTime,
+                )
+            }.toList()
+    }
+
+    private fun isChinaPackage(packageName: String): Boolean {
+        if (SKIPPED_PREFIXES.any { packageName == it || packageName.startsWith("$it.") }) {
+            return false
+        }
+        if (packageName.matches(CHINA_PACKAGE_REGEX)) {
+            return true
+        }
+
+        return runCatching {
+            val packageInfo = getPackageInfo(packageName)
+            packageInfo.componentNames().any { it.matches(CHINA_PACKAGE_REGEX) } ||
+                packageInfo.applicationInfo?.publicSourceDir?.let(::scanArchive) == true
+        }.getOrDefault(false)
+    }
+
+    private fun getPackageInfo(packageName: String) = if (
+        Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU
+    ) {
+        packageManager.getPackageInfo(
+            packageName,
+            PackageManager.PackageInfoFlags.of(PACKAGE_INFO_FLAGS.toLong()),
+        )
+    } else {
+        @Suppress("DEPRECATION")
+        packageManager.getPackageInfo(packageName, PACKAGE_INFO_FLAGS)
+    }
+
+    private fun android.content.pm.PackageInfo.componentNames(): Sequence<String> = sequence {
+        yieldAll(services.orEmpty().asSequence().map(ComponentInfo::name))
+        yieldAll(activities.orEmpty().asSequence().map(ComponentInfo::name))
+        yieldAll(receivers.orEmpty().asSequence().map(ComponentInfo::name))
+        yieldAll(providers.orEmpty().asSequence().map(ComponentInfo::name))
+    }
+
+    private fun scanArchive(sourcePath: String): Boolean = ZipFile(File(sourcePath)).use { archive ->
+        if (archive.entries().asSequence().any { it.name.startsWith("firebase-") }) {
+            return false
+        }
+        archive.entries().asSequence()
+            .filter { entry ->
+                entry.name.startsWith("classes") && entry.name.endsWith(".dex")
+            }.any { entry ->
+                if (entry.size > MAX_DEX_SIZE_BYTES) {
+                    return@any true
+                }
+                val dexFile = archive.getInputStream(entry).buffered().use { input ->
+                    DexBackedDexFile.fromInputStream(null, input)
+                }
+                dexFile.classes.any { clazz ->
+                    clazz.type
+                        .removeSurrounding("L", ";")
+                        .replace('/', '.')
+                        .replace('$', '.')
+                        .matches(CHINA_PACKAGE_REGEX)
+                }
+            }
+    }
+
+    private companion object {
+        const val ANDROID_PACKAGE_NAME = "android"
+        const val MAX_DEX_SIZE_BYTES = 15_000_000L
+
+        val PACKAGE_INFO_FLAGS = PackageManager.GET_ACTIVITIES or
+            PackageManager.GET_SERVICES or
+            PackageManager.GET_RECEIVERS or
+            PackageManager.GET_PROVIDERS
+
+        val SKIPPED_PREFIXES = listOf(
+            "com.google",
+            "com.android.chrome",
+            "com.android.vending",
+            "com.microsoft",
+            "com.apple",
+            "com.zhiliaoapp.musically",
+        )
+
+        val CHINA_PACKAGE_REGEX = listOf(
+            "com.tencent",
+            "com.alibaba",
+            "com.umeng",
+            "com.qihoo",
+            "com.ali",
+            "com.alipay",
+            "com.amap",
+            "com.sina",
+            "com.weibo",
+            "com.vivo",
+            "com.xiaomi",
+            "com.huawei",
+            "com.taobao",
+            "com.secneo",
+            "s.h.e.l.l",
+            "com.stub",
+            "com.kiwisec",
+            "com.secshell",
+            "com.wrapper",
+            "cn.securitystack",
+            "com.mogosec",
+            "com.secoen",
+            "com.netease",
+            "com.mx",
+            "com.qq.e",
+            "com.baidu",
+            "com.bytedance",
+            "com.bugly",
+            "com.miui",
+            "com.oppo",
+            "com.coloros",
+            "com.iqoo",
+            "com.meizu",
+            "com.gionee",
+            "cn.nubia",
+            "com.oplus",
+            "andes.oplus",
+            "com.unionpay",
+            "cn.wps",
+        ).joinToString("|", prefix = "(", postfix = ").*") { prefix ->
+            Regex.escape(prefix)
+        }.toRegex()
+    }
+}
diff --git a/android/app/src/main/kotlin/com/follow/clash/plugins/AppPlugin.kt b/android/app/src/main/kotlin/com/follow/clash/plugins/AppPlugin.kt
index e562051f8c..505d485ee9 100644
--- a/android/app/src/main/kotlin/com/follow/clash/plugins/AppPlugin.kt
+++ b/android/app/src/main/kotlin/com/follow/clash/plugins/AppPlugin.kt
@@ -1,11 +1,10 @@
 package com.follow.clash.plugins
 
 import android.Manifest
+import android.annotation.SuppressLint
 import android.app.Activity
 import android.app.ActivityManager
 import android.content.Intent
-import android.content.pm.ApplicationInfo
-import android.content.pm.ComponentInfo
 import android.content.pm.PackageManager
 import android.net.VpnService
 import android.os.Build
@@ -18,17 +17,15 @@ import androidx.core.content.pm.ShortcutInfoCompat
 import androidx.core.content.pm.ShortcutManagerCompat
 import androidx.core.graphics.drawable.IconCompat
 import androidx.core.net.toUri
-import com.android.tools.smali.dexlib2.dexbacked.DexBackedDexFile
 import com.follow.clash.R
 import com.follow.clash.common.Components
 import com.follow.clash.common.GlobalState
 import com.follow.clash.common.QuickAction
 import com.follow.clash.common.quickIntent
 import com.follow.clash.getPackageIconPath
-import com.follow.clash.models.Package
+import com.follow.clash.packages.PackageResolver
 import com.follow.clash.showToast
 import com.google.gson.Gson
-import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.plugins.FlutterPlugin
 import io.flutter.embedding.engine.plugins.activity.ActivityAware
 import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
@@ -37,93 +34,39 @@ import io.flutter.plugin.common.MethodChannel
 import io.flutter.plugin.common.MethodChannel.Result
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-import java.io.File
-import java.lang.ref.WeakReference
-import java.util.zip.ZipFile
 
 class AppPlugin : FlutterPlugin, MethodChannel.MethodCallHandler, ActivityAware {
 
-    companion object {
-        const val VPN_PERMISSION_REQUEST_CODE = 1001
-        const val NOTIFICATION_PERMISSION_REQUEST_CODE = 1002
-    }
-
-    private var activityRef: WeakReference<Activity>? = null
+    private var activity: Activity? = null
 
     private lateinit var channel: MethodChannel
 
     private lateinit var scope: CoroutineScope
 
-    private var vpnPrepareCallback: (suspend () -> Unit)? = null
-
-    private var requestNotificationCallback: (() -> Unit)? = null
-
-    private val packages = mutableListOf<Package>()
-
-    private val skipPrefixList = listOf(
-        "com.google",
-        "com.android.chrome",
-        "com.android.vending",
-        "com.microsoft",
-        "com.apple",
-        "com.zhiliaoapp.musically", // Banned by China
-    )
-
-    private val chinaAppPrefixList = listOf(
-        "com.tencent",
-        "com.alibaba",
-        "com.umeng",
-        "com.qihoo",
-        "com.ali",
-        "com.alipay",
-        "com.amap",
-        "com.sina",
-        "com.weibo",
-        "com.vivo",
-        "com.xiaomi",
-        "com.huawei",
-        "com.taobao",
-        "com.secneo",
-        "s.h.e.l.l",
-        "com.stub",
-        "com.kiwisec",
-        "com.secshell",
-        "com.wrapper",
-        "cn.securitystack",
-        "com.mogosec",
-        "com.secoen",
-        "com.netease",
-        "com.mx",
-        "com.qq.e",
-        "com.baidu",
-        "com.bytedance",
-        "com.bugly",
-        "com.miui",
-        "com.oppo",
-        "com.coloros",
-        "com.iqoo",
-        "com.meizu",
-        "com.gionee",
-        "cn.nubia",
-        "com.oplus",
-        "andes.oplus",
-        "com.unionpay",
-        "cn.wps"
-    )
-
-    private val chinaAppRegex by lazy {
-        ("(" + chinaAppPrefixList.joinToString("|").replace(".", "\\.") + ").*").toRegex()
+    private var vpnPrepareCallback: ((Boolean) -> Unit)? = null
+
+    private var requestNotificationCallback: ((Boolean) -> Unit)? = null
+
+    private var isRequestingNotificationPermission = false
+
+    private val gson = Gson()
+
+    private val packageResolver by lazy {
+        PackageResolver(
+            GlobalState.application.packageManager,
+            GlobalState.application.packageName,
+        )
     }
 
-    private var isBlockNotification: Boolean = false
+    private var skipNotificationPermissionRequest = false
 
     override fun onMethodCall(call: MethodCall, result: Result) {
         when (call.method) {
             "moveTaskToBack" -> {
-                activityRef?.get()?.moveTaskToBack(true)
+                activity?.moveTaskToBack(true)
                 result.success(true)
             }
 
@@ -134,19 +77,24 @@ class AppPlugin : FlutterPlugin, MethodChannel.MethodCallHandler, ActivityAware
             }
 
             "initShortcuts" -> {
-                initShortcuts(call.arguments as String)
-                result.success(true)
+                val label = call.arguments as? String
+                if (label == null) {
+                    result.error("INVALID_ARGUMENT", "Shortcut label must be a string", null)
+                } else {
+                    initShortcuts(label)
+                    result.success(true)
+                }
             }
 
             "getPackages" -> {
-                scope.launch {
-                    result.success(getPackagesToJson())
+                scope.launch(Dispatchers.IO) {
+                    result.success(gson.toJson(packageResolver.installedPackages))
                 }
             }
 
             "getChinaPackageNames" -> {
-                scope.launch {
-                    result.success(getChinaPackageNames())
+                scope.launch(Dispatchers.IO) {
+                    result.success(gson.toJson(packageResolver.getChinaPackageNames()))
                 }
             }
 
@@ -156,7 +104,7 @@ class AppPlugin : FlutterPlugin, MethodChannel.MethodCallHandler, ActivityAware
 
             "tip" -> {
                 val message = call.argument<String>("message")
-                tip(message)
+                GlobalState.application.showToast(message)
                 result.success(true)
             }
 
@@ -172,6 +120,10 @@ class AppPlugin : FlutterPlugin, MethodChannel.MethodCallHandler, ActivityAware
                 result.success(openAppSettings())
             }
 
+            "didCrashOnPreviousExecution" -> {
+                result.success(GlobalState.didCrashOnPreviousExecution())
+            }
+
             else -> {
                 result.notImplemented()
             }
@@ -197,32 +149,32 @@ class AppPlugin : FlutterPlugin, MethodChannel.MethodCallHandler, ActivityAware
                 IconCompat.createWithResource(
                     GlobalState.application,
                     R.mipmap.ic_launcher_round,
-                )
+                ),
             )
             setIntent(QuickAction.TOGGLE.quickIntent)
             build()
         }
         ShortcutManagerCompat.setDynamicShortcuts(
-            GlobalState.application, listOf(shortcut)
+            GlobalState.application,
+            listOf(shortcut),
         )
     }
 
-    private fun tip(message: String?) {
-        GlobalState.application.showToast(message)
-    }
-
     private fun isBatteryOptimizationDisabled(): Boolean {
         val powerManager = getSystemService(GlobalState.application, PowerManager::class.java)
         return powerManager?.isIgnoringBatteryOptimizations(GlobalState.application.packageName)
             ?: false
     }
 
+    @SuppressLint("BatteryLife")
     private fun openBatteryOptimizationSettings(): Boolean {
+        // VPN continuity is the user-requested core function, so the direct exemption is intentional.
+        val activity = activity ?: return false
         return try {
             val intent = Intent(Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS).apply {
                 data = "package:${GlobalState.application.packageName}".toUri()
             }
-            activityRef?.get()?.startActivity(intent)
+            activity.startActivity(intent)
             true
         } catch (_: Exception) {
             false
@@ -230,11 +182,12 @@ class AppPlugin : FlutterPlugin, MethodChannel.MethodCallHandler, ActivityAware
     }
 
     private fun openAppSettings(): Boolean {
+        val activity = activity ?: return false
         return try {
             val intent = Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS).apply {
                 data = "package:${GlobalState.application.packageName}".toUri()
             }
-            activityRef?.get()?.startActivity(intent)
+            activity.startActivity(intent)
             true
         } catch (_: Exception) {
             false
@@ -246,170 +199,82 @@ class AppPlugin : FlutterPlugin, MethodChannel.MethodCallHandler, ActivityAware
         val am = getSystemService(GlobalState.application, ActivityManager::class.java)
         val task = am?.appTasks?.firstOrNull {
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-                it.taskInfo.taskId == activityRef?.get()?.taskId
+                it.taskInfo.taskId == activity?.taskId
             } else {
-                it.taskInfo.id == activityRef?.get()?.taskId
+                it.taskInfo.id == activity?.taskId
             }
         }
-
-        when (value) {
-            true -> task?.setExcludeFromRecents(value)
-            false -> task?.setExcludeFromRecents(value)
-            null -> task?.setExcludeFromRecents(false)
-        }
-    }
-
-
-    private fun getPackages(): List<Package> {
-        val packageManager = GlobalState.application.packageManager
-        if (packages.isNotEmpty()) return packages
-        packageManager?.getInstalledPackages(PackageManager.GET_META_DATA or PackageManager.GET_PERMISSIONS)
-            ?.filter {
-                it.packageName != GlobalState.application.packageName && it.packageName != "android"
-            }?.map {
-                Package(
-                    packageName = it.packageName,
-                    label = it.applicationInfo?.loadLabel(packageManager).toString(),
-                    system = (it.applicationInfo?.flags?.and(ApplicationInfo.FLAG_SYSTEM)) != 0,
-                    lastUpdateTime = it.lastUpdateTime,
-                    internet = it.requestedPermissions?.contains(Manifest.permission.INTERNET) == true
-                )
-            }?.let { packages.addAll(it) }
-        return packages
-    }
-
-    private suspend fun getPackagesToJson(): String {
-        return withContext(Dispatchers.Default) {
-            Gson().toJson(getPackages())
-        }
+        task?.setExcludeFromRecents(value ?: false)
     }
 
-    private suspend fun getChinaPackageNames(): String {
-        return withContext(Dispatchers.Default) {
-            val packages: List<String> =
-                getPackages().map { it.packageName }.filter { isChinaPackage(it) }
-            Gson().toJson(packages)
-        }
-    }
-
-    fun requestNotificationsPermission(callBack: () -> Unit) {
-        requestNotificationCallback = callBack
+    fun requestNotificationPermission(callback: (Boolean) -> Unit) {
+        requestNotificationCallback?.invoke(false)
+        requestNotificationCallback = callback
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
             val permission = ContextCompat.checkSelfPermission(
-                GlobalState.application, Manifest.permission.POST_NOTIFICATIONS
+                GlobalState.application,
+                Manifest.permission.POST_NOTIFICATIONS,
             )
-            if (permission == PackageManager.PERMISSION_GRANTED || isBlockNotification) {
-                invokeRequestNotificationCallback()
+            if (permission == PackageManager.PERMISSION_GRANTED || skipNotificationPermissionRequest) {
+                invokeRequestNotificationCallback(true)
                 return
             }
-            activityRef?.get()?.let {
+            if (isRequestingNotificationPermission) {
+                return
+            }
+            isRequestingNotificationPermission = true
+            activity?.let {
                 ActivityCompat.requestPermissions(
                     it,
                     arrayOf(Manifest.permission.POST_NOTIFICATIONS),
-                    NOTIFICATION_PERMISSION_REQUEST_CODE
+                    NOTIFICATION_PERMISSION_REQUEST_CODE,
                 )
-            }
+            } ?: invokeRequestNotificationCallback(true)
             return
-        } else {
-            invokeRequestNotificationCallback()
         }
-
+        invokeRequestNotificationCallback(true)
     }
 
-    fun invokeRequestNotificationCallback() {
-        requestNotificationCallback?.invoke()
+    private fun invokeRequestNotificationCallback(shouldStart: Boolean) {
+        isRequestingNotificationPermission = false
+        requestNotificationCallback?.invoke(shouldStart)
         requestNotificationCallback = null
     }
 
-    fun prepare(needPrepare: Boolean, callBack: (suspend () -> Unit)) {
-        vpnPrepareCallback = callBack
+    fun prepareVpn(needPrepare: Boolean, callback: (Boolean) -> Unit) {
+        invokeVpnPrepareCallback(false)
+        vpnPrepareCallback = callback
         if (!needPrepare) {
-            invokeVpnPrepareCallback()
+            invokeVpnPrepareCallback(true)
             return
         }
         val intent = VpnService.prepare(GlobalState.application)
         if (intent != null) {
-            activityRef?.get()?.startActivityForResult(intent, VPN_PERMISSION_REQUEST_CODE)
+            val activity = activity
+            if (activity == null) {
+                invokeVpnPrepareCallback(false)
+            } else {
+                @Suppress("DEPRECATION")
+                activity.startActivityForResult(intent, VPN_PERMISSION_REQUEST_CODE)
+            }
             return
         }
-        invokeVpnPrepareCallback()
+        invokeVpnPrepareCallback(true)
     }
 
-    fun invokeVpnPrepareCallback() {
-        GlobalState.launch {
-            vpnPrepareCallback?.invoke()
+    fun cancelVpnPreparation(callback: (Boolean) -> Unit) {
+        if (vpnPrepareCallback === callback) {
             vpnPrepareCallback = null
         }
     }
 
-
-    @Suppress("DEPRECATION")
-    private fun isChinaPackage(packageName: String): Boolean {
-        val packageManager = GlobalState.application.packageManager ?: return false
-        skipPrefixList.forEach {
-            if (packageName == it || packageName.startsWith("$it.")) return false
-        }
-        val packageManagerFlags =
-            PackageManager.MATCH_UNINSTALLED_PACKAGES or PackageManager.GET_ACTIVITIES or PackageManager.GET_SERVICES or PackageManager.GET_RECEIVERS or PackageManager.GET_PROVIDERS
-        if (packageName.matches(chinaAppRegex)) {
-            return true
-        }
-        try {
-            val packageInfo = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-                packageManager.getPackageInfo(
-                    packageName, PackageManager.PackageInfoFlags.of(packageManagerFlags.toLong())
-                )
-            } else {
-                packageManager.getPackageInfo(
-                    packageName, packageManagerFlags
-                )
-            }
-            mutableListOf<ComponentInfo>().apply {
-                packageInfo.services?.let { addAll(it) }
-                packageInfo.activities?.let { addAll(it) }
-                packageInfo.receivers?.let { addAll(it) }
-                packageInfo.providers?.let { addAll(it) }
-            }.forEach {
-                if (it.name.matches(chinaAppRegex)) return true
-            }
-            packageInfo.applicationInfo?.publicSourceDir?.let {
-                ZipFile(File(it)).use {
-                    for (packageEntry in it.entries()) {
-                        if (packageEntry.name.startsWith("firebase-")) return false
-                    }
-                    for (packageEntry in it.entries()) {
-                        if (!(packageEntry.name.startsWith("classes") && packageEntry.name.endsWith(
-                                ".dex"
-                            ))
-                        ) {
-                            continue
-                        }
-                        if (packageEntry.size > 15000000) {
-                            return true
-                        }
-                        val input = it.getInputStream(packageEntry).buffered()
-                        val dexFile = try {
-                            DexBackedDexFile.fromInputStream(null, input)
-                        } catch (e: Exception) {
-                            return false
-                        }
-                        for (clazz in dexFile.classes) {
-                            val clazzName =
-                                clazz.type.substring(1, clazz.type.length - 1).replace("/", ".")
-                                    .replace("$", ".")
-                            if (clazzName.matches(chinaAppRegex)) return true
-                        }
-                    }
-                }
-            }
-        } catch (_: Exception) {
-            return false
-        }
-        return false
+    private fun invokeVpnPrepareCallback(granted: Boolean) {
+        vpnPrepareCallback?.invoke(granted)
+        vpnPrepareCallback = null
     }
 
     override fun onAttachedToEngine(flutterPluginBinding: FlutterPlugin.FlutterPluginBinding) {
-        scope = CoroutineScope(Dispatchers.Default)
+        scope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
         channel =
             MethodChannel(flutterPluginBinding.binaryMessenger, "${Components.PACKAGE_NAME}/app")
         channel.setMethodCallHandler(this)
@@ -418,43 +283,58 @@ class AppPlugin : FlutterPlugin, MethodChannel.MethodCallHandler, ActivityAware
     override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
         channel.setMethodCallHandler(null)
         scope.cancel()
+        invokeVpnPrepareCallback(false)
+        invokeRequestNotificationCallback(false)
     }
 
     override fun onAttachedToActivity(binding: ActivityPluginBinding) {
-        activityRef = WeakReference(binding.activity)
+        attachToActivity(binding)
+    }
+
+    private fun attachToActivity(binding: ActivityPluginBinding) {
+        activity = binding.activity
         binding.addActivityResultListener(::onActivityResult)
         binding.addRequestPermissionsResultListener(::onRequestPermissionsResultListener)
     }
 
     override fun onDetachedFromActivityForConfigChanges() {
-        activityRef = null
+        activity = null
     }
 
     override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
-        activityRef = WeakReference(binding.activity)
+        attachToActivity(binding)
     }
 
     override fun onDetachedFromActivity() {
         channel.invokeMethod("exit", null)
-        activityRef = null
+        activity = null
+        invokeVpnPrepareCallback(false)
+        invokeRequestNotificationCallback(false)
     }
 
     private fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
-        if (requestCode == VPN_PERMISSION_REQUEST_CODE) {
-            if (resultCode == FlutterActivity.RESULT_OK) {
-                invokeVpnPrepareCallback()
-            }
+        if (requestCode != VPN_PERMISSION_REQUEST_CODE) {
+            return false
         }
+        invokeVpnPrepareCallback(resultCode == Activity.RESULT_OK)
         return true
     }
 
     private fun onRequestPermissionsResultListener(
-        requestCode: Int, permissions: Array<String>, grantResults: IntArray
+        requestCode: Int,
+        permissions: Array<String>,
+        grantResults: IntArray,
     ): Boolean {
-        if (requestCode == NOTIFICATION_PERMISSION_REQUEST_CODE) {
-            isBlockNotification = true
+        if (requestCode != NOTIFICATION_PERMISSION_REQUEST_CODE) {
+            return false
         }
-        invokeRequestNotificationCallback()
+        skipNotificationPermissionRequest = true
+        invokeRequestNotificationCallback(true)
         return true
     }
+
+    private companion object {
+        const val VPN_PERMISSION_REQUEST_CODE = 1001
+        const val NOTIFICATION_PERMISSION_REQUEST_CODE = 1002
+    }
 }
diff --git a/android/app/src/main/kotlin/com/follow/clash/plugins/ServicePlugin.kt b/android/app/src/main/kotlin/com/follow/clash/plugins/ServicePlugin.kt
index 00d8bd3e8b..ccf4082ea7 100644
--- a/android/app/src/main/kotlin/com/follow/clash/plugins/ServicePlugin.kt
+++ b/android/app/src/main/kotlin/com/follow/clash/plugins/ServicePlugin.kt
@@ -1,10 +1,8 @@
 package com.follow.clash.plugins
 
-import com.follow.clash.RunState
-import com.follow.clash.Service
-import com.follow.clash.State
+import com.follow.clash.ServiceController
+import com.follow.clash.ServiceState
 import com.follow.clash.common.Components
-import com.follow.clash.invokeMethodOnMainThread
 import com.follow.clash.models.SharedState
 import com.google.gson.Gson
 import io.flutter.embedding.engine.plugins.FlutterPlugin
@@ -13,127 +11,102 @@ import io.flutter.plugin.common.MethodChannel
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
-import kotlinx.coroutines.sync.Semaphore
-import kotlinx.coroutines.sync.withPermit
 
-class ServicePlugin : FlutterPlugin, MethodChannel.MethodCallHandler,
-    CoroutineScope by CoroutineScope(SupervisorJob() + Dispatchers.Default) {
-    private lateinit var flutterMethodChannel: MethodChannel
+class ServicePlugin : FlutterPlugin, MethodChannel.MethodCallHandler {
+    private lateinit var channel: MethodChannel
+    private lateinit var scope: CoroutineScope
+    private val gson = Gson()
 
-    override fun onAttachedToEngine(flutterPluginBinding: FlutterPlugin.FlutterPluginBinding) {
-        flutterMethodChannel = MethodChannel(
-            flutterPluginBinding.binaryMessenger, "${Components.PACKAGE_NAME}/service"
-        )
-        flutterMethodChannel.setMethodCallHandler(this)
+    override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+        scope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
+        channel = MethodChannel(binding.binaryMessenger, "${Components.PACKAGE_NAME}/service")
+        channel.setMethodCallHandler(this)
     }
 
-    override fun onDetachedFromEngine(flutterPluginBinding: FlutterPlugin.FlutterPluginBinding) {
-        flutterMethodChannel.setMethodCallHandler(null)
+    override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+        channel.setMethodCallHandler(null)
+        scope.cancel()
+        ServiceController.setEventListener(null)
     }
 
-    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) = when (call.method) {
-        "init" -> {
-            handleInit(result)
-        }
-
-        "shutdown" -> {
-            handleShutdown(result)
-        }
-
-        "invokeAction" -> {
-            handleInvokeAction(call, result)
-        }
-
-        "getRunTime" -> {
-            handleGetRunTime(result)
-        }
-
-        "syncState" -> {
-            handleSyncState(call, result)
-        }
-
-        "start" -> {
-            handleStart(result)
-        }
-
-        "stop" -> {
-            handleStop(result)
-        }
-
-        else -> {
-            result.notImplemented()
-        }
-    }
-
-    private fun handleInvokeAction(call: MethodCall, result: MethodChannel.Result) {
-        launch {
-            val data = call.arguments<String>()!!
-            Service.invokeAction(data) {
-                result.success(it)
-            }
+    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
+        when (call.method) {
+            "init" -> initialize(result)
+            "shutdown" -> shutdown(result)
+            "invokeMethod" -> invokeMethod(call, result)
+            "getRunTime" -> getRunTime(result)
+            "syncState" -> syncState(call, result)
+            "start" -> start(result)
+            "stop" -> stop(result)
+            else -> result.notImplemented()
         }
     }
 
-    private fun handleShutdown(result: MethodChannel.Result) {
-        Service.unbind()
-        result.success(true)
-    }
-
-    private fun handleStart(result: MethodChannel.Result) {
-        State.handleStartService()
-        result.success(true)
+    private fun initialize(result: MethodChannel.Result) {
+        ServiceController.setEventListener(::sendEvent)
+            .onSuccess { result.success("") }
+            .onFailure { error -> result.success(error.message.orEmpty()) }
     }
 
-    private fun handleStop(result: MethodChannel.Result) {
-        State.handleStopService()
-        result.success(true)
+    private fun shutdown(result: MethodChannel.Result) {
+        scope.launch {
+            ServiceController.unbind()
+            result.success(true)
+        }
     }
 
-    val semaphore = Semaphore(10)
-
-    fun handleSendEvent(value: String?) {
-        launch(Dispatchers.Main) {
-            semaphore.withPermit {
-                flutterMethodChannel.invokeMethod("event", value)
+    private fun invokeMethod(call: MethodCall, result: MethodChannel.Result) {
+        val data = call.arguments as? String
+        if (data == null) {
+            result.error("INVALID_ARGUMENT", "Method call payload must be a string", null)
+            return
+        }
+        scope.launch {
+            ServiceController.invokeMethod(data) { response ->
+                result.success(response)
+            }.onFailure { error ->
+                result.error("CORE_ERROR", error.message, null)
             }
         }
     }
 
-    private fun onServiceDisconnected(message: String) {
-        State.runStateFlow.tryEmit(RunState.STOP)
-        flutterMethodChannel.invokeMethodOnMainThread<Any>("crash", message)
+    private fun getRunTime(result: MethodChannel.Result) {
+        scope.launch {
+            ServiceState.refresh()
+            result.success(ServiceState.runTimeMillis)
+        }
     }
 
-    private fun handleSyncState(call: MethodCall, result: MethodChannel.Result) {
-        val data = call.arguments<String>()!!
-        State.sharedState = Gson().fromJson(data, SharedState::class.java)
-        launch {
-            State.syncState()
+    private fun syncState(call: MethodCall, result: MethodChannel.Result) {
+        val data = call.arguments as? String
+        val state = runCatching {
+            gson.fromJson(data, SharedState::class.java)
+        }.getOrNull()
+        if (state == null) {
+            result.success("Invalid shared state")
+            return
+        }
+        scope.launch {
+            ServiceState.syncSharedState(state)
             result.success("")
         }
     }
 
+    private fun start(result: MethodChannel.Result) {
+        ServiceState.requestStart()
+        result.success(true)
+    }
 
-    fun handleInit(result: MethodChannel.Result) {
-        Service.bind()
-        launch {
-            Service.setEventListener {
-                handleSendEvent(it)
-            }.onSuccess {
-                result.success("")
-            }.onFailure {
-                result.success(it.message)
-            }
-
-        }
-        Service.onServiceDisconnected = ::onServiceDisconnected
+    private fun stop(result: MethodChannel.Result) {
+        ServiceState.requestStop()
+        result.success(true)
     }
 
-    private fun handleGetRunTime(result: MethodChannel.Result) {
-        launch {
-            State.handleSyncState()
-            result.success(State.runTime)
+    private fun sendEvent(value: String?) {
+        scope.launch(Dispatchers.Main) {
+            channel.invokeMethod("event", value)
         }
     }
-}
\ No newline at end of file
+}
diff --git a/android/app/src/main/kotlin/com/follow/clash/plugins/TilePlugin.kt b/android/app/src/main/kotlin/com/follow/clash/plugins/TilePlugin.kt
index f7a5732b3b..744bf98b12 100644
--- a/android/app/src/main/kotlin/com/follow/clash/plugins/TilePlugin.kt
+++ b/android/app/src/main/kotlin/com/follow/clash/plugins/TilePlugin.kt
@@ -7,7 +7,6 @@ import io.flutter.plugin.common.MethodCall
 import io.flutter.plugin.common.MethodChannel
 
 class TilePlugin : FlutterPlugin, MethodChannel.MethodCallHandler {
-
     private lateinit var channel: MethodChannel
 
     override fun onAttachedToEngine(flutterPluginBinding: FlutterPlugin.FlutterPluginBinding) {
@@ -21,13 +20,14 @@ class TilePlugin : FlutterPlugin, MethodChannel.MethodCallHandler {
     }
 
     fun handleStart() {
-        channel.invokeMethodOnMainThread<Any>("start", null)
+        channel.invokeMethodOnMainThread("start")
     }
 
     fun handleStop() {
-        channel.invokeMethodOnMainThread<Any>("stop", null)
+        channel.invokeMethodOnMainThread("stop")
     }
 
-
-    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {}
-}
\ No newline at end of file
+    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
+        result.notImplemented()
+    }
+}
diff --git a/android/app/src/main/res/xml/file_paths.xml b/android/app/src/main/res/xml/file_paths.xml
deleted file mode 100644
index 798f29681f..0000000000
--- a/android/app/src/main/res/xml/file_paths.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<paths>
-    <files-path
-        name="files"
-        path="."/>
-</paths>
-
diff --git a/android/app/src/main/res/xml/network_security_config.xml b/android/app/src/main/res/xml/network_security_config.xml
deleted file mode 100644
index 9496fa2e5a..0000000000
--- a/android/app/src/main/res/xml/network_security_config.xml
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<network-security-config xmlns:tools="http://schemas.android.com/tools"
-    tools:ignore="AcceptsUserCertificates">
-    <base-config>
-        <trust-anchors>
-            <certificates src="system" />
-            <certificates src="user" />
-        </trust-anchors>
-    </base-config>
-    <domain-config cleartextTrafficPermitted="true">
-        <domain includeSubdomains="true">localhost</domain>
-        <domain includeSubdomains="true">127.0.0.1</domain>
-    </domain-config>
-</network-security-config>
\ No newline at end of file
diff --git a/android/app/src/profile/AndroidManifest.xml b/android/app/src/profile/AndroidManifest.xml
deleted file mode 100644
index 399f6981d5..0000000000
--- a/android/app/src/profile/AndroidManifest.xml
+++ /dev/null
@@ -1,7 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <!-- The INTERNET permission is required for development. Specifically,
-         the Flutter tool needs it to communicate with the running application
-         to allow setting breakpoints, to provide hot reload, etc.
-    -->
-    <uses-permission android:name="android.permission.INTERNET"/>
-</manifest>
diff --git a/android/build.gradle.kts b/android/build.gradle.kts
index 18fecbd96b..6ccdf128ad 100644
--- a/android/build.gradle.kts
+++ b/android/build.gradle.kts
@@ -14,9 +14,6 @@ rootProject.layout.buildDirectory.value(newBuildDir)
 subprojects {
     val newSubprojectBuildDir: Directory = newBuildDir.dir(project.name)
     project.layout.buildDirectory.value(newSubprojectBuildDir)
-}
-
-subprojects {
     project.evaluationDependsOn(":app")
 }
 
diff --git a/android/common/build.gradle.kts b/android/common/build.gradle.kts
index 35e2c7c6ce..20d1afdd57 100644
--- a/android/common/build.gradle.kts
+++ b/android/common/build.gradle.kts
@@ -9,24 +9,13 @@ android {
     compileSdk = libs.versions.compileSdk.get().toInt()
 
     defaultConfig {
-        minSdk = 21
-        consumerProguardFiles("consumer-rules.pro")
-    }
-
-    buildTypes {
-        release {
-            proguardFiles(
-                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro"
-            )
-        }
+        minSdk = libs.versions.minSdk.get().toInt()
     }
 
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17
     }
-
 }
 
 kotlin {
diff --git a/android/common/consumer-rules.pro b/android/common/consumer-rules.pro
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/android/common/src/main/java/com/follow/clash/common/Components.kt b/android/common/src/main/java/com/follow/clash/common/Components.kt
index 6d8dd5033f..cacc45e594 100644
--- a/android/common/src/main/java/com/follow/clash/common/Components.kt
+++ b/android/common/src/main/java/com/follow/clash/common/Components.kt
@@ -5,12 +5,12 @@ import android.content.ComponentName
 object Components {
     const val PACKAGE_NAME = "com.follow.clash"
 
-    val MAIN_ACTIVITY =
+    val mainActivity =
         ComponentName(GlobalState.packageName, "${PACKAGE_NAME}.MainActivity")
 
-    val TEMP_ACTIVITY =
-        ComponentName(GlobalState.packageName, "${PACKAGE_NAME}.TempActivity")
+    val quickActionActivity =
+        ComponentName(GlobalState.packageName, "${PACKAGE_NAME}.QuickActionActivity")
 
-    val BROADCAST_RECEIVER =
-        ComponentName(GlobalState.packageName, "${PACKAGE_NAME}.BroadcastReceiver")
-}
\ No newline at end of file
+    val serviceBroadcastReceiver =
+        ComponentName(GlobalState.packageName, "${PACKAGE_NAME}.ServiceBroadcastReceiver")
+}
diff --git a/android/common/src/main/java/com/follow/clash/common/Enums.kt b/android/common/src/main/java/com/follow/clash/common/Enums.kt
index 91310af04c..709e5bbfdf 100644
--- a/android/common/src/main/java/com/follow/clash/common/Enums.kt
+++ b/android/common/src/main/java/com/follow/clash/common/Enums.kt
@@ -2,7 +2,6 @@ package com.follow.clash.common
 
 import com.google.gson.annotations.SerializedName
 
-
 enum class QuickAction {
     STOP,
     START,
@@ -10,8 +9,8 @@ enum class QuickAction {
 }
 
 enum class BroadcastAction {
-    SERVICE_CREATED,
-    SERVICE_DESTROYED,
+    VPN_START_REQUESTED,
+    VPN_REVOKED,
 }
 
 enum class AccessControlMode {
@@ -20,4 +19,4 @@ enum class AccessControlMode {
 
     @SerializedName("rejectSelected")
     REJECT_SELECTED,
-}
\ No newline at end of file
+}
diff --git a/android/common/src/main/java/com/follow/clash/common/Ext.kt b/android/common/src/main/java/com/follow/clash/common/Ext.kt
index 71773d9cd0..9692ab345c 100644
--- a/android/common/src/main/java/com/follow/clash/common/Ext.kt
+++ b/android/common/src/main/java/com/follow/clash/common/Ext.kt
@@ -13,98 +13,60 @@ import android.content.Context
 import android.content.Context.RECEIVER_NOT_EXPORTED
 import android.content.Intent
 import android.content.IntentFilter
-import android.content.ServiceConnection
 import android.content.pm.ServiceInfo.FOREGROUND_SERVICE_TYPE_SPECIAL_USE
 import android.os.Build
-import android.os.Handler
-import android.os.IBinder
-import android.os.Looper
-import android.os.RemoteException
-import android.util.Log
 import androidx.core.content.getSystemService
-import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.channels.awaitClose
-import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.callbackFlow
-import kotlinx.coroutines.flow.retryWhen
-import kotlinx.coroutines.withContext
-import java.nio.charset.Charset
 import kotlin.reflect.KClass
 
-//fun Context.startForegroundServiceCompat(intent: Intent?) {
-//    if (Build.VERSION.SDK_INT >= 26) {
-//        startForegroundService(intent)
-//    } else {
-//        startService(intent)
-//    }
-//}
-
 val KClass<*>.intent: Intent
     get() = Intent(GlobalState.application, this.java)
 
-fun Service.startForegroundCompat(id: Int, notification: Notification) {
-    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-        startForeground(id, notification, FOREGROUND_SERVICE_TYPE_SPECIAL_USE)
-    } else {
-        startForeground(id, notification)
-    }
-}
-
 val ComponentName.intent: Intent
     get() = Intent().apply {
-        setComponent(this@intent)
-        setPackage(GlobalState.packageName)
+        component = this@intent
     }
 
 val QuickAction.action: String
     get() = "${GlobalState.application.packageName}.action.${this.name}"
 
 val QuickAction.quickIntent: Intent
-    get() = Components.TEMP_ACTIVITY.intent.apply {
+    get() = Components.quickActionActivity.intent.apply {
         action = this@quickIntent.action
-        addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_MULTIPLE_TASK)
+        addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
     }
 
 val BroadcastAction.action: String
     get() = "${GlobalState.application.packageName}.intent.action.${this.name}"
 
 val Context.processName: String?
-    get() {
-        val pid = android.os.Process.myPid()
-        val activityManager = getSystemService<ActivityManager>()
-        activityManager?.runningAppProcesses?.find { it.pid == pid }?.let {
-            return it.processName
-        }
-        return null
-    }
-
-val BroadcastAction.quickIntent: Intent
-    get() = Components.BROADCAST_RECEIVER.intent.apply {
-        action = this@quickIntent.action
-    }
+    get() = getSystemService<ActivityManager>()
+        ?.runningAppProcesses
+        ?.firstOrNull { it.pid == android.os.Process.myPid() }
+        ?.processName
 
 fun BroadcastAction.sendBroadcast() {
-    val intent = Intent().apply {
-        action = this@sendBroadcast.action
-        Log.d("[sendBroadcast]", "$action")
-        setPackage(GlobalState.packageName)
+    val broadcastAction = action
+    val intent = Intent(broadcastAction).apply {
+        component = Components.serviceBroadcastReceiver
     }
+    GlobalState.log("Send broadcast: $broadcastAction")
     GlobalState.application.sendBroadcast(
-        intent, GlobalState.RECEIVE_BROADCASTS_PERMISSIONS
+        intent,
+        GlobalState.receiveBroadcastPermission,
     )
 }
 
-
 val Intent.toPendingIntent: PendingIntent
     get() = PendingIntent.getActivity(
         GlobalState.application,
         0,
         this,
-        PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT
+        PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
     )
 
-
 fun Service.startForeground(notification: Notification) {
     if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
         val manager = getSystemService(NotificationManager::class.java)
@@ -112,13 +74,21 @@ fun Service.startForeground(notification: Notification) {
         if (channel == null) {
             channel = NotificationChannel(
                 GlobalState.NOTIFICATION_CHANNEL,
-                "SERVICE_CHANNEL",
-                NotificationManager.IMPORTANCE_LOW
+                getString(R.string.service_channel_name),
+                NotificationManager.IMPORTANCE_LOW,
             )
             manager?.createNotificationChannel(channel)
         }
     }
-    startForegroundCompat(GlobalState.NOTIFICATION_ID, notification)
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+        startForeground(
+            GlobalState.NOTIFICATION_ID,
+            notification,
+            FOREGROUND_SERVICE_TYPE_SPECIAL_USE,
+        )
+    } else {
+        startForeground(GlobalState.NOTIFICATION_ID, notification)
+    }
 }
 
 @SuppressLint("UnspecifiedRegisterReceiverFlag")
@@ -144,107 +114,3 @@ fun Context.receiveBroadcastFlow(
     registerReceiverCompat(receiver, filter)
     awaitClose { unregisterReceiver(receiver) }
 }
-
-
-inline fun <reified T : IBinder> Context.bindServiceFlow(
-    intent: Intent,
-    flags: Int = Context.BIND_AUTO_CREATE,
-    maxRetries: Int = 10,
-    retryDelayMillis: Long = 200L
-): Flow<Pair<IBinder?, String>> = callbackFlow {
-    val connection = object : ServiceConnection {
-        override fun onServiceConnected(name: ComponentName?, binder: IBinder?) {
-            if (binder != null) {
-                try {
-                    @Suppress("UNCHECKED_CAST") val casted = binder as? T
-                    if (casted != null) {
-                        trySend(Pair(casted, ""))
-                    } else {
-                        trySend(Pair(null, "Binder is not of type ${T::class.java}"))
-                    }
-                } catch (e: RemoteException) {
-                    trySend(Pair(null, "Failed to link to death: ${e.message}"))
-                }
-            } else {
-                trySend(Pair(null, "Binder empty"))
-            }
-        }
-
-        override fun onServiceDisconnected(name: ComponentName?) {
-            trySend(Pair(null, "Service disconnected"))
-        }
-    }
-
-    val success = withContext(Dispatchers.Main) {
-        bindService(intent, connection, flags)
-    }
-
-    if (!success) {
-        throw IllegalStateException("bindService() failed, will retry")
-    }
-
-    awaitClose {
-        Handler(Looper.getMainLooper()).post {
-            unbindService(connection)
-            trySend(Pair(null, ""))
-        }
-    }
-}.retryWhen { cause, attempt ->
-    if (attempt < maxRetries && cause is Exception) {
-        delay(retryDelayMillis)
-        true
-    } else {
-        false
-    }
-}
-
-
-val Long.formatBytes: String
-    get() {
-        val units = arrayOf("B", "KB", "MB", "GB", "TB")
-        var size = this.toDouble()
-        var unitIndex = 0
-
-        while (size >= 1024 && unitIndex < units.size - 1) {
-            size /= 1024
-            unitIndex++
-        }
-
-        return if (unitIndex == 0) {
-            "${size.toLong()}${units[unitIndex]}"
-        } else {
-            "%.1f${units[unitIndex]}".format(size)
-        }
-    }
-
-fun String.chunkedForAidl(charset: Charset = Charsets.UTF_8): List<ByteArray> {
-    val allBytes = toByteArray(charset)
-    val total = allBytes.size
-    val maxBytes = when {
-        total <= 100 * 1024 -> total
-        total <= 1024 * 1024 -> 64 * 1024
-        total <= 10 * 1024 * 1024 -> 128 * 1024
-        else -> 256 * 1024
-    }
-
-    val result = mutableListOf<ByteArray>()
-    var index = 0
-    while (index < total) {
-        val end = minOf(index + maxBytes, total)
-        result.add(allBytes.copyOfRange(index, end))
-        index = end
-    }
-    return result
-}
-
-
-fun <T : List<ByteArray>> T.formatString(charset: Charset = Charsets.UTF_8): String {
-    val totalSize = this.sumOf { it.size }
-    val combined = ByteArray(totalSize)
-    var offset = 0
-    forEach { byteArray ->
-        byteArray.copyInto(combined, offset)
-        offset += byteArray.size
-    }
-    return String(combined, charset)
-}
\ No newline at end of file
diff --git a/android/common/src/main/java/com/follow/clash/common/GlobalState.kt b/android/common/src/main/java/com/follow/clash/common/GlobalState.kt
index 0b7a2336e8..cc1f562700 100644
--- a/android/common/src/main/java/com/follow/clash/common/GlobalState.kt
+++ b/android/common/src/main/java/com/follow/clash/common/GlobalState.kt
@@ -1,47 +1,47 @@
 package com.follow.clash.common
 
-
 import android.app.Application
 import android.util.Log
 import com.google.firebase.FirebaseApp
 import com.google.firebase.crashlytics.FirebaseCrashlytics
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
 
-object GlobalState : CoroutineScope by CoroutineScope(Dispatchers.Default) {
-
+object GlobalState : CoroutineScope by CoroutineScope(SupervisorJob() + Dispatchers.Default) {
     const val NOTIFICATION_CHANNEL = "FlClash"
-
     const val NOTIFICATION_ID = 1
 
     val packageName: String
         get() = application.packageName
 
-    val RECEIVE_BROADCASTS_PERMISSIONS: String
-        get() = "${packageName}.permission.RECEIVE_BROADCASTS"
-
-
-    private var _application: Application? = null
+    val receiveBroadcastPermission: String
+        get() = "$packageName.permission.RECEIVE_BROADCASTS"
 
     val application: Application
-        get() = _application!!
+        get() = checkNotNull(appInstance) { "GlobalState is not initialized" }
 
+    @Volatile
+    private var appInstance: Application? = null
 
-    fun log(text: String) {
-        Log.d("[FlClash]", text)
+    fun init(application: Application) {
+        appInstance = application
     }
 
-    fun init(application: Application) {
-        _application = application
+    fun log(text: String) {
+        Log.d("FlClash", text)
     }
 
     fun setCrashlytics(enable: Boolean) {
-        _application?.let {
-            FirebaseApp.initializeApp(it)
-            FirebaseCrashlytics.getInstance().isCrashlyticsCollectionEnabled = enable
-            if (enable) {
-                log("init crashlytics ${it.processName}")
-            }
+        FirebaseApp.initializeApp(application)
+        FirebaseCrashlytics.getInstance().isCrashlyticsCollectionEnabled = enable
+        if (enable) {
+            log("Crashlytics enabled for ${application.processName}")
         }
     }
-}
\ No newline at end of file
+
+    fun didCrashOnPreviousExecution(): Boolean {
+        FirebaseApp.initializeApp(application)
+        return FirebaseCrashlytics.getInstance().didCrashOnPreviousExecution()
+    }
+}
diff --git a/android/common/src/main/java/com/follow/clash/common/Service.kt b/android/common/src/main/java/com/follow/clash/common/Service.kt
deleted file mode 100644
index 09433cb892..0000000000
--- a/android/common/src/main/java/com/follow/clash/common/Service.kt
+++ /dev/null
@@ -1,78 +0,0 @@
-package com.follow.clash.common
-
-import android.content.Intent
-import android.os.IBinder
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.Job
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.filterNotNull
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-import kotlinx.coroutines.withTimeout
-import java.util.concurrent.atomic.AtomicBoolean
-
-class ServiceDelegate<T>(
-    private val intent: Intent,
-    private val onServiceDisconnected: ((String) -> Unit)? = null,
-    private val interfaceCreator: (IBinder) -> T,
-) : CoroutineScope by CoroutineScope(SupervisorJob() + Dispatchers.Default) {
-
-    private val _bindingState = AtomicBoolean(false)
-
-    private var _serviceState = MutableStateFlow<Pair<T?, String>?>(null)
-
-    val serviceState: StateFlow<Pair<T?, String>?> = _serviceState
-    private var job: Job? = null
-
-    private fun handleBind(data: Pair<IBinder?, String>) {
-        data.first?.let {
-            _serviceState.value = Pair(interfaceCreator(it), data.second)
-        } ?: run {
-            _serviceState.value = Pair(null, data.second)
-            unbind()
-            onServiceDisconnected?.invoke(data.second)
-            _bindingState.set(false)
-        }
-    }
-
-    fun bind() {
-        if (_bindingState.compareAndSet(false, true)) {
-            job?.cancel()
-            job = null
-            _serviceState.value = null
-            job = launch {
-                runCatching {
-                    GlobalState.application.bindServiceFlow<IBinder>(intent)
-                        .collect { handleBind(it) }
-                }
-            }
-        }
-    }
-
-    suspend inline fun <R> useService(
-        timeoutMillis: Long = 5000, crossinline block: suspend (T) -> R
-    ): Result<R> {
-        return runCatching {
-            withTimeout(timeoutMillis) {
-                val state = serviceState.filterNotNull().first()
-                state.first?.let {
-                    withContext(Dispatchers.Default) {
-                        block(it)
-                    }
-                } ?: throw Exception(state.second)
-            }
-        }
-    }
-
-    fun unbind() {
-        if (_bindingState.compareAndSet(true, false)) {
-            job?.cancel()
-            job = null
-            _serviceState.value = null
-        }
-    }
-}
\ No newline at end of file
diff --git a/android/common/src/main/java/com/follow/clash/common/Utils.kt b/android/common/src/main/java/com/follow/clash/common/Utils.kt
deleted file mode 100644
index 2b22dd5e2d..0000000000
--- a/android/common/src/main/java/com/follow/clash/common/Utils.kt
+++ /dev/null
@@ -1,14 +0,0 @@
-package com.follow.clash.common
-
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.flow
-
-
-fun tickerFlow(delayMillis: Long, initialDelayMillis: Long = delayMillis): Flow<Unit> = flow {
-    delay(initialDelayMillis)
-    while (true) {
-        emit(Unit)
-        delay(delayMillis)
-    }
-}
\ No newline at end of file
diff --git a/android/common/src/main/res/values/strings.xml b/android/common/src/main/res/values/strings.xml
index c31b20711e..1e795f3c45 100644
--- a/android/common/src/main/res/values/strings.xml
+++ b/android/common/src/main/res/values/strings.xml
@@ -1,4 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="FlClash">FlClash</string>
+    <string name="app_name">FlClash</string>
+    <string name="service_channel_name">FlClash Service</string>
 </resources>
diff --git a/android/core/build.gradle.kts b/android/core/build.gradle.kts
index 915d5c9687..cac81a2ca2 100644
--- a/android/core/build.gradle.kts
+++ b/android/core/build.gradle.kts
@@ -13,13 +13,6 @@ android {
         minSdk = libs.versions.minSdk.get().toInt()
     }
 
-
-    sourceSets {
-        getByName("main") {
-            jniLibs.srcDirs("src/main/jniLibs")
-        }
-    }
-
     externalNativeBuild {
         cmake {
             path("src/main/cpp/CMakeLists.txt")
@@ -32,14 +25,6 @@ android {
         targetCompatibility = JavaVersion.VERSION_17
     }
 
-    buildTypes {
-        release {
-            proguardFiles(
-                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro"
-            )
-        }
-    }
 }
 
 kotlin {
@@ -48,7 +33,6 @@ kotlin {
     }
 }
 
-
 dependencies {
     implementation(libs.annotation.jvm)
 }
diff --git a/android/core/src/main/cpp/core.cpp b/android/core/src/main/cpp/core.cpp
index 878d20ccd9..816c75ffcc 100644
--- a/android/core/src/main/cpp/core.cpp
+++ b/android/core/src/main/cpp/core.cpp
@@ -34,9 +34,9 @@ Java_com_follow_clash_core_Core_updateDNS(JNIEnv *env, jobject thiz, jstring dns
 
 extern "C"
 JNIEXPORT void JNICALL
-Java_com_follow_clash_core_Core_invokeAction(JNIEnv *env, jobject thiz, jstring data, jobject cb) {
+Java_com_follow_clash_core_Core_invokeMethod(JNIEnv *env, jobject thiz, jstring data, jobject cb) {
     const auto interface = new_global(cb);
-    invokeAction(interface, get_string(data));
+    invokeMethod(interface, get_string(data));
 }
 
 extern "C"
@@ -54,14 +54,16 @@ extern "C"
 JNIEXPORT jstring JNICALL
 Java_com_follow_clash_core_Core_getTraffic(JNIEnv *env, jobject thiz,
                                            const jboolean only_statistics_proxy) {
-    return new_string(getTraffic(only_statistics_proxy));
+    scoped_string traffic = getTraffic(only_statistics_proxy);
+    return new_string(traffic);
 }
 
 extern "C"
 JNIEXPORT jstring JNICALL
 Java_com_follow_clash_core_Core_getTotalTraffic(JNIEnv *env, jobject thiz,
                                                 const jboolean only_statistics_proxy) {
-    return new_string(getTotalTraffic(only_statistics_proxy));
+    scoped_string traffic = getTotalTraffic(only_statistics_proxy);
+    return new_string(traffic);
 }
 
 extern "C"
@@ -106,21 +108,31 @@ call_tun_interface_resolve_process_impl(void *tun_interface, const int protocol,
                                         const char *target,
                                         const int uid) {
     ATTACH_JNI();
-    const auto packageName = reinterpret_cast<jstring>(env->CallObjectMethod(
+    const auto source_string = new_string(source);
+    const auto target_string = new_string(target);
+    const auto package_name = reinterpret_cast<jstring>(env->CallObjectMethod(
             static_cast<jobject>(tun_interface),
             m_tun_interface_resolve_process,
             protocol,
-            new_string(source),
-            new_string(target),
+            source_string,
+            target_string,
             uid));
-    return get_string(packageName);
+    env->DeleteLocalRef(source_string);
+    env->DeleteLocalRef(target_string);
+    const auto result = get_string(package_name);
+    if (package_name != nullptr) {
+        env->DeleteLocalRef(package_name);
+    }
+    return result;
 }
 
 static void call_invoke_interface_result_impl(void *invoke_interface, const char *data) {
     ATTACH_JNI();
+    const auto value = new_string(data);
     env->CallVoidMethod(static_cast<jobject>(invoke_interface),
                         m_invoke_interface_result,
-                        new_string(data));
+                        value);
+    env->DeleteLocalRef(value);
 }
 
 extern "C"
@@ -166,7 +178,7 @@ Java_com_follow_clash_core_Core_stopTun(JNIEnv *env, jobject thiz) {
 
 extern "C"
 JNIEXPORT void JNICALL
-Java_com_follow_clash_core_Core_invokeAction(JNIEnv *env, jobject thiz, jstring data, jobject cb) {
+Java_com_follow_clash_core_Core_invokeMethod(JNIEnv *env, jobject thiz, jstring data, jobject cb) {
 }
 
 extern "C"
@@ -188,11 +200,13 @@ extern "C"
 JNIEXPORT jstring JNICALL
 Java_com_follow_clash_core_Core_getTraffic(JNIEnv *env, jobject thiz,
                                            const jboolean only_statistics_proxy) {
+    return env->NewStringUTF("{}");
 }
 extern "C"
 JNIEXPORT jstring JNICALL
 Java_com_follow_clash_core_Core_getTotalTraffic(JNIEnv *env, jobject thiz,
                                                 const jboolean only_statistics_proxy) {
+    return env->NewStringUTF("{}");
 }
 
 extern "C"
@@ -205,4 +219,4 @@ JNIEXPORT void JNICALL
 Java_com_follow_clash_core_Core_quickSetup(JNIEnv *env, jobject thiz, jstring init_params_string,
                                            jstring setup_params_string, jobject cb) {
 }
-#endif
\ No newline at end of file
+#endif
diff --git a/android/core/src/main/cpp/jni_helper.cpp b/android/core/src/main/cpp/jni_helper.cpp
index e840fe3148..1858e35c8e 100644
--- a/android/core/src/main/cpp/jni_helper.cpp
+++ b/android/core/src/main/cpp/jni_helper.cpp
@@ -1,7 +1,6 @@
 #include "jni_helper.h"
 
 #include <cstdlib>
-#include <malloc.h>
 #include <cstring>
 
 static JavaVM *global_vm;
@@ -18,15 +17,15 @@ void initialize_jni(JavaVM *vm, JNIEnv *env) {
     m_get_bytes = find_method(c_string, "getBytes", "()[B");
 }
 
-JavaVM *global_java_vm() {
-    return global_vm;
-}
-
 char *jni_get_string(JNIEnv *env, jstring str) {
+    if (str == nullptr) {
+        return static_cast<char *>(calloc(1, 1));
+    }
     const auto array = reinterpret_cast<jbyteArray>(env->CallObjectMethod(str, m_get_bytes));
     const int length = env->GetArrayLength(array);
     const auto content = static_cast<char *>(malloc(length + 1));
     env->GetByteArrayRegion(array, 0, length, reinterpret_cast<jbyte *>(content));
+    env->DeleteLocalRef(array);
     content[length] = 0;
     return content;
 }
@@ -35,37 +34,28 @@ jstring jni_new_string(JNIEnv *env, const char *str) {
     const auto length = static_cast<int>(strlen(str));
     const auto array = env->NewByteArray(length);
     env->SetByteArrayRegion(array, 0, length, reinterpret_cast<const jbyte *>(str));
-    return reinterpret_cast<jstring>(env->NewObject(c_string, m_new_string, array));
-}
-
-int jni_catch_exception(JNIEnv *env) {
-    const int result = env->ExceptionCheck();
-    if (result) {
-        env->ExceptionDescribe();
-        env->ExceptionClear();
-    }
+    const auto result = reinterpret_cast<jstring>(env->NewObject(c_string, m_new_string, array));
+    env->DeleteLocalRef(array);
     return result;
 }
 
 void jni_attach_thread(scoped_jni *jni) {
-    JavaVM *vm = global_java_vm();
-    if (vm->GetEnv(reinterpret_cast<void **>(&jni->env), JNI_VERSION_1_6) == JNI_OK) {
+    if (global_vm->GetEnv(reinterpret_cast<void **>(&jni->env), JNI_VERSION_1_6) == JNI_OK) {
         jni->require_release = 0;
         return;
     }
-    if (vm->AttachCurrentThread(&jni->env, nullptr) != JNI_OK) {
+    if (global_vm->AttachCurrentThread(&jni->env, nullptr) != JNI_OK) {
         abort();
     }
     jni->require_release = 1;
 }
 
 void jni_detach_thread(const scoped_jni *env) {
-    JavaVM *vm = global_java_vm();
     if (env->require_release) {
-        vm->DetachCurrentThread();
+        global_vm->DetachCurrentThread();
     }
 }
 
-void release_string(char **str) {
-    free(*str);
-}
\ No newline at end of file
+void release_string(char **value) {
+    free(*value);
+}
diff --git a/android/core/src/main/cpp/jni_helper.h b/android/core/src/main/cpp/jni_helper.h
index a408751999..9d89d9ff0f 100644
--- a/android/core/src/main/cpp/jni_helper.h
+++ b/android/core/src/main/cpp/jni_helper.h
@@ -13,13 +13,11 @@ extern jstring jni_new_string(JNIEnv *env, const char *str);
 
 extern char *jni_get_string(JNIEnv *env, jstring str);
 
-extern int jni_catch_exception(JNIEnv *env);
-
 extern void jni_attach_thread(scoped_jni *jni);
 
 extern void jni_detach_thread(const scoped_jni *env);
 
-extern void release_string( char **str);
+extern void release_string(char **value);
 
 #define ATTACH_JNI() __attribute__((unused, cleanup(jni_detach_thread))) \
                     scoped_jni _jni{}; \
diff --git a/android/core/src/main/java/com/follow/clash/core/Core.kt b/android/core/src/main/java/com/follow/clash/core/Core.kt
index bbc4e70f72..86aaff7042 100644
--- a/android/core/src/main/java/com/follow/clash/core/Core.kt
+++ b/android/core/src/main/java/com/follow/clash/core/Core.kt
@@ -2,9 +2,9 @@ package com.follow.clash.core
 
 import java.net.InetAddress
 import java.net.InetSocketAddress
-import java.net.URL
+import java.net.URI
 
-data object Core {
+object Core {
     private external fun startTun(
         fd: Int,
         cb: TunInterface,
@@ -13,17 +13,17 @@ data object Core {
         dns: String,
     )
 
-    external fun forceGC(
-    )
+    external fun forceGC()
 
     external fun updateDNS(
         dns: String,
     )
 
     private fun parseInetSocketAddress(address: String): InetSocketAddress {
-        val url = URL("https://$address")
-
-        return InetSocketAddress(InetAddress.getByName(url.host), url.port)
+        val uri = URI("tcp://$address")
+        val host = requireNotNull(uri.host) { "Missing host in address: $address" }
+        require(uri.port >= 0) { "Missing port in address: $address" }
+        return InetSocketAddress(InetAddress.getByName(host), uri.port)
     }
 
     fun startTun(
@@ -45,7 +45,7 @@ data object Core {
                     protocol: Int,
                     source: String,
                     target: String,
-                    uid: Int
+                    uid: Int,
                 ): String {
                     return resolverProcess(
                         protocol,
@@ -57,7 +57,7 @@ data object Core {
             },
             stack,
             address,
-            dns
+            dns,
         )
     }
 
@@ -65,16 +65,16 @@ data object Core {
         suspended: Boolean,
     )
 
-    private external fun invokeAction(
+    private external fun invokeMethod(
         data: String,
-        cb: InvokeInterface
+        cb: InvokeInterface,
     )
 
-    fun invokeAction(
+    fun invokeMethod(
         data: String,
-        cb: (result: String?) -> Unit
+        cb: (result: String?) -> Unit,
     ) {
-        invokeAction(
+        invokeMethod(
             data,
             object : InvokeInterface {
                 override fun onResult(result: String?) {
@@ -86,33 +86,33 @@ data object Core {
 
     private external fun setEventListener(cb: InvokeInterface?)
 
-    fun callSetEventListener(
-        cb: ((result: String?) -> Unit)?
+    fun updateEventListener(
+        callback: ((result: String?) -> Unit)?,
     ) {
-        when (cb != null) {
-            true -> setEventListener(
+        if (callback == null) {
+            setEventListener(null)
+        } else {
+            setEventListener(
                 object : InvokeInterface {
                     override fun onResult(result: String?) {
-                        cb(result)
+                        callback(result)
                     }
                 },
             )
-
-            false -> setEventListener(null)
         }
     }
 
     fun quickSetup(
         initParamsString: String,
         setupParamsString: String,
-        cb: (result: String?) -> Unit,
+        callback: (result: String?) -> Unit,
     ) {
         quickSetup(
             initParamsString,
             setupParamsString,
             object : InvokeInterface {
                 override fun onResult(result: String?) {
-                    cb(result)
+                    callback(result)
                 }
             },
         )
@@ -121,7 +121,7 @@ data object Core {
     private external fun quickSetup(
         initParamsString: String,
         setupParamsString: String,
-        cb: InvokeInterface
+        cb: InvokeInterface,
     )
 
     external fun stopTun()
@@ -133,4 +133,4 @@ data object Core {
     init {
         System.loadLibrary("core")
     }
-}
\ No newline at end of file
+}
diff --git a/android/core/src/main/java/com/follow/clash/core/TunInterface.kt b/android/core/src/main/java/com/follow/clash/core/TunInterface.kt
index ed46d6c493..06c1a4bc0e 100644
--- a/android/core/src/main/java/com/follow/clash/core/TunInterface.kt
+++ b/android/core/src/main/java/com/follow/clash/core/TunInterface.kt
@@ -5,5 +5,6 @@ import androidx.annotation.Keep
 @Keep
 interface TunInterface {
     fun protect(fd: Int)
+
     fun resolverProcess(protocol: Int, source: String, target: String, uid: Int): String
-}
\ No newline at end of file
+}
diff --git a/android/gradle.properties b/android/gradle.properties
index f2122b21a2..cac97e80de 100644
--- a/android/gradle.properties
+++ b/android/gradle.properties
@@ -1,6 +1,5 @@
 org.gradle.jvmargs=-Xmx4G
 android.useAndroidX=true
-android.enableJetifier=true
 # This builtInKotlin flag was added automatically by Flutter migrator
 android.builtInKotlin=false
 # This newDsl flag was added automatically by Flutter migrator
diff --git a/android/gradle/libs.versions.toml b/android/gradle/libs.versions.toml
index ed7237addb..c51cabf82c 100644
--- a/android/gradle/libs.versions.toml
+++ b/android/gradle/libs.versions.toml
@@ -1,5 +1,4 @@
 [versions]
-#agp = "8.10.1"
 firebaseBom = "34.15.0"
 minSdk = "23"
 targetSdk = "36"
@@ -9,10 +8,7 @@ coreKtx = "1.17.0"
 annotationJvm = "1.9.1"
 coreSplashscreen = "1.0.1"
 gson = "2.13.1"
-kotlin = "2.2.20"
 smaliDexlib2 = "3.0.9"
-firebaseCrashlyticsKtx = "20.0.6"
-firebaseCommonKtx = "22.1.0"
 
 [libraries]
 androidx-core = { module = "androidx.core:core-ktx", version.ref = "coreKtx" }
@@ -23,5 +19,3 @@ firebase-bom = { module = "com.google.firebase:firebase-bom", version.ref = "fir
 firebase-crashlytics-ndk = { module = "com.google.firebase:firebase-crashlytics-ndk" }
 gson = { module = "com.google.code.gson:gson", version.ref = "gson" }
 smali-dexlib2 = { module = "com.android.tools.smali:smali-dexlib2", version.ref = "smaliDexlib2" }
-firebase-crashlytics-ktx = { group = "com.google.firebase", name = "firebase-crashlytics-ktx", version.ref = "firebaseCrashlyticsKtx" }
-firebase-common-ktx = { group = "com.google.firebase", name = "firebase-common-ktx", version.ref = "firebaseCommonKtx" }
diff --git a/android/service/build.gradle.kts b/android/service/build.gradle.kts
index ac715317a1..6fe7ad719a 100644
--- a/android/service/build.gradle.kts
+++ b/android/service/build.gradle.kts
@@ -6,29 +6,17 @@ plugins {
 
 android {
     namespace = "com.follow.clash.service"
-    compileSdk = 36
+    compileSdk = libs.versions.compileSdk.get().toInt()
 
     defaultConfig {
         minSdk = libs.versions.minSdk.get().toInt()
     }
 
-    buildFeatures {
-        aidl = true
-    }
-
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17
     }
 
-    buildTypes {
-        release {
-            proguardFiles(
-                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro"
-            )
-        }
-    }
 }
 
 kotlin {
@@ -37,7 +25,6 @@ kotlin {
     }
 }
 
-
 dependencies {
     implementation(project(":core"))
     implementation(project(":common"))
diff --git a/android/service/src/main/AndroidManifest.xml b/android/service/src/main/AndroidManifest.xml
index f633493802..dcd8699ca8 100644
--- a/android/service/src/main/AndroidManifest.xml
+++ b/android/service/src/main/AndroidManifest.xml
@@ -8,8 +8,7 @@
             android:name=".VpnService"
             android:exported="false"
             android:foregroundServiceType="specialUse"
-            android:permission="android.permission.BIND_VPN_SERVICE"
-            android:process=":remote">
+            android:permission="android.permission.BIND_VPN_SERVICE">
             <intent-filter>
                 <action android:name="android.net.VpnService" />
             </intent-filter>
@@ -19,31 +18,23 @@
         </service>
 
         <service
-            android:name=".CommonService"
+            android:name=".ProxyService"
             android:exported="false"
-            android:foregroundServiceType="specialUse"
-            android:process=":remote">
+            android:foregroundServiceType="specialUse">
             <property
                 android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
                 android:value="proxy" />
         </service>
 
-        <service
-            android:name=".RemoteService"
-            android:enabled="true"
-            android:exported="false"
-            android:process=":remote" />
-
         <provider
             android:name=".FilesProvider"
             android:authorities="${applicationId}.files"
             android:exported="true"
             android:grantUriPermissions="true"
-            android:permission="android.permission.MANAGE_DOCUMENTS"
-            android:process=":remote">
+            android:permission="android.permission.MANAGE_DOCUMENTS">
             <intent-filter>
                 <action android:name="android.content.action.DOCUMENTS_PROVIDER" />
             </intent-filter>
         </provider>
     </application>
-</manifest>
\ No newline at end of file
+</manifest>
diff --git a/android/service/src/main/aidl/com/follow/clash/service/IAckInterface.aidl b/android/service/src/main/aidl/com/follow/clash/service/IAckInterface.aidl
deleted file mode 100644
index 11efaa98d2..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/IAckInterface.aidl
+++ /dev/null
@@ -1,8 +0,0 @@
-// IAckInterface.aidl
-package com.follow.clash.service;
-
-import com.follow.clash.service.IAckInterface;
-
-interface IAckInterface {
-   oneway void onAck();
-}
\ No newline at end of file
diff --git a/android/service/src/main/aidl/com/follow/clash/service/ICallbackInterface.aidl b/android/service/src/main/aidl/com/follow/clash/service/ICallbackInterface.aidl
deleted file mode 100644
index 5a8cf24e2e..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/ICallbackInterface.aidl
+++ /dev/null
@@ -1,8 +0,0 @@
-// ICallbackInterface.aidl
-package com.follow.clash.service;
-
-import com.follow.clash.service.IAckInterface;
-
-interface ICallbackInterface {
-    oneway void onResult(in byte[] data,in boolean isSuccess, in IAckInterface ack);
-}
\ No newline at end of file
diff --git a/android/service/src/main/aidl/com/follow/clash/service/IEventInterface.aidl b/android/service/src/main/aidl/com/follow/clash/service/IEventInterface.aidl
deleted file mode 100644
index 87c18974b2..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/IEventInterface.aidl
+++ /dev/null
@@ -1,8 +0,0 @@
-// IEventInterface.aidl
-package com.follow.clash.service;
-
-import com.follow.clash.service.IAckInterface;
-
-interface IEventInterface {
-    oneway void onEvent(in String id, in byte[] data,in boolean isSuccess, in IAckInterface ack);
-}
\ No newline at end of file
diff --git a/android/service/src/main/aidl/com/follow/clash/service/IRemoteInterface.aidl b/android/service/src/main/aidl/com/follow/clash/service/IRemoteInterface.aidl
deleted file mode 100644
index 4eac0b7dad..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/IRemoteInterface.aidl
+++ /dev/null
@@ -1,20 +0,0 @@
-// IRemoteInterface.aidl
-package com.follow.clash.service;
-
-import com.follow.clash.service.ICallbackInterface;
-import com.follow.clash.service.IEventInterface;
-import com.follow.clash.service.IResultInterface;
-import com.follow.clash.service.IVoidInterface;
-import com.follow.clash.service.models.VpnOptions;
-import com.follow.clash.service.models.NotificationParams;
-
-interface IRemoteInterface {
-    void invokeAction(in String data, in ICallbackInterface callback);
-    void quickSetup(in String initParamsString, in String setupParamsString, in ICallbackInterface callback, in IVoidInterface onStarted);
-    void updateNotificationParams(in NotificationParams params);
-    void startService(in VpnOptions options, in long runTime, in IResultInterface result);
-    void stopService(in IResultInterface result);
-    void setEventListener(in IEventInterface event);
-    void setCrashlytics(in boolean enable);
-    long getRunTime();
-}
\ No newline at end of file
diff --git a/android/service/src/main/aidl/com/follow/clash/service/IResultInterface.aidl b/android/service/src/main/aidl/com/follow/clash/service/IResultInterface.aidl
deleted file mode 100644
index 5f4f78b501..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/IResultInterface.aidl
+++ /dev/null
@@ -1,6 +0,0 @@
-// IResultInterface.aidl
-package com.follow.clash.service;
-
-interface IResultInterface {
-    oneway void onResult(in long runTime);
-}
\ No newline at end of file
diff --git a/android/service/src/main/aidl/com/follow/clash/service/IVoidInterface.aidl b/android/service/src/main/aidl/com/follow/clash/service/IVoidInterface.aidl
deleted file mode 100644
index 28db4c38e6..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/IVoidInterface.aidl
+++ /dev/null
@@ -1,6 +0,0 @@
-// IVoidInterface.aidl
-package com.follow.clash.service;
-
-interface IVoidInterface {
-    oneway void invoke();
-}
\ No newline at end of file
diff --git a/android/service/src/main/aidl/com/follow/clash/service/models/AccessControl.aidl b/android/service/src/main/aidl/com/follow/clash/service/models/AccessControl.aidl
deleted file mode 100644
index ea75b66997..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/models/AccessControl.aidl
+++ /dev/null
@@ -1,4 +0,0 @@
-//AccessControl.aidl
-package com.follow.clash.service.models;
-
-parcelable AccessControl;
\ No newline at end of file
diff --git a/android/service/src/main/aidl/com/follow/clash/service/models/NotificationParams.aidl b/android/service/src/main/aidl/com/follow/clash/service/models/NotificationParams.aidl
deleted file mode 100644
index 524221e7a5..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/models/NotificationParams.aidl
+++ /dev/null
@@ -1,4 +0,0 @@
-//NotificationParams.aidl
-package com.follow.clash.service.models;
-
-parcelable NotificationParams;
\ No newline at end of file
diff --git a/android/service/src/main/aidl/com/follow/clash/service/models/VpnOptions.aidl b/android/service/src/main/aidl/com/follow/clash/service/models/VpnOptions.aidl
deleted file mode 100644
index c1d780d696..0000000000
--- a/android/service/src/main/aidl/com/follow/clash/service/models/VpnOptions.aidl
+++ /dev/null
@@ -1,6 +0,0 @@
-//VpnOptions.aidl
-package com.follow.clash.service.models;
-
-import com.follow.clash.service.models.AccessControl;
-
-parcelable VpnOptions;
\ No newline at end of file
diff --git a/android/service/src/main/java/com/follow/clash/service/CommonService.kt b/android/service/src/main/java/com/follow/clash/service/CommonService.kt
deleted file mode 100644
index 4f680d09da..0000000000
--- a/android/service/src/main/java/com/follow/clash/service/CommonService.kt
+++ /dev/null
@@ -1,64 +0,0 @@
-package com.follow.clash.service
-
-import android.app.Service
-import android.content.Intent
-import android.os.Binder
-import android.os.IBinder
-import com.follow.clash.core.Core
-import com.follow.clash.service.modules.NetworkObserveModule
-import com.follow.clash.service.modules.NotificationModule
-import com.follow.clash.service.modules.SuspendModule
-import com.follow.clash.service.modules.moduleLoader
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-
-class CommonService : Service(), IBaseService,
-    CoroutineScope by CoroutineScope(Dispatchers.Default) {
-
-    private val self: CommonService
-        get() = this
-
-    private val loader = moduleLoader {
-        install(NetworkObserveModule(self))
-        install(NotificationModule(self))
-        install(SuspendModule(self))
-    }
-
-    override fun onCreate() {
-        super.onCreate()
-        handleCreate()
-    }
-
-    override fun onDestroy() {
-        handleDestroy()
-        super.onDestroy()
-    }
-
-    override fun onLowMemory() {
-        Core.forceGC()
-        super.onLowMemory()
-    }
-
-    private val binder = LocalBinder()
-
-    inner class LocalBinder : Binder() {
-        fun getService(): CommonService = this@CommonService
-    }
-
-    override fun onBind(intent: Intent): IBinder {
-        return binder
-    }
-
-    override fun start() {
-        try {
-            loader.load()
-        } catch (_: Exception) {
-            stop()
-        }
-    }
-
-    override fun stop() {
-        loader.cancel()
-        stopSelf()
-    }
-}
\ No newline at end of file
diff --git a/android/service/src/main/java/com/follow/clash/service/FilesProvider.kt b/android/service/src/main/java/com/follow/clash/service/FilesProvider.kt
index 26601feae8..c3d974bbd7 100644
--- a/android/service/src/main/java/com/follow/clash/service/FilesProvider.kt
+++ b/android/service/src/main/java/com/follow/clash/service/FilesProvider.kt
@@ -6,60 +6,34 @@ import android.os.CancellationSignal
 import android.os.ParcelFileDescriptor
 import android.provider.DocumentsContract
 import android.provider.DocumentsProvider
+import com.follow.clash.common.R as CommonR
 import java.io.File
 import java.io.FileNotFoundException
+import java.io.IOException
 
 class FilesProvider : DocumentsProvider() {
+    override fun onCreate() = true
 
-    companion object {
-        private const val DEFAULT_ROOT_ID = "0"
-
-        private val DEFAULT_DOCUMENT_COLUMNS = arrayOf(
-            DocumentsContract.Document.COLUMN_DOCUMENT_ID,
-            DocumentsContract.Document.COLUMN_DISPLAY_NAME,
-            DocumentsContract.Document.COLUMN_MIME_TYPE,
-            DocumentsContract.Document.COLUMN_FLAGS,
-            DocumentsContract.Document.COLUMN_SIZE,
-        )
-        private val DEFAULT_ROOT_COLUMNS = arrayOf(
-            DocumentsContract.Root.COLUMN_ROOT_ID,
-            DocumentsContract.Root.COLUMN_FLAGS,
-            DocumentsContract.Root.COLUMN_ICON,
-            DocumentsContract.Root.COLUMN_TITLE,
-            DocumentsContract.Root.COLUMN_SUMMARY,
-            DocumentsContract.Root.COLUMN_DOCUMENT_ID
-        )
-    }
-
-    override fun onCreate(): Boolean {
-        return true
-    }
-
-    override fun queryRoots(projection: Array<String>?): Cursor {
-        return MatrixCursor(projection ?: DEFAULT_ROOT_COLUMNS).apply {
-            newRow().apply {
-                add(DocumentsContract.Root.COLUMN_ROOT_ID, DEFAULT_ROOT_ID)
-                add(DocumentsContract.Root.COLUMN_FLAGS, DocumentsContract.Root.FLAG_LOCAL_ONLY)
-                add(DocumentsContract.Root.COLUMN_ICON, R.drawable.ic_service)
-                add(DocumentsContract.Root.COLUMN_TITLE, "FlClash")
-                add(DocumentsContract.Root.COLUMN_SUMMARY, "Data")
-                add(DocumentsContract.Root.COLUMN_DOCUMENT_ID, "/")
-            }
+    override fun queryRoots(projection: Array<String>?): Cursor =
+        MatrixCursor(projection ?: DEFAULT_ROOT_COLUMNS).apply {
+            newRow()
+                .add(DocumentsContract.Root.COLUMN_ROOT_ID, DEFAULT_ROOT_ID)
+                .add(DocumentsContract.Root.COLUMN_FLAGS, DocumentsContract.Root.FLAG_LOCAL_ONLY)
+                .add(DocumentsContract.Root.COLUMN_ICON, R.drawable.ic_service)
+                .add(
+                    DocumentsContract.Root.COLUMN_TITLE,
+                    context?.getString(CommonR.string.app_name).orEmpty(),
+                )
+                .add(DocumentsContract.Root.COLUMN_DOCUMENT_ID, ROOT_DOCUMENT_ID)
         }
-    }
-
 
     override fun queryChildDocuments(
         parentDocumentId: String,
         projection: Array<String>?,
-        sortOrder: String?
+        sortOrder: String?,
     ): Cursor {
-        val result = MatrixCursor(resolveDocumentProjection(projection))
-        val parentFile = if (parentDocumentId == "/") {
-            context?.filesDir
-        } else {
-            File(parentDocumentId)
-        } ?: throw FileNotFoundException("Parent directory not found")
+        val result = MatrixCursor(projection ?: DEFAULT_DOCUMENT_COLUMNS)
+        val parentFile = resolveFile(parentDocumentId)
         parentFile.listFiles()?.forEach { file ->
             includeFile(result, file)
         }
@@ -67,20 +41,18 @@ class FilesProvider : DocumentsProvider() {
     }
 
     override fun queryDocument(documentId: String, projection: Array<String>?): Cursor {
-        val result = MatrixCursor(resolveDocumentProjection(projection))
-        val file = File(documentId)
-        includeFile(result, file)
+        val result = MatrixCursor(projection ?: DEFAULT_DOCUMENT_COLUMNS)
+        includeFile(result, resolveFile(documentId))
         return result
     }
 
     override fun openDocument(
         documentId: String,
         mode: String,
-        signal: CancellationSignal?
+        signal: CancellationSignal?,
     ): ParcelFileDescriptor {
-        val file = File(documentId)
         val accessMode = ParcelFileDescriptor.parseMode(mode)
-        return ParcelFileDescriptor.open(file, accessMode)
+        return ParcelFileDescriptor.open(resolveFile(documentId), accessMode)
     }
 
     private fun includeFile(result: MatrixCursor, file: File) {
@@ -88,23 +60,54 @@ class FilesProvider : DocumentsProvider() {
             add(DocumentsContract.Document.COLUMN_DOCUMENT_ID, file.absolutePath)
             add(DocumentsContract.Document.COLUMN_DISPLAY_NAME, file.name)
             add(DocumentsContract.Document.COLUMN_SIZE, file.length())
-            add(
-                DocumentsContract.Document.COLUMN_FLAGS,
-                DocumentsContract.Document.FLAG_SUPPORTS_WRITE or DocumentsContract.Document.FLAG_SUPPORTS_DELETE
-            )
-            add(DocumentsContract.Document.COLUMN_MIME_TYPE, getDocumentType(file))
+            val flags = if (file.isFile) {
+                DocumentsContract.Document.FLAG_SUPPORTS_WRITE
+            } else {
+                0
+            }
+            val mimeType = if (file.isDirectory) {
+                DocumentsContract.Document.MIME_TYPE_DIR
+            } else {
+                "application/octet-stream"
+            }
+            add(DocumentsContract.Document.COLUMN_FLAGS, flags)
+            add(DocumentsContract.Document.COLUMN_MIME_TYPE, mimeType)
         }
     }
 
-    private fun getDocumentType(file: File): String {
-        return if (file.isDirectory) {
-            DocumentsContract.Document.MIME_TYPE_DIR
-        } else {
-            "application/octet-stream"
+    private fun resolveFile(documentId: String): File {
+        val root = context?.filesDir?.canonicalFile
+            ?: throw FileNotFoundException("App files directory is unavailable")
+        val file = try {
+            if (documentId == ROOT_DOCUMENT_ID) root else File(documentId).canonicalFile
+        } catch (error: IOException) {
+            throw FileNotFoundException(error.message).apply { initCause(error) }
+        }
+        val isInsideRoot = file == root || file.path.startsWith("${root.path}${File.separator}")
+        if (!isInsideRoot) {
+            throw FileNotFoundException("Document is outside the app files directory")
         }
+        return file
     }
 
-    private fun resolveDocumentProjection(projection: Array<String>?): Array<String> {
-        return projection ?: DEFAULT_DOCUMENT_COLUMNS
+    private companion object {
+        const val DEFAULT_ROOT_ID = "0"
+        const val ROOT_DOCUMENT_ID = "/"
+
+        val DEFAULT_DOCUMENT_COLUMNS = arrayOf(
+            DocumentsContract.Document.COLUMN_DOCUMENT_ID,
+            DocumentsContract.Document.COLUMN_DISPLAY_NAME,
+            DocumentsContract.Document.COLUMN_MIME_TYPE,
+            DocumentsContract.Document.COLUMN_FLAGS,
+            DocumentsContract.Document.COLUMN_SIZE,
+        )
+        val DEFAULT_ROOT_COLUMNS = arrayOf(
+            DocumentsContract.Root.COLUMN_ROOT_ID,
+            DocumentsContract.Root.COLUMN_FLAGS,
+            DocumentsContract.Root.COLUMN_ICON,
+            DocumentsContract.Root.COLUMN_TITLE,
+            DocumentsContract.Root.COLUMN_SUMMARY,
+            DocumentsContract.Root.COLUMN_DOCUMENT_ID,
+        )
     }
-}
\ No newline at end of file
+}
diff --git a/android/service/src/main/java/com/follow/clash/service/IBaseService.kt b/android/service/src/main/java/com/follow/clash/service/IBaseService.kt
deleted file mode 100644
index 7206ebf192..0000000000
--- a/android/service/src/main/java/com/follow/clash/service/IBaseService.kt
+++ /dev/null
@@ -1,21 +0,0 @@
-package com.follow.clash.service
-
-import com.follow.clash.common.BroadcastAction
-import com.follow.clash.common.GlobalState
-import com.follow.clash.common.sendBroadcast
-
-interface IBaseService {
-    fun handleCreate() {
-        GlobalState.log("Service create")
-        BroadcastAction.SERVICE_CREATED.sendBroadcast()
-    }
-
-    fun handleDestroy() {
-        GlobalState.log("Service destroy")
-        BroadcastAction.SERVICE_DESTROYED.sendBroadcast()
-    }
-
-    fun start()
-
-    fun stop()
-}
\ No newline at end of file
diff --git a/android/service/src/main/java/com/follow/clash/service/ManagedService.kt b/android/service/src/main/java/com/follow/clash/service/ManagedService.kt
new file mode 100644
index 0000000000..32a5a0e204
--- /dev/null
+++ b/android/service/src/main/java/com/follow/clash/service/ManagedService.kt
@@ -0,0 +1,22 @@
+package com.follow.clash.service
+
+import android.app.Service
+import com.follow.clash.common.BroadcastAction
+import com.follow.clash.common.GlobalState
+import com.follow.clash.common.sendBroadcast
+
+interface ManagedService {
+    fun start()
+
+    fun stop()
+}
+
+internal fun Service.notifyVpnStartRequested() {
+    GlobalState.log("VPN start requested")
+    BroadcastAction.VPN_START_REQUESTED.sendBroadcast()
+}
+
+internal fun Service.notifyVpnRevoked() {
+    GlobalState.log("VPN permission revoked")
+    BroadcastAction.VPN_REVOKED.sendBroadcast()
+}
diff --git a/android/service/src/main/java/com/follow/clash/service/ProxyService.kt b/android/service/src/main/java/com/follow/clash/service/ProxyService.kt
new file mode 100644
index 0000000000..eba9f28d6d
--- /dev/null
+++ b/android/service/src/main/java/com/follow/clash/service/ProxyService.kt
@@ -0,0 +1,52 @@
+package com.follow.clash.service
+
+import android.app.Service
+import android.content.Intent
+import android.os.Binder
+import android.os.IBinder
+import com.follow.clash.core.Core
+import com.follow.clash.service.modules.ServiceModules
+
+class ProxyService : Service(), ManagedService {
+    private val modules = ServiceModules(this)
+    private val binder = LocalBinder()
+
+    override fun onDestroy() {
+        try {
+            cleanup()
+        } finally {
+            super.onDestroy()
+        }
+    }
+
+    override fun onLowMemory() {
+        Core.forceGC()
+        super.onLowMemory()
+    }
+
+    inner class LocalBinder : Binder() {
+        val service: ProxyService
+            get() = this@ProxyService
+    }
+
+    override fun onBind(intent: Intent): IBinder = binder
+
+    override fun start() {
+        try {
+            modules.start()
+        } catch (error: Exception) {
+            stop()
+            throw error
+        }
+    }
+
+    override fun stop() {
+        try {
+            cleanup()
+        } finally {
+            stopSelf()
+        }
+    }
+
+    private fun cleanup() = modules.stop()
+}
diff --git a/android/service/src/main/java/com/follow/clash/service/RemoteService.kt b/android/service/src/main/java/com/follow/clash/service/RemoteService.kt
deleted file mode 100644
index 54e608a713..0000000000
--- a/android/service/src/main/java/com/follow/clash/service/RemoteService.kt
+++ /dev/null
@@ -1,196 +0,0 @@
-package com.follow.clash.service
-
-import android.app.Service
-import android.content.Intent
-import android.os.IBinder
-import com.follow.clash.common.GlobalState
-import com.follow.clash.common.ServiceDelegate
-import com.follow.clash.common.chunkedForAidl
-import com.follow.clash.common.intent
-import com.follow.clash.core.Core
-import com.follow.clash.service.State.delegate
-import com.follow.clash.service.State.intent
-import com.follow.clash.service.State.runLock
-import com.follow.clash.service.models.NotificationParams
-import com.follow.clash.service.models.VpnOptions
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.suspendCancellableCoroutine
-import kotlinx.coroutines.sync.withLock
-import java.util.UUID
-import kotlin.coroutines.resume
-
-class RemoteService : Service(),
-    CoroutineScope by CoroutineScope(SupervisorJob() + Dispatchers.Default) {
-    private fun handleStopService(result: IResultInterface) {
-        launch {
-            runLock.withLock {
-                delegate?.useService { service ->
-                    service.stop()
-                    delegate?.unbind()
-                }
-                State.runTime = 0
-                result.onResult(0)
-            }
-        }
-    }
-
-    private fun handleServiceDisconnected(message: String) {
-        GlobalState.log("Background service disconnected: $message")
-        intent = null
-        delegate = null
-    }
-
-    private fun handleStartService(runTime: Long, result: IResultInterface) {
-        launch {
-            runLock.withLock {
-                val nextIntent = when (State.options?.enable == true) {
-                    true -> VpnService::class.intent
-                    false -> CommonService::class.intent
-                }
-                if (intent != nextIntent) {
-                    delegate?.unbind()
-                    delegate = ServiceDelegate(nextIntent, ::handleServiceDisconnected) { binder ->
-                        when (binder) {
-                            is VpnService.LocalBinder -> binder.getService()
-                            is CommonService.LocalBinder -> binder.getService()
-                            else -> throw IllegalArgumentException("Invalid binder type")
-                        }
-                    }
-                    intent = nextIntent
-                    delegate?.bind()
-                }
-                delegate?.useService { service ->
-                    service.start()
-                }
-                State.runTime = when (runTime != 0L) {
-                    true -> runTime
-                    false -> System.currentTimeMillis()
-                }
-                result.onResult(State.runTime)
-            }
-        }
-    }
-
-    private val binder = object : IRemoteInterface.Stub() {
-        override fun invokeAction(data: String, callback: ICallbackInterface) {
-            Core.invokeAction(data) {
-                launch {
-                    runCatching {
-                        val chunks = it?.chunkedForAidl() ?: listOf()
-                        for ((index, chunk) in chunks.withIndex()) {
-                            suspendCancellableCoroutine { cont ->
-                                callback.onResult(
-                                    chunk,
-                                    index == chunks.lastIndex,
-                                    object : IAckInterface.Stub() {
-                                        override fun onAck() {
-                                            cont.resume(Unit)
-                                        }
-                                    },
-                                )
-                            }
-                        }
-                    }
-                }
-            }
-        }
-
-        override fun quickSetup(
-            initParamsString: String,
-            setupParamsString: String,
-            callback: ICallbackInterface,
-            onStarted: IVoidInterface
-        ) {
-            Core.quickSetup(initParamsString, setupParamsString) {
-                launch {
-                    runCatching {
-                        val chunks = it?.chunkedForAidl() ?: listOf()
-                        for ((index, chunk) in chunks.withIndex()) {
-                            suspendCancellableCoroutine { cont ->
-                                callback.onResult(
-                                    chunk,
-                                    index == chunks.lastIndex,
-                                    object : IAckInterface.Stub() {
-                                        override fun onAck() {
-                                            cont.resume(Unit)
-                                        }
-                                    },
-                                )
-                            }
-                        }
-                    }
-                }
-            }
-            onStarted()
-        }
-
-        override fun updateNotificationParams(params: NotificationParams?) {
-            State.notificationParamsFlow.tryEmit(params)
-        }
-
-
-        override fun startService(
-            options: VpnOptions,
-            runtime: Long,
-            result: IResultInterface,
-        ) {
-            GlobalState.log("remote startService")
-            State.options = options
-            handleStartService(runtime, result)
-        }
-
-        override fun stopService(result: IResultInterface) {
-            handleStopService(result)
-        }
-
-        override fun setEventListener(eventListener: IEventInterface?) {
-            GlobalState.log("RemoveEventListener ${eventListener == null}")
-            when (eventListener != null) {
-                true -> Core.callSetEventListener {
-                    launch {
-                        runCatching {
-                            val id = UUID.randomUUID().toString()
-                            val chunks = it?.chunkedForAidl() ?: listOf()
-                            for ((index, chunk) in chunks.withIndex()) {
-                                suspendCancellableCoroutine { cont ->
-                                    eventListener.onEvent(
-                                        id,
-                                        chunk,
-                                        index == chunks.lastIndex,
-                                        object : IAckInterface.Stub() {
-                                            override fun onAck() {
-                                                cont.resume(Unit)
-                                            }
-                                        },
-                                    )
-                                }
-                            }
-                        }
-                    }
-                }
-
-                false -> Core.callSetEventListener(null)
-            }
-        }
-
-        override fun setCrashlytics(enable: Boolean) {
-            GlobalState.setCrashlytics(enable)
-        }
-
-        override fun getRunTime(): Long {
-            return State.runTime
-        }
-    }
-
-    override fun onBind(intent: Intent?): IBinder {
-        return binder
-    }
-
-    override fun onDestroy() {
-        GlobalState.log("Remote service destroy")
-        super.onDestroy()
-    }
-}
\ No newline at end of file
diff --git a/android/service/src/main/java/com/follow/clash/service/ServiceConfig.kt b/android/service/src/main/java/com/follow/clash/service/ServiceConfig.kt
new file mode 100644
index 0000000000..51095f0d8d
--- /dev/null
+++ b/android/service/src/main/java/com/follow/clash/service/ServiceConfig.kt
@@ -0,0 +1,25 @@
+package com.follow.clash.service
+
+import com.follow.clash.service.models.NotificationParams
+import com.follow.clash.service.models.VpnOptions
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.asStateFlow
+
+object ServiceConfig {
+    @Volatile
+    private var currentVpnOptions: VpnOptions? = null
+    private val mutableNotificationParams = MutableStateFlow(NotificationParams())
+
+    val vpnOptions: VpnOptions?
+        get() = currentVpnOptions
+
+    val notificationParams = mutableNotificationParams.asStateFlow()
+
+    fun updateVpnOptions(options: VpnOptions) {
+        currentVpnOptions = options
+    }
+
+    fun updateNotificationParams(params: NotificationParams) {
+        mutableNotificationParams.value = params
+    }
+}
diff --git a/android/service/src/main/java/com/follow/clash/service/State.kt b/android/service/src/main/java/com/follow/clash/service/State.kt
deleted file mode 100644
index 670626fe20..0000000000
--- a/android/service/src/main/java/com/follow/clash/service/State.kt
+++ /dev/null
@@ -1,22 +0,0 @@
-package com.follow.clash.service
-
-import android.content.Intent
-import com.follow.clash.common.ServiceDelegate
-import com.follow.clash.service.models.NotificationParams
-import com.follow.clash.service.models.VpnOptions
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.sync.Mutex
-
-object State {
-    var options: VpnOptions? = null
-    var notificationParamsFlow: MutableStateFlow<NotificationParams?> = MutableStateFlow(
-        NotificationParams()
-    )
-
-    val runLock = Mutex()
-    var runTime: Long = 0L
-
-    var delegate: ServiceDelegate<IBaseService>? = null
-
-    var intent: Intent? = null
-}
\ No newline at end of file
diff --git a/android/service/src/main/java/com/follow/clash/service/VpnService.kt b/android/service/src/main/java/com/follow/clash/service/VpnService.kt
index f576702761..c88f6d0e76 100644
--- a/android/service/src/main/java/com/follow/clash/service/VpnService.kt
+++ b/android/service/src/main/java/com/follow/clash/service/VpnService.kt
@@ -6,52 +6,40 @@ import android.net.ProxyInfo
 import android.os.Binder
 import android.os.Build
 import android.os.IBinder
-import android.os.Parcel
-import android.os.RemoteException
 import android.util.Log
 import androidx.core.content.getSystemService
 import com.follow.clash.common.AccessControlMode
 import com.follow.clash.common.GlobalState
+import com.follow.clash.common.R as CommonR
 import com.follow.clash.core.Core
+import com.follow.clash.service.models.CIDR
 import com.follow.clash.service.models.VpnOptions
 import com.follow.clash.service.models.getIpv4RouteAddress
 import com.follow.clash.service.models.getIpv6RouteAddress
 import com.follow.clash.service.models.toCIDR
-import com.follow.clash.service.modules.NetworkObserveModule
-import com.follow.clash.service.modules.NotificationModule
-import com.follow.clash.service.modules.SuspendModule
-import com.follow.clash.service.modules.moduleLoader
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
+import com.follow.clash.service.modules.ServiceModules
 import java.net.InetSocketAddress
+import java.util.concurrent.ConcurrentHashMap
 import android.net.VpnService as SystemVpnService
 
-class VpnService : SystemVpnService(), IBaseService,
-    CoroutineScope by CoroutineScope(Dispatchers.Default) {
-
-    private val self: VpnService
-        get() = this
-
-    private val loader = moduleLoader {
-        install(NetworkObserveModule(self))
-        install(NotificationModule(self))
-        install(SuspendModule(self))
-    }
-
-    override fun onCreate() {
-        super.onCreate()
-        handleCreate()
-    }
+class VpnService : SystemVpnService(), ManagedService {
+    private val modules = ServiceModules(this)
+    private val binder = LocalBinder()
+    private val tunLock = Any()
+    private var tunRunning = false
 
     override fun onDestroy() {
-        handleDestroy()
-        super.onDestroy()
+        try {
+            cleanup()
+        } finally {
+            super.onDestroy()
+        }
     }
 
     private val connectivity by lazy {
         getSystemService<ConnectivityManager>()
     }
-    private val uidPageNameMap = mutableMapOf<Int, String>()
+    private val uidPackageNameMap = ConcurrentHashMap<Int, String>()
 
     private fun resolverProcess(
         protocol: Int,
@@ -67,13 +55,15 @@ class VpnService : SystemVpnService(), IBaseService,
         if (nextUid == -1) {
             return ""
         }
-        if (!uidPageNameMap.containsKey(nextUid)) {
-            uidPageNameMap[nextUid] = this.packageManager?.getPackagesForUid(nextUid)?.first() ?: ""
+        return uidPackageNameMap.getOrPut(nextUid) {
+            packageManager
+                .getPackagesForUid(nextUid)
+                ?.firstOrNull()
+                .orEmpty()
         }
-        return uidPageNameMap[nextUid] ?: ""
     }
 
-    val VpnOptions.address
+    private val VpnOptions.tunAddress
         get(): String = buildString {
             append(IPV4_ADDRESS)
             if (ipv6) {
@@ -82,7 +72,7 @@ class VpnService : SystemVpnService(), IBaseService,
             }
         }
 
-    val VpnOptions.dns
+    private val VpnOptions.tunDns
         get(): String {
             if (dnsHijacking) {
                 return NET_ANY
@@ -96,158 +86,180 @@ class VpnService : SystemVpnService(), IBaseService,
             }
         }
 
-
     override fun onLowMemory() {
         Core.forceGC()
         super.onLowMemory()
     }
 
-    private val binder = LocalBinder()
-
     inner class LocalBinder : Binder() {
-        fun getService(): VpnService = this@VpnService
+        val service: VpnService
+            get() = this@VpnService
+    }
 
-        override fun onTransact(code: Int, data: Parcel, reply: Parcel?, flags: Int): Boolean {
-            try {
-                val isSuccess = super.onTransact(code, data, reply, flags)
-                if (!isSuccess) {
-                    GlobalState.log("VpnService disconnected")
-                    handleDestroy()
-                }
-                return isSuccess
-            } catch (e: RemoteException) {
-                GlobalState.log("VpnService onTransact $e")
-                return false
-            }
+    override fun onBind(intent: Intent): IBinder? =
+        if (intent.action == SystemVpnService.SERVICE_INTERFACE) {
+            super.onBind(intent)
+        } else {
+            binder
         }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        // Android starts always-on VPN through this callback instead of FlClash's bound-service
+        // path. Notify the app layer so it can restore Core and fully initialize the VPN service.
+        notifyVpnStartRequested()
+        return super.onStartCommand(intent, flags, startId)
     }
 
-    override fun onBind(intent: Intent): IBinder {
-        return binder
+    override fun onRevoke() {
+        stop()
+        notifyVpnRevoked()
     }
 
     private fun handleStart(options: VpnOptions) {
         val fd = with(Builder()) {
-            val cidr = IPV4_ADDRESS.toCIDR()
-            addAddress(cidr.address, cidr.prefixLength)
-            Log.d(
-                "addAddress", "address: ${cidr.address} prefixLength:${cidr.prefixLength}"
-            )
-            val routeAddress = options.getIpv4RouteAddress()
-            if (routeAddress.isNotEmpty()) {
-                try {
-                    routeAddress.forEach { i ->
-                        Log.d(
-                            "addRoute4", "address: ${i.address} prefixLength:${i.prefixLength}"
-                        )
-                        addRoute(i.address, i.prefixLength)
-                    }
-                } catch (_: Exception) {
-                    addRoute(NET_ANY, 0)
-                }
-            } else {
-                addRoute(NET_ANY, 0)
-            }
-            if (options.ipv6) {
-                try {
-                    val cidr = IPV6_ADDRESS.toCIDR()
-                    Log.d(
-                        "addAddress6", "address: ${cidr.address} prefixLength:${cidr.prefixLength}"
-                    )
-                    addAddress(cidr.address, cidr.prefixLength)
-                } catch (_: Exception) {
-                    Log.d(
-                        "addAddress6", "IPv6 is not supported."
-                    )
-                }
-
-                try {
-                    val routeAddress = options.getIpv6RouteAddress()
-                    if (routeAddress.isNotEmpty()) {
-                        try {
-                            routeAddress.forEach { i ->
-                                Log.d(
-                                    "addRoute6",
-                                    "address: ${i.address} prefixLength:${i.prefixLength}"
-                                )
-                                addRoute(i.address, i.prefixLength)
-                            }
-                        } catch (_: Exception) {
-                            addRoute("::", 0)
-                        }
-                    } else {
-                        addRoute(NET_ANY6, 0)
-                    }
-                } catch (_: Exception) {
-                    addRoute(NET_ANY6, 0)
-                }
-            }
-            addDnsServer(DNS)
-            if (options.ipv6) {
-                addDnsServer(DNS6)
-            }
-            setMtu(9000)
-            options.accessControlProps.let { accessControl ->
-                if (accessControl.enable) {
-                    when (accessControl.mode) {
-                        AccessControlMode.ACCEPT_SELECTED -> {
-                            (accessControl.acceptList + packageName).forEach {
-                                addAllowedApplication(it)
-                            }
-                        }
-
-                        AccessControlMode.REJECT_SELECTED -> {
-                            (accessControl.rejectList - packageName).forEach {
-                                addDisallowedApplication(it)
-                            }
-                        }
-                    }
-                }
-            }
-            setSession("FlClash")
+            addAddressAndRoutes(options)
+            addDnsServers(options)
+            setMtu(MTU)
+            configureAccessControl(options)
+            setSession(getString(CommonR.string.app_name))
             setBlocking(false)
-            if (Build.VERSION.SDK_INT >= 29) {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
                 setMetered(false)
             }
             if (options.allowBypass) {
                 allowBypass()
             }
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q && options.systemProxy) {
-                GlobalState.log("Open http proxy")
+                GlobalState.log("Enable VPN HTTP proxy")
                 setHttpProxy(
                     ProxyInfo.buildDirectProxy(
-                        "127.0.0.1", options.port, options.bypassDomain
-                    )
+                        LOCAL_HOST,
+                        options.port,
+                        options.bypassDomain,
+                    ),
                 )
             }
             establish()?.detachFd()
-                ?: throw NullPointerException("Establish VPN rejected by system")
+                ?: error("VPN establishment was rejected by the system")
+        }
+        synchronized(tunLock) {
+            tunRunning = true
+            try {
+                Core.startTun(
+                    fd = fd,
+                    protect = this::protect,
+                    resolverProcess = this::resolverProcess,
+                    stack = options.stack,
+                    address = options.tunAddress,
+                    dns = options.tunDns,
+                )
+            } catch (error: Exception) {
+                stopTunLocked()
+                throw error
+            }
         }
-        Core.startTun(
-            fd,
-            protect = this::protect,
-            resolverProcess = this::resolverProcess,
-            options.stack,
-            options.address,
-            options.dns
+    }
+
+    private fun Builder.addAddressAndRoutes(options: VpnOptions) {
+        val ipv4Address = IPV4_ADDRESS.toCIDR()
+        addAddress(ipv4Address.address, ipv4Address.prefixLength)
+        addRoutes(
+            routes = options::getIpv4RouteAddress,
+            fallbackAddress = NET_ANY,
+            logTag = "addRoute4",
         )
+
+        if (options.ipv6) {
+            try {
+                val ipv6Address = IPV6_ADDRESS.toCIDR()
+                addAddress(ipv6Address.address, ipv6Address.prefixLength)
+            } catch (_: Exception) {
+                GlobalState.log("IPv6 VPN address is not supported")
+            }
+            addRoutes(
+                routes = options::getIpv6RouteAddress,
+                fallbackAddress = NET_ANY6,
+                logTag = "addRoute6",
+            )
+        }
     }
 
-    override fun start() {
+    private fun Builder.addRoutes(
+        routes: () -> List<CIDR>,
+        fallbackAddress: String,
+        logTag: String,
+    ) {
+        val routeList = runCatching(routes).getOrDefault(emptyList())
+        if (routeList.isEmpty()) {
+            addRoute(fallbackAddress, 0)
+            return
+        }
         try {
-            loader.load()
-            State.options?.let {
-                handleStart(it)
+            routeList.forEach { route ->
+                Log.d(logTag, "address: ${route.address} prefixLength: ${route.prefixLength}")
+                addRoute(route.address, route.prefixLength)
             }
         } catch (_: Exception) {
+            addRoute(fallbackAddress, 0)
+        }
+    }
+
+    private fun Builder.addDnsServers(options: VpnOptions) {
+        addDnsServer(DNS)
+        if (options.ipv6) {
+            addDnsServer(DNS6)
+        }
+    }
+
+    private fun Builder.configureAccessControl(options: VpnOptions) {
+        val accessControl = options.accessControlProps
+        if (!accessControl.enable) return
+        when (accessControl.mode) {
+            AccessControlMode.ACCEPT_SELECTED -> {
+                (accessControl.acceptList + packageName).forEach(::addAllowedApplication)
+            }
+
+            AccessControlMode.REJECT_SELECTED -> {
+                (accessControl.rejectList - packageName).forEach(::addDisallowedApplication)
+            }
+        }
+    }
+
+    override fun start() {
+        try {
+            modules.start()
+            handleStart(requireNotNull(ServiceConfig.vpnOptions) { "VPN options are missing" })
+        } catch (error: Exception) {
             stop()
+            throw error
         }
     }
 
     override fun stop() {
-        loader.cancel()
-        Core.stopTun()
-        stopSelf()
+        try {
+            cleanup()
+        } finally {
+            stopSelf()
+        }
+    }
+
+    private fun cleanup() {
+        try {
+            modules.stop()
+        } finally {
+            stopTun()
+        }
+    }
+
+    private fun stopTun() = synchronized(tunLock) {
+        stopTunLocked()
+    }
+
+    private fun stopTunLocked() {
+        if (tunRunning) {
+            Core.stopTun()
+            tunRunning = false
+        }
     }
 
     companion object {
@@ -257,5 +269,7 @@ class VpnService : SystemVpnService(), IBaseService,
         private const val DNS6 = "fdfe:dcba:9876::2"
         private const val NET_ANY = "0.0.0.0"
         private const val NET_ANY6 = "::"
+        private const val LOCAL_HOST = "127.0.0.1"
+        private const val MTU = 9000
     }
-}
\ No newline at end of file
+}
diff --git a/android/service/src/main/java/com/follow/clash/service/models/NotificationParams.kt b/android/service/src/main/java/com/follow/clash/service/models/NotificationParams.kt
index dc18eeb4ad..c72ca69872 100644
--- a/android/service/src/main/java/com/follow/clash/service/models/NotificationParams.kt
+++ b/android/service/src/main/java/com/follow/clash/service/models/NotificationParams.kt
@@ -1,36 +1,7 @@
 package com.follow.clash.service.models
 
-import android.os.Parcel
-import android.os.Parcelable
-
 data class NotificationParams(
     val title: String = "FlClash",
     val stopText: String = "STOP",
     val onlyStatisticsProxy: Boolean = false,
-) : Parcelable {
-    constructor(parcel: Parcel) : this(
-        title = parcel.readString() ?: "FlClash",
-        stopText = parcel.readString() ?: "STOP",
-        onlyStatisticsProxy = parcel.readByte() != 0.toByte(),
-    )
-
-    override fun writeToParcel(parcel: Parcel, flags: Int) {
-        parcel.writeString(title)
-        parcel.writeString(stopText)
-        parcel.writeByte(if (onlyStatisticsProxy) 1.toByte() else 0.toByte())
-    }
-
-    override fun describeContents(): Int {
-        return 0
-    }
-
-    companion object CREATOR : Parcelable.Creator<NotificationParams> {
-        override fun createFromParcel(parcel: Parcel): NotificationParams {
-            return NotificationParams(parcel)
-        }
-
-        override fun newArray(size: Int): Array<NotificationParams?> {
-            return arrayOfNulls(size)
-        }
-    }
-}
+)
diff --git a/android/service/src/main/java/com/follow/clash/service/models/Traffic.kt b/android/service/src/main/java/com/follow/clash/service/models/Traffic.kt
index a12c00d46c..cb5130dc31 100644
--- a/android/service/src/main/java/com/follow/clash/service/models/Traffic.kt
+++ b/android/service/src/main/java/com/follow/clash/service/models/Traffic.kt
@@ -1,25 +1,39 @@
 package com.follow.clash.service.models
 
 import com.follow.clash.common.GlobalState
-import com.follow.clash.common.formatBytes
 import com.follow.clash.core.Core
 import com.google.gson.Gson
 
+private val gson = Gson()
+
 data class Traffic(
     val up: Long,
     val down: Long,
 )
 
+private val Long.formatBytes: String
+    get() {
+        val units = arrayOf("B", "KB", "MB", "GB", "TB")
+        var value = toDouble()
+        var unit = 0
+        while (value >= 1024 && unit < units.lastIndex) {
+            value /= 1024
+            unit++
+        }
+        return if (unit == 0) {
+            "${value.toLong()}${units[unit]}"
+        } else {
+            "%.1f${units[unit]}".format(value)
+        }
+    }
+
 val Traffic.speedText: String
     get() = "${up.formatBytes}/s↑  ${down.formatBytes}/s↓"
 
 fun Core.getSpeedTrafficText(onlyStatisticsProxy: Boolean): String {
-    try {
-        val res = getTraffic(onlyStatisticsProxy)
-        val traffic = Gson().fromJson(res, Traffic::class.java)
-        return traffic.speedText
-    } catch (e: Exception) {
-        GlobalState.log(e.message + "")
-        return ""
-    }
-}
\ No newline at end of file
+    return runCatching {
+        gson.fromJson(getTraffic(onlyStatisticsProxy), Traffic::class.java).speedText
+    }.onFailure { error ->
+        GlobalState.log("Unable to read traffic: $error")
+    }.getOrDefault("")
+}
diff --git a/android/service/src/main/java/com/follow/clash/service/models/VpnOptions.kt b/android/service/src/main/java/com/follow/clash/service/models/VpnOptions.kt
index 27264aa0cb..3cf475201c 100644
--- a/android/service/src/main/java/com/follow/clash/service/models/VpnOptions.kt
+++ b/android/service/src/main/java/com/follow/clash/service/models/VpnOptions.kt
@@ -1,8 +1,8 @@
 package com.follow.clash.service.models
 
-import android.os.Parcel
-import android.os.Parcelable
 import com.follow.clash.common.AccessControlMode
+import java.net.Inet4Address
+import java.net.Inet6Address
 import java.net.InetAddress
 
 data class AccessControlProps(
@@ -10,35 +10,7 @@ data class AccessControlProps(
     val mode: AccessControlMode,
     val acceptList: List<String>,
     val rejectList: List<String>,
-) : Parcelable {
-    constructor(parcel: Parcel) : this(
-        enable = parcel.readByte() != 0.toByte(),
-        mode = AccessControlMode.valueOf(parcel.readString() ?: AccessControlMode.ACCEPT_SELECTED.name),
-        acceptList = parcel.createStringArrayList() ?: emptyList(),
-        rejectList = parcel.createStringArrayList() ?: emptyList(),
-    )
-
-    override fun writeToParcel(parcel: Parcel, flags: Int) {
-        parcel.writeByte(if (enable) 1.toByte() else 0.toByte())
-        parcel.writeString(mode.name)
-        parcel.writeStringList(acceptList)
-        parcel.writeStringList(rejectList)
-    }
-
-    override fun describeContents(): Int {
-        return 0
-    }
-
-    companion object CREATOR : Parcelable.Creator<AccessControlProps> {
-        override fun createFromParcel(parcel: Parcel): AccessControlProps {
-            return AccessControlProps(parcel)
-        }
-
-        override fun newArray(size: Int): Array<AccessControlProps?> {
-            return arrayOfNulls(size)
-        }
-    }
-}
+)
 
 data class VpnOptions(
     val enable: Boolean,
@@ -51,110 +23,32 @@ data class VpnOptions(
     val bypassDomain: List<String>,
     val stack: String,
     val routeAddress: List<String>,
-) : Parcelable {
-    constructor(parcel: Parcel) : this(
-        enable = parcel.readByte() != 0.toByte(),
-        port = parcel.readInt(),
-        ipv6 = parcel.readByte() != 0.toByte(),
-        dnsHijacking = parcel.readByte() != 0.toByte(),
-        accessControlProps = readAccessControlProps(parcel),
-        allowBypass = parcel.readByte() != 0.toByte(),
-        systemProxy = parcel.readByte() != 0.toByte(),
-        bypassDomain = parcel.createStringArrayList() ?: emptyList(),
-        stack = parcel.readString() ?: "",
-        routeAddress = parcel.createStringArrayList() ?: emptyList(),
-    )
+)
 
-    override fun writeToParcel(parcel: Parcel, flags: Int) {
-        parcel.writeByte(if (enable) 1.toByte() else 0.toByte())
-        parcel.writeInt(port)
-        parcel.writeByte(if (ipv6) 1.toByte() else 0.toByte())
-        parcel.writeByte(if (dnsHijacking) 1.toByte() else 0.toByte())
-        parcel.writeParcelable(accessControlProps, flags)
-        parcel.writeByte(if (allowBypass) 1.toByte() else 0.toByte())
-        parcel.writeByte(if (systemProxy) 1.toByte() else 0.toByte())
-        parcel.writeStringList(bypassDomain)
-        parcel.writeString(stack)
-        parcel.writeStringList(routeAddress)
-    }
-
-    override fun describeContents(): Int {
-        return 0
-    }
-
-    companion object CREATOR : Parcelable.Creator<VpnOptions> {
-        @Suppress("DEPRECATION")
-        private fun readAccessControlProps(parcel: Parcel): AccessControlProps {
-            return parcel.readParcelable<AccessControlProps>(
-                AccessControlProps::class.java.classLoader,
-            ) ?: AccessControlProps(
-                enable = false,
-                mode = AccessControlMode.ACCEPT_SELECTED,
-                acceptList = emptyList(),
-                rejectList = emptyList(),
-            )
-        }
+data class CIDR(
+    val address: InetAddress,
+    val prefixLength: Int,
+)
 
-        override fun createFromParcel(parcel: Parcel): VpnOptions {
-            return VpnOptions(parcel)
-        }
+fun VpnOptions.getIpv4RouteAddress(): List<CIDR> = routeAddress
+    .map(String::toCIDR)
+    .filter { it.address is Inet4Address }
 
-        override fun newArray(size: Int): Array<VpnOptions?> {
-            return arrayOfNulls(size)
-        }
-    }
-}
-
-data class CIDR(val address: InetAddress, val prefixLength: Int)
-
-fun VpnOptions.getIpv4RouteAddress(): List<CIDR> {
-    return routeAddress.filter {
-        it.isIpv4()
-    }.map {
-        it.toCIDR()
-    }
-}
-
-fun VpnOptions.getIpv6RouteAddress(): List<CIDR> {
-    return routeAddress.filter {
-        it.isIpv6()
-    }.map {
-        it.toCIDR()
-    }
-}
-
-fun String.isIpv4(): Boolean {
-    val parts = split("/")
-    if (parts.size != 2) {
-        throw IllegalArgumentException("Invalid CIDR format")
-    }
-    val address = InetAddress.getByName(parts[0])
-    return address.address.size == 4
-}
-
-fun String.isIpv6(): Boolean {
-    val parts = split("/")
-    if (parts.size != 2) {
-        throw IllegalArgumentException("Invalid CIDR format")
-    }
-    val address = InetAddress.getByName(parts[0])
-    return address.address.size == 16
-}
+fun VpnOptions.getIpv6RouteAddress(): List<CIDR> = routeAddress
+    .map(String::toCIDR)
+    .filter { it.address is Inet6Address }
 
 fun String.toCIDR(): CIDR {
     val parts = split("/")
-    if (parts.size != 2) {
-        throw IllegalArgumentException("Invalid CIDR format")
-    }
+    require(parts.size == 2) { "Invalid CIDR format: $this" }
     val ipAddress = parts[0]
-    val prefixLength =
-        parts[1].toIntOrNull() ?: throw IllegalArgumentException("Invalid prefix length")
+    val prefixLength = parts[1].toIntOrNull()
+        ?: throw IllegalArgumentException("Invalid prefix length: ${parts[1]}")
 
     val address = InetAddress.getByName(ipAddress)
-
     val maxPrefix = if (address.address.size == 4) 32 else 128
-    if (prefixLength < 0 || prefixLength > maxPrefix) {
-        throw IllegalArgumentException("Invalid prefix length for IP version")
+    require(prefixLength in 0..maxPrefix) {
+        "Invalid prefix length $prefixLength for $ipAddress"
     }
 
     return CIDR(address, prefixLength)
diff --git a/android/service/src/main/java/com/follow/clash/service/modules/Module.kt b/android/service/src/main/java/com/follow/clash/service/modules/Module.kt
deleted file mode 100644
index f2fb9cdffa..0000000000
--- a/android/service/src/main/java/com/follow/clash/service/modules/Module.kt
+++ /dev/null
@@ -1,19 +0,0 @@
-package com.follow.clash.service.modules
-
-abstract class Module {
-
-    private var isInstall: Boolean = false
-
-    protected abstract fun onInstall()
-    protected abstract fun onUninstall()
-
-    fun install() {
-        isInstall = true
-        onInstall()
-    }
-
-    fun uninstall() {
-        onUninstall()
-        isInstall = false
-    }
-}
\ No newline at end of file
diff --git a/android/service/src/main/java/com/follow/clash/service/modules/ModuleLoader.kt b/android/service/src/main/java/com/follow/clash/service/modules/ModuleLoader.kt
deleted file mode 100644
index d11215ca90..0000000000
--- a/android/service/src/main/java/com/follow/clash/service/modules/ModuleLoader.kt
+++ /dev/null
@@ -1,51 +0,0 @@
-package com.follow.clash.service.modules
-
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.Job
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.sync.Mutex
-import kotlinx.coroutines.sync.withLock
-
-interface ModuleLoaderScope {
-    fun <T : Module> install(module: T): T
-}
-
-interface ModuleLoader {
-    fun load()
-
-    fun cancel()
-}
-
-private val mutex = Mutex()
-fun CoroutineScope.moduleLoader(block: suspend ModuleLoaderScope.() -> Unit): ModuleLoader {
-    val modules = mutableListOf<Module>()
-    var job: Job? = null
-
-    return object : ModuleLoader {
-        override fun load() {
-            job = launch(Dispatchers.IO) {
-                mutex.withLock {
-                    val scope = object : ModuleLoaderScope {
-                        override fun <T : Module> install(module: T): T {
-                            modules.add(module)
-                            module.install()
-                            return module
-                        }
-                    }
-                    scope.block()
-                }
-            }
-        }
-
-        override fun cancel() {
-            launch(Dispatchers.IO) {
-                job?.cancel()
-                mutex.withLock {
-                    modules.asReversed().forEach { it.uninstall() }
-                    modules.clear()
-                }
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/android/service/src/main/java/com/follow/clash/service/modules/NetworkObserveModule.kt b/android/service/src/main/java/com/follow/clash/service/modules/NetworkObserveModule.kt
index 94e4f37a4a..153ea6ebe6 100644
--- a/android/service/src/main/java/com/follow/clash/service/modules/NetworkObserveModule.kt
+++ b/android/service/src/main/java/com/follow/clash/service/modules/NetworkObserveModule.kt
@@ -17,18 +17,20 @@ import java.net.InetAddress
 import java.util.concurrent.ConcurrentHashMap
 
 private data class NetworkInfo(
-    @Volatile var losingMs: Long = 0, @Volatile var dnsList: List<InetAddress> = emptyList()
+    @Volatile var losingUntilMillis: Long = 0,
+    @Volatile var dnsList: List<InetAddress> = emptyList(),
 ) {
-    fun isAvailable(): Boolean = losingMs < System.currentTimeMillis()
+    val priorityPenalty: Int
+        get() = if (losingUntilMillis > System.currentTimeMillis()) 10 else 0
 }
 
-class NetworkObserveModule(private val service: Service) : Module() {
+internal class NetworkObserveModule(private val service: Service) : ServiceModule {
 
     private val networkInfos = ConcurrentHashMap<Network, NetworkInfo>()
     private val connectivity by lazy {
         service.getSystemService<ConnectivityManager>()
     }
-    private var preDnsList = listOf<String>()
+    private var currentDnsList = listOf<String>()
 
     private val request = NetworkRequest.Builder().apply {
         addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
@@ -42,108 +44,79 @@ class NetworkObserveModule(private val service: Service) : Module() {
     private val callback = object : ConnectivityManager.NetworkCallback() {
         override fun onAvailable(network: Network) {
             networkInfos[network] = NetworkInfo()
-            onUpdateNetwork()
-            super.onAvailable(network)
+            updateDns()
         }
 
         override fun onLosing(network: Network, maxMsToLive: Int) {
-            networkInfos[network]?.losingMs = System.currentTimeMillis() + maxMsToLive
-            onUpdateNetwork()
-            setUnderlyingNetworks(network)
-            super.onLosing(network, maxMsToLive)
+            networkInfos[network]?.losingUntilMillis = System.currentTimeMillis() + maxMsToLive
+            updateDns()
         }
 
         override fun onLost(network: Network) {
             networkInfos.remove(network)
-            onUpdateNetwork()
-            setUnderlyingNetworks(network)
-            super.onLost(network)
+            updateDns()
         }
 
         override fun onLinkPropertiesChanged(network: Network, linkProperties: LinkProperties) {
             networkInfos[network]?.dnsList = linkProperties.dnsServers
-            onUpdateNetwork()
-            setUnderlyingNetworks(network)
-            super.onLinkPropertiesChanged(network, linkProperties)
+            updateDns()
         }
     }
 
-
-    override fun onInstall() {
-        onUpdateNetwork()
+    override fun start() {
+        updateDns()
         connectivity?.registerNetworkCallback(request, callback)
     }
 
-    private fun networkToInt(entry: Map.Entry<Network, NetworkInfo>): Int {
+    private fun networkPriority(entry: Map.Entry<Network, NetworkInfo>): Int {
         val capabilities = connectivity?.getNetworkCapabilities(entry.key)
         return when {
             capabilities == null -> 100
             capabilities.hasTransport(NetworkCapabilities.TRANSPORT_VPN) -> 90
             capabilities.hasTransport(NetworkCapabilities.TRANSPORT_WIFI) -> 0
             capabilities.hasTransport(NetworkCapabilities.TRANSPORT_ETHERNET) -> 1
-            Build.VERSION.SDK_INT >= Build.VERSION_CODES.S && capabilities.hasTransport(
-                TRANSPORT_USB
-            ) -> 2
+            Build.VERSION.SDK_INT >= Build.VERSION_CODES.S &&
+                capabilities.hasTransport(TRANSPORT_USB) -> 2
 
             capabilities.hasTransport(NetworkCapabilities.TRANSPORT_BLUETOOTH) -> 3
             capabilities.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR) -> 4
-            Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM && capabilities.hasTransport(
-                TRANSPORT_SATELLITE
-            ) -> 5
+            Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM &&
+                capabilities.hasTransport(TRANSPORT_SATELLITE) -> 5
 
             else -> 20
-        } + (if (entry.value.isAvailable()) 0 else 10)
+        } + entry.value.priorityPenalty
     }
 
-    fun onUpdateNetwork() {
-        val dnsList = (networkInfos.asSequence().minByOrNull { networkToInt(it) }?.value?.dnsList
-            ?: emptyList()).map { x -> x.asSocketAddressText(53) }
-        if (dnsList == preDnsList) {
+    @Synchronized
+    private fun updateDns() {
+        val dnsList = networkInfos.asSequence()
+            .minByOrNull(::networkPriority)
+            ?.value
+            ?.dnsList
+            .orEmpty()
+            .map { address -> address.asSocketAddressText(DNS_PORT) }
+            .distinct()
+        if (dnsList == currentDnsList) {
             return
         }
-        preDnsList = dnsList
-        Core.updateDNS(dnsList.toSet().joinToString(","))
-    }
-
-    fun setUnderlyingNetworks(network: Network) {
-//        if (service is VpnService && Build.VERSION.SDK_INT in 22..28) {
-//            service.setUnderlyingNetworks(arrayOf(network))
-//        }
+        currentDnsList = dnsList
+        Core.updateDNS(dnsList.joinToString(","))
     }
 
-    override fun onUninstall() {
-        connectivity?.unregisterNetworkCallback(callback)
-        networkInfos.clear()
-        onUpdateNetwork()
+    override fun stop() {
+        try {
+            connectivity?.unregisterNetworkCallback(callback)
+        } finally {
+            networkInfos.clear()
+            updateDns()
+        }
     }
 }
 
-fun InetAddress.asSocketAddressText(port: Int): String {
-    return when (this) {
-        is Inet6Address -> "[${numericToTextFormat(this)}]:$port"
-
-        is Inet4Address -> "${this.hostAddress}:$port"
+private const val DNS_PORT = 53
 
-        else -> throw IllegalArgumentException("Unsupported Inet type ${this.javaClass}")
-    }
+private fun InetAddress.asSocketAddressText(port: Int): String = when (this) {
+    is Inet6Address -> "[$hostAddress]:$port"
+    is Inet4Address -> "$hostAddress:$port"
+    else -> error("Unsupported address type: ${javaClass.name}")
 }
-
-private fun numericToTextFormat(address: Inet6Address): String {
-    val src = address.address
-    val sb = StringBuilder(39)
-    for (i in 0 until 8) {
-        sb.append(
-            Integer.toHexString(
-                src[i shl 1].toInt() shl 8 and 0xff00 or (src[(i shl 1) + 1].toInt() and 0xff)
-            )
-        )
-        if (i < 7) {
-            sb.append(":")
-        }
-    }
-    if (address.scopeId > 0) {
-        sb.append("%")
-        sb.append(address.scopeId)
-    }
-    return sb.toString()
-}
\ No newline at end of file
diff --git a/android/service/src/main/java/com/follow/clash/service/modules/NotificationModule.kt b/android/service/src/main/java/com/follow/clash/service/modules/NotificationModule.kt
index d68cb3abb0..045927a8f3 100644
--- a/android/service/src/main/java/com/follow/clash/service/modules/NotificationModule.kt
+++ b/android/service/src/main/java/com/follow/clash/service/modules/NotificationModule.kt
@@ -14,39 +14,41 @@ import com.follow.clash.common.QuickAction
 import com.follow.clash.common.quickIntent
 import com.follow.clash.common.receiveBroadcastFlow
 import com.follow.clash.common.startForeground
-import com.follow.clash.common.tickerFlow
 import com.follow.clash.common.toPendingIntent
 import com.follow.clash.core.Core
 import com.follow.clash.service.R
-import com.follow.clash.service.State
+import com.follow.clash.service.ServiceConfig
 import com.follow.clash.service.models.NotificationParams
 import com.follow.clash.service.models.getSpeedTrafficText
 import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.combine
 import kotlinx.coroutines.flow.distinctUntilChanged
-import kotlinx.coroutines.flow.filter
+import kotlinx.coroutines.flow.filterNotNull
+import kotlinx.coroutines.flow.flow
 import kotlinx.coroutines.flow.map
 import kotlinx.coroutines.flow.onStart
 import kotlinx.coroutines.launch
 
-data class ExtendedNotificationParams(
+private data class ExtendedNotificationParams(
     val title: String,
     val stopText: String,
-    val onlyStatisticsProxy: Boolean,
     val contentText: String,
 )
 
-val NotificationParams.extended: ExtendedNotificationParams
+private val NotificationParams.extended: ExtendedNotificationParams
     get() = ExtendedNotificationParams(
-        title, stopText, onlyStatisticsProxy, Core.getSpeedTrafficText(onlyStatisticsProxy)
+        title,
+        stopText,
+        Core.getSpeedTrafficText(onlyStatisticsProxy),
     )
 
-class NotificationModule(private val service: Service) : Module() {
-    private val scope = CoroutineScope(Dispatchers.Default)
-
-    override fun onInstall() {
+internal class NotificationModule(
+    private val service: Service,
+    private val scope: CoroutineScope,
+) : ServiceModule {
+    override fun start() {
+        update(ServiceConfig.notificationParams.value.extended)
         scope.launch {
             val screenFlow = service.receiveBroadcastFlow {
                 addAction(Intent.ACTION_SCREEN_ON)
@@ -58,41 +60,36 @@ class NotificationModule(private val service: Service) : Module() {
             }
 
             combine(
-                tickerFlow(1000, 0), State.notificationParamsFlow, screenFlow
+                flow {
+                    while (true) {
+                        delay(1_000)
+                        emit(Unit)
+                    }
+                },
+                ServiceConfig.notificationParams,
+                screenFlow,
             ) { _, params, screenOn ->
-                params?.extended to screenOn
-            }.filter { (params, screenOn) -> params != null && screenOn }
-                .distinctUntilChanged { old, new -> old.first == new.first && old.second == new.second }
-                .collect { (params, _) ->
-                    update(params!!)
-                }
-
-            State.notificationParamsFlow.value?.let {
-                update(it.extended)
-            } ?: run {
-                update(NotificationParams().extended)
-            }
+                params.takeIf { screenOn }?.extended
+            }.filterNotNull()
+                .distinctUntilChanged()
+                .collect(::update)
         }
     }
 
-    private fun isScreenOn(): Boolean {
-        val pm = service.getSystemService<PowerManager>()
-        return when (pm != null) {
-            true -> pm.isInteractive
-            false -> true
-        }
-    }
+    private fun isScreenOn() =
+        service.getSystemService<PowerManager>()?.isInteractive ?: true
 
     private val notificationBuilder: NotificationCompat.Builder by lazy {
-        val intent = Intent().setComponent(Components.MAIN_ACTIVITY)
+        val intent = Intent().setComponent(Components.mainActivity)
 
         NotificationCompat.Builder(
-            service, GlobalState.NOTIFICATION_CHANNEL
+            service,
+            GlobalState.NOTIFICATION_CHANNEL,
         ).apply {
             setSmallIcon(R.drawable.ic_service)
             setContentTitle("FlClash")
             setContentIntent(intent.toPendingIntent)
-            setPriority(NotificationCompat.PRIORITY_HIGH)
+            setPriority(NotificationCompat.PRIORITY_LOW)
             setCategory(NotificationCompat.CATEGORY_SERVICE)
             setOngoing(true)
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
@@ -100,9 +97,6 @@ class NotificationModule(private val service: Service) : Module() {
             }
             setShowWhen(true)
             setOnlyAlertOnce(true)
-//            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-//                setRequestPromotedOngoing(true)
-//            }
         }
     }
 
@@ -113,17 +107,20 @@ class NotificationModule(private val service: Service) : Module() {
                 setContentText(params.contentText)
                 clearActions()
                 addAction(
-                    0, params.stopText, QuickAction.STOP.quickIntent.toPendingIntent
+                    0,
+                    params.stopText,
+                    QuickAction.STOP.quickIntent.toPendingIntent,
                 ).build()
-            })
+            },
+        )
     }
 
-    override fun onUninstall() {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+    @Suppress("DEPRECATION")
+    override fun stop() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
             service.stopForeground(STOP_FOREGROUND_REMOVE)
         } else {
             service.stopForeground(true)
         }
-        scope.cancel()
     }
-}
\ No newline at end of file
+}
diff --git a/android/service/src/main/java/com/follow/clash/service/modules/ServiceModules.kt b/android/service/src/main/java/com/follow/clash/service/modules/ServiceModules.kt
new file mode 100644
index 0000000000..4bd97ad511
--- /dev/null
+++ b/android/service/src/main/java/com/follow/clash/service/modules/ServiceModules.kt
@@ -0,0 +1,59 @@
+package com.follow.clash.service.modules
+
+import android.app.Service
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+
+internal interface ServiceModule {
+    fun start()
+
+    fun stop()
+}
+
+internal class ServiceModules(private val service: Service) {
+    private var scope: CoroutineScope? = null
+    private var modules = emptyList<ServiceModule>()
+
+    @Synchronized
+    fun start() {
+        if (scope != null) return
+
+        val nextScope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
+        val nextModules = listOf(
+            NotificationModule(service, nextScope),
+            NetworkObserveModule(service),
+            SuspendModule(service, nextScope),
+        )
+        val startedModules = mutableListOf<ServiceModule>()
+
+        try {
+            nextModules.forEach { module ->
+                module.start()
+                startedModules.add(module)
+            }
+            scope = nextScope
+            modules = nextModules
+        } catch (error: Throwable) {
+            nextScope.cancel()
+            startedModules.asReversed().forEach { module ->
+                runCatching { module.stop() }
+            }
+            throw error
+        }
+    }
+
+    @Synchronized
+    fun stop() {
+        val currentScope = scope ?: return
+        val currentModules = modules
+        scope = null
+        modules = emptyList()
+
+        currentScope.cancel()
+        currentModules.asReversed().forEach { module ->
+            runCatching { module.stop() }
+        }
+    }
+}
diff --git a/android/service/src/main/java/com/follow/clash/service/modules/SuspendModule.kt b/android/service/src/main/java/com/follow/clash/service/modules/SuspendModule.kt
index 5fd8d59a26..12f6930f05 100644
--- a/android/service/src/main/java/com/follow/clash/service/modules/SuspendModule.kt
+++ b/android/service/src/main/java/com/follow/clash/service/modules/SuspendModule.kt
@@ -7,55 +7,41 @@ import androidx.core.content.getSystemService
 import com.follow.clash.common.receiveBroadcastFlow
 import com.follow.clash.core.Core
 import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.cancel
 import kotlinx.coroutines.flow.map
 import kotlinx.coroutines.flow.onStart
 import kotlinx.coroutines.launch
 
+internal class SuspendModule(
+    private val service: Service,
+    private val scope: CoroutineScope,
+) : ServiceModule {
+    private fun isScreenOn() =
+        service.getSystemService<PowerManager>()?.isInteractive ?: true
 
-class SuspendModule(private val service: Service) : Module() {
-    private val scope = CoroutineScope(Dispatchers.Default)
+    private val isDeviceIdle: Boolean
+        get() = service.getSystemService<PowerManager>()?.isDeviceIdleMode ?: true
 
-    private fun isScreenOn(): Boolean {
-        val pm = service.getSystemService<PowerManager>()
-        return when (pm != null) {
-            true -> pm.isInteractive
-            false -> true
-        }
-    }
-
-    val isDeviceIdleMode: Boolean
-        get() {
-            return service.getSystemService<PowerManager>()?.isDeviceIdleMode ?: true
-        }
-
-    private fun onUpdate(isScreenOn: Boolean) {
-        if (isScreenOn) {
-            Core.suspended(false)
-            return
-        }
-        Core.suspended(isDeviceIdleMode)
+    private fun updateSuspension(screenOn: Boolean) {
+        Core.suspended(!screenOn && isDeviceIdle)
     }
 
-    override fun onInstall() {
+    override fun start() {
         scope.launch {
             val screenFlow = service.receiveBroadcastFlow {
                 addAction(Intent.ACTION_SCREEN_ON)
                 addAction(Intent.ACTION_SCREEN_OFF)
-            }.map { intent ->
-                intent.action == Intent.ACTION_SCREEN_ON
+                addAction(PowerManager.ACTION_DEVICE_IDLE_MODE_CHANGED)
+            }.map {
+                isScreenOn()
             }.onStart {
                 emit(isScreenOn())
             }
 
-            screenFlow.collect {
-                    onUpdate(it)
-                }
+            screenFlow.collect(::updateSuspension)
         }
     }
 
-    override fun onUninstall() {
-        scope.cancel()
+    override fun stop() {
+        Core.suspended(false)
     }
-}
\ No newline at end of file
+}
diff --git a/android/settings.gradle.kts b/android/settings.gradle.kts
index 5564c35eb7..145cd6f873 100644
--- a/android/settings.gradle.kts
+++ b/android/settings.gradle.kts
@@ -21,11 +21,10 @@ plugins {
     id("dev.flutter.flutter-plugin-loader") version "1.0.0"
     id("com.android.application") version "9.0.1" apply false
     id("org.jetbrains.kotlin.android") version "2.4.0" apply false
-    id("com.google.gms.google-services") version ("4.5.0") apply false
-    id("com.google.firebase.crashlytics") version ("3.0.7") apply false
+    id("com.google.gms.google-services") version "4.5.0" apply false
+    id("com.google.firebase.crashlytics") version "3.0.7" apply false
 }
 
-
 include(":app")
 include(":core")
 include(":service")
diff --git a/arb/intl_en.arb b/arb/intl_en.arb
index 6951fb3a5f..079726971a 100644
--- a/arb/intl_en.arb
+++ b/arb/intl_en.arb
@@ -318,6 +318,8 @@
   "messageTest": "Message test",
   "messageTestTip": "This is a message.",
   "crashTest": "Crash test",
+  "crashDetected": "Crash detected",
+  "crashDetectedTip": "The app crashed during the previous run. To prevent repeated crashes, the current profile has been cleared and automatic configuration setup was skipped.",
   "clearData": "Clear Data",
   "textScale": "Text Scaling",
   "internet": "Internet",
@@ -547,8 +549,68 @@
   "hoursCount": "{count} hours",
   "geoResources": "Geo Resources",
   "geoUpdating": "Updating {name}...",
-  "geoSkipped": "{name} skipped",
+  "geoSkipped": "{name} is already up to date",
   "geoUpdated": "{name} updated",
   "secondsCount": "{count} seconds",
-  "entriesCount": "{count} entries"
+  "entriesCount": "{count} entries",
+  "features": "Features",
+  "hideAdvanced": "Hide advanced",
+  "showAdvanced": "Show advanced",
+  "tailscale": "Tailscale",
+  "tailscaleDesc": "Manage Tailscale outbound nodes",
+  "tailscaleEnable": "Enable Tailscale",
+  "tailscaleEnableDesc": "Inject Tailscale nodes as outbounds. Turning this off stops Tailscale from handling traffic; normal traffic is unaffected.",
+  "tailscaleEmptyTip": "No Tailscale nodes yet. Add one to route traffic through your tailnet.",
+  "addTailscaleNode": "Add Tailscale node",
+  "editTailscaleNode": "Edit Tailscale node",
+  "tailscaleAuthKey": "Auth key",
+  "tailscaleHostname": "Hostname",
+  "tailscaleControlUrl": "Control URL",
+  "tailscaleStateDir": "State directory",
+  "tailscaleEphemeral": "Ephemeral",
+  "tailscaleUdp": "UDP relay",
+  "tailscaleAcceptRoutes": "Accept routes",
+  "tailscaleExitNode": "Exit node",
+  "tailscaleExitNodeAllowLanAccess": "Allow LAN access via exit node",
+  "tailscaleNameExistsTip": "A node with this name already exists",
+  "tailscaleGuideTitle": "How Tailscale works",
+  "tailscaleAuthKeyHint": "From the Tailscale admin console → Settings → Keys. Required to authenticate the node.",
+  "tailscaleHostnameHint": "Optional. Device name shown in your tailnet.",
+  "tailscaleControlUrlHint": "Optional. Only for self-hosted control servers such as Headscale.",
+  "tailscaleStateDirHint": "Optional. Directory used to persist Tailscale state.",
+  "tailscaleExitNodeHint": "Optional. IP or name of a tailnet exit node to route all traffic through.",
+  "tailscaleBypass": "Keep Tailscale traffic direct",
+  "tailscaleRoutes": "Route destinations",
+  "tailscaleRoutesHint": "Domains or IPs sent through this node, one per line (e.g. your home PC's Tailscale IP or MagicDNS name).",
+  "tailscaleScenarioAndroidTitle": "Android client setup",
+  "tailscaleScenarioAndroidBody": "Keep FlClash as the only VPN. Do not run the Tailscale app VPN at the same time (Android allows only one). Use an embedded Tailscale node below, then add your home device to Route destinations.",
+  "tailscaleScenarioDesktopTitle": "Desktop / host setup",
+  "tailscaleScenarioDesktopBody": "You can run FlClash and the real Tailscale app together. Turn on \"Keep Tailscale traffic direct\" so FlClash does not hijack Tailscale's control plane or fake-IP DNS.",
+  "tailscaleAndroidStep1": "Get an auth key from the Tailscale admin console (Settings → Keys).",
+  "tailscaleAndroidStep2": "Add a node, paste the auth key, and put your home device IP or MagicDNS name in Route destinations.",
+  "tailscaleAndroidStep3": "Turn on Enable Tailscale. Leave \"Keep Tailscale traffic direct\" off unless the Tailscale app is also installed.",
+  "tailscaleAndroidStep4": "Start FlClash VPN, then tap the ping button on a node to verify the connection.",
+  "tailscaleDesktopStep1": "If this PC also runs the Tailscale app/service, turn on \"Keep Tailscale traffic direct\".",
+  "tailscaleDesktopStep2": "Optional: add an embedded Tailscale node with an auth key to route selected traffic through the tailnet from FlClash.",
+  "tailscaleDesktopStep3": "Put destinations (home IPs / MagicDNS) in Route destinations, then turn on Enable Tailscale.",
+  "tailscaleDesktopStep4": "Start FlClash, then tap the ping button on a node to verify the connection is solid.",
+  "tailscaleBypassRecommended": "Recommended on desktop when the Tailscale app/service is installed. Auto-manages DIRECT rules and Fake IP Filter.",
+  "tailscaleBypassAndroidHint": "Usually leave this off on Android. Turn on only if the Tailscale app is also installed on this phone.",
+  "tailscaleStatusDisabled": "Tailscale is off — nodes are not injected into the running profile.",
+  "tailscaleStatusNoNodes": "Enabled, but no nodes yet. Add a node to get started.",
+  "tailscaleStatusNeedStart": "Nodes are ready. Start FlClash VPN, then tap ping to test.",
+  "tailscaleStatusReady": "{count} node(s) active. Tap ping on a node to test connectivity.",
+  "tailscaleStatusNeedRoutes": "Nodes are added, but no route destinations yet — traffic will not match until you add routes (or pick the node manually).",
+  "tailscaleBypassNudge": "This device likely runs Tailscale already — turn on “Keep Tailscale traffic direct” to avoid fake-IP / control-plane breakage.",
+  "tailscaleShowSetupGuide": "Setup guide",
+  "tailscaleEnableBypassAction": "Enable",
+  "tailscaleNameHelper": "Outbound name used in Proxies. Renaming changes how selections and delay tests key this node.",
+  "tailscaleTestNeedEnable": "Turn on Enable Tailscale before testing.",
+  "tailscaleTestNeedStart": "Start FlClash VPN before testing the connection.",
+  "tailscaleTestNode": "Test connection",
+  "tailscaleNotTested": "Not tested",
+  "tailscaleNoRoutes": "No route destinations",
+  "tailscaleRoutesCount": "{count} route(s)",
+  "tailscaleNodesTitle": "Nodes",
+  "tailscaleTestTip": "Use the ping button next to a node to check whether the Tailscale outbound can dial out. A latency value means the connection is working; Timeout means check the auth key, Enable switch, and that FlClash VPN is started."
 }
diff --git a/arb/intl_ja.arb b/arb/intl_ja.arb
index a310126c0e..7285111fde 100644
--- a/arb/intl_ja.arb
+++ b/arb/intl_ja.arb
@@ -318,6 +318,8 @@
   "messageTest": "メッセージテスト",
   "messageTestTip": "これはメッセージです。",
   "crashTest": "クラッシュテスト",
+  "crashDetected": "クラッシュを検出しました",
+  "crashDetectedTip": "前回の実行中にアプリがクラッシュしました。クラッシュの繰り返しを防ぐため、現在のプロファイルを解除し、設定の自動セットアップをスキップしました。",
   "clearData": "データを消去",
   "textScale": "テキストスケーリング",
   "internet": "インターネット",
@@ -547,8 +549,68 @@
   "hoursCount": "{count} 時間",
   "geoResources": "Geoリソース",
   "geoUpdating": "{name}を更新中...",
-  "geoSkipped": "{name} スキップ済み",
+  "geoSkipped": "{name} はすでに最新です",
   "geoUpdated": "{name} 更新済み",
   "secondsCount": "{count} 秒",
-  "entriesCount": "{count} エントリ"
+  "entriesCount": "{count} エントリ",
+  "features": "機能",
+  "hideAdvanced": "詳細設定を隠す",
+  "showAdvanced": "詳細設定を表示",
+  "tailscale": "Tailscale",
+  "tailscaleDesc": "Tailscale アウトバウンドノードを管理",
+  "tailscaleEnable": "Tailscale を有効化",
+  "tailscaleEnableDesc": "Tailscale ノードをアウトバウンドとして注入します。オフにすると Tailscale はトラフィックを処理しなくなりますが、通常のトラフィックには影響しません。",
+  "tailscaleEmptyTip": "Tailscale ノードがありません。追加すると、トラフィックを tailnet 経由で転送できます。",
+  "addTailscaleNode": "Tailscale ノードを追加",
+  "editTailscaleNode": "Tailscale ノードを編集",
+  "tailscaleAuthKey": "認証キー",
+  "tailscaleHostname": "ホスト名",
+  "tailscaleControlUrl": "コントロール URL",
+  "tailscaleStateDir": "状態ディレクトリ",
+  "tailscaleEphemeral": "エフェメラル",
+  "tailscaleUdp": "UDP リレー",
+  "tailscaleAcceptRoutes": "ルートを受け入れる",
+  "tailscaleExitNode": "出口ノード",
+  "tailscaleExitNodeAllowLanAccess": "出口ノード経由の LAN アクセスを許可",
+  "tailscaleNameExistsTip": "同じ名前のノードが既に存在します",
+  "tailscaleGuideTitle": "Tailscale の仕組み",
+  "tailscaleAuthKeyHint": "Tailscale 管理コンソール → 設定 → Keys から取得します。ノードの認証に必要です。",
+  "tailscaleHostnameHint": "任意。tailnet に表示されるデバイス名です。",
+  "tailscaleControlUrlHint": "任意。Headscale などの自己ホスト型コントロールサーバー用です。",
+  "tailscaleStateDirHint": "任意。Tailscale の状態を保存するディレクトリです。",
+  "tailscaleExitNodeHint": "任意。すべてのトラフィックを転送する tailnet 出口ノードの IP または名前です。",
+  "tailscaleBypass": "Tailscale のトラフィックを直結に保つ",
+  "tailscaleRoutes": "ルーティング先",
+  "tailscaleRoutesHint": "このノード経由で送るドメインまたは IP（1 行に 1 つ、例: 自宅 PC の Tailscale IP や MagicDNS 名）。",
+  "tailscaleScenarioAndroidTitle": "Android クライアント設定",
+  "tailscaleScenarioAndroidBody": "VPN は FlClash だけにしてください。Tailscale アプリの VPN と同時には使えません（Android は VPN を 1 つだけ許可）。下で内蔵 Tailscale ノードを追加し、自宅デバイスをルーティング先に入れてください。",
+  "tailscaleScenarioDesktopTitle": "デスクトップ / ホスト設定",
+  "tailscaleScenarioDesktopBody": "FlClash と正式な Tailscale アプリを同時に使えます。「Tailscale のトラフィックを直結に保つ」をオンにして、FlClash が制御プレーンや fake-IP DNS を横取りしないようにします。",
+  "tailscaleAndroidStep1": "Tailscale 管理コンソール（設定 → Keys）で認証キーを取得します。",
+  "tailscaleAndroidStep2": "ノードを追加し、認証キーを貼り付け、ルーティング先に自宅デバイスの IP または MagicDNS 名を入れます。",
+  "tailscaleAndroidStep3": "「Tailscale を有効化」をオンにします。Tailscale アプリも入れている場合以外は「直結に保つ」はオフのままで構いません。",
+  "tailscaleAndroidStep4": "FlClash VPN を開始し、ノード横のピンボタンで接続を確認します。",
+  "tailscaleDesktopStep1": "この PC で Tailscale アプリ/サービスも動かす場合は「Tailscale のトラフィックを直結に保つ」をオンにします。",
+  "tailscaleDesktopStep2": "任意: 認証キー付きの内蔵 Tailscale ノードを追加し、選択した通信を FlClash から tailnet 経由にします。",
+  "tailscaleDesktopStep3": "ルーティング先に宛先（自宅 IP / MagicDNS）を入れ、「Tailscale を有効化」をオンにします。",
+  "tailscaleDesktopStep4": "FlClash を開始し、ノード横のピンボタンで接続が安定しているか確認します。",
+  "tailscaleBypassRecommended": "Tailscale アプリ/サービスが入っているデスクトップでは推奨。DIRECT ルールと Fake IP Filter を自動管理します。",
+  "tailscaleBypassAndroidHint": "Android では通常オフのまま。この端末にも Tailscale アプリがある場合だけオンにしてください。",
+  "tailscaleStatusDisabled": "Tailscale はオフです — ノードは実行中の設定に注入されません。",
+  "tailscaleStatusNoNodes": "有効ですが、ノードがありません。まずノードを追加してください。",
+  "tailscaleStatusNeedStart": "ノードの準備ができました。FlClash VPN を開始してからピンでテストしてください。",
+  "tailscaleStatusReady": "{count} 個のノードが有効です。ノード横のピンで接続をテストできます。",
+  "tailscaleStatusNeedRoutes": "ノードは追加済みですがルート先がありません — ルートを追加するまで自動一致しません（または手動でノードを選択）。",
+  "tailscaleBypassNudge": "この端末では Tailscale も動いている可能性があります — 「Tailscale 通信を直通」をオンにして Fake IP / 制御面の不具合を避けてください。",
+  "tailscaleShowSetupGuide": "セットアップガイド",
+  "tailscaleEnableBypassAction": "有効にする",
+  "tailscaleNameHelper": "プロキシ一覧の出站名です。名前を変えると選択や遅延テストの対応も変わります。",
+  "tailscaleTestNeedEnable": "テストする前に「Tailscale を有効化」をオンにしてください。",
+  "tailscaleTestNeedStart": "接続をテストする前に FlClash VPN を開始してください。",
+  "tailscaleTestNode": "接続をテスト",
+  "tailscaleNotTested": "未テスト",
+  "tailscaleNoRoutes": "ルーティング先なし",
+  "tailscaleRoutesCount": "ルーティング先 {count} 件",
+  "tailscaleNodesTitle": "ノード",
+  "tailscaleTestTip": "ノード横のピンボタンで、Tailscale アウトバウンドが発信できるか確認できます。遅延が表示されれば接続は正常です。Timeout の場合は認証キー、「有効化」、FlClash VPN の起動を確認してください。"
 }
diff --git a/arb/intl_ru.arb b/arb/intl_ru.arb
index 4cdfdf3036..81d7f9fe4e 100644
--- a/arb/intl_ru.arb
+++ b/arb/intl_ru.arb
@@ -318,6 +318,8 @@
   "messageTest": "Тестирование сообщения",
   "messageTestTip": "Это сообщение.",
   "crashTest": "Тест на сбои",
+  "crashDetected": "Обнаружен сбой",
+  "crashDetectedTip": "Во время предыдущего запуска произошёл сбой приложения. Чтобы предотвратить повторный сбой, текущий профиль был сброшен, а автоматическая настройка конфигурации пропущена.",
   "clearData": "Очистить данные",
   "textScale": "Масштабирование текста",
   "internet": "Интернет",
@@ -547,8 +549,68 @@
   "hoursCount": "{count} часов",
   "geoResources": "Ресурсы Geo",
   "geoUpdating": "Обновление {name}...",
-  "geoSkipped": "{name} пропущено",
+  "geoSkipped": "Для {name} уже установлена последняя версия",
   "geoUpdated": "{name} обновлено",
   "secondsCount": "{count} секунд",
-  "entriesCount": "{count} записей"
+  "entriesCount": "{count} записей",
+  "features": "Функции",
+  "hideAdvanced": "Скрыть дополнительно",
+  "showAdvanced": "Показать дополнительно",
+  "tailscale": "Tailscale",
+  "tailscaleDesc": "Управление исходящими узлами Tailscale",
+  "tailscaleEnable": "Включить Tailscale",
+  "tailscaleEnableDesc": "Добавлять узлы Tailscale как исходящие. При отключении Tailscale перестаёт обрабатывать трафик; обычный трафик не затрагивается.",
+  "tailscaleEmptyTip": "Узлов Tailscale пока нет. Добавьте узел, чтобы направлять трафик через вашу сеть tailnet.",
+  "addTailscaleNode": "Добавить узел Tailscale",
+  "editTailscaleNode": "Изменить узел Tailscale",
+  "tailscaleAuthKey": "Ключ аутентификации",
+  "tailscaleHostname": "Имя хоста",
+  "tailscaleControlUrl": "URL сервера управления",
+  "tailscaleStateDir": "Каталог состояния",
+  "tailscaleEphemeral": "Временный узел",
+  "tailscaleUdp": "Ретрансляция UDP",
+  "tailscaleAcceptRoutes": "Принимать маршруты",
+  "tailscaleExitNode": "Выходной узел",
+  "tailscaleExitNodeAllowLanAccess": "Разрешить доступ к локальной сети через выходной узел",
+  "tailscaleNameExistsTip": "Узел с таким именем уже существует",
+  "tailscaleGuideTitle": "Как работает Tailscale",
+  "tailscaleAuthKeyHint": "Из консоли администратора Tailscale → Settings → Keys. Требуется для аутентификации узла.",
+  "tailscaleHostnameHint": "Необязательно. Имя устройства, отображаемое в вашей сети tailnet.",
+  "tailscaleControlUrlHint": "Необязательно. Только для собственных серверов управления, например Headscale.",
+  "tailscaleStateDirHint": "Необязательно. Каталог для хранения состояния Tailscale.",
+  "tailscaleExitNodeHint": "Необязательно. IP-адрес или имя выходного узла tailnet для маршрутизации всего трафика.",
+  "tailscaleBypass": "Оставлять трафик Tailscale напрямую",
+  "tailscaleRoutes": "Пункты назначения маршрута",
+  "tailscaleRoutesHint": "Домены или IP, направляемые через этот узел, по одному в строке (например, Tailscale IP или имя MagicDNS вашего домашнего ПК).",
+  "tailscaleScenarioAndroidTitle": "Настройка клиента Android",
+  "tailscaleScenarioAndroidBody": "Оставьте FlClash единственным VPN. Не запускайте VPN приложения Tailscale одновременно (Android допускает только один). Добавьте встроенный узел Tailscale ниже и укажите домашнее устройство в пунктах назначения маршрута.",
+  "tailscaleScenarioDesktopTitle": "Настройка ПК / хоста",
+  "tailscaleScenarioDesktopBody": "Можно запускать FlClash и настоящее приложение Tailscale вместе. Включите «Оставлять трафик Tailscale напрямую», чтобы FlClash не перехватывал плоскость управления Tailscale и fake-IP DNS.",
+  "tailscaleAndroidStep1": "Получите ключ аутентификации в консоли администратора Tailscale (Settings → Keys).",
+  "tailscaleAndroidStep2": "Добавьте узел, вставьте ключ и укажите IP или имя MagicDNS домашнего устройства в пунктах назначения маршрута.",
+  "tailscaleAndroidStep3": "Включите Tailscale. «Оставлять трафик напрямую» обычно выключайте, если приложение Tailscale на телефоне не установлено.",
+  "tailscaleAndroidStep4": "Запустите VPN FlClash, затем нажмите кнопку ping у узла, чтобы проверить соединение.",
+  "tailscaleDesktopStep1": "Если на этом ПК также работает приложение/служба Tailscale, включите «Оставлять трафик Tailscale напрямую».",
+  "tailscaleDesktopStep2": "Необязательно: добавьте встроенный узел Tailscale с ключом, чтобы направлять выбранный трафик через tailnet из FlClash.",
+  "tailscaleDesktopStep3": "Укажите назначения (домашние IP / MagicDNS) в пунктах назначения маршрута и включите Tailscale.",
+  "tailscaleDesktopStep4": "Запустите FlClash и нажмите ping у узла, чтобы убедиться, что соединение стабильно.",
+  "tailscaleBypassRecommended": "Рекомендуется на ПК, где установлено приложение/служба Tailscale. Автоматически управляет правилами DIRECT и Fake IP Filter.",
+  "tailscaleBypassAndroidHint": "На Android обычно оставляйте выключенным. Включайте только если на телефоне также установлено приложение Tailscale.",
+  "tailscaleStatusDisabled": "Tailscale выключен — узлы не добавляются в рабочий профиль.",
+  "tailscaleStatusNoNodes": "Включено, но узлов ещё нет. Добавьте узел, чтобы начать.",
+  "tailscaleStatusNeedStart": "Узлы готовы. Запустите VPN FlClash, затем нажмите ping для проверки.",
+  "tailscaleStatusReady": "Активных узлов: {count}. Нажмите ping у узла, чтобы проверить связь.",
+  "tailscaleStatusNeedRoutes": "Узлы добавлены, но нет маршрутов — трафик не совпадёт, пока не добавите маршруты (или выберите узел вручную).",
+  "tailscaleBypassNudge": "На этом устройстве, возможно, уже запущен Tailscale — включите «Прямой трафик Tailscale», чтобы избежать проблем Fake IP / control plane.",
+  "tailscaleShowSetupGuide": "Инструкция",
+  "tailscaleEnableBypassAction": "Включить",
+  "tailscaleNameHelper": "Имя исходящего узла в Proxies. Переименование меняет привязку выбора и тестов задержки.",
+  "tailscaleTestNeedEnable": "Перед проверкой включите Tailscale.",
+  "tailscaleTestNeedStart": "Перед проверкой соединения запустите VPN FlClash.",
+  "tailscaleTestNode": "Проверить соединение",
+  "tailscaleNotTested": "Не проверено",
+  "tailscaleNoRoutes": "Нет пунктов назначения",
+  "tailscaleRoutesCount": "Маршрутов: {count}",
+  "tailscaleNodesTitle": "Узлы",
+  "tailscaleTestTip": "Кнопка ping рядом с узлом проверяет, может ли исходящий Tailscale установить соединение. Задержка означает, что связь есть; Timeout — проверьте ключ, переключатель включения и что VPN FlClash запущен."
 }
diff --git a/arb/intl_zh_CN.arb b/arb/intl_zh_CN.arb
index 28435c1095..6883c67345 100644
--- a/arb/intl_zh_CN.arb
+++ b/arb/intl_zh_CN.arb
@@ -318,6 +318,8 @@
   "messageTest": "消息测试",
   "messageTestTip": "这是一条消息。",
   "crashTest": "崩溃测试",
+  "crashDetected": "检测到崩溃",
+  "crashDetectedTip": "检测到应用上次运行发生崩溃。为避免重复崩溃，已清除当前配置选择，并跳过本次自动配置。",
   "clearData": "清除数据",
   "textScale": "文本缩放",
   "internet": "互联网",
@@ -547,8 +549,68 @@
   "hoursCount": "{count} 小时",
   "geoResources": "Geo 资源",
   "geoUpdating": "正在更新 {name}...",
-  "geoSkipped": "{name} 已跳过",
+  "geoSkipped": "{name} 已是最新版本",
   "geoUpdated": "{name} 已更新",
   "secondsCount": "{count} 秒",
-  "entriesCount": "{count} 个条目"
+  "entriesCount": "{count} 个条目",
+  "features": "功能",
+  "hideAdvanced": "隐藏高级选项",
+  "showAdvanced": "显示高级选项",
+  "tailscale": "Tailscale",
+  "tailscaleDesc": "管理 Tailscale 出站节点",
+  "tailscaleEnable": "启用 Tailscale",
+  "tailscaleEnableDesc": "将 Tailscale 节点作为出站注入。关闭后 Tailscale 将不再处理流量，普通流量不受影响。",
+  "tailscaleEmptyTip": "暂无 Tailscale 节点。添加一个即可让流量经由你的 tailnet 转发。",
+  "addTailscaleNode": "添加 Tailscale 节点",
+  "editTailscaleNode": "编辑 Tailscale 节点",
+  "tailscaleAuthKey": "认证密钥",
+  "tailscaleHostname": "主机名",
+  "tailscaleControlUrl": "控制服务器地址",
+  "tailscaleStateDir": "状态目录",
+  "tailscaleEphemeral": "临时节点",
+  "tailscaleUdp": "UDP 转发",
+  "tailscaleAcceptRoutes": "接受路由",
+  "tailscaleExitNode": "出口节点",
+  "tailscaleExitNodeAllowLanAccess": "允许通过出口节点访问局域网",
+  "tailscaleNameExistsTip": "已存在同名节点",
+  "tailscaleGuideTitle": "Tailscale 使用说明",
+  "tailscaleAuthKeyHint": "来自 Tailscale 管理后台 → 设置 → Keys，用于对节点进行认证。",
+  "tailscaleHostnameHint": "可选。在 tailnet 中显示的设备名称。",
+  "tailscaleControlUrlHint": "可选。仅用于自建控制服务器（如 Headscale）。",
+  "tailscaleStateDirHint": "可选。用于持久化 Tailscale 状态的目录。",
+  "tailscaleExitNodeHint": "可选。tailnet 出口节点的 IP 或名称，用于转发全部流量。",
+  "tailscaleBypass": "保持 Tailscale 流量直连",
+  "tailscaleRoutes": "路由目标",
+  "tailscaleRoutesHint": "经由该节点转发的域名或 IP，每行一个（例如你家用电脑的 Tailscale IP 或 MagicDNS 名称）。",
+  "tailscaleScenarioAndroidTitle": "Android 客户端设置",
+  "tailscaleScenarioAndroidBody": "请只保留 FlClash 作为 VPN。不要同时开启 Tailscale 应用的 VPN（Android 同一时间只允许一个）。在下方添加内置 Tailscale 节点，并把家里的设备填入“路由目标”。",
+  "tailscaleScenarioDesktopTitle": "桌面 / 主机设置",
+  "tailscaleScenarioDesktopBody": "可以同时运行 FlClash 与正式的 Tailscale 应用。请开启“保持 Tailscale 流量直连”，避免 FlClash 劫持 Tailscale 控制面或 fake-IP DNS。",
+  "tailscaleAndroidStep1": "在 Tailscale 管理后台（设置 → Keys）获取认证密钥。",
+  "tailscaleAndroidStep2": "添加节点，粘贴认证密钥，并在“路由目标”中填入家里设备的 IP 或 MagicDNS 名称。",
+  "tailscaleAndroidStep3": "打开“启用 Tailscale”。除非本机也安装了 Tailscale 应用，否则请关闭“保持 Tailscale 流量直连”。",
+  "tailscaleAndroidStep4": "启动 FlClash VPN，然后点击节点旁的测速按钮检查连接。",
+  "tailscaleDesktopStep1": "如果这台电脑同时运行 Tailscale 应用/服务，请开启“保持 Tailscale 流量直连”。",
+  "tailscaleDesktopStep2": "可选：用认证密钥添加一个内置 Tailscale 节点，让 FlClash 将选定流量经由 tailnet 转发。",
+  "tailscaleDesktopStep3": "在“路由目标”中填写目标（家里的 IP / MagicDNS），然后打开“启用 Tailscale”。",
+  "tailscaleDesktopStep4": "启动 FlClash，然后点击节点旁的测速按钮确认连接是否正常。",
+  "tailscaleBypassRecommended": "在已安装 Tailscale 应用/服务的桌面上建议开启。会自动管理直连规则与 Fake IP Filter。",
+  "tailscaleBypassAndroidHint": "Android 上通常保持关闭。仅当本机也安装了 Tailscale 应用时再开启。",
+  "tailscaleStatusDisabled": "Tailscale 已关闭 — 节点不会注入到运行配置中。",
+  "tailscaleStatusNoNodes": "已启用，但还没有节点。请先添加一个节点。",
+  "tailscaleStatusNeedStart": "节点已就绪。请先启动 FlClash VPN，再点击测速。",
+  "tailscaleStatusReady": "已有 {count} 个节点。点击节点旁的测速按钮检查连通性。",
+  "tailscaleStatusNeedRoutes": "已添加节点，但还没有路由目标 — 在填写路由之前流量不会自动匹配（或请手动选择该节点）。",
+  "tailscaleBypassNudge": "本机可能已安装 Tailscale — 建议开启“Tailscale 流量直连”，避免 Fake IP / 控制面被劫持。",
+  "tailscaleShowSetupGuide": "设置指南",
+  "tailscaleEnableBypassAction": "开启",
+  "tailscaleNameHelper": "代理列表中的出站名称。重命名会改变选中项与延迟测试的对应关系。",
+  "tailscaleTestNeedEnable": "请先打开“启用 Tailscale”再测试。",
+  "tailscaleTestNeedStart": "请先启动 FlClash VPN 再测试连接。",
+  "tailscaleTestNode": "测试连接",
+  "tailscaleNotTested": "未测试",
+  "tailscaleNoRoutes": "无路由目标",
+  "tailscaleRoutesCount": "{count} 个路由目标",
+  "tailscaleNodesTitle": "节点",
+  "tailscaleTestTip": "点击节点旁的测速按钮，检查 Tailscale 出站是否能拨号。显示延迟表示连接正常；显示超时请检查认证密钥、“启用”开关，以及 FlClash VPN 是否已启动。"
 }
diff --git a/core/Clash.Meta b/core/Clash.Meta
index 80362fc189..1691c15bf2 160000
--- a/core/Clash.Meta
+++ b/core/Clash.Meta
@@ -1 +1 @@
-Subproject commit 80362fc1895dcf60b79b562896653046e0687413
+Subproject commit 1691c15bf23909ba7181406dfe196c780f0a2e6f
diff --git a/core/action.go b/core/action.go
deleted file mode 100644
index a7d6c8f917..0000000000
--- a/core/action.go
+++ /dev/null
@@ -1,193 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"runtime"
-	"unsafe"
-)
-
-type Action struct {
-	Id     string      `json:"id"`
-	Method Method      `json:"method"`
-	Data   interface{} `json:"data"`
-}
-
-type ActionResult struct {
-	Id       string      `json:"id"`
-	Method   Method      `json:"method"`
-	Data     interface{} `json:"data"`
-	Code     int         `json:"code"`
-	callback unsafe.Pointer
-}
-
-func (result ActionResult) Json() ([]byte, error) {
-	data, err := json.Marshal(result)
-	return data, err
-}
-
-func (result ActionResult) success(data interface{}) {
-	result.Code = 0
-	result.Data = data
-	result.send()
-}
-
-func (result ActionResult) error(data interface{}) {
-	result.Code = -1
-	result.Data = data
-	result.send()
-}
-
-func handleAction(action *Action, result ActionResult) {
-	defer func() {
-		if r := recover(); r != nil {
-			buf := make([]byte, 4096)
-			n := runtime.Stack(buf, false)
-			logError("panic in handleAction(%s): %v\n%s", action.Method, r, buf[:n])
-			result.error(fmt.Sprintf("internal panic: %v", r))
-		}
-	}()
-	switch action.Method {
-	case initClashMethod:
-		paramsString := action.Data.(string)
-		result.success(handleInitClash(paramsString))
-		return
-	case getIsInitMethod:
-		result.success(handleGetIsInit())
-		return
-	case forceGcMethod:
-		handleForceGC()
-		result.success(true)
-		return
-	case shutdownMethod:
-		result.success(handleShutdown())
-		return
-	case validateConfigMethod:
-		path := action.Data.(string)
-		result.success(handleValidateConfig(path))
-		return
-	case updateConfigMethod:
-		data := []byte(action.Data.(string))
-		result.success(handleUpdateConfig(data))
-		return
-	case setupConfigMethod:
-		data := []byte(action.Data.(string))
-		result.success(handleSetupConfig(data))
-		return
-	case getProxiesMethod:
-		result.success(handleGetProxies())
-		return
-	case changeProxyMethod:
-		data := action.Data.(string)
-		handleChangeProxy(data, func(value string) {
-			result.success(value)
-		})
-		return
-	case getTrafficMethod:
-		data := action.Data.(bool)
-		result.success(handleGetTraffic(data))
-		return
-	case getTotalTrafficMethod:
-		data := action.Data.(bool)
-		result.success(handleGetTotalTraffic(data))
-		return
-	case resetTrafficMethod:
-		handleResetTraffic()
-		result.success(true)
-		return
-	case asyncTestDelayMethod:
-		data := action.Data.(string)
-		handleAsyncTestDelay(data, func(value string) {
-			result.success(value)
-		})
-		return
-	case getConnectionsMethod:
-		result.success(handleGetConnections())
-		return
-	case closeConnectionsMethod:
-		result.success(handleCloseConnections())
-		return
-	case resetConnectionsMethod:
-		result.success(handleResetConnections())
-		return
-	case getConfigMethod:
-		path := action.Data.(string)
-		config, err := handleGetConfig(path)
-		if err != nil {
-			result.error(err)
-			return
-		}
-		result.success(config)
-		return
-	case closeConnectionMethod:
-		id := action.Data.(string)
-		result.success(handleCloseConnection(id))
-		return
-	case getExternalProvidersMethod:
-		result.success(handleGetExternalProviders())
-		return
-	case getExternalProviderMethod:
-		externalProviderName := action.Data.(string)
-		result.success(handleGetExternalProvider(externalProviderName))
-		return
-	case updateGeoDataMethod:
-		geoType := action.Data.(string)
-		handleUpdateGeoData(geoType)
-		result.success("")
-		return
-	case updateExternalProviderMethod:
-		providerName := action.Data.(string)
-		handleUpdateExternalProvider(providerName, func(value string) {
-			result.success(value)
-		})
-		return
-	case sideLoadExternalProviderMethod:
-		paramsString := action.Data.(string)
-		var params = map[string]string{}
-		err := json.Unmarshal([]byte(paramsString), &params)
-		if err != nil {
-			result.success(err.Error())
-			return
-		}
-		providerName := params["providerName"]
-		data := params["data"]
-		handleSideLoadExternalProvider(providerName, []byte(data), func(value string) {
-			result.success(value)
-		})
-		return
-	case startLogMethod:
-		handleStartLog()
-		result.success(true)
-		return
-	case stopLogMethod:
-		handleStopLog()
-		result.success(true)
-		return
-	case startListenerMethod:
-		result.success(handleStartListener())
-		return
-	case stopListenerMethod:
-		result.success(handleStopListener())
-		return
-	case getCountryCodeMethod:
-		ip := action.Data.(string)
-		handleGetCountryCode(ip, func(value string) {
-			result.success(value)
-		})
-		return
-	case getMemoryMethod:
-		handleGetMemory(func(value string) {
-			result.success(value)
-		})
-		return
-	case crashMethod:
-		result.success(true)
-		handleCrash()
-	case deleteFile:
-		path := action.Data.(string)
-		handleDelFile(path, result)
-		return
-	default:
-		nextHandle(action, result)
-	}
-}
diff --git a/core/common.go b/core/common.go
index 46d9bdfdf8..13717488d2 100644
--- a/core/common.go
+++ b/core/common.go
@@ -229,11 +229,21 @@ func updateConfig(params *UpdateParams) {
 
 	if params.Tun != nil {
 		general.Tun.Enable = params.Tun.Enable
-		general.Tun.AutoRoute = *params.Tun.AutoRoute
-		general.Tun.Device = *params.Tun.Device
-		general.Tun.RouteAddress = *params.Tun.RouteAddress
-		general.Tun.DNSHijack = *params.Tun.DNSHijack
-		general.Tun.Stack = *params.Tun.Stack
+		if params.Tun.AutoRoute != nil {
+			general.Tun.AutoRoute = *params.Tun.AutoRoute
+		}
+		if params.Tun.Device != nil {
+			general.Tun.Device = *params.Tun.Device
+		}
+		if params.Tun.RouteAddress != nil {
+			general.Tun.RouteAddress = *params.Tun.RouteAddress
+		}
+		if params.Tun.DNSHijack != nil {
+			general.Tun.DNSHijack = *params.Tun.DNSHijack
+		}
+		if params.Tun.Stack != nil {
+			general.Tun.Stack = *params.Tun.Stack
+		}
 	}
 
 	if params.GeoAutoUpdate != nil {
diff --git a/core/constant.go b/core/constant.go
index ed16fea2eb..f7ae1a4453 100644
--- a/core/constant.go
+++ b/core/constant.go
@@ -48,8 +48,8 @@ type tunSchema struct {
 }
 
 type ChangeProxyParams struct {
-	GroupName *string `json:"group-name"`
-	ProxyName *string `json:"proxy-name"`
+	GroupName string `json:"group-name"`
+	ProxyName string `json:"proxy-name"`
 }
 
 type TestDelayParams struct {
@@ -58,6 +58,11 @@ type TestDelayParams struct {
 	Timeout   int64  `json:"timeout"`
 }
 
+type Traffic struct {
+	Up   int64 `json:"up"`
+	Down int64 `json:"down"`
+}
+
 type ExternalProvider struct {
 	Name             string                     `json:"name"`
 	Type             string                     `json:"type"`
@@ -74,42 +79,42 @@ type ProxiesData struct {
 }
 
 const (
-	messageMethod                  Method = "message"
-	initClashMethod                Method = "initClash"
-	getIsInitMethod                Method = "getIsInit"
-	forceGcMethod                  Method = "forceGc"
-	shutdownMethod                 Method = "shutdown"
-	validateConfigMethod           Method = "validateConfig"
-	updateConfigMethod             Method = "updateConfig"
-	getProxiesMethod               Method = "getProxies"
-	changeProxyMethod              Method = "changeProxy"
-	getTrafficMethod               Method = "getTraffic"
-	getTotalTrafficMethod          Method = "getTotalTraffic"
-	resetTrafficMethod             Method = "resetTraffic"
-	asyncTestDelayMethod           Method = "asyncTestDelay"
-	getConnectionsMethod           Method = "getConnections"
-	closeConnectionsMethod         Method = "closeConnections"
-	resetConnectionsMethod         Method = "resetConnections"
-	closeConnectionMethod          Method = "closeConnection"
-	getExternalProvidersMethod     Method = "getExternalProviders"
-	getExternalProviderMethod      Method = "getExternalProvider"
-	getCountryCodeMethod           Method = "getCountryCode"
-	getMemoryMethod                Method = "getMemory"
-	updateGeoDataMethod            Method = "updateGeoData"
-	updateExternalProviderMethod   Method = "updateExternalProvider"
-	sideLoadExternalProviderMethod Method = "sideLoadExternalProvider"
-	startLogMethod                 Method = "startLog"
-	stopLogMethod                  Method = "stopLog"
-	startListenerMethod            Method = "startListener"
-	stopListenerMethod             Method = "stopListener"
-	updateDnsMethod                Method = "updateDns"
-	crashMethod                    Method = "crash"
-	setupConfigMethod              Method = "setupConfig"
-	getConfigMethod                Method = "getConfig"
-	deleteFile                     Method = "deleteFile"
+	messageMethod                  CoreMethod = "message"
+	initClashMethod                CoreMethod = "initClash"
+	getIsInitMethod                CoreMethod = "getIsInit"
+	forceGcMethod                  CoreMethod = "forceGc"
+	shutdownMethod                 CoreMethod = "shutdown"
+	validateConfigMethod           CoreMethod = "validateConfig"
+	updateConfigMethod             CoreMethod = "updateConfig"
+	getProxiesMethod               CoreMethod = "getProxies"
+	changeProxyMethod              CoreMethod = "changeProxy"
+	getTrafficMethod               CoreMethod = "getTraffic"
+	getTotalTrafficMethod          CoreMethod = "getTotalTraffic"
+	resetTrafficMethod             CoreMethod = "resetTraffic"
+	asyncTestDelayMethod           CoreMethod = "asyncTestDelay"
+	getConnectionsMethod           CoreMethod = "getConnections"
+	closeConnectionsMethod         CoreMethod = "closeConnections"
+	resetConnectionsMethod         CoreMethod = "resetConnections"
+	closeConnectionMethod          CoreMethod = "closeConnection"
+	getExternalProvidersMethod     CoreMethod = "getExternalProviders"
+	getExternalProviderMethod      CoreMethod = "getExternalProvider"
+	getCountryCodeMethod           CoreMethod = "getCountryCode"
+	getMemoryMethod                CoreMethod = "getMemory"
+	updateGeoDataMethod            CoreMethod = "updateGeoData"
+	updateExternalProviderMethod   CoreMethod = "updateExternalProvider"
+	sideLoadExternalProviderMethod CoreMethod = "sideLoadExternalProvider"
+	startLogMethod                 CoreMethod = "startLog"
+	stopLogMethod                  CoreMethod = "stopLog"
+	startListenerMethod            CoreMethod = "startListener"
+	stopListenerMethod             CoreMethod = "stopListener"
+	updateDnsMethod                CoreMethod = "updateDns"
+	crashMethod                    CoreMethod = "crash"
+	setupConfigMethod              CoreMethod = "setupConfig"
+	getConfigMethod                CoreMethod = "getConfig"
+	clearEffectMethod              CoreMethod = "clearEffect"
 )
 
-type Method string
+type CoreMethod string
 
 type MessageType string
 
diff --git a/core/go.mod b/core/go.mod
index e04990f85e..fc40d0cf7c 100644
--- a/core/go.mod
+++ b/core/go.mod
@@ -14,7 +14,7 @@ require (
 require (
 	github.com/RyuaNerin/go-krypto v1.3.0 // indirect
 	github.com/Yawning/aez v0.0.0-20211027044916-e49e68abd344 // indirect
-	github.com/ajg/form v1.5.1 // indirect
+	github.com/ajg/form v1.7.1 // indirect
 	github.com/akutz/memconn v0.1.0 // indirect
 	github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa // indirect
 	github.com/andybalholm/brotli v1.1.1 // indirect
@@ -25,7 +25,7 @@ require (
 	github.com/coreos/go-iptables v0.8.0 // indirect
 	github.com/dlclark/regexp2 v1.12.0 // indirect
 	github.com/dunglas/httpsfv v1.0.2 // indirect
-	github.com/enfein/mieru/v3 v3.33.0 // indirect
+	github.com/enfein/mieru/v3 v3.34.0 // indirect
 	github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358 // indirect
 	github.com/ericlagergren/polyval v0.0.0-20220411101811-e25bc10ba391 // indirect
 	github.com/ericlagergren/siv v0.0.0-20220507050439-0b757b3aa5f1 // indirect
@@ -55,13 +55,13 @@ require (
 	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/metacubex/age v0.0.0-20260603010618-28d156b4ea78 // indirect
-	github.com/metacubex/amneziawg-go v0.0.0-20251104174305-5a0e9f7e361d // indirect
+	github.com/metacubex/amneziawg-go v0.0.0-20260612143004-19b4f1cdd5ec // indirect
 	github.com/metacubex/ascon v0.1.0 // indirect
 	github.com/metacubex/bart v0.26.0 // indirect
-	github.com/metacubex/bbolt v0.0.0-20250725135710-010dbbbb7a5b // indirect
+	github.com/metacubex/bbolt v0.0.0-20260706163408-d4ec34ad7c48 // indirect
 	github.com/metacubex/blake3 v0.1.0 // indirect
 	github.com/metacubex/chacha v0.1.5 // indirect
-	github.com/metacubex/chi v0.1.0 // indirect
+	github.com/metacubex/chi v0.1.1 // indirect
 	github.com/metacubex/connect-ip-go v0.0.0-20260412152424-e1625567920a // indirect
 	github.com/metacubex/cpu v0.1.1 // indirect
 	github.com/metacubex/edwards25519 v1.2.0 // indirect
@@ -71,32 +71,33 @@ require (
 	github.com/metacubex/hkdf v0.1.0 // indirect
 	github.com/metacubex/hpke v0.1.0 // indirect
 	github.com/metacubex/http v0.1.6 // indirect
+	github.com/metacubex/jls-quic-go v0.0.0-20260717074316-85a8decdd355 // indirect
+	github.com/metacubex/jls-tls v0.0.0-20260716145614-4bf88db633e2 // indirect
 	github.com/metacubex/jsonv2 v0.0.0-20260518173308-f4597c22f1df // indirect
 	github.com/metacubex/kcp-go v0.0.0-20260105040817-550693377604 // indirect
 	github.com/metacubex/mhurl v0.1.0 // indirect
 	github.com/metacubex/mlkem v0.1.0 // indirect
 	github.com/metacubex/nftables v0.0.0-20260426003805-208c2c1ba2cb // indirect
 	github.com/metacubex/qpack v0.6.0 // indirect
-	github.com/metacubex/quic-go v0.59.1-0.20260520020949-fcd18c7b6ace // indirect
+	github.com/metacubex/quic-go v0.59.1-0.20260606115121-0662b57ad5bf // indirect
 	github.com/metacubex/randv2 v0.2.0 // indirect
-	github.com/metacubex/restls-client-go v0.1.7 // indirect
+	github.com/metacubex/restls-client-go v0.1.8 // indirect
 	github.com/metacubex/sevenzip v1.6.4 // indirect
 	github.com/metacubex/sing v0.5.7 // indirect
-	github.com/metacubex/sing-mux v0.3.9 // indirect
+	github.com/metacubex/sing-mux v0.3.10 // indirect
 	github.com/metacubex/sing-quic v0.0.0-20260527143057-68e10a6afdc3 // indirect
 	github.com/metacubex/sing-shadowsocks v0.2.12 // indirect
 	github.com/metacubex/sing-shadowsocks2 v0.2.7 // indirect
-	github.com/metacubex/sing-shadowtls v0.0.0-20260517015314-c11c36474edc // indirect
-	github.com/metacubex/sing-tun v0.4.20 // indirect
+	github.com/metacubex/sing-tun v0.4.21 // indirect
 	github.com/metacubex/sing-vmess v0.2.5 // indirect
 	github.com/metacubex/sing-wireguard v0.0.0-20260520151737-7e7c7c1b854c // indirect
 	github.com/metacubex/smux v0.0.0-20260105030934-d0c8756d3141 // indirect
 	github.com/metacubex/ssh v0.1.0 // indirect
-	github.com/metacubex/tailscale v0.0.0-20260520011538-f23132fac4b7 // indirect
-	github.com/metacubex/tailscale-wireguard-go v0.0.0-20260521124654-e1bf77ef79af // indirect
-	github.com/metacubex/tfo-go v0.0.0-20251130171125-413e892ac443 // indirect
-	github.com/metacubex/tls v0.1.6 // indirect
-	github.com/metacubex/utls v1.8.4 // indirect
+	github.com/metacubex/tailscale v0.0.0-20260711142031-e2257fe61058 // indirect
+	github.com/metacubex/tailscale-wireguard-go v0.0.0-20260623093519-06ea214022e4 // indirect
+	github.com/metacubex/tfo-go v0.0.0-20260623020846-376a77860b8c // indirect
+	github.com/metacubex/tls v0.1.7 // indirect
+	github.com/metacubex/utls v1.8.7 // indirect
 	github.com/metacubex/wireguard-go v0.0.0-20250820062549-a6cecdd7f57f // indirect
 	github.com/metacubex/yamux v0.0.0-20250918083631-dd5f17c0be49 // indirect
 	github.com/miekg/dns v1.1.63 // indirect
diff --git a/core/go.sum b/core/go.sum
index f9206d6849..b8aa979025 100644
--- a/core/go.sum
+++ b/core/go.sum
@@ -6,8 +6,8 @@ github.com/RyuaNerin/testingutil v0.1.0 h1:IYT6JL57RV3U2ml3dLHZsVtPOP6yNK7WUVdzz
 github.com/RyuaNerin/testingutil v0.1.0/go.mod h1:yTqj6Ta/ycHMPJHRyO12Mz3VrvTloWOsy23WOZH19AA=
 github.com/Yawning/aez v0.0.0-20211027044916-e49e68abd344 h1:cDVUiFo+npB0ZASqnw4q90ylaVAbnYyx0JYqK4YcGok=
 github.com/Yawning/aez v0.0.0-20211027044916-e49e68abd344/go.mod h1:9pIqrY6SXNL8vjRQE5Hd/OL5GyK/9MrGUWs87z/eFfk=
-github.com/ajg/form v1.5.1 h1:t9c7v8JUKu/XxOGBU0yjNpaMloxGEJhUkqFRq0ibGeU=
-github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
+github.com/ajg/form v1.7.1 h1:OsnBDzTkrWdrxvEnO68I72ZVGJGNaMwPhoAm0V+llgc=
+github.com/ajg/form v1.7.1/go.mod h1:HL757PzLyNkj5AIfptT6L+iGNeXTlnrr/oDePGc/y7Q=
 github.com/akutz/memconn v0.1.0 h1:NawI0TORU4hcOMsMr11g7vwlCdkYeLKXBcxWu2W/P8A=
 github.com/akutz/memconn v0.1.0/go.mod h1:Jo8rI7m0NieZyLI5e2CDlRdRqRRB4S7Xp77ukDjH+Fw=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
@@ -34,8 +34,8 @@ github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dunglas/httpsfv v1.0.2 h1:iERDp/YAfnojSDJ7PW3dj1AReJz4MrwbECSSE59JWL0=
 github.com/dunglas/httpsfv v1.0.2/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
-github.com/enfein/mieru/v3 v3.33.0 h1:hv2jK8nqYHwpSG86U2rpZR2I8Aff1/J3ifRmd9NBbFc=
-github.com/enfein/mieru/v3 v3.33.0/go.mod h1:zJBUCsi5rxyvHM8fjFf+GLaEl4OEjjBXr1s5F6Qd3hM=
+github.com/enfein/mieru/v3 v3.34.0 h1:8yeaPORvfSQtdfEH+Arw9wttDyFxkik8My4zFdGu79Y=
+github.com/enfein/mieru/v3 v3.34.0/go.mod h1:zJBUCsi5rxyvHM8fjFf+GLaEl4OEjjBXr1s5F6Qd3hM=
 github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358 h1:kXYqH/sL8dS/FdoFjr12ePjnLPorPo2FsnrHNuXSDyo=
 github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358/go.mod h1:hkIFzoiIPZYxdFOOLyDho59b7SrDfo+w3h+yWdlg45I=
 github.com/ericlagergren/polyval v0.0.0-20220411101811-e25bc10ba391 h1:8j2RH289RJplhA6WfdaPqzg1MjH2K8wX5e0uhAxrw2g=
@@ -106,20 +106,20 @@ github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
 github.com/metacubex/age v0.0.0-20260603010618-28d156b4ea78 h1:LqWr0vb9zDNuQS+jJd4fnRYk/SEI7KJ7TDe/L4WFK48=
 github.com/metacubex/age v0.0.0-20260603010618-28d156b4ea78/go.mod h1:BTBG/iVY7rg3qq5WdVCg0GFk58CSvCDSbjy8I7kEx/c=
-github.com/metacubex/amneziawg-go v0.0.0-20251104174305-5a0e9f7e361d h1:vAJ0ZT4aO803F1uw2roIA9yH7Sxzox34tVVyye1bz6c=
-github.com/metacubex/amneziawg-go v0.0.0-20251104174305-5a0e9f7e361d/go.mod h1:MsM/5czONyXMJ3PRr5DbQ4O/BxzAnJWOIcJdLzW6qHY=
+github.com/metacubex/amneziawg-go v0.0.0-20260612143004-19b4f1cdd5ec h1:nRHevF7PmvDKjkYPjQCU7NUfVrr3Sry4QOPxpqoyo8U=
+github.com/metacubex/amneziawg-go v0.0.0-20260612143004-19b4f1cdd5ec/go.mod h1:MsM/5czONyXMJ3PRr5DbQ4O/BxzAnJWOIcJdLzW6qHY=
 github.com/metacubex/ascon v0.1.0 h1:6ZWxmXYszT1XXtwkf6nxfFhc/OTtQ9R3Vyj1jN32lGM=
 github.com/metacubex/ascon v0.1.0/go.mod h1:eV5oim4cVPPdEL8/EYaTZ0iIKARH9pnhAK/fcT5Kacc=
 github.com/metacubex/bart v0.26.0 h1:d/bBTvVatfVWGfQbiDpYKI1bXUJgjaabB2KpK1Tnk6w=
 github.com/metacubex/bart v0.26.0/go.mod h1:DCcyfP4MC+Zy7sLK7XeGuMw+P5K9mIRsYOBgiE8icsI=
-github.com/metacubex/bbolt v0.0.0-20250725135710-010dbbbb7a5b h1:j7dadXD8I2KTmMt8jg1JcaP1ANL3JEObJPdANKcSYPY=
-github.com/metacubex/bbolt v0.0.0-20250725135710-010dbbbb7a5b/go.mod h1:+WmP0VJZDkDszvpa83HzfUp6QzARl/IKkMorH4+nODw=
+github.com/metacubex/bbolt v0.0.0-20260706163408-d4ec34ad7c48 h1:D+AoQ7g/ZeZAHAapelrZB0xUNRcDGuoNLcGmHCnC9Ss=
+github.com/metacubex/bbolt v0.0.0-20260706163408-d4ec34ad7c48/go.mod h1:yOfzykxfYIEVOtEys6KOKwxy75M2I/KtOQ+p3Kzc8/k=
 github.com/metacubex/blake3 v0.1.0 h1:KGnjh/56REO7U+cgZA8dnBhxdP7jByrG7hTP+bu6cqY=
 github.com/metacubex/blake3 v0.1.0/go.mod h1:CCkLdzFrqf7xmxCdhQFvJsRRV2mwOLDoSPg6vUTB9Uk=
 github.com/metacubex/chacha v0.1.5 h1:fKWMb/5c7ZrY8Uoqi79PPFxl+qwR7X/q0OrsAubyX2M=
 github.com/metacubex/chacha v0.1.5/go.mod h1:Djn9bPZxLTXbJFSeyo0/qzEzQI+gUSSzttuzZM75GH8=
-github.com/metacubex/chi v0.1.0 h1:rjNDyDj50nRpicG43CNkIw4ssiCbmDL8d7wJXKlUCsg=
-github.com/metacubex/chi v0.1.0/go.mod h1:zM5u5oMQt8b2DjvDHvzadKrP6B2ztmasL1YHRMbVV+g=
+github.com/metacubex/chi v0.1.1 h1:GajmCIXSIPAZNxqTTYpkCrkY9suBz9wjIdgPcoQ5K1A=
+github.com/metacubex/chi v0.1.1/go.mod h1:/CvDXe8jZD/ecU8Y7fmS5XKLRR44UDmC6/IBkRIb6Z4=
 github.com/metacubex/connect-ip-go v0.0.0-20260412152424-e1625567920a h1:Ph5UfTWDsGruZ+v95Df1ycTflQFmpZBFg2LUvj2kx/M=
 github.com/metacubex/connect-ip-go v0.0.0-20260412152424-e1625567920a/go.mod h1:xYC8Ik7/rN6no+vTRuWMEziGwm3brA0wNM/zZP9qhOQ=
 github.com/metacubex/cpu v0.1.1 h1:rRV5HGmeuGzjiKI3hYbL0dCd0qGwM7VUtk4ICXD06mI=
@@ -138,6 +138,10 @@ github.com/metacubex/hpke v0.1.0 h1:gu2jUNhraehWi0P/z5HX2md3d7L1FhPQE6/Q0E9r9xQ=
 github.com/metacubex/hpke v0.1.0/go.mod h1:vfDm6gfgrwlXUxKDkWbcE44hXtmc1uxLDm2BcR11b3U=
 github.com/metacubex/http v0.1.6 h1:xvXuvXMCMxCWMF5nEJF4yiKvXL+p2atWMzs37e80m1I=
 github.com/metacubex/http v0.1.6/go.mod h1:Nxx0zZAo2AhRfanyL+fmmK6ACMtVsfpwIl1aFAik2Eg=
+github.com/metacubex/jls-quic-go v0.0.0-20260717074316-85a8decdd355 h1:DD4qraoIY3IbkHxaBbpJR68sWNzrdKHfFRfFhT6m1W8=
+github.com/metacubex/jls-quic-go v0.0.0-20260717074316-85a8decdd355/go.mod h1:dbfkDUKqohALRmgUrVIOLirCNfKjgaos9nfTnBRTpS8=
+github.com/metacubex/jls-tls v0.0.0-20260716145614-4bf88db633e2 h1:n+qiR8opOJEerewq/S92zGoHBDXZb+dKmyYq0aKJtis=
+github.com/metacubex/jls-tls v0.0.0-20260716145614-4bf88db633e2/go.mod h1:mmqs889W/TqPlfNRDa2UyJvRiLyiTJIEnWHkcj3SKB8=
 github.com/metacubex/jsonv2 v0.0.0-20260518173308-f4597c22f1df h1:S0vBzqjXok24VopstOgPd1JdgglW9tXehrqvwpQWbQ8=
 github.com/metacubex/jsonv2 v0.0.0-20260518173308-f4597c22f1df/go.mod h1:F4sVXat6QjPXkNsKRDyyG3BhSkxPFFnRPEIwmmyCgbg=
 github.com/metacubex/kcp-go v0.0.0-20260105040817-550693377604 h1:hJwCVlE3ojViC35MGHB+FBr8TuIf3BUFn2EQ1VIamsI=
@@ -150,28 +154,26 @@ github.com/metacubex/nftables v0.0.0-20260426003805-208c2c1ba2cb h1:wk6mHYPURSUv
 github.com/metacubex/nftables v0.0.0-20260426003805-208c2c1ba2cb/go.mod h1:73ZrCfhdkW4F2E2GAlta3km/S2RHhFNogCMtWZV2anQ=
 github.com/metacubex/qpack v0.6.0 h1:YqClGIMOpiRYLjV1qOs483Od08MdPgRnHjt90FuaAKw=
 github.com/metacubex/qpack v0.6.0/go.mod h1:lKGSi7Xk94IMvHGOmxS9eIei3bvIqpOAImEBsaOwTkA=
-github.com/metacubex/quic-go v0.59.1-0.20260520020949-fcd18c7b6ace h1:KXacx7dp1GYVMgxezwXRt5BMsEbvAYuA6rPFUmdAvcQ=
-github.com/metacubex/quic-go v0.59.1-0.20260520020949-fcd18c7b6ace/go.mod h1:2YEQEvFrZ5V76oynMBDTlN+4fdnSHCa2uNJxv3cm1HU=
+github.com/metacubex/quic-go v0.59.1-0.20260606115121-0662b57ad5bf h1:WvIp5pF+LLZwg0I6555eMVlKFrLrqQqPKob6XW6niyo=
+github.com/metacubex/quic-go v0.59.1-0.20260606115121-0662b57ad5bf/go.mod h1:2YEQEvFrZ5V76oynMBDTlN+4fdnSHCa2uNJxv3cm1HU=
 github.com/metacubex/randv2 v0.2.0 h1:uP38uBvV2SxYfLj53kuvAjbND4RUDfFJjwr4UigMiLs=
 github.com/metacubex/randv2 v0.2.0/go.mod h1:kFi2SzrQ5WuneuoLLCMkABtiBu6VRrMrWFqSPyj2cxY=
-github.com/metacubex/restls-client-go v0.1.7 h1:eCwiXCTQb5WJu9IlgYvDBA1OgrINv58dEe7hcN5H15k=
-github.com/metacubex/restls-client-go v0.1.7/go.mod h1:BN/U52vPw7j8VTSh2vleD/MnmVKCov84mS5VcjVHH4g=
+github.com/metacubex/restls-client-go v0.1.8 h1:0kQ699TWnbK3bWLhCPE0oIiBJLN+errOLQ9Z3/P1lbA=
+github.com/metacubex/restls-client-go v0.1.8/go.mod h1:BN/U52vPw7j8VTSh2vleD/MnmVKCov84mS5VcjVHH4g=
 github.com/metacubex/sevenzip v1.6.4 h1:OIL+DeOeSAbKNsjqxcYUMiarRmX6Kaxakb0GT7E9Oik=
 github.com/metacubex/sevenzip v1.6.4/go.mod h1:FP3X9bzFKj9wPxifGN9B3w2fIEicMjzKYIGIhnu+1pw=
 github.com/metacubex/sing v0.5.7 h1:8OC+fhKFSv/l9ehEhJRaZZAOuthfZo68SteBVLe8QqM=
 github.com/metacubex/sing v0.5.7/go.mod h1:ypf0mjwlZm0sKdQSY+yQvmsbWa0hNPtkeqyRMGgoN+w=
-github.com/metacubex/sing-mux v0.3.9 h1:/aoBD2+sK2qsXDlNDe3hkR0GZuFDtwIZhOeGUx9W0Yk=
-github.com/metacubex/sing-mux v0.3.9/go.mod h1:8bT7ZKT3clRrJjYc/x5CRYibC1TX/bK73a3r3+2E+Fc=
+github.com/metacubex/sing-mux v0.3.10 h1:r5CuZ/KuwFsEcRRwpLvzLncW4fDzNfmSEcBEWcy/+94=
+github.com/metacubex/sing-mux v0.3.10/go.mod h1:8bT7ZKT3clRrJjYc/x5CRYibC1TX/bK73a3r3+2E+Fc=
 github.com/metacubex/sing-quic v0.0.0-20260527143057-68e10a6afdc3 h1:PnMby5+kZXTl/CFDHfxMbMTaSRD+uMKMsrDYVQyAmX8=
 github.com/metacubex/sing-quic v0.0.0-20260527143057-68e10a6afdc3/go.mod h1:6ayFGfzzBE85csgQkM3gf4neFq6s0losHlPRSxY+nuk=
 github.com/metacubex/sing-shadowsocks v0.2.12 h1:Wqzo8bYXrK5aWqxu/TjlTnYZzAKtKsaFQBdr6IHFaBE=
 github.com/metacubex/sing-shadowsocks v0.2.12/go.mod h1:2e5EIaw0rxKrm1YTRmiMnDulwbGxH9hAFlrwQLQMQkU=
 github.com/metacubex/sing-shadowsocks2 v0.2.7 h1:hSuuc0YpsfiqYqt1o+fP4m34BQz4e6wVj3PPBVhor3A=
 github.com/metacubex/sing-shadowsocks2 v0.2.7/go.mod h1:vOEbfKC60txi0ca+yUlqEwOGc3Obl6cnSgx9Gf45KjE=
-github.com/metacubex/sing-shadowtls v0.0.0-20260517015314-c11c36474edc h1:8wLoFfYQ88iGPL+krQ5tJsI8IAmkFjKpQL2q+y3pvss=
-github.com/metacubex/sing-shadowtls v0.0.0-20260517015314-c11c36474edc/go.mod h1:mbfboaXauKJNIHJYxQRa+NJs4JU9NZfkA+I33dS2+9E=
-github.com/metacubex/sing-tun v0.4.20 h1:xdupzizRoZKyDzP0l68WAx5Sk4ooiuT1GiWsiJyOGPw=
-github.com/metacubex/sing-tun v0.4.20/go.mod h1:g4I/JNplDBhXLF+aQWgFbhNeJPSXQOWS9HvLeNvkgeA=
+github.com/metacubex/sing-tun v0.4.21 h1:MjbPYytM240VH70lO182v2Sg/JthMmx6R6z6E2fCR2I=
+github.com/metacubex/sing-tun v0.4.21/go.mod h1:g4I/JNplDBhXLF+aQWgFbhNeJPSXQOWS9HvLeNvkgeA=
 github.com/metacubex/sing-vmess v0.2.5 h1:m9Zt5I27lB9fmLMZfism9sH2LcnAfShZfwSkf6/KJoE=
 github.com/metacubex/sing-vmess v0.2.5/go.mod h1:AwtlzUgf8COe9tRYAKqWZ+leDH7p5U98a0ZUpYehl8Q=
 github.com/metacubex/sing-wireguard v0.0.0-20260520151737-7e7c7c1b854c h1:tH9FuQW357zp2xAGzkoZTGpNGMVmEFZov0iV5M2S5ew=
@@ -180,16 +182,16 @@ github.com/metacubex/smux v0.0.0-20260105030934-d0c8756d3141 h1:DK2l6m2Fc85H2Bhi
 github.com/metacubex/smux v0.0.0-20260105030934-d0c8756d3141/go.mod h1:/yI4OiGOSn0SURhZdJF3CbtPg3nwK700bG8TZLMBvAg=
 github.com/metacubex/ssh v0.1.0 h1:iGfr99qk/eMHzUnQ/0bTxXT8+8SWqLSHBWDHoAhngzw=
 github.com/metacubex/ssh v0.1.0/go.mod h1:NUtl0d+/f2cG9ECEpMM8iCVOpmggQlC13oLeDUONDlU=
-github.com/metacubex/tailscale v0.0.0-20260520011538-f23132fac4b7 h1:LoJR4NMyNKHeEJoeGDtcsao7sV0NRkzMeV5H/0J0MIE=
-github.com/metacubex/tailscale v0.0.0-20260520011538-f23132fac4b7/go.mod h1:MAo3HhE7968rIwmDvYTYE8xCsV4x+hLnkChdXeP3X4c=
-github.com/metacubex/tailscale-wireguard-go v0.0.0-20260521124654-e1bf77ef79af h1:c60IbBMUq2h1M2m7+grMJJmBmrObxL8SwvNtm6Ozbwk=
-github.com/metacubex/tailscale-wireguard-go v0.0.0-20260521124654-e1bf77ef79af/go.mod h1:i3zLKytWkOnyT1i9OmiLevWvrN5J5HE1+yjE7UYNfcQ=
-github.com/metacubex/tfo-go v0.0.0-20251130171125-413e892ac443 h1:H6TnfM12tOoTizYE/qBHH3nEuibIelmHI+BVSxVJr8o=
-github.com/metacubex/tfo-go v0.0.0-20251130171125-413e892ac443/go.mod h1:l9oLnLoEXyGZ5RVLsh7QCC5XsouTUyKk4F2nLm2DHLw=
-github.com/metacubex/tls v0.1.6 h1:t2ubLneYa4ceyIC++54a57BLqZFA/QYUrhdjLk2GPwo=
-github.com/metacubex/tls v0.1.6/go.mod h1:0XeVdL0cBw+8i5Hqy3lVeP9IyD/LFTq02ExvHM6rzEM=
-github.com/metacubex/utls v1.8.4 h1:HmL9nUApDdWSkgUyodfwF6hSjtiwCGGdyhaSpEejKpg=
-github.com/metacubex/utls v1.8.4/go.mod h1:kncGGVhFaoGn5M3pFe3SXhZCzsbCJayNOH4UEqTKTko=
+github.com/metacubex/tailscale v0.0.0-20260711142031-e2257fe61058 h1:TFM/yl2XvyMDQY16GHDxXtuJMa8DGz7roRpY6plxLMk=
+github.com/metacubex/tailscale v0.0.0-20260711142031-e2257fe61058/go.mod h1:rDpd7cy7itpPi3Kgb90fUgSnKwMXHYBk0R5DuNRiNNA=
+github.com/metacubex/tailscale-wireguard-go v0.0.0-20260623093519-06ea214022e4 h1:ui12xOUPsCAYwzI7+7Hw2mVhrAbWDGNQZcrBiELhGk0=
+github.com/metacubex/tailscale-wireguard-go v0.0.0-20260623093519-06ea214022e4/go.mod h1:W00EeoPdd2jbV3+ZUa0m2b7FdKx5B1LFsXvEpy7cToQ=
+github.com/metacubex/tfo-go v0.0.0-20260623020846-376a77860b8c h1:+2C1UshSLzaogLY/IDz1XhOLxjhs3rkhVHB4eCN9Zto=
+github.com/metacubex/tfo-go v0.0.0-20260623020846-376a77860b8c/go.mod h1:l9oLnLoEXyGZ5RVLsh7QCC5XsouTUyKk4F2nLm2DHLw=
+github.com/metacubex/tls v0.1.7 h1:7YW+7z2xGH1bozSg04q3gKNd7GBSiTSXIrQY2SMnfoE=
+github.com/metacubex/tls v0.1.7/go.mod h1:0XeVdL0cBw+8i5Hqy3lVeP9IyD/LFTq02ExvHM6rzEM=
+github.com/metacubex/utls v1.8.7 h1:Cp+yWkNTFkSihETgGWq34hlVFds5HpYWVOR1xovUVTs=
+github.com/metacubex/utls v1.8.7/go.mod h1:kncGGVhFaoGn5M3pFe3SXhZCzsbCJayNOH4UEqTKTko=
 github.com/metacubex/wireguard-go v0.0.0-20250820062549-a6cecdd7f57f h1:FGBPRb1zUabhPhDrlKEjQ9lgIwQ6cHL4x8M9lrERhbk=
 github.com/metacubex/wireguard-go v0.0.0-20250820062549-a6cecdd7f57f/go.mod h1:oPGcV994OGJedmmxrcK9+ni7jUEMGhR+uVQAdaduIP4=
 github.com/metacubex/yamux v0.0.0-20250918083631-dd5f17c0be49 h1:lhlqpYHopuTLx9xQt22kSA9HtnyTDmk5XjjQVCGHe2E=
diff --git a/core/hub.go b/core/hub.go
index aad920838f..ac3e8a3641 100644
--- a/core/hub.go
+++ b/core/hub.go
@@ -3,7 +3,6 @@ package main
 import (
 	"cmp"
 	"context"
-	"encoding/json"
 	"github.com/metacubex/mihomo/adapter"
 	"github.com/metacubex/mihomo/adapter/outboundgroup"
 	"github.com/metacubex/mihomo/common/observable"
@@ -23,30 +22,27 @@ import (
 	"golang.org/x/exp/slices"
 	"net"
 	"os"
+	"path/filepath"
 	"runtime"
 	"runtime/debug"
 	"strconv"
+	"sync/atomic"
 	"time"
 )
 
 var (
-	isInit            = false
+	isInit            atomic.Bool
 	externalProviders = map[string]cp.Provider{}
 	logSubscriber     observable.Subscription[log.Event]
 )
 
-func handleInitClash(paramsString string) bool {
+func handleInitClash(params *InitParams) bool {
 	runLock.Lock()
 	defer runLock.Unlock()
-	var params = InitParams{}
-	err := json.Unmarshal([]byte(paramsString), &params)
-	if err != nil {
-		return false
-	}
 	version = params.Version
 	constant.SetHomeDir(params.HomeDir)
-	isInit = true
-	return isInit
+	isInit.Store(true)
+	return true
 }
 
 func handleStartListener() bool {
@@ -68,7 +64,7 @@ func handleStopListener() bool {
 }
 
 func handleGetIsInit() bool {
-	return isInit
+	return isInit.Load()
 }
 
 func handleForceGC() {
@@ -83,7 +79,7 @@ func handleShutdown() bool {
 	stopListeners()
 	executor.Shutdown()
 	handleForceGC()
-	isInit = false
+	isInit.Store(false)
 	return true
 }
 
@@ -136,25 +132,23 @@ func handleGetProxies() ProxiesData {
 	}
 }
 
-func handleChangeProxy(data string, fn func(string string)) {
+func handleChangeProxy(params *ChangeProxyParams, fn func(string string)) {
 	runLock.Lock()
 	go func() {
 		defer runLock.Unlock()
-		var params = &ChangeProxyParams{}
-		err := json.Unmarshal([]byte(data), params)
-		if err != nil {
-			fn(err.Error())
-			return
-		}
-		groupName := *params.GroupName
-		proxyName := *params.ProxyName
+		groupName := params.GroupName
+		proxyName := params.ProxyName
 		proxies := tunnel.AllProxies()
 		group, ok := proxies[groupName]
 		if !ok {
 			fn("Not found group")
 			return
 		}
-		adapterProxy := group.(*adapter.Proxy)
+		adapterProxy, ok := group.(*adapter.Proxy)
+		if !ok {
+			fn("Group has invalid proxy type")
+			return
+		}
 		selector, ok := adapterProxy.ProxyAdapter.(outboundgroup.SelectAble)
 		if !ok {
 			fn("Group is not selectable")
@@ -163,11 +157,11 @@ func handleChangeProxy(data string, fn func(string string)) {
 		if proxyName == "" {
 			selector.ForceSet(proxyName)
 		} else {
-			err = selector.Set(proxyName)
-		}
-		if err != nil {
-			fn(err.Error())
-			return
+			err := selector.Set(proxyName)
+			if err != nil {
+				fn(err.Error())
+				return
+			}
 		}
 
 		fn("")
@@ -175,50 +169,42 @@ func handleChangeProxy(data string, fn func(string string)) {
 	}()
 }
 
-func handleGetTraffic(onlyStatisticsProxy bool) string {
+func handleGetTraffic(onlyStatisticsProxy bool) Traffic {
 	up, down := statistic.DefaultManager.NowTraffic(onlyStatisticsProxy)
-	traffic := map[string]int64{
-		"up":   up,
-		"down": down,
-	}
-	data, err := json.Marshal(traffic)
-	if err != nil {
-		logError("Error: %s", err)
-		return ""
+	return Traffic{
+		Up:   up,
+		Down: down,
 	}
-	return string(data)
 }
 
-func handleGetTotalTraffic(onlyStatisticsProxy bool) string {
+func handleGetTotalTraffic(onlyStatisticsProxy bool) Traffic {
 	up, down := statistic.DefaultManager.TotalTraffic(onlyStatisticsProxy)
-	traffic := map[string]int64{
-		"up":   up,
-		"down": down,
-	}
-	data, err := json.Marshal(traffic)
-	if err != nil {
-		logError("Error: %s", err)
-		return ""
+	return Traffic{
+		Up:   up,
+		Down: down,
 	}
-	return string(data)
 }
 
 func handleResetTraffic() {
 	statistic.DefaultManager.ResetStatistic()
 }
 
-func handleAsyncTestDelay(paramsString string, fn func(string)) {
-	mBatch.Go(paramsString, func() (bool, error) {
-		var params = &TestDelayParams{}
-		err := json.Unmarshal([]byte(paramsString), params)
-		if err != nil {
-			fn("")
-			return false, nil
+func handleAsyncTestDelay(params *TestDelayParams, fn func(*Delay)) {
+	batchKey := params.ProxyName + "\x00" + params.TestUrl
+	mBatch.Go(batchKey, func() (bool, error) {
+		testUrl := params.TestUrl
+		if testUrl == "" {
+			testUrl = constant.DefaultTestURL
+		}
+		delayData := &Delay{
+			Name:  params.ProxyName,
+			Url:   testUrl,
+			Value: -1,
 		}
 
 		expectedStatus, err := utils.NewUnsignedRanges[uint16]("")
 		if err != nil {
-			fn("")
+			fn(delayData)
 			return false, nil
 		}
 
@@ -228,48 +214,26 @@ func handleAsyncTestDelay(paramsString string, fn func(string)) {
 		proxies := tunnel.AllProxies()
 		proxy := proxies[params.ProxyName]
 
-		delayData := &Delay{
-			Name: params.ProxyName,
-		}
-
 		if proxy == nil {
-			delayData.Value = -1
-			data, _ := json.Marshal(delayData)
-			fn(string(data))
+			fn(delayData)
 			return false, nil
 		}
-
-		testUrl := constant.DefaultTestURL
-
-		if params.TestUrl != "" {
-			testUrl = params.TestUrl
-		}
-		delayData.Url = testUrl
 		delay, err := proxy.URLTest(ctx, testUrl, expectedStatus)
 		if err != nil || delay == 0 {
-			delayData.Value = -1
-			data, _ := json.Marshal(delayData)
-			fn(string(data))
+			fn(delayData)
 			return false, nil
 		}
 
 		delayData.Value = int32(delay)
-		data, _ := json.Marshal(delayData)
-		fn(string(data))
+		fn(delayData)
 		return false, nil
 	})
 }
 
-func handleGetConnections() string {
+func handleGetConnections() *statistic.Snapshot {
 	runLock.Lock()
 	defer runLock.Unlock()
-	snapshot := statistic.DefaultManager.Snapshot()
-	data, err := json.Marshal(snapshot)
-	if err != nil {
-		logError("Error: %s", err)
-		return ""
-	}
-	return string(data)
+	return statistic.DefaultManager.Snapshot()
 }
 
 func handleCloseConnections() bool {
@@ -307,7 +271,7 @@ func handleCloseConnection(connectionId string) bool {
 	return true
 }
 
-func handleGetExternalProviders() string {
+func handleGetExternalProviders() []ExternalProvider {
 	runLock.Lock()
 	defer runLock.Unlock()
 	externalProviders = getExternalProvidersRaw()
@@ -322,29 +286,21 @@ func handleGetExternalProviders() string {
 	slices.SortFunc(eps, func(a, b ExternalProvider) int {
 		return cmp.Compare(a.Name, b.Name)
 	})
-	data, err := json.Marshal(eps)
-	if err != nil {
-		return ""
-	}
-	return string(data)
+	return eps
 }
 
-func handleGetExternalProvider(externalProviderName string) string {
+func handleGetExternalProvider(externalProviderName string) *ExternalProvider {
 	runLock.Lock()
 	defer runLock.Unlock()
 	externalProvider, exist := externalProviders[externalProviderName]
 	if !exist {
-		return ""
+		return nil
 	}
 	e, err := toExternalProvider(externalProvider)
 	if err != nil {
-		return ""
-	}
-	data, err := json.Marshal(e)
-	if err != nil {
-		return ""
+		return nil
 	}
-	return string(data)
+	return e
 }
 
 func handleUpdateGeoData(geoType string) {
@@ -368,7 +324,9 @@ func handleUpdateGeoData(geoType string) {
 
 func handleUpdateExternalProvider(providerName string, fn func(value string)) {
 	go func() {
+		runLock.Lock()
 		externalProvider, exist := externalProviders[providerName]
+		runLock.Unlock()
 		if !exist {
 			fn("external provider is not exist")
 			return
@@ -410,13 +368,15 @@ func handleSuspend(suspended bool) bool {
 }
 
 func handleStartLog() {
+	runLock.Lock()
 	if logSubscriber != nil {
 		log.UnSubscribe(logSubscriber)
-		logSubscriber = nil
 	}
-	logSubscriber = log.Subscribe()
+	subscriber := log.Subscribe()
+	logSubscriber = subscriber
+	runLock.Unlock()
 	go func() {
-		for logData := range logSubscriber {
+		for logData := range subscriber {
 			if logData.LogLevel < log.Level() {
 				continue
 			}
@@ -430,6 +390,8 @@ func handleStartLog() {
 }
 
 func handleStopLog() {
+	runLock.Lock()
+	defer runLock.Unlock()
 	if logSubscriber != nil {
 		log.UnSubscribe(logSubscriber)
 		logSubscriber = nil
@@ -449,9 +411,9 @@ func handleGetCountryCode(ip string, fn func(value string)) {
 	}()
 }
 
-func handleGetMemory(fn func(value string)) {
+func handleGetMemory(fn func(value uint64)) {
 	go func() {
-		fn(strconv.FormatUint(statistic.DefaultManager.Memory(), 10))
+		fn(statistic.DefaultManager.Memory())
 	}()
 }
 
@@ -471,55 +433,46 @@ func handleCrash() {
 	panic("handle invoke crash")
 }
 
-func handleUpdateConfig(bytes []byte) string {
-	var params = &UpdateParams{}
-	err := json.Unmarshal(bytes, params)
-	if err != nil {
-		return err.Error()
-	}
+func handleUpdateConfig(params *UpdateParams) string {
 	updateConfig(params)
 	return ""
 }
 
-func handleDelFile(path string, result ActionResult) {
+// handleClearEffect derives the provider directory from a profile ID so the
+// method cannot be used as a general-purpose privileged file deletion API.
+func handleClearEffect(profileId int64, response MethodResponse) {
 	go func() {
-		fileInfo, err := os.Stat(path)
-		if err != nil {
-			if !os.IsNotExist(err) {
-				result.success(err.Error())
-			}
-			result.success("")
+		if !isInit.Load() {
+			response.success("not initialized")
 			return
 		}
-		if fileInfo.IsDir() {
-			err = os.RemoveAll(path)
-			if err != nil {
-				result.success(err.Error())
-				return
-			}
-		} else {
-			err = os.Remove(path)
-			if err != nil {
-				result.success(err.Error())
-				return
-			}
+		if profileId <= 0 {
+			response.success("invalid profile id")
+			return
+		}
+		providersRoot := filepath.Join(
+			constant.Path.HomeDir(),
+			"profiles",
+			"providers",
+		)
+		providersPath := filepath.Join(
+			providersRoot,
+			strconv.FormatInt(profileId, 10),
+		)
+		if err := os.RemoveAll(providersPath); err != nil {
+			response.success(err.Error())
+			return
 		}
-		result.success("")
+		_ = os.Remove(providersRoot)
+		response.success("")
 	}()
 }
 
-func handleSetupConfig(bytes []byte) string {
-	if !isInit {
+func handleSetupConfig(params *SetupParams) string {
+	if !isInit.Load() {
 		return "not initialized"
 	}
-	var params = defaultSetupParams()
-	err := UnmarshalJson(bytes, params)
-	if err != nil {
-		logError("unmarshalRawConfig error %v", err)
-		_ = applyConfig(defaultSetupParams())
-		return err.Error()
-	}
-	err = applyConfig(params)
+	err := applyConfig(params)
 	if err != nil {
 		return err.Error()
 	}
diff --git a/core/lib.go b/core/lib.go
index 61d0089e57..7082f44374 100644
--- a/core/lib.go
+++ b/core/lib.go
@@ -159,43 +159,44 @@ func handleUpdateDns(value string) {
 	}()
 }
 
-func (result ActionResult) send() {
-	data, err := result.Json()
+func (response MethodResponse) send() {
+	data, err := response.JSON()
 	if err != nil {
 		return
 	}
-	invokeResult(result.callback, string(data))
-	if result.Method != messageMethod {
-		releaseObject(result.callback)
-	}
+	invokeResult(response.callback, string(data))
+	releaseObject(response.callback)
 }
 
-func nextHandle(action *Action, result ActionResult) bool {
-	switch action.Method {
+func handlePlatformMethodCall(call *MethodCall, response MethodResponse) bool {
+	switch call.Method {
 	case updateDnsMethod:
-		data := action.Data.(string)
-		handleUpdateDns(data)
-		result.success(true)
+		value := ""
+		if !decodeMethodArguments(call, response, &value) {
+			return true
+		}
+		handleUpdateDns(value)
+		response.success(true)
 		return true
 	}
 	return false
 }
 
-//export invokeAction
-func invokeAction(callback unsafe.Pointer, paramsChar *C.char) {
+//export invokeMethod
+func invokeMethod(callback unsafe.Pointer, paramsChar *C.char) {
 	params := takeCString(paramsChar)
-	var action = &Action{}
-	err := json.Unmarshal([]byte(params), action)
+	call := &MethodCall{}
+	err := json.Unmarshal([]byte(params), call)
 	if err != nil {
-		invokeResult(callback, err.Error())
+		response := MethodResponse{callback: callback}
+		response.failure("invalid_method_call", err.Error(), nil)
 		return
 	}
-	result := ActionResult{
-		Id:       action.Id,
-		Method:   action.Method,
+	response := MethodResponse{
+		ID:       call.ID,
 		callback: callback,
 	}
-	go handleAction(action, result)
+	go handleMethodCall(call, response)
 }
 
 //export startTUN
@@ -212,14 +213,21 @@ func startTUN(callback unsafe.Pointer, fd C.int, stackChar, addressChar, dnsChar
 //export quickSetup
 func quickSetup(callback unsafe.Pointer, initParamsChar *C.char, setupParamsChar *C.char) {
 	go func() {
+		defer releaseObject(callback)
 		initParamsString := takeCString(initParamsChar)
 		setupParamsString := takeCString(setupParamsChar)
-		if !handleInitClash(initParamsString) {
+		initParams := InitParams{}
+		if err := json.Unmarshal([]byte(initParamsString), &initParams); err != nil || !handleInitClash(&initParams) {
 			invokeResult(callback, "init failed")
 			return
 		}
 		isRunning = true
-		message := handleSetupConfig([]byte(setupParamsString))
+		setupParams := defaultSetupParams()
+		if err := UnmarshalJson([]byte(setupParamsString), setupParams); err != nil {
+			invokeResult(callback, err.Error())
+			return
+		}
+		message := handleSetupConfig(setupParams)
 		invokeResult(callback, message)
 	}()
 }
@@ -234,28 +242,42 @@ func setEventListener(listener unsafe.Pointer) {
 
 //export getTotalTraffic
 func getTotalTraffic(onlyStatisticsProxy bool) *C.char {
-	data := C.CString(handleGetTotalTraffic(onlyStatisticsProxy))
-	defer C.free(unsafe.Pointer(data))
-	return data
+	return C.CString(marshalResult(handleGetTotalTraffic(onlyStatisticsProxy)))
 }
 
 //export getTraffic
 func getTraffic(onlyStatisticsProxy bool) *C.char {
-	data := C.CString(handleGetTraffic(onlyStatisticsProxy))
-	defer C.free(unsafe.Pointer(data))
-	return data
+	return C.CString(marshalResult(handleGetTraffic(onlyStatisticsProxy)))
 }
 
-func sendMessage(message Message) {
+func marshalResult(value any) string {
+	data, err := json.Marshal(value)
+	if err != nil {
+		logError("Result marshal error: %v", err)
+		return ""
+	}
+	return string(data)
+}
+
+func sendMessageBatch(messages []Message) {
 	if eventListener == nil {
 		return
 	}
-	result := ActionResult{
-		Method:   messageMethod,
-		callback: eventListener,
-		Data:     message,
+	arguments, err := json.Marshal(messages)
+	if err != nil {
+		logError("Message batch marshal error: %v", err)
+		return
+	}
+	call := MethodCall{
+		Method:    messageMethod,
+		Arguments: arguments,
+	}
+	data, err := json.Marshal(call)
+	if err != nil {
+		logError("MethodCall marshal error: method=%s err=%v", call.Method, err)
+		return
 	}
-	result.send()
+	invokeResult(eventListener, string(data))
 }
 
 //export stopTun
diff --git a/core/message.go b/core/message.go
new file mode 100644
index 0000000000..cb3dff0a54
--- /dev/null
+++ b/core/message.go
@@ -0,0 +1,124 @@
+package main
+
+import "time"
+
+const (
+	messageBatchInterval = 16 * time.Millisecond
+	messageBatchSize     = 32
+	messageQueueSize     = 256
+	messagePriorityBurst = 8
+)
+
+var (
+	priorityMessageQueue = make(chan Message, messageQueueSize)
+	bulkMessageQueue     = make(chan Message, messageQueueSize)
+)
+
+func init() {
+	go runMessageBatcher(priorityMessageQueue, bulkMessageQueue, sendMessageBatch)
+}
+
+func sendMessage(message Message) {
+	queue := priorityMessageQueue
+	if message.Type == LogMessage || message.Type == RequestMessage {
+		queue = bulkMessageQueue
+	}
+	enqueueLatest(queue, message)
+}
+
+func enqueueLatest(queue chan Message, message Message) {
+	select {
+	case queue <- message:
+		return
+	default:
+	}
+
+	// Event delivery must never block the core. Each priority class evicts only
+	// its own oldest event, so log or request floods cannot displace state.
+	select {
+	case <-queue:
+	default:
+	}
+	select {
+	case queue <- message:
+	default:
+	}
+}
+
+func runMessageBatcher(
+	priorityMessages <-chan Message,
+	bulkMessages <-chan Message,
+	send func([]Message),
+) {
+	ticker := time.NewTicker(messageBatchInterval)
+	defer ticker.Stop()
+
+	batch := make([]Message, 0, messageBatchSize)
+	flush := func() {
+		if len(batch) == 0 {
+			return
+		}
+		current := append([]Message(nil), batch...)
+		batch = batch[:0]
+		send(current)
+	}
+	appendMessage := func(message Message) {
+		batch = append(batch, message)
+		if len(batch) >= messageBatchSize {
+			flush()
+		}
+	}
+
+	priorityBurst := 0
+	for priorityMessages != nil || bulkMessages != nil {
+		// Give bulk events one guaranteed opportunity after a bounded priority
+		// burst, while retaining priority preference under ordinary load.
+		if priorityBurst >= messagePriorityBurst && bulkMessages != nil {
+			select {
+			case message, ok := <-bulkMessages:
+				if !ok {
+					bulkMessages = nil
+				} else {
+					appendMessage(message)
+				}
+				priorityBurst = 0
+				continue
+			default:
+				priorityBurst = 0
+			}
+		}
+
+		// Prefer state-bearing events whenever both queues have work.
+		select {
+		case message, ok := <-priorityMessages:
+			if !ok {
+				priorityMessages = nil
+			} else {
+				appendMessage(message)
+				priorityBurst++
+			}
+			continue
+		default:
+		}
+
+		select {
+		case message, ok := <-priorityMessages:
+			if !ok {
+				priorityMessages = nil
+			} else {
+				appendMessage(message)
+				priorityBurst++
+			}
+		case message, ok := <-bulkMessages:
+			if !ok {
+				bulkMessages = nil
+			} else {
+				appendMessage(message)
+			}
+			priorityBurst = 0
+		case <-ticker.C:
+			flush()
+		}
+	}
+	flush()
+}
diff --git a/core/method.go b/core/method.go
new file mode 100644
index 0000000000..62c4c3abaf
--- /dev/null
+++ b/core/method.go
@@ -0,0 +1,276 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"runtime"
+	"unsafe"
+)
+
+type MethodCall struct {
+	ID        string          `json:"id,omitempty"`
+	Method    CoreMethod      `json:"method"`
+	Arguments json.RawMessage `json:"arguments"`
+}
+
+func (call MethodCall) decodeArguments(target any) error {
+	if len(call.Arguments) == 0 || string(call.Arguments) == "null" {
+		return fmt.Errorf("missing arguments")
+	}
+	return json.Unmarshal(call.Arguments, target)
+}
+
+func decodeMethodArguments(call *MethodCall, response MethodResponse, target any) bool {
+	if err := call.decodeArguments(target); err != nil {
+		response.failure(
+			"invalid_arguments",
+			fmt.Sprintf("invalid arguments for %s: %v", call.Method, err),
+			nil,
+		)
+		return false
+	}
+	return true
+}
+
+type MethodError struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+	Details any    `json:"details"`
+}
+
+type MethodResponse struct {
+	ID       string       `json:"id,omitempty"`
+	Result   any          `json:"result"`
+	Error    *MethodError `json:"error,omitempty"`
+	callback unsafe.Pointer
+}
+
+func (response MethodResponse) JSON() ([]byte, error) {
+	return json.Marshal(response)
+}
+
+func (response MethodResponse) success(result any) {
+	response.Result = result
+	response.Error = nil
+	response.send()
+}
+
+func (response MethodResponse) failure(code, message string, details any) {
+	response.Result = nil
+	response.Error = &MethodError{
+		Code:    code,
+		Message: message,
+		Details: details,
+	}
+	response.send()
+}
+
+func (response MethodResponse) notImplemented(method CoreMethod) {
+	response.failure(
+		"not_implemented",
+		fmt.Sprintf("unknown method: %s", method),
+		nil,
+	)
+}
+
+func handleMethodCall(call *MethodCall, response MethodResponse) {
+	// The crash method is a developer-only fatal-path test. It must bypass the
+	// recovery below so the core process terminates; on Android this also
+	// terminates the in-process application.
+	if call.Method == crashMethod {
+		handleCrash()
+		return
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			buf := make([]byte, 4096)
+			n := runtime.Stack(buf, false)
+			logError("panic in handleMethodCall(%s): %v\n%s", call.Method, r, buf[:n])
+			response.failure("internal_error", fmt.Sprintf("internal panic: %v", r), nil)
+		}
+	}()
+	switch call.Method {
+	case initClashMethod:
+		params := InitParams{}
+		if !decodeMethodArguments(call, response, &params) {
+			return
+		}
+		response.success(handleInitClash(&params))
+		return
+	case getIsInitMethod:
+		response.success(handleGetIsInit())
+		return
+	case forceGcMethod:
+		handleForceGC()
+		response.success(true)
+		return
+	case shutdownMethod:
+		response.success(handleShutdown())
+		return
+	case validateConfigMethod:
+		path := ""
+		if !decodeMethodArguments(call, response, &path) {
+			return
+		}
+		response.success(handleValidateConfig(path))
+		return
+	case updateConfigMethod:
+		params := UpdateParams{}
+		if !decodeMethodArguments(call, response, &params) {
+			return
+		}
+		response.success(handleUpdateConfig(&params))
+		return
+	case setupConfigMethod:
+		params := defaultSetupParams()
+		if !decodeMethodArguments(call, response, params) {
+			return
+		}
+		response.success(handleSetupConfig(params))
+		return
+	case getProxiesMethod:
+		response.success(handleGetProxies())
+		return
+	case changeProxyMethod:
+		params := ChangeProxyParams{}
+		if !decodeMethodArguments(call, response, &params) {
+			return
+		}
+		handleChangeProxy(&params, func(value string) {
+			response.success(value)
+		})
+		return
+	case getTrafficMethod:
+		onlyStatisticsProxy := false
+		if !decodeMethodArguments(call, response, &onlyStatisticsProxy) {
+			return
+		}
+		response.success(handleGetTraffic(onlyStatisticsProxy))
+		return
+	case getTotalTrafficMethod:
+		onlyStatisticsProxy := false
+		if !decodeMethodArguments(call, response, &onlyStatisticsProxy) {
+			return
+		}
+		response.success(handleGetTotalTraffic(onlyStatisticsProxy))
+		return
+	case resetTrafficMethod:
+		handleResetTraffic()
+		response.success(true)
+		return
+	case asyncTestDelayMethod:
+		params := TestDelayParams{}
+		if !decodeMethodArguments(call, response, &params) {
+			return
+		}
+		handleAsyncTestDelay(&params, func(value *Delay) {
+			response.success(value)
+		})
+		return
+	case getConnectionsMethod:
+		response.success(handleGetConnections())
+		return
+	case closeConnectionsMethod:
+		response.success(handleCloseConnections())
+		return
+	case resetConnectionsMethod:
+		response.success(handleResetConnections())
+		return
+	case getConfigMethod:
+		path := ""
+		if !decodeMethodArguments(call, response, &path) {
+			return
+		}
+		config, err := handleGetConfig(path)
+		if err != nil {
+			response.failure("core_error", err.Error(), nil)
+			return
+		}
+		response.success(config)
+		return
+	case closeConnectionMethod:
+		id := ""
+		if !decodeMethodArguments(call, response, &id) {
+			return
+		}
+		response.success(handleCloseConnection(id))
+		return
+	case getExternalProvidersMethod:
+		response.success(handleGetExternalProviders())
+		return
+	case getExternalProviderMethod:
+		externalProviderName := ""
+		if !decodeMethodArguments(call, response, &externalProviderName) {
+			return
+		}
+		response.success(handleGetExternalProvider(externalProviderName))
+		return
+	case updateGeoDataMethod:
+		geoType := ""
+		if !decodeMethodArguments(call, response, &geoType) {
+			return
+		}
+		handleUpdateGeoData(geoType)
+		response.success("")
+		return
+	case updateExternalProviderMethod:
+		providerName := ""
+		if !decodeMethodArguments(call, response, &providerName) {
+			return
+		}
+		handleUpdateExternalProvider(providerName, func(value string) {
+			response.success(value)
+		})
+		return
+	case sideLoadExternalProviderMethod:
+		params := map[string]string{}
+		if !decodeMethodArguments(call, response, &params) {
+			return
+		}
+		providerName := params["providerName"]
+		data := params["data"]
+		handleSideLoadExternalProvider(providerName, []byte(data), func(value string) {
+			response.success(value)
+		})
+		return
+	case startLogMethod:
+		handleStartLog()
+		response.success(true)
+		return
+	case stopLogMethod:
+		handleStopLog()
+		response.success(true)
+		return
+	case startListenerMethod:
+		response.success(handleStartListener())
+		return
+	case stopListenerMethod:
+		response.success(handleStopListener())
+		return
+	case getCountryCodeMethod:
+		ip := ""
+		if !decodeMethodArguments(call, response, &ip) {
+			return
+		}
+		handleGetCountryCode(ip, func(value string) {
+			response.success(value)
+		})
+		return
+	case getMemoryMethod:
+		handleGetMemory(func(value uint64) {
+			response.success(value)
+		})
+		return
+	case clearEffectMethod:
+		var profileId int64
+		if !decodeMethodArguments(call, response, &profileId) {
+			return
+		}
+		handleClearEffect(profileId, response)
+		return
+	default:
+		if !handlePlatformMethodCall(call, response) {
+			response.notImplemented(call.Method)
+		}
+	}
+}
diff --git a/core/server.go b/core/server.go
index 87f412eeee..28b8cb6135 100644
--- a/core/server.go
+++ b/core/server.go
@@ -5,6 +5,7 @@ package main
 import (
 	"encoding/binary"
 	"encoding/json"
+	"fmt"
 	"io"
 	"sync"
 )
@@ -14,29 +15,59 @@ var (
 	connMu sync.Mutex
 )
 
-func (result ActionResult) send() {
-	data, err := result.Json()
+const maxIPCFrameSize = 64 * 1024 * 1024
+
+func (response MethodResponse) send() {
+	data, err := response.JSON()
 	if err != nil {
-		logError("ActionResult marshal error: method=%s id=%s err=%v", result.Method, result.Id, err)
+		logError("MethodResponse marshal error: id=%s err=%v", response.ID, err)
 		return
 	}
 	send(data)
 }
 
-func sendMessage(message Message) {
-	result := ActionResult{
-		Method: messageMethod,
-		Data:   message,
+func sendMessageBatch(messages []Message) {
+	arguments, err := json.Marshal(messages)
+	if err != nil {
+		logError("Message batch marshal error: %v", err)
+		return
 	}
-	result.send()
+	call := MethodCall{
+		Method:    messageMethod,
+		Arguments: arguments,
+	}
+	data, err := json.Marshal(call)
+	if err != nil {
+		logError("MethodCall marshal error: method=%s err=%v", call.Method, err)
+		return
+	}
+	send(data)
 }
 
 func writeFrame(w io.Writer, data []byte) error {
-	frame := make([]byte, 4+len(data))
-	binary.LittleEndian.PutUint32(frame, uint32(len(data)))
-	copy(frame[4:], data)
-	_, err := w.Write(frame)
-	return err
+	if len(data) > maxIPCFrameSize {
+		return fmt.Errorf("IPC frame exceeds %d bytes", maxIPCFrameSize)
+	}
+	lenBuf := [4]byte{}
+	binary.LittleEndian.PutUint32(lenBuf[:], uint32(len(data)))
+	if err := writeAll(w, lenBuf[:]); err != nil {
+		return err
+	}
+	return writeAll(w, data)
+}
+
+func writeAll(w io.Writer, data []byte) error {
+	for len(data) > 0 {
+		n, err := w.Write(data)
+		if err != nil {
+			return err
+		}
+		if n == 0 {
+			return io.ErrShortWrite
+		}
+		data = data[n:]
+	}
+	return nil
 }
 
 func readFrame(r io.Reader) ([]byte, error) {
@@ -45,7 +76,10 @@ func readFrame(r io.Reader) ([]byte, error) {
 		return nil, err
 	}
 	length := binary.LittleEndian.Uint32(lenBuf)
-	data := make([]byte, length)
+	if length > maxIPCFrameSize {
+		return nil, fmt.Errorf("IPC frame exceeds %d bytes", maxIPCFrameSize)
+	}
+	data := make([]byte, int(length))
 	if _, err := io.ReadFull(r, data); err != nil {
 		return nil, err
 	}
@@ -83,24 +117,23 @@ func startServer(arg string) {
 			}
 			return
 		}
-		var action = &Action{}
+		call := &MethodCall{}
 
-		err = json.Unmarshal(data, action)
+		err = json.Unmarshal(data, call)
 
 		if err != nil {
 			logError("server unmarshal error: %v (data: %q)", err, data)
 			continue
 		}
 
-		result := ActionResult{
-			Id:     action.Id,
-			Method: action.Method,
+		response := MethodResponse{
+			ID: call.ID,
 		}
 
-		go handleAction(action, result)
+		go handleMethodCall(call, response)
 	}
 }
 
-func nextHandle(action *Action, result ActionResult) bool {
+func handlePlatformMethodCall(call *MethodCall, response MethodResponse) bool {
 	return false
 }
diff --git a/lib/application.dart b/lib/application.dart
index e1416c3060..ee46de24af 100644
--- a/lib/application.dart
+++ b/lib/application.dart
@@ -3,7 +3,6 @@ import 'dart:io';
 
 import 'package:connectivity_plus/connectivity_plus.dart';
 import 'package:fl_clash/common/common.dart';
-import 'package:fl_clash/core/core.dart';
 import 'package:fl_clash/l10n/l10n.dart';
 import 'package:fl_clash/manager/hotkey_manager.dart';
 import 'package:fl_clash/manager/manager.dart';
@@ -185,11 +184,9 @@ class ApplicationState extends ConsumerState<Application> {
   }
 
   @override
-  Future<void> dispose() async {
+  void dispose() {
     linkManager.destroy();
     _autoUpdateProfilesTaskTimer?.cancel();
-    await coreController.destroy();
-    await ref.read(systemActionProvider.notifier).handleExit();
     super.dispose();
   }
 }
diff --git a/lib/common/color.dart b/lib/common/color.dart
index a12c028fd0..4df12565b6 100644
--- a/lib/common/color.dart
+++ b/lib/common/color.dart
@@ -4,43 +4,43 @@ import 'package:flutter/material.dart';
 
 extension ColorExtension on Color {
   Color get opacity80 {
-    return withAlpha(204);
+    return withValues(alpha: 0.8);
   }
 
   Color get opacity60 {
-    return withAlpha(153);
+    return withValues(alpha: 0.6);
   }
 
   Color get opacity50 {
-    return withAlpha(128);
+    return withValues(alpha: 0.5);
   }
 
   Color get opacity38 {
-    return withAlpha(97);
+    return withValues(alpha: 0.38);
   }
 
   Color get opacity30 {
-    return withAlpha(77);
+    return withValues(alpha: 0.3);
   }
 
   Color get opacity12 {
-    return withAlpha(31);
+    return withValues(alpha: 0.12);
   }
 
   Color get opacity15 {
-    return withAlpha(38);
+    return withValues(alpha: 0.15);
   }
 
   Color get opacity10 {
-    return withAlpha(15);
+    return withValues(alpha: 0.1);
   }
 
   Color get opacity3 {
-    return withAlpha(76);
+    return withValues(alpha: 0.03);
   }
 
   Color get opacity0 {
-    return withAlpha(0);
+    return withValues(alpha: 0);
   }
 
   int get value32bit {
diff --git a/lib/common/common.dart b/lib/common/common.dart
index 72fc85dc68..f606be9ad0 100644
--- a/lib/common/common.dart
+++ b/lib/common/common.dart
@@ -20,7 +20,6 @@ export 'launch.dart';
 export 'link.dart';
 export 'lock.dart';
 export 'measure.dart';
-export 'migration.dart';
 export 'mixin.dart';
 export 'navigation.dart';
 export 'navigator.dart';
diff --git a/lib/common/constant.dart b/lib/common/constant.dart
index 813030bc47..70f5fb8ce9 100644
--- a/lib/common/constant.dart
+++ b/lib/common/constant.dart
@@ -16,8 +16,10 @@ const browserUa =
     'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
 const packageName = 'com.follow.clash';
 final unixSocketPath = '/tmp/FlClashSocket_${Random().nextInt(10000)}.sock';
-final windowsPipeName = '\\\\.\\pipe\\FlClashCore_${Random().nextInt(10000)}';
+final windowsPipeName = '\\\\.\\pipe\\FlClashCore_${_randomPipeId()}';
 const helperPort = 47890;
+const helperProtocolVersionHeader = 'x-flclash-helper-protocol';
+const helperProtocolVersion = '5';
 const maxTextScale = 1.4;
 const minTextScale = 0.8;
 final baseInfoEdgeInsets = EdgeInsets.symmetric(
@@ -34,6 +36,14 @@ const sheetAppBarHeight = 68.0;
 
 const watchExecution = false;
 
+String _randomPipeId() {
+  final random = Random.secure();
+  return List.generate(
+    16,
+    (_) => random.nextInt(256).toRadixString(16).padLeft(2, '0'),
+  ).join();
+}
+
 final defaultTextScaleFactor =
     WidgetsBinding.instance.platformDispatcher.textScaleFactor;
 const httpTimeoutDuration = Duration(milliseconds: 5000);
diff --git a/lib/common/dav_client.dart b/lib/common/dav_client.dart
index e4ea95a445..b60384d08c 100644
--- a/lib/common/dav_client.dart
+++ b/lib/common/dav_client.dart
@@ -2,8 +2,11 @@ import 'dart:async';
 
 import 'package:fl_clash/common/common.dart';
 import 'package:fl_clash/models/models.dart';
+import 'package:flutter/foundation.dart';
 import 'package:webdav_client/webdav_client.dart';
 
+typedef DAVClientFactory = DAVClient Function(DAVProps props);
+
 class DAVClient {
   late Client client;
   late String fileName;
@@ -43,3 +46,46 @@ class DAVClient {
     return true;
   }
 }
+
+class DAVConnectionController extends ValueNotifier<bool?> {
+  DAVConnectionController({DAVClientFactory? createClient})
+    : _createClient = createClient ?? DAVClient.new,
+      super(null);
+
+  final DAVClientFactory _createClient;
+
+  DAVProps? _lastProps;
+  bool _hasUpdated = false;
+  int _requestId = 0;
+  bool _disposed = false;
+
+  DAVClient? client;
+
+  Future<void> update(DAVProps? props) async {
+    final nextClient = props == null ? null : _createClient(props);
+    client = nextClient;
+
+    final rawProps = props?.copyWith(fileName: '');
+    final rawLastProps = _lastProps?.copyWith(fileName: '');
+    final isSameCredentials = _hasUpdated && rawProps == rawLastProps;
+    _lastProps = props;
+    _hasUpdated = true;
+    if (isSameCredentials) {
+      return;
+    }
+
+    final requestId = ++_requestId;
+    value = null;
+    final result = await nextClient?.ping() ?? false;
+    if (!_disposed && requestId == _requestId) {
+      value = result;
+    }
+  }
+
+  @override
+  void dispose() {
+    _disposed = true;
+    _requestId++;
+    super.dispose();
+  }
+}
diff --git a/lib/common/function.dart b/lib/common/function.dart
index e171152560..40ae36869a 100644
--- a/lib/common/function.dart
+++ b/lib/common/function.dart
@@ -28,6 +28,22 @@ class Debouncer {
   }
 }
 
+class SerialTaskScheduler {
+  Future<void> _serialTail = Future<void>.value();
+
+  Future<T> run<T>(Future<T> Function() task) {
+    final completer = Completer<T>();
+    _serialTail = _serialTail.then((_) async {
+      try {
+        completer.complete(await task());
+      } catch (error, stackTrace) {
+        completer.completeError(error, stackTrace);
+      }
+    });
+    return completer.future;
+  }
+}
+
 class Throttler {
   final Map<dynamic, Timer?> _operations = {};
 
diff --git a/lib/common/future.dart b/lib/common/future.dart
index 0f880dfab5..465ed65624 100644
--- a/lib/common/future.dart
+++ b/lib/common/future.dart
@@ -11,11 +11,19 @@ extension FutureExt<T> on Future<T> {
     FutureOr<T> Function()? onTimeout,
   }) {
     final realTimeout = timeout ?? const Duration(minutes: 3);
-    Timer(realTimeout + commonDuration, () {
-      if (onLast != null) {
-        onLast();
-      }
-    });
+    final cleanupTimer = onLast == null
+        ? null
+        : Timer(realTimeout + commonDuration, onLast);
+    if (cleanupTimer != null) {
+      unawaited(
+        then<void>(
+          (_) => cleanupTimer.cancel(),
+          onError: (Object _, StackTrace _) {
+            cleanupTimer.cancel();
+          },
+        ),
+      );
+    }
     return this.timeout(
       realTimeout,
       onTimeout: () async {
diff --git a/lib/common/migration.dart b/lib/common/migration.dart
index 7d9646527c..a3329d5b25 100644
--- a/lib/common/migration.dart
+++ b/lib/common/migration.dart
@@ -1,53 +1,148 @@
-import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/database/database.dart';
 import 'package:fl_clash/models/models.dart';
 
-class Migration {
-  static Migration? _instance;
-  late int _oldVersion;
+import 'preferences.dart';
+import 'task.dart';
+
+typedef MigrationTransform =
+    Future<MigrationData> Function(Map<String, Object?> configMap);
+
+abstract interface class MigrationStore {
+  Future<Map<String, Object?>?> getConfigMap();
+
+  Future<int> getVersion();
 
-  Migration._internal();
+  Future<Map<String, Object?>?> getClashConfigMap();
 
-  final currentVersion = 1;
+  Future<void> restore(MigrationData data);
+
+  Future<bool> saveConfig(Config config);
+
+  Future<void> clearClashConfig();
+
+  Future<void> setVersion(int version);
+}
 
-  factory Migration() {
-    _instance ??= Migration._internal();
-    return _instance!;
+class _AppMigrationStore implements MigrationStore {
+  const _AppMigrationStore();
+
+  @override
+  Future<Map<String, Object?>?> getConfigMap() => preferences.getConfigMap();
+
+  @override
+  Future<int> getVersion() => preferences.getVersion();
+
+  @override
+  Future<Map<String, Object?>?> getClashConfigMap() =>
+      preferences.getClashConfigMap();
+
+  @override
+  Future<void> restore(MigrationData data) {
+    return database.restore(
+      data.profiles,
+      data.scripts,
+      data.rules,
+      data.links,
+      data.proxyGroups,
+    );
   }
 
-  Future<Config> migrationIfNeeded(
-    Map<String, Object?>? configMap, {
-    required Future<Config> Function(MigrationData data) sync,
-  }) async {
-    _oldVersion = await preferences.getVersion();
-    if (_oldVersion == currentVersion) {
+  @override
+  Future<bool> saveConfig(Config config) => preferences.saveConfig(config);
+
+  @override
+  Future<void> clearClashConfig() => preferences.clearClashConfig();
+
+  @override
+  Future<void> setVersion(int version) => preferences.setVersion(version);
+}
+
+class Migration {
+  final MigrationStore _store;
+  final MigrationTransform _migrateV0;
+
+  Migration({required MigrationStore store, MigrationTransform? migrateV0})
+    : _store = store,
+      _migrateV0 = migrateV0 ?? oldToNowTask;
+
+  static const currentVersion = 1;
+
+  Future<Config> run() async {
+    final configMap = await _store.getConfigMap();
+    var oldVersion = await _store.getVersion();
+    Config? config;
+    if (oldVersion > currentVersion) {
+      throw StateError(
+        'Local data version $oldVersion is newer than $currentVersion.',
+      );
+    }
+    if (oldVersion == currentVersion) {
       try {
-        return Config.realFromJson(configMap);
+        config = Config.realFromJson(configMap);
       } catch (_) {
-        final isV0 = configMap?['proxiesStyle'] != null;
-        if (isV0) {
-          _oldVersion = 0;
-        } else {
-          throw 'Local data is damaged. A reset is required to fix this issue.';
+        if (!_isV0(configMap)) {
+          throw StateError(
+            'Local data is damaged. A reset is required to fix this issue.',
+          );
+        }
+        oldVersion = 0;
+      }
+      if (config != null) {
+        final storedDavPassword = _getStoredDavPassword(configMap);
+        final hasPlainTextDavPassword =
+            storedDavPassword != null &&
+            storedDavPassword == config.davProps?.password;
+        if (hasPlainTextDavPassword && !await _store.saveConfig(config)) {
+          throw StateError('Failed to obfuscate the legacy WebDAV password');
         }
+        return config;
       }
     }
+
     MigrationData data = MigrationData(configMap: configMap);
-    if (_oldVersion == 0 && configMap != null) {
-      final clashConfigMap = await preferences.getClashConfigMap();
-      if (clashConfigMap != null) {
-        configMap['patchClashConfig'] = clashConfigMap;
-        await preferences.clearClashConfig();
+    var shouldClearClashConfig = false;
+    if (oldVersion == 0) {
+      final clashConfigMap = await _store.getClashConfigMap();
+      if (_isV0(configMap) && configMap != null) {
+        final legacyConfigMap = Map<String, Object?>.from(configMap);
+        if (clashConfigMap != null) {
+          legacyConfigMap['patchClashConfig'] = clashConfigMap;
+          shouldClearClashConfig = true;
+        }
+        data = await _migrateV0(legacyConfigMap);
+      } else if (clashConfigMap != null) {
+        final currentConfigMap = Map<String, Object?>.from(
+          configMap ?? const {},
+        );
+        currentConfigMap.putIfAbsent('patchClashConfig', () => clashConfigMap);
+        data = MigrationData(configMap: currentConfigMap);
+        shouldClearClashConfig = true;
       }
-      data = await _oldToNow(configMap);
     }
-    final res = await sync(data);
-    await preferences.setVersion(currentVersion);
-    return res;
+
+    config = Config.realFromJson(data.configMap);
+    await _store.restore(data);
+    if (!await _store.saveConfig(config)) {
+      throw StateError('Failed to save migrated preferences');
+    }
+    if (shouldClearClashConfig) {
+      await _store.clearClashConfig();
+    }
+    await _store.setVersion(currentVersion);
+    return config;
   }
+}
+
+bool _isV0(Map<String, Object?>? configMap) =>
+    configMap?['proxiesStyle'] != null;
 
-  Future<MigrationData> _oldToNow(Map<String, Object?> configMap) async {
-    return oldToNowTask(configMap);
+String? _getStoredDavPassword(Map<String, Object?>? configMap) {
+  final dav = configMap?['davProps'] ?? configMap?['dav'];
+  if (dav is! Map) {
+    return null;
   }
+  final password = dav['password'];
+  return password is String && password.isNotEmpty ? password : null;
 }
 
-final migration = Migration();
+final migration = Migration(store: const _AppMigrationStore());
diff --git a/lib/common/path.dart b/lib/common/path.dart
index ed20647cb3..059db565f3 100644
--- a/lib/common/path.dart
+++ b/lib/common/path.dart
@@ -8,7 +8,7 @@ import 'package:path_provider/path_provider.dart';
 class AppPath {
   static AppPath? _instance;
   Completer<Directory> dataDir = Completer();
-  Completer<Directory> downloadDir = Completer();
+  late final Future<Directory?> _downloadDir = getDownloadsDirectory();
   Completer<Directory> tempDir = Completer();
   Completer<Directory> cacheDir = Completer();
   late String appDirPath;
@@ -21,9 +21,6 @@ class AppPath {
     getTemporaryDirectory().then((value) {
       tempDir.complete(value);
     });
-    getDownloadsDirectory().then((value) {
-      downloadDir.complete(value);
-    });
     getApplicationCacheDirectory().then((value) {
       cacheDir.complete(value);
     });
@@ -52,8 +49,8 @@ class AppPath {
   }
 
   Future<String> get downloadDirPath async {
-    final directory = await downloadDir.future;
-    return directory.path;
+    final directory = await _downloadDir;
+    return directory?.path ?? await homeDirPath;
   }
 
   Future<String> get homeDirPath async {
diff --git a/lib/common/permission.dart b/lib/common/permission.dart
index b5d78a6db1..7ce9bf73dd 100644
--- a/lib/common/permission.dart
+++ b/lib/common/permission.dart
@@ -5,19 +5,45 @@ import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/plugins/app.dart';
 import 'package:fl_clash/providers/providers.dart';
 import 'package:fl_clash/state.dart';
+import 'package:flutter/foundation.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:wifi_ssid/wifi_ssid_manager.dart';
 
+enum LocationPermissionFollowUp { none, showDeniedMessage, openSettings }
+
+LocationPermissionFollowUp getLocationPermissionFollowUp(
+  WifiSsidPermission permission,
+) {
+  return switch (permission) {
+    WifiSsidPermission.granted => LocationPermissionFollowUp.none,
+    WifiSsidPermission.denied => LocationPermissionFollowUp.showDeniedMessage,
+    WifiSsidPermission.permanentlyDenied =>
+      LocationPermissionFollowUp.openSettings,
+  };
+}
+
 class Permissions {
   static Permissions? _instance;
 
-  Permissions._internal();
+  Permissions._internal({bool Function()? supportsLocationPermissions})
+    : _supportsLocationPermissions =
+          supportsLocationPermissions ??
+          (() => system.isAndroid || system.isMacOS);
 
   factory Permissions() {
     _instance ??= Permissions._internal();
     return _instance!;
   }
 
+  @visibleForTesting
+  factory Permissions.test({required bool supportsLocationPermissions}) {
+    return Permissions._internal(
+      supportsLocationPermissions: () => supportsLocationPermissions,
+    );
+  }
+
+  final bool Function() _supportsLocationPermissions;
+
   bool _isRequestingLocation = false;
   bool needWaitingBatteryOptimizationSettings = false;
 
@@ -53,7 +79,7 @@ class Permissions {
   }
 
   Future<void> checkLocationPermissions() async {
-    if (!(system.isAndroid || system.isMacOS)) {
+    if (!_supportsLocationPermissions()) {
       return;
     }
     final res = await WifiSsidManager.instance.checkPermission();
@@ -74,7 +100,7 @@ class Permissions {
         final res = await WifiSsidManager.instance.requestPermission();
         globalState.container.read(locationPermissionsProvider.notifier).value =
             res;
-        if (res != WifiSsidPermission.granted) {
+        if (res == WifiSsidPermission.granted) {
           final ssid = await WifiSsidManager.instance.getSsid();
           globalState.container.read(currentSSIDProvider.notifier).value = ssid;
         }
diff --git a/lib/common/request.dart b/lib/common/request.dart
index 1bbe9f3cdc..206548ec6d 100644
--- a/lib/common/request.dart
+++ b/lib/common/request.dart
@@ -1,6 +1,6 @@
 import 'dart:async';
-import 'dart:convert';
 import 'dart:io';
+import 'dart:typed_data';
 
 import 'package:dio/dio.dart';
 import 'package:dio/io.dart';
@@ -9,7 +9,6 @@ import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/models/models.dart';
 import 'package:fl_clash/state.dart';
 import 'package:flutter/cupertino.dart';
-import 'package:flutter/foundation.dart';
 
 class Request {
   late final Dio dio;
@@ -143,61 +142,6 @@ class Request {
     token.cancel();
     return res;
   }
-
-  Future<bool> pingHelper() async {
-    if (kDebugMode) return true;
-    try {
-      final response = await dio
-          .get(
-            'http://$localhost:$helperPort/ping',
-            options: Options(responseType: ResponseType.plain),
-          )
-          .timeout(const Duration(milliseconds: 2000));
-      if (response.statusCode != HttpStatus.ok) {
-        return false;
-      }
-      return (response.data as String) == globalState.coreSHA256;
-    } catch (_) {
-      return false;
-    }
-  }
-
-  Future<bool> startCoreByHelper(String arg) async {
-    try {
-      final response = await dio
-          .post(
-            'http://$localhost:$helperPort/start',
-            data: json.encode({'path': appPath.corePath, 'arg': arg}),
-            options: Options(responseType: ResponseType.plain),
-          )
-          .timeout(const Duration(milliseconds: 2000));
-      if (response.statusCode != HttpStatus.ok) {
-        return false;
-      }
-      final data = response.data as String;
-      return data.isEmpty;
-    } catch (_) {
-      return false;
-    }
-  }
-
-  Future<bool> stopCoreByHelper() async {
-    try {
-      final response = await dio
-          .post(
-            'http://$localhost:$helperPort/stop',
-            options: Options(responseType: ResponseType.plain),
-          )
-          .timeout(const Duration(milliseconds: 2000));
-      if (response.statusCode != HttpStatus.ok) {
-        return false;
-      }
-      final data = response.data as String;
-      return data.isEmpty;
-    } catch (_) {
-      return false;
-    }
-  }
 }
 
 final request = Request();
diff --git a/lib/common/system.dart b/lib/common/system.dart
index f86178b597..2d52e539d7 100644
--- a/lib/common/system.dart
+++ b/lib/common/system.dart
@@ -4,6 +4,7 @@ import 'dart:io';
 import 'package:device_info_plus/device_info_plus.dart';
 import 'package:ffi/ffi.dart';
 import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/core/desktop/helper_client.dart';
 import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/plugins/app.dart';
 import 'package:fl_clash/state.dart';
@@ -41,11 +42,15 @@ class System {
     };
   }
 
+  Future<bool> didCrashOnPreviousExecution() async {
+    if (!isAndroid) return false;
+    return await app?.didCrashOnPreviousExecution() ?? false;
+  }
+
   Future<bool> checkIsAdmin() async {
     final corePath = appPath.corePath.replaceAll(' ', '\\\\ ');
     if (system.isWindows) {
-      final result = await windows?.checkService();
-      return result == WindowsHelperServiceStatus.running;
+      return windowsHelperClient.isReady();
     } else if (system.isMacOS) {
       final result = await Process.run('stat', ['-f', '%Su:%Sg %Sp', corePath]);
       final output = result.stdout.trim();
@@ -72,19 +77,14 @@ class System {
     if (system.isAndroid) {
       return AuthorizeCode.error;
     }
+    if (system.isWindows) {
+      return await windows?.registerService() ?? AuthorizeCode.error;
+    }
     final isAdmin = await checkIsAdmin();
     if (isAdmin) {
       return AuthorizeCode.none;
     }
 
-    if (system.isWindows) {
-      final result = await windows?.registerService();
-      if (result == true) {
-        return AuthorizeCode.success;
-      }
-      return AuthorizeCode.error;
-    }
-
     if (system.isMacOS) {
       final escapedPath = _shellEscape(appPath.corePath);
       final shell = 'chown root:admin $escapedPath && chmod +sx $escapedPath';
@@ -134,7 +134,6 @@ class System {
     if (system.isAndroid) {
       await SystemNavigator.pop();
     }
-    await window?.close();
     window?.forceExit();
   }
 }
@@ -203,79 +202,52 @@ class Windows {
     return true;
   }
 
-  // Future<void> _killProcess(int port) async {
-  //   final result = await Process.run('netstat', ['-ano']);
-  //   final lines = result.stdout.toString().trim().split('\n');
-  //   for (final line in lines) {
-  //     if (!line.contains(':$port') || !line.contains('LISTENING')) {
-  //       continue;
-  //     }
-  //     final parts = line.trim().split(RegExp(r'\s+'));
-  //     final pid = int.tryParse(parts.last);
-  //     if (pid != null) {
-  //      await Process.run('taskkill', ['/PID', pid.toString(), '/F']);
-  //     }
-  //   }
-  // }
-
-  Future<WindowsHelperServiceStatus> checkService() async {
-    // final qcResult = await Process.run('sc', ['qc', appHelperService]);
-    // final qcOutput = qcResult.stdout.toString();
-    // if (qcResult.exitCode != 0 || !qcOutput.contains(appPath.helperPath)) {
-    //   return WindowsHelperServiceStatus.none;
-    // }
-    final result = await Process.run('sc', ['query', appHelperService]);
-    if (result.exitCode != 0) {
-      return WindowsHelperServiceStatus.none;
-    }
-    final output = result.stdout.toString();
-    if (output.contains('RUNNING') && await request.pingHelper()) {
-      return WindowsHelperServiceStatus.running;
+  Future<AuthorizeCode> registerService() async {
+    if (await windowsHelperClient.isReady()) {
+      commonPrint.log('helper service is ready');
+      return AuthorizeCode.none;
     }
-    return WindowsHelperServiceStatus.presence;
-  }
-
-  Future<bool> registerService() async {
-    final status = await checkService();
 
-    if (status == WindowsHelperServiceStatus.running) {
-      return true;
+    commonPrint.log(
+      'helper service is unavailable, requesting elevated installation',
+      logLevel: LogLevel.warning,
+    );
+    if (!runas(appPath.helperPath, 'install')) {
+      commonPrint.log(
+        'failed to launch elevated helper installation',
+        logLevel: LogLevel.error,
+      );
+      return AuthorizeCode.error;
     }
 
-    final command = [
-      '/c',
-      if (status == WindowsHelperServiceStatus.presence) ...[
-        'taskkill',
-        '/F',
-        '/IM',
-        '$appHelperService.exe'
-            ' & '
-            'sc',
-        'delete',
-        appHelperService,
-        '&',
-      ],
-      'sc',
-      'create',
-      appHelperService,
-      'binPath= "${appPath.helperPath}"',
-      'start= auto',
-      '&&',
-      'sc',
-      'start',
-      appHelperService,
-    ].join(' ');
-
-    final res = runas('cmd.exe', command);
-
-    await Future.delayed(const Duration(milliseconds: 300));
-    final retryStatus = await retry(
-      task: checkService,
-      maxAttempts: 5,
-      retryIf: (status) => status != WindowsHelperServiceStatus.running,
-      delay: const Duration(seconds: 1),
+    final isRunning = await _waitForHelperService();
+    commonPrint.log(
+      isRunning
+          ? 'helper service installation completed'
+          : 'helper service did not become ready after installation',
+      logLevel: isRunning ? LogLevel.info : LogLevel.error,
     );
-    return res && retryStatus == WindowsHelperServiceStatus.running;
+    return isRunning ? AuthorizeCode.success : AuthorizeCode.error;
+  }
+
+  Future<bool> _waitForHelperService() async {
+    const timeout = Duration(seconds: 6);
+    const interval = Duration(seconds: 1);
+    const maxAttempts = 6;
+    final stopwatch = Stopwatch()..start();
+    for (var attempt = 0; attempt < maxAttempts; attempt++) {
+      final remaining = timeout - stopwatch.elapsed;
+      if (remaining <= Duration.zero) return false;
+      final isRunning = await windowsHelperClient.isReady(
+        timeout: remaining,
+        logFailure: false,
+      );
+      if (isRunning) return true;
+      final delay = timeout - stopwatch.elapsed;
+      if (delay <= Duration.zero || attempt == maxAttempts - 1) return false;
+      await Future.delayed(delay < interval ? delay : interval);
+    }
+    return false;
   }
 
   Future<bool> registerTask(String appName) async {
diff --git a/lib/common/task.dart b/lib/common/task.dart
index ea29017a88..3412413854 100644
--- a/lib/common/task.dart
+++ b/lib/common/task.dart
@@ -218,6 +218,25 @@ Future<VM2<String, String>> _makeRealProfileTask(
       rawConfig['dns']['nameserver'] = [...nameserver, systemDns];
     }
   }
+
+  // Keep Tailscale control/DERP/MagicDNS out of Clash fake-IP so the real
+  // Tailscale daemon (or curl diagnostics) gets a public IP, not 198.18.x.x.
+  if (data.tailscaleFakeIpFilters.isNotEmpty) {
+    if (rawConfig['dns'] == null) {
+      rawConfig['dns'] = <String, dynamic>{};
+    }
+    final existingFilters = <String>[
+      ...?((rawConfig['dns'] as Map)['fake-ip-filter'] as List?)?.map(
+        (item) => item.toString(),
+      ),
+    ];
+    for (final filter in data.tailscaleFakeIpFilters) {
+      if (!existingFilters.contains(filter)) {
+        existingFilters.add(filter);
+      }
+    }
+    rawConfig['dns']['fake-ip-filter'] = existingFilters;
+  }
   List<String> rules = [];
   if (data.rules.isEmpty) {
     if (rawConfig['rules'] != null) {
@@ -266,8 +285,17 @@ Future<VM2<String, String>> _makeRealProfileTask(
   if (data.proxyGroups.isNotEmpty) {
     rawConfig['proxy-groups'] = data.proxyGroups;
   }
+
+  // Tailscale rules are injected at the very top so they take priority over the
+  // imported provider profile, without the user editing rules per profile.
+  if (data.tailscaleRules.isNotEmpty) {
+    rules = [...data.tailscaleRules, ...rules];
+  }
   rawConfig['rules'] = rules;
-  final yaml = await _encodeYaml(Map<String, dynamic>.from(rawConfig));
+  final mergedConfig = data.tailscaleProxies.mergeInto(
+    Map<String, dynamic>.from(rawConfig),
+  );
+  final yaml = await _encodeYaml(Map<String, dynamic>.from(mergedConfig));
   return VM2(yaml, yaml.toMd5());
 }
 
diff --git a/lib/common/tray.dart b/lib/common/tray.dart
index 97e5362779..ab10ee3319 100644
--- a/lib/common/tray.dart
+++ b/lib/common/tray.dart
@@ -86,7 +86,7 @@ class Tray {
     final startMenuItem = MenuItem.checkbox(
       label: trayState.isStart ? appLocalizations.stop : appLocalizations.start,
       onClick: (_) async {
-        commonAction.updateStart();
+        commonAction.toggleRunning();
       },
       checked: false,
     );
diff --git a/lib/common/utils.dart b/lib/common/utils.dart
index c95dcc64fc..32a8664dc7 100644
--- a/lib/common/utils.dart
+++ b/lib/common/utils.dart
@@ -91,13 +91,14 @@ class Utils {
     }
     final diff = timeStamp / 1000;
     final inHours = (diff / 3600).floor();
-    if (inHours > 99) {
-      return '99:59:59';
+    if (inHours > 999) {
+      return '999:59:59';
     }
     final inMinutes = (diff / 60 % 60).floor();
     final inSeconds = (diff % 60).floor();
+    final hoursText = inHours.toString().padLeft(2, '0');
 
-    return '${getDateStringLast2(inHours)}:${getDateStringLast2(inMinutes)}:${getDateStringLast2(inSeconds)}';
+    return '$hoursText:${getDateStringLast2(inMinutes)}:${getDateStringLast2(inSeconds)}';
   }
 
   Locale? getLocaleForString(String? localString) {
diff --git a/lib/core/controller.dart b/lib/core/controller.dart
index c6b3bd545b..9e075e1dc6 100644
--- a/lib/core/controller.dart
+++ b/lib/core/controller.dart
@@ -1,5 +1,4 @@
 import 'dart:async';
-import 'dart:convert';
 import 'dart:io';
 
 import 'package:fl_clash/common/common.dart';
@@ -36,11 +35,13 @@ class CoreController {
     return _instance!;
   }
 
-  bool get isCompleted => _interface.completer.isCompleted;
+  Future<CoreLifecycleResult> start() => _interface.start();
 
-  Future<String> preload() {
-    return _interface.preload();
-  }
+  Future<CoreLifecycleResult> restart() => _interface.restart();
+
+  Future<CoreLifecycleResult> stop() => _interface.stop();
+
+  Future<CoreLifecycleResult> close() => _interface.close();
 
   static Future<void> initGeo() async {
     final homePath = await appPath.homeDirPath;
@@ -76,10 +77,6 @@ class CoreController {
     return _interface.init(InitParams(homeDir: homeDirPath, version: version));
   }
 
-  Future<void> shutdown(bool isUser) async {
-    await _interface.shutdown(isUser);
-  }
-
   FutureOr<bool> get isInit => _interface.isInit;
 
   Future<String> validateConfig(String path) async {
@@ -102,14 +99,16 @@ class CoreController {
 
   Future<String> setupConfig({
     required SetupParams params,
-    required SetupState setupState,
-    VoidCallback? preloadInvoke,
+    Future<void> Function()? preloadInvoke,
   }) async {
-    final res = _interface.setupConfig(params);
-    if (preloadInvoke != null) {
-      preloadInvoke();
+    if (preloadInvoke == null) {
+      return _interface.setupConfig(params);
     }
-    return res;
+    final (result, _) = await (
+      _interface.setupConfig(params),
+      preloadInvoke(),
+    ).wait;
+    return result;
   }
 
   Future<List<Group>> getProxiesGroups({
@@ -135,10 +134,7 @@ class CoreController {
   }
 
   Future<List<TrackerInfo>> getConnections() async {
-    final res = await _interface.getConnections();
-    final connectionsData = json.decode(res) as Map;
-    final connectionsRaw = connectionsData['connections'] as List? ?? [];
-    return connectionsRaw.map((e) => TrackerInfo.fromJson(e)).toList();
+    return _interface.getConnections();
   }
 
   Future<void> closeConnection(String id) async {
@@ -154,27 +150,13 @@ class CoreController {
   }
 
   Future<List<ExternalProvider>> getExternalProviders() async {
-    final externalProvidersRawString = await _interface.getExternalProviders();
-    if (externalProvidersRawString.isEmpty) {
-      return [];
-    }
-    final externalProviders =
-        (await externalProvidersRawString.commonToJSON<List<dynamic>>())
-            .map((item) => ExternalProvider.fromJson(item))
-            .toList();
-    return externalProviders;
+    return _interface.getExternalProviders();
   }
 
   Future<ExternalProvider?> getExternalProvider(
     String externalProviderName,
   ) async {
-    final externalProvidersRawString = await _interface.getExternalProvider(
-      externalProviderName,
-    );
-    if (externalProvidersRawString.isEmpty) {
-      return null;
-    }
-    return ExternalProvider.fromJson(json.decode(externalProvidersRawString));
+    return _interface.getExternalProvider(externalProviderName);
   }
 
   Future<String> updateGeoData(String type) {
@@ -204,29 +186,21 @@ class CoreController {
   }
 
   Future<Delay> getDelay(String url, String proxyName) async {
-    final data = await _interface.asyncTestDelay(url, proxyName);
-    return Delay.fromJson(json.decode(data));
+    return _interface.asyncTestDelay(url, proxyName);
   }
 
   Future<Map<String, dynamic>> getConfig(int id) async {
     final profilePath = await appPath.getProfilePath(id.toString());
-    final res = await _interface.getConfig(profilePath);
-    if (res.isSuccess) {
-      final data = Map<String, dynamic>.from(res.data);
-      data['rules'] = data['rule'];
-      data.remove('rule');
-      return data;
-    } else {
-      throw res.message;
-    }
+    final data = Map<String, dynamic>.from(
+      await _interface.getConfig(profilePath),
+    );
+    data['rules'] = data['rule'];
+    data.remove('rule');
+    return data;
   }
 
   Future<Traffic> getTraffic(bool onlyStatisticsProxy) async {
-    final trafficString = await _interface.getTraffic(onlyStatisticsProxy);
-    if (trafficString.isEmpty) {
-      return const Traffic();
-    }
-    return Traffic.fromJson(json.decode(trafficString));
+    return _interface.getTraffic(onlyStatisticsProxy);
   }
 
   Future<IpInfo?> getCountryCode(String ip) async {
@@ -238,21 +212,11 @@ class CoreController {
   }
 
   Future<Traffic> getTotalTraffic(bool onlyStatisticsProxy) async {
-    final totalTrafficString = await _interface.getTotalTraffic(
-      onlyStatisticsProxy,
-    );
-    if (totalTrafficString.isEmpty) {
-      return const Traffic();
-    }
-    return Traffic.fromJson(json.decode(totalTrafficString));
+    return _interface.getTotalTraffic(onlyStatisticsProxy);
   }
 
   Future<int> getMemory() async {
-    final value = await _interface.getMemory();
-    if (value.isEmpty) {
-      return 0;
-    }
-    return int.parse(value);
+    return _interface.getMemory();
   }
 
   void resetTraffic() {
@@ -271,16 +235,12 @@ class CoreController {
     await _interface.forceGc();
   }
 
-  Future<void> destroy() async {
-    await _interface.destroy();
-  }
-
   Future<void> crash() async {
     await _interface.crash();
   }
 
-  Future<String> deleteFile(String path) async {
-    return _interface.deleteFile(path);
+  Future<String> clearEffect(int profileId) async {
+    return _interface.clearEffect(profileId);
   }
 }
 
diff --git a/lib/core/core.dart b/lib/core/core.dart
index 92b5283f8d..c53def1f7e 100644
--- a/lib/core/core.dart
+++ b/lib/core/core.dart
@@ -1,5 +1,7 @@
 export 'controller.dart';
 export 'core.dart';
+export 'desktop/model.dart';
 export 'event.dart';
 export 'lib.dart';
+export 'method.dart';
 export 'service.dart';
diff --git a/lib/core/desktop/helper_client.dart b/lib/core/desktop/helper_client.dart
new file mode 100644
index 0000000000..d1ae6e9dd8
--- /dev/null
+++ b/lib/core/desktop/helper_client.dart
@@ -0,0 +1,385 @@
+import 'dart:async';
+import 'dart:io';
+
+import 'package:dio/dio.dart';
+import 'package:fl_clash/common/constant.dart';
+import 'package:fl_clash/common/print.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:path/path.dart' as p;
+
+import 'launcher.dart';
+import 'model.dart';
+
+final class HelperStartResponse {
+  final String sessionId;
+  final int pid;
+
+  const HelperStartResponse({required this.sessionId, required this.pid});
+}
+
+final class HelperStopResponse {
+  final String sessionId;
+  final bool stopped;
+  final String? reason;
+
+  const HelperStopResponse({
+    required this.sessionId,
+    required this.stopped,
+    this.reason,
+  });
+}
+
+final class WindowsHelperException implements Exception {
+  final String code;
+  final String message;
+  final Object? details;
+
+  const WindowsHelperException({
+    required this.code,
+    required this.message,
+    this.details,
+  });
+
+  @override
+  String toString() => 'WindowsHelperException($code, $message, $details)';
+}
+
+final class WindowsHelperClient {
+  final Dio _dio;
+  final String Function() _expectedHelperPath;
+  final String baseUrl;
+
+  WindowsHelperClient({
+    Dio? dio,
+    String Function()? expectedHelperPath,
+    this.baseUrl = 'http://$localhost:$helperPort',
+  }) : _dio = dio ?? Dio(),
+       _expectedHelperPath = expectedHelperPath ?? _defaultHelperPath;
+
+  static String _defaultHelperPath() {
+    final context = p.Context(style: p.Style.windows);
+    return context.join(
+      context.dirname(Platform.resolvedExecutable),
+      '$appHelperService.exe',
+    );
+  }
+
+  Future<bool> isReady({Duration? timeout, bool logFailure = true}) async {
+    if (timeout != null && timeout <= Duration.zero) {
+      return false;
+    }
+    final cancelToken = CancelToken();
+    final timeoutTimer = timeout == null
+        ? null
+        : Timer(
+            timeout,
+            () => cancelToken.cancel('helper ping deadline exceeded'),
+          );
+    try {
+      final response = await _dio.get<Object?>(
+        '$baseUrl/ping',
+        cancelToken: cancelToken,
+        options: _options(ResponseType.plain),
+      );
+      final helperPath = response.data;
+      if (response.statusCode != HttpStatus.ok || helperPath is! String) {
+        _logPingFailure('helper ping returned invalid response', logFailure);
+        return false;
+      }
+      final protocolVersion = response.headers.value(
+        helperProtocolVersionHeader,
+      );
+      if (protocolVersion != helperProtocolVersion) {
+        _logPingFailure(
+          'helper protocol mismatch: $protocolVersion',
+          logFailure,
+        );
+        return false;
+      }
+      final matches = p.Context(
+        style: p.Style.windows,
+      ).equals(helperPath.trim(), _expectedHelperPath());
+      if (!matches) {
+        _logPingFailure('helper executable path mismatch', logFailure);
+      }
+      return matches;
+    } catch (error) {
+      _logPingFailure('helper ping failed: $error', logFailure);
+      return false;
+    } finally {
+      timeoutTimer?.cancel();
+    }
+  }
+
+  void _logPingFailure(String message, bool enabled) {
+    if (enabled) {
+      commonPrint.log(message, logLevel: LogLevel.warning);
+    }
+  }
+
+  Future<HelperStartResponse> start({
+    required String address,
+    required String sessionId,
+  }) async {
+    _validateSessionId(sessionId);
+    try {
+      final response = await _dio.post<Object?>(
+        '$baseUrl/start',
+        data: {'address': address, 'sessionId': sessionId},
+        options: _options(ResponseType.json),
+      );
+      final data = _responseMap(response, operation: 'start');
+      final returnedSession = data['sessionId'];
+      final pid = data['pid'];
+      if (returnedSession != sessionId || pid is! int || pid <= 0) {
+        throw const WindowsHelperException(
+          code: 'invalidResponse',
+          message: 'Helper returned an invalid start response',
+        );
+      }
+      return HelperStartResponse(
+        sessionId: returnedSession as String,
+        pid: pid,
+      );
+    } on WindowsHelperException {
+      rethrow;
+    } on DioException catch (error) {
+      throw _mapDioException(error, operation: 'start');
+    } catch (error) {
+      throw WindowsHelperException(
+        code: 'transportError',
+        message: 'Unable to start Core through Helper',
+        details: error.toString(),
+      );
+    }
+  }
+
+  Future<HelperStopResponse> stop(String sessionId) async {
+    _validateSessionId(sessionId);
+    try {
+      final response = await _dio.post<Object?>(
+        '$baseUrl/stop',
+        data: {'sessionId': sessionId},
+        options: _options(ResponseType.json),
+      );
+      return _parseStopResponse(response, sessionId);
+    } on WindowsHelperException {
+      rethrow;
+    } on DioException catch (error) {
+      final response = error.response;
+      if (response?.statusCode == HttpStatus.conflict) {
+        final data = _mapFrom(response?.data);
+        final reason = data?['reason'];
+        if (reason is String) {
+          throw WindowsHelperException(
+            code: reason,
+            message: 'Helper refused to stop the requested Core session',
+            details: data,
+          );
+        }
+      }
+      throw _mapDioException(error, operation: 'stop');
+    } catch (error) {
+      throw WindowsHelperException(
+        code: 'transportError',
+        message: 'Unable to stop Core through Helper',
+        details: error.toString(),
+      );
+    }
+  }
+
+  HelperStopResponse _parseStopResponse(
+    Response<Object?> response,
+    String sessionId,
+  ) {
+    final data = _responseMap(response, operation: 'stop');
+    final returnedSession = data['sessionId'];
+    final stopped = data['stopped'];
+    final reason = data['reason'];
+    if (returnedSession != sessionId ||
+        stopped is! bool ||
+        (stopped && reason != null) ||
+        (!stopped && reason != 'notRunning')) {
+      throw const WindowsHelperException(
+        code: 'invalidResponse',
+        message: 'Helper returned an invalid stop response',
+      );
+    }
+    return HelperStopResponse(
+      sessionId: returnedSession as String,
+      stopped: stopped,
+      reason: reason as String?,
+    );
+  }
+
+  Map<String, Object?> _responseMap(
+    Response<Object?> response, {
+    required String operation,
+  }) {
+    if (response.statusCode != HttpStatus.ok) {
+      throw WindowsHelperException(
+        code: 'unexpectedStatus',
+        message: 'Helper $operation returned HTTP ${response.statusCode}',
+        details: response.data,
+      );
+    }
+    final data = _mapFrom(response.data);
+    if (data == null) {
+      throw WindowsHelperException(
+        code: 'invalidResponse',
+        message: 'Helper returned an invalid $operation response',
+        details: response.data,
+      );
+    }
+    return data;
+  }
+
+  WindowsHelperException _mapDioException(
+    DioException error, {
+    required String operation,
+  }) {
+    final data = _mapFrom(error.response?.data);
+    final code = data?['code'];
+    final message = data?['message'];
+    if (code is String && message is String) {
+      return WindowsHelperException(
+        code: code,
+        message: message,
+        details: data?['details'],
+      );
+    }
+    return WindowsHelperException(
+      code: 'transportError',
+      message: 'Helper $operation request failed',
+      details: error.toString(),
+    );
+  }
+
+  Map<String, Object?>? _mapFrom(Object? data) {
+    if (data is! Map) {
+      return null;
+    }
+    return Map<String, Object?>.from(data);
+  }
+
+  void _validateSessionId(String sessionId) {
+    if (!RegExp(r'^[0-9a-f]{32}$').hasMatch(sessionId)) {
+      throw const WindowsHelperException(
+        code: 'invalidSessionId',
+        message: 'Core session ID must be 128-bit lowercase hexadecimal',
+      );
+    }
+  }
+
+  Options _options(ResponseType responseType) {
+    return Options(
+      responseType: responseType,
+      connectTimeout: const Duration(milliseconds: 300),
+      receiveTimeout: const Duration(seconds: 2),
+    );
+  }
+}
+
+final class WindowsHelperLauncher implements CoreProcessLauncher {
+  final WindowsHelperClient client;
+
+  const WindowsHelperLauncher(this.client);
+
+  @override
+  CoreProcessOwner get owner => CoreProcessOwner.windowsHelper;
+
+  @override
+  Future<CoreProcessLease> start({
+    required String sessionId,
+    required String address,
+  }) async {
+    try {
+      final response = await client.start(
+        address: address,
+        sessionId: sessionId,
+      );
+      return HelperCoreLease(
+        sessionId: response.sessionId,
+        pid: response.pid,
+        client: client,
+      );
+    } catch (error, stackTrace) {
+      try {
+        await client.stop(sessionId);
+      } catch (_) {}
+      Error.throwWithStackTrace(error, stackTrace);
+    }
+  }
+}
+
+typedef HelperReadinessProbe = Future<bool> Function();
+
+final class WindowsHelperLauncherResolver
+    implements DesktopCoreLauncherResolver {
+  final bool isWindows;
+  final CoreProcessLauncher directLauncher;
+  final CoreProcessLauncher helperLauncher;
+  final HelperReadinessProbe helperReady;
+
+  const WindowsHelperLauncherResolver({
+    required this.isWindows,
+    required this.directLauncher,
+    required this.helperLauncher,
+    required this.helperReady,
+  });
+
+  @override
+  Future<CoreProcessLauncher> resolve() async {
+    if (isWindows && await helperReady()) {
+      return helperLauncher;
+    }
+    return directLauncher;
+  }
+}
+
+final class HelperCoreLease implements CoreProcessLease {
+  @override
+  final String sessionId;
+
+  @override
+  final int pid;
+
+  final WindowsHelperClient _client;
+  Future<CoreProcessStopResult>? _stopOperation;
+
+  HelperCoreLease({
+    required this.sessionId,
+    required this.pid,
+    required WindowsHelperClient client,
+  }) : _client = client;
+
+  @override
+  CoreProcessOwner get owner => CoreProcessOwner.windowsHelper;
+
+  @override
+  Future<CoreProcessStopResult> stop(Duration timeout) {
+    final stopOperation = _stopOperation;
+    if (stopOperation != null) {
+      return stopOperation;
+    }
+    final nextOperation = _stop().onError((
+      Object error,
+      StackTrace stackTrace,
+    ) {
+      _stopOperation = null;
+      Error.throwWithStackTrace(error, stackTrace);
+    });
+    _stopOperation = nextOperation;
+    return nextOperation;
+  }
+
+  Future<CoreProcessStopResult> _stop() async {
+    final response = await _client.stop(sessionId);
+    return CoreProcessStopResult(
+      stopped: response.stopped,
+      exitConfirmed: true,
+    );
+  }
+}
+
+final windowsHelperClient = WindowsHelperClient();
diff --git a/lib/core/desktop/launcher.dart b/lib/core/desktop/launcher.dart
new file mode 100644
index 0000000000..a2790e65bc
--- /dev/null
+++ b/lib/core/desktop/launcher.dart
@@ -0,0 +1,95 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/enum/enum.dart';
+
+import 'model.dart';
+
+typedef CoreProcessStarter =
+    Future<Process> Function(String executable, List<String> arguments);
+
+abstract interface class CoreProcessLauncher {
+  CoreProcessOwner get owner;
+
+  Future<CoreProcessLease> start({
+    required String sessionId,
+    required String address,
+  });
+}
+
+abstract interface class DesktopCoreLauncherResolver {
+  Future<CoreProcessLauncher> resolve();
+}
+
+final class DirectCoreLauncher implements CoreProcessLauncher {
+  final CoreProcessStarter _startProcess;
+  final String corePath;
+
+  DirectCoreLauncher({CoreProcessStarter? startProcess, String? corePath})
+    : _startProcess = startProcess ?? Process.start,
+      corePath = corePath ?? appPath.corePath;
+
+  @override
+  CoreProcessOwner get owner => CoreProcessOwner.direct;
+
+  @override
+  Future<CoreProcessLease> start({
+    required String sessionId,
+    required String address,
+  }) async {
+    final process = await _startProcess(corePath, [address]);
+    process.stdout.listen((_) {});
+    process.stderr.listen((data) {
+      final error = utf8.decode(data);
+      if (error.isNotEmpty) {
+        commonPrint.log(error, logLevel: LogLevel.warning);
+      }
+    });
+    return DirectCoreLease(sessionId: sessionId, process: process);
+  }
+}
+
+final class DirectCoreLease implements CoreProcessLease {
+  @override
+  final String sessionId;
+
+  final Process _process;
+  Future<CoreProcessStopResult>? _stopOperation;
+
+  DirectCoreLease({required this.sessionId, required Process process})
+    : _process = process;
+
+  @override
+  CoreProcessOwner get owner => CoreProcessOwner.direct;
+
+  @override
+  int get pid => _process.pid;
+
+  @override
+  Future<CoreProcessStopResult> stop(Duration timeout) {
+    final stopOperation = _stopOperation;
+    if (stopOperation != null) {
+      return stopOperation;
+    }
+    final nextOperation = _stop(timeout).then((result) {
+      if (!result.exitConfirmed) {
+        _stopOperation = null;
+      }
+      return result;
+    });
+    _stopOperation = nextOperation;
+    return nextOperation;
+  }
+
+  Future<CoreProcessStopResult> _stop(Duration timeout) async {
+    final stopped = _process.kill();
+    try {
+      await _process.exitCode.timeout(timeout);
+      return CoreProcessStopResult(stopped: stopped, exitConfirmed: true);
+    } on TimeoutException {
+      return CoreProcessStopResult(stopped: stopped, exitConfirmed: false);
+    }
+  }
+}
diff --git a/lib/core/desktop/lifecycle.dart b/lib/core/desktop/lifecycle.dart
new file mode 100644
index 0000000000..d073c7b9c9
--- /dev/null
+++ b/lib/core/desktop/lifecycle.dart
@@ -0,0 +1,798 @@
+import 'dart:async';
+
+import 'launcher.dart';
+import 'model.dart';
+import 'transport.dart';
+
+abstract interface class DesktopCoreLifecycleController {
+  DesktopCoreState get state;
+
+  Stream<DesktopCoreState> get states;
+
+  Stream<DesktopCoreFailure> get crashEvents;
+
+  Future<CoreLifecycleResult> start();
+
+  Future<CoreLifecycleResult> restart();
+
+  Future<CoreLifecycleResult> stop();
+
+  Future<CoreLifecycleResult> close();
+
+  Future<DesktopCoreSession> waitUntilRunning(Duration timeout);
+}
+
+enum _LifecycleTarget { running, restarted, stopped, closed }
+
+enum _LifecycleAchievement { runningExisting, runningFresh, idle, closed }
+
+final class _LifecycleIntent {
+  final int revision;
+  final _LifecycleTarget target;
+
+  const _LifecycleIntent(this.revision, this.target);
+}
+
+final class _PendingLifecycleCommand {
+  final _LifecycleIntent intent;
+  final Completer<CoreLifecycleResult> completer =
+      Completer<CoreLifecycleResult>();
+
+  _PendingLifecycleCommand(this.intent);
+}
+
+final class _TransportConnectionWaiter {
+  final Completer<void> _settled = Completer<void>();
+  late final StreamSubscription<DesktopTransportEvent> _subscription;
+  late final Timer _timer;
+  TransportConnected? _connection;
+  Object? _error;
+  StackTrace? _stackTrace;
+
+  _TransportConnectionWaiter(
+    Stream<DesktopTransportEvent> events,
+    Duration timeout,
+  ) {
+    _subscription = events.listen(
+      (event) {
+        switch (event) {
+          case TransportConnected():
+            if (!_settled.isCompleted) {
+              _connection = event;
+              _settled.complete();
+            }
+          case TransportFailed(:final error, :final stackTrace):
+            if (!_settled.isCompleted) {
+              _error = error;
+              _stackTrace = stackTrace;
+              _settled.complete();
+            }
+          case TransportReady() || TransportDisconnected():
+            break;
+        }
+      },
+      onDone: () {
+        if (!_settled.isCompleted) {
+          _error = StateError('Core transport closed before connection');
+          _stackTrace = StackTrace.current;
+          _settled.complete();
+        }
+      },
+    );
+    _timer = Timer(timeout, () {
+      if (!_settled.isCompleted) {
+        _error = TimeoutException(
+          'Core transport connection timed out',
+          timeout,
+        );
+        _stackTrace = StackTrace.current;
+        _settled.complete();
+      }
+    });
+  }
+
+  Future<TransportConnected> get future async {
+    await _settled.future;
+    final error = _error;
+    if (error != null) {
+      Error.throwWithStackTrace(error, _stackTrace ?? StackTrace.current);
+    }
+    return _connection!;
+  }
+
+  Future<void> cancel() async {
+    _timer.cancel();
+    await _subscription.cancel();
+  }
+}
+
+final class DesktopCoreLifecycle implements DesktopCoreLifecycleController {
+  final DesktopCoreTransport Function() transportFactory;
+  final DesktopCoreLauncherResolver launcherResolver;
+  final DesktopCoreTimeouts timeouts;
+  final String Function() sessionIdFactory;
+  final bool verifyPeerPid;
+  final DesktopCoreTransportBinding _transport;
+
+  final StreamController<DesktopCoreState> _stateController =
+      StreamController<DesktopCoreState>.broadcast();
+  final StreamController<DesktopCoreFailure> _crashController =
+      StreamController<DesktopCoreFailure>.broadcast();
+  final List<_PendingLifecycleCommand> _pending = [];
+
+  late final StreamSubscription<DesktopTransportEvent> _transportSubscription;
+  DesktopCoreState _state = const DesktopCoreIdle();
+  DesktopCoreSession? _session;
+  Future<void>? _worker;
+  Future<void>? _unexpectedDisconnectOperation;
+  CoreProcessLease? _unconfirmedLease;
+  Future<CoreLifecycleResult>? _closeResult;
+  int _revision = 0;
+  _LifecycleIntent _desired = const _LifecycleIntent(
+    0,
+    _LifecycleTarget.stopped,
+  );
+  Completer<void> _intentChanged = Completer<void>();
+  bool _terminalRequested = false;
+
+  factory DesktopCoreLifecycle({
+    required DesktopCoreTransport Function() transportFactory,
+    required DesktopCoreLauncherResolver launcherResolver,
+    DesktopCoreTimeouts timeouts = const DesktopCoreTimeouts(),
+    String Function()? sessionIdFactory,
+    bool verifyPeerPid = false,
+  }) {
+    return DesktopCoreLifecycle._(
+      transportFactory: transportFactory,
+      launcherResolver: launcherResolver,
+      timeouts: timeouts,
+      sessionIdFactory: sessionIdFactory ?? createCoreSessionId,
+      verifyPeerPid: verifyPeerPid,
+      transport: DesktopCoreTransportBinding(transportFactory()),
+    );
+  }
+
+  DesktopCoreLifecycle._({
+    required this.transportFactory,
+    required this.launcherResolver,
+    required this.timeouts,
+    required this.sessionIdFactory,
+    required this.verifyPeerPid,
+    required DesktopCoreTransportBinding transport,
+  }) : _transport = transport {
+    _transportSubscription = _transport.events.listen(_handleTransportEvent);
+  }
+
+  DesktopCoreTransport get transport => _transport;
+
+  @override
+  DesktopCoreState get state => _state;
+
+  @override
+  Stream<DesktopCoreState> get states => _stateController.stream;
+
+  @override
+  Stream<DesktopCoreFailure> get crashEvents => _crashController.stream;
+
+  @override
+  Future<CoreLifecycleResult> start() => _submit(_LifecycleTarget.running);
+
+  @override
+  Future<CoreLifecycleResult> restart() => _submit(_LifecycleTarget.restarted);
+
+  @override
+  Future<CoreLifecycleResult> stop() => _submit(_LifecycleTarget.stopped);
+
+  @override
+  Future<CoreLifecycleResult> close() {
+    final closeResult = _closeResult;
+    if (closeResult != null) {
+      return closeResult;
+    }
+    final result = _submit(_LifecycleTarget.closed);
+    _closeResult = result;
+    return result;
+  }
+
+  Future<CoreLifecycleResult> _submit(_LifecycleTarget target) {
+    if (_terminalRequested) {
+      return Future.error(
+        DesktopCoreFailure(
+          code: 'lifecycle_closed',
+          phase: DesktopCorePhase.closed,
+          revision: _revision,
+        ),
+      );
+    }
+    if (target == _LifecycleTarget.closed) {
+      _terminalRequested = true;
+    }
+    final intent = _LifecycleIntent(++_revision, target);
+    final command = _PendingLifecycleCommand(intent);
+    _pending.add(command);
+    _desired = intent;
+    final changed = _intentChanged;
+    _intentChanged = Completer<void>();
+    if (!changed.isCompleted) {
+      changed.complete();
+    }
+    _ensureWorker();
+    return command.completer.future;
+  }
+
+  void _ensureWorker() {
+    if (_worker != null) {
+      return;
+    }
+    late final Future<void> worker;
+    worker = _runWorker().whenComplete(() {
+      if (identical(_worker, worker)) {
+        _worker = null;
+      }
+      if (_pending.isNotEmpty) {
+        _ensureWorker();
+      }
+    });
+    _worker = worker;
+  }
+
+  Future<void> _runWorker() async {
+    while (_pending.isNotEmpty) {
+      final recovery = _unexpectedDisconnectOperation;
+      if (recovery != null) {
+        await recovery;
+      }
+      final intent = _desired;
+      try {
+        final achievement = await _reconcile(intent);
+        final settled = _desired;
+        if (!_satisfies(achievement, settled.target)) {
+          continue;
+        }
+        _completeCommands(settled);
+      } catch (error, stackTrace) {
+        final failure = error is DesktopCoreFailure
+            ? error
+            : _failure(
+                code: 'lifecycle_error',
+                phase: _state.phase,
+                revision: intent.revision,
+                cause: error,
+                stackTrace: stackTrace,
+              );
+        final desired = _desired;
+        if (desired.target == _LifecycleTarget.closed &&
+            intent.target != _LifecycleTarget.closed) {
+          continue;
+        }
+        _publish(DesktopCoreFailed(failure));
+        _failCommands(desired.revision, failure);
+      }
+    }
+  }
+
+  Future<_LifecycleAchievement> _reconcile(_LifecycleIntent intent) async {
+    final unconfirmedLease = _unconfirmedLease;
+    if (unconfirmedLease != null) {
+      if (intent.target == _LifecycleTarget.closed) {
+        await _stopUnconfirmedLease(unconfirmedLease, allowFailure: true);
+      } else if (intent.target == _LifecycleTarget.stopped) {
+        await _stopUnconfirmedLease(unconfirmedLease, allowFailure: false);
+      } else {
+        throw _failure(
+          code: 'process_exit_unconfirmed',
+          phase: DesktopCorePhase.failed,
+          revision: intent.revision,
+          lease: unconfirmedLease,
+        );
+      }
+    }
+    switch (intent.target) {
+      case _LifecycleTarget.running:
+        if (_session != null && _state is DesktopCoreRunning) {
+          return _LifecycleAchievement.runningExisting;
+        }
+        final started = await _startSession(intent.revision);
+        if (!started && _desired.target == _LifecycleTarget.stopped) {
+          _publish(const DesktopCoreIdle());
+        }
+        return started
+            ? _LifecycleAchievement.runningFresh
+            : _LifecycleAchievement.idle;
+      case _LifecycleTarget.restarted:
+        final session = _session;
+        if (session != null) {
+          await _stopSession(
+            session,
+            intent.revision,
+            allowUnconfirmedExit: _terminalRequested,
+          );
+        }
+        if (!_wantsRunning) {
+          return _LifecycleAchievement.idle;
+        }
+        final started = await _startSession(_desired.revision);
+        return started
+            ? _LifecycleAchievement.runningFresh
+            : _LifecycleAchievement.idle;
+      case _LifecycleTarget.stopped:
+        final session = _session;
+        if (session != null) {
+          await _stopSession(
+            session,
+            intent.revision,
+            allowUnconfirmedExit: false,
+          );
+        }
+        if (_desired.target == _LifecycleTarget.stopped) {
+          _publish(const DesktopCoreIdle());
+        }
+        return _LifecycleAchievement.idle;
+      case _LifecycleTarget.closed:
+        final session = _session;
+        if (session != null) {
+          await _stopSession(
+            session,
+            intent.revision,
+            allowUnconfirmedExit: true,
+          );
+        }
+        await _transportSubscription.cancel();
+        await _transport.close();
+        _publish(DesktopCoreClosed(intent.revision));
+        await _stateController.close();
+        await _crashController.close();
+        return _LifecycleAchievement.closed;
+    }
+  }
+
+  bool get _wantsRunning {
+    return _desired.target == _LifecycleTarget.running ||
+        _desired.target == _LifecycleTarget.restarted;
+  }
+
+  Future<bool> _startSession(int revision) async {
+    final sessionId = sessionIdFactory();
+    _publish(DesktopCoreStarting(revision: revision, sessionId: sessionId));
+    CoreProcessLease? lease;
+    var leaseReleased = false;
+    _TransportConnectionWaiter? connectionWaiter;
+
+    Future<void> releaseLease() async {
+      final ownedLease = lease;
+      if (ownedLease == null || leaseReleased) {
+        return;
+      }
+      leaseReleased = true;
+      await _cleanObsoleteLease(ownedLease, revision);
+    }
+
+    try {
+      if (!await _ensureTransportReady()) {
+        return false;
+      }
+      final launcher = await launcherResolver.resolve();
+      if (!_wantsRunning) {
+        return false;
+      }
+      connectionWaiter = _TransportConnectionWaiter(
+        _transport.events,
+        timeouts.connection,
+      );
+      lease = await launcher.start(
+        sessionId: sessionId,
+        address: _transport.address,
+      );
+      if (lease.sessionId != sessionId) {
+        await releaseLease();
+        throw _failure(
+          code: 'session_mismatch',
+          phase: DesktopCorePhase.starting,
+          revision: revision,
+          lease: lease,
+        );
+      }
+      if (!_wantsRunning) {
+        await releaseLease();
+        _publish(const DesktopCoreIdle());
+        return false;
+      }
+      final connected = await _waitForConnectionWhileWanted(
+        connectionWaiter.future,
+      );
+      if (connected == null || !_wantsRunning) {
+        await releaseLease();
+        _publish(const DesktopCoreIdle());
+        return false;
+      }
+      if (verifyPeerPid && connected.pid != lease.pid) {
+        await releaseLease();
+        throw _failure(
+          code: 'peer_pid_mismatch',
+          phase: DesktopCorePhase.starting,
+          revision: revision,
+          lease: lease,
+          connectionGeneration: connected.generation,
+          cause: StateError(
+            'Expected Core PID ${lease.pid}, connected ${connected.pid}',
+          ),
+        );
+      }
+      final session = DesktopCoreSession(
+        sessionId: sessionId,
+        lease: lease,
+        connectionGeneration: connected.generation,
+      );
+      _session = session;
+      leaseReleased = true;
+      _publish(DesktopCoreRunning(session));
+      return true;
+    } catch (error, stackTrace) {
+      try {
+        await releaseLease();
+      } on DesktopCoreFailure catch (cleanupFailure) {
+        Error.throwWithStackTrace(
+          cleanupFailure,
+          cleanupFailure.stackTrace ?? stackTrace,
+        );
+      }
+      if (error is DesktopCoreFailure) {
+        Error.throwWithStackTrace(error, error.stackTrace ?? stackTrace);
+      }
+      throw _failure(
+        code: 'start_failed',
+        phase: DesktopCorePhase.starting,
+        revision: revision,
+        cause: error,
+        stackTrace: stackTrace,
+      );
+    } finally {
+      await connectionWaiter?.cancel();
+    }
+  }
+
+  Future<bool> _ensureTransportReady() async {
+    if (_transport.state == DesktopTransportState.failed ||
+        _transport.state == DesktopTransportState.closed ||
+        (_transport.state == DesktopTransportState.connected &&
+            _session == null)) {
+      await _transport.replace(transportFactory());
+    }
+    if (_transport.state == DesktopTransportState.ready ||
+        _transport.state == DesktopTransportState.connected) {
+      return true;
+    }
+    final opening = _transport.open().timeout(timeouts.ready);
+    while (_wantsRunning) {
+      final changed = _intentChanged.future;
+      final result = await Future.any<Object?>([
+        opening.then<Object?>((_) => true),
+        changed.then<Object?>((_) => false),
+      ]);
+      if (result == true) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  Future<TransportConnected?> _waitForConnectionWhileWanted(
+    Future<TransportConnected> connection,
+  ) async {
+    while (_wantsRunning) {
+      final changed = _intentChanged.future;
+      final result = await Future.any<Object?>([
+        connection,
+        changed.then<Object?>((_) => null),
+      ]);
+      if (result is TransportConnected) {
+        return result;
+      }
+    }
+    return null;
+  }
+
+  Future<void> _cleanObsoleteLease(CoreProcessLease lease, int revision) async {
+    late final CoreProcessStopResult result;
+    try {
+      result = await lease.stop(timeouts.disconnection);
+    } catch (error, stackTrace) {
+      _unconfirmedLease = lease;
+      throw _failure(
+        code: 'process_cleanup_failed',
+        phase: DesktopCorePhase.stopping,
+        revision: revision,
+        lease: lease,
+        cause: error,
+        stackTrace: stackTrace,
+      );
+    }
+    if (result.exitConfirmed) {
+      if (identical(_unconfirmedLease, lease)) {
+        _unconfirmedLease = null;
+      }
+      return;
+    }
+    _unconfirmedLease = lease;
+    throw _failure(
+      code: 'process_exit_unconfirmed',
+      phase: DesktopCorePhase.stopping,
+      revision: revision,
+      lease: lease,
+    );
+  }
+
+  Future<void> _stopUnconfirmedLease(
+    CoreProcessLease lease, {
+    required bool allowFailure,
+  }) async {
+    try {
+      final result = await lease.stop(timeouts.disconnection);
+      if (result.exitConfirmed) {
+        _unconfirmedLease = null;
+      } else if (!allowFailure) {
+        throw _failure(
+          code: 'process_exit_unconfirmed',
+          phase: DesktopCorePhase.stopping,
+          revision: _desired.revision,
+          lease: lease,
+        );
+      }
+    } catch (_) {
+      if (!allowFailure) {
+        rethrow;
+      }
+    } finally {
+      if (allowFailure) {
+        _unconfirmedLease = null;
+      }
+    }
+  }
+
+  Future<void> _stopSession(
+    DesktopCoreSession session,
+    int revision, {
+    required bool allowUnconfirmedExit,
+  }) async {
+    _publish(DesktopCoreStopping(revision: revision, session: session));
+    final disconnected = Completer<void>();
+    late final StreamSubscription<DesktopTransportEvent> subscription;
+    subscription = _transport.events.listen((event) {
+      if (event case TransportDisconnected(
+        :final generation,
+      ) when generation == session.connectionGeneration) {
+        if (!disconnected.isCompleted) {
+          disconnected.complete();
+        }
+      }
+    });
+    try {
+      final stopResult = await session.lease.stop(timeouts.disconnection);
+      if (!stopResult.exitConfirmed) {
+        if (!allowUnconfirmedExit) {
+          throw _failure(
+            code: 'process_exit_unconfirmed',
+            phase: DesktopCorePhase.stopping,
+            revision: revision,
+            session: session,
+          );
+        }
+        _session = null;
+        return;
+      }
+      try {
+        await disconnected.future.timeout(timeouts.disconnection);
+      } on TimeoutException {
+        _session = null;
+        if (!_terminalRequested) {
+          await _transport.replace(transportFactory());
+        }
+        return;
+      }
+      _session = null;
+    } on DesktopCoreFailure {
+      rethrow;
+    } catch (error, stackTrace) {
+      if (allowUnconfirmedExit) {
+        _session = null;
+        return;
+      }
+      throw _failure(
+        code: 'stop_failed',
+        phase: DesktopCorePhase.stopping,
+        revision: revision,
+        session: session,
+        cause: error,
+        stackTrace: stackTrace,
+      );
+    } finally {
+      await subscription.cancel();
+    }
+  }
+
+  bool _satisfies(_LifecycleAchievement achievement, _LifecycleTarget target) {
+    return switch (target) {
+      _LifecycleTarget.running =>
+        achievement == _LifecycleAchievement.runningExisting ||
+            achievement == _LifecycleAchievement.runningFresh,
+      _LifecycleTarget.restarted =>
+        achievement == _LifecycleAchievement.runningFresh,
+      _LifecycleTarget.stopped => achievement == _LifecycleAchievement.idle,
+      _LifecycleTarget.closed => achievement == _LifecycleAchievement.closed,
+    };
+  }
+
+  void _completeCommands(_LifecycleIntent settled) {
+    final commands = _pending
+        .where((command) => command.intent.revision <= settled.revision)
+        .toList(growable: false);
+    _pending.removeWhere(
+      (command) => command.intent.revision <= settled.revision,
+    );
+    for (final command in commands) {
+      final outcome = command.intent.revision == settled.revision
+          ? CoreLifecycleOutcome.applied
+          : _targetsCoalesce(command.intent.target, settled.target)
+          ? CoreLifecycleOutcome.coalesced
+          : CoreLifecycleOutcome.superseded;
+      command.completer.complete(
+        CoreLifecycleResult(
+          revision: command.intent.revision,
+          outcome: outcome,
+          session: _session,
+        ),
+      );
+    }
+  }
+
+  bool _targetsCoalesce(_LifecycleTarget first, _LifecycleTarget settled) {
+    final firstRuns =
+        first == _LifecycleTarget.running ||
+        first == _LifecycleTarget.restarted;
+    final settledRuns =
+        settled == _LifecycleTarget.running ||
+        settled == _LifecycleTarget.restarted;
+    return (firstRuns && settledRuns) || first == settled;
+  }
+
+  void _failCommands(int revision, DesktopCoreFailure failure) {
+    final commands = _pending
+        .where((command) => command.intent.revision <= revision)
+        .toList(growable: false);
+    _pending.removeWhere((command) => command.intent.revision <= revision);
+    for (final command in commands) {
+      command.completer.completeError(failure, failure.stackTrace);
+    }
+  }
+
+  void _handleTransportEvent(DesktopTransportEvent event) {
+    final running = _state;
+    if (running is! DesktopCoreRunning) {
+      return;
+    }
+    switch (event) {
+      case TransportDisconnected(:final generation)
+          when generation == running.session.connectionGeneration:
+        _handleUnexpectedDisconnect(
+          running.session,
+          code: 'unexpected_disconnect',
+        );
+      case TransportFailed(:final error, :final stackTrace):
+        _handleUnexpectedDisconnect(
+          running.session,
+          code: 'transport_failed',
+          cause: error,
+          stackTrace: stackTrace,
+        );
+      case TransportReady() || TransportConnected() || TransportDisconnected():
+        break;
+    }
+  }
+
+  void _handleUnexpectedDisconnect(
+    DesktopCoreSession session, {
+    required String code,
+    Object? cause,
+    StackTrace? stackTrace,
+  }) {
+    if (_unexpectedDisconnectOperation != null ||
+        !identical(_session, session)) {
+      return;
+    }
+    _session = null;
+    final failure = _failure(
+      code: code,
+      phase: DesktopCorePhase.running,
+      revision: _revision,
+      session: session,
+      cause: cause,
+      stackTrace: stackTrace,
+    );
+    _publish(DesktopCoreFailed(failure));
+    if (!_crashController.isClosed) {
+      _crashController.add(failure);
+    }
+    late final Future<void> operation;
+    operation = session.lease
+        .stop(timeouts.disconnection)
+        .then<void>((result) {
+          if (!result.exitConfirmed) {
+            _unconfirmedLease = session.lease;
+          }
+        })
+        .catchError((_) {
+          _unconfirmedLease = session.lease;
+        })
+        .whenComplete(() {
+          if (identical(_unexpectedDisconnectOperation, operation)) {
+            _unexpectedDisconnectOperation = null;
+          }
+        });
+    _unexpectedDisconnectOperation = operation;
+  }
+
+  DesktopCoreFailure _failure({
+    required String code,
+    required DesktopCorePhase phase,
+    required int revision,
+    DesktopCoreSession? session,
+    CoreProcessLease? lease,
+    int? connectionGeneration,
+    Object? cause,
+    StackTrace? stackTrace,
+  }) {
+    return DesktopCoreFailure(
+      code: code,
+      phase: phase,
+      revision: revision,
+      sessionId: session?.sessionId ?? lease?.sessionId,
+      owner: session?.owner ?? lease?.owner,
+      pid: session?.pid ?? lease?.pid,
+      connectionGeneration:
+          connectionGeneration ?? session?.connectionGeneration,
+      cause: cause,
+      stackTrace: stackTrace,
+    );
+  }
+
+  void _publish(DesktopCoreState state) {
+    _state = state;
+    if (!_stateController.isClosed) {
+      _stateController.add(state);
+    }
+  }
+
+  @override
+  Future<DesktopCoreSession> waitUntilRunning(Duration timeout) {
+    final current = _state;
+    if (current is DesktopCoreRunning) {
+      return Future.value(current.session);
+    }
+    if (current is DesktopCoreFailed) {
+      return Future.error(current.failure, current.failure.stackTrace);
+    }
+    if (current is DesktopCoreClosed) {
+      return Future.error(StateError('Desktop Core lifecycle is closed'));
+    }
+    return states
+        .firstWhere(
+          (state) =>
+              state is DesktopCoreRunning ||
+              state is DesktopCoreFailed ||
+              state is DesktopCoreClosed,
+        )
+        .then<DesktopCoreSession>((state) {
+          if (state case DesktopCoreRunning(:final session)) {
+            return session;
+          }
+          if (state case DesktopCoreFailed(:final failure)) {
+            Error.throwWithStackTrace(
+              failure,
+              failure.stackTrace ?? StackTrace.current,
+            );
+          }
+          throw StateError('Desktop Core lifecycle is closed');
+        })
+        .timeout(timeout);
+  }
+}
diff --git a/lib/core/desktop/model.dart b/lib/core/desktop/model.dart
new file mode 100644
index 0000000000..caa9d08fc7
--- /dev/null
+++ b/lib/core/desktop/model.dart
@@ -0,0 +1,177 @@
+import 'dart:async';
+import 'dart:math';
+
+enum CoreProcessOwner { direct, windowsHelper }
+
+enum CoreLifecycleOutcome { applied, coalesced, superseded }
+
+enum DesktopCorePhase { idle, starting, running, stopping, failed, closed }
+
+final class CoreLifecycleResult {
+  final int revision;
+  final CoreLifecycleOutcome outcome;
+  final DesktopCoreSession? session;
+
+  const CoreLifecycleResult({
+    required this.revision,
+    required this.outcome,
+    this.session,
+  });
+}
+
+final class DesktopCoreTimeouts {
+  final Duration ready;
+  final Duration connection;
+  final Duration disconnection;
+
+  const DesktopCoreTimeouts({
+    this.ready = const Duration(seconds: 10),
+    this.connection = const Duration(seconds: 10),
+    this.disconnection = const Duration(seconds: 10),
+  });
+}
+
+final class CoreProcessStopResult {
+  final bool stopped;
+  final bool exitConfirmed;
+
+  const CoreProcessStopResult({
+    required this.stopped,
+    required this.exitConfirmed,
+  });
+
+  @override
+  bool operator ==(Object other) {
+    return other is CoreProcessStopResult &&
+        other.stopped == stopped &&
+        other.exitConfirmed == exitConfirmed;
+  }
+
+  @override
+  int get hashCode => Object.hash(stopped, exitConfirmed);
+}
+
+abstract interface class CoreProcessLease {
+  String get sessionId;
+
+  CoreProcessOwner get owner;
+
+  int get pid;
+
+  Future<CoreProcessStopResult> stop(Duration timeout);
+}
+
+final class DesktopCoreSession {
+  final String sessionId;
+  final CoreProcessLease lease;
+  final int connectionGeneration;
+
+  const DesktopCoreSession({
+    required this.sessionId,
+    required this.lease,
+    required this.connectionGeneration,
+  });
+
+  CoreProcessOwner get owner => lease.owner;
+
+  int get pid => lease.pid;
+}
+
+final class DesktopCoreFailure implements Exception {
+  final String code;
+  final DesktopCorePhase phase;
+  final int revision;
+  final String? sessionId;
+  final CoreProcessOwner? owner;
+  final int? pid;
+  final int? connectionGeneration;
+  final Object? cause;
+  final StackTrace? stackTrace;
+
+  const DesktopCoreFailure({
+    required this.code,
+    required this.phase,
+    required this.revision,
+    this.sessionId,
+    this.owner,
+    this.pid,
+    this.connectionGeneration,
+    this.cause,
+    this.stackTrace,
+  });
+
+  @override
+  String toString() {
+    return 'DesktopCoreFailure($code, $phase, revision: $revision, '
+        'session: $sessionId, owner: $owner, pid: $pid, '
+        'generation: $connectionGeneration, cause: $cause)';
+  }
+}
+
+sealed class DesktopCoreState {
+  const DesktopCoreState();
+
+  DesktopCorePhase get phase;
+}
+
+final class DesktopCoreIdle extends DesktopCoreState {
+  const DesktopCoreIdle();
+
+  @override
+  DesktopCorePhase get phase => DesktopCorePhase.idle;
+}
+
+final class DesktopCoreStarting extends DesktopCoreState {
+  final int revision;
+  final String sessionId;
+
+  const DesktopCoreStarting({required this.revision, required this.sessionId});
+
+  @override
+  DesktopCorePhase get phase => DesktopCorePhase.starting;
+}
+
+final class DesktopCoreRunning extends DesktopCoreState {
+  final DesktopCoreSession session;
+
+  const DesktopCoreRunning(this.session);
+
+  @override
+  DesktopCorePhase get phase => DesktopCorePhase.running;
+}
+
+final class DesktopCoreStopping extends DesktopCoreState {
+  final int revision;
+  final DesktopCoreSession session;
+
+  const DesktopCoreStopping({required this.revision, required this.session});
+
+  @override
+  DesktopCorePhase get phase => DesktopCorePhase.stopping;
+}
+
+final class DesktopCoreFailed extends DesktopCoreState {
+  final DesktopCoreFailure failure;
+
+  const DesktopCoreFailed(this.failure);
+
+  @override
+  DesktopCorePhase get phase => DesktopCorePhase.failed;
+}
+
+final class DesktopCoreClosed extends DesktopCoreState {
+  final int revision;
+
+  const DesktopCoreClosed(this.revision);
+
+  @override
+  DesktopCorePhase get phase => DesktopCorePhase.closed;
+}
+
+String createCoreSessionId() {
+  final random = Random.secure();
+  return List.generate(
+    16,
+    (_) => random.nextInt(256).toRadixString(16).padLeft(2, '0'),
+  ).join();
+}
diff --git a/lib/core/desktop/rpc_client.dart b/lib/core/desktop/rpc_client.dart
new file mode 100644
index 0000000000..cdb6144eef
--- /dev/null
+++ b/lib/core/desktop/rpc_client.dart
@@ -0,0 +1,208 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/core/event.dart';
+import 'package:fl_clash/core/method.dart';
+import 'package:fl_clash/enum/enum.dart';
+
+import 'transport.dart';
+
+abstract interface class CoreRpcChannel {
+  Future<T?> invoke<T>({
+    required CoreMethod method,
+    Object? arguments,
+    Duration? timeout,
+  });
+
+  Future<void> close();
+}
+
+final class CoreRpcClient implements CoreRpcChannel {
+  final DesktopCoreTransport transport;
+  final Map<String, Completer<Object?>> _pending = {};
+  late final StreamSubscription<Uint8List> _frameSubscription;
+  late final StreamSubscription<DesktopTransportEvent> _eventSubscription;
+
+  int _methodCallId = 0;
+  Future<void>? _closeOperation;
+
+  CoreRpcClient(this.transport) {
+    _frameSubscription = transport.frames.listen(
+      _handleFrame,
+      onError: _handleFrameError,
+    );
+    _eventSubscription = transport.events.listen(_handleTransportEvent);
+  }
+
+  int get pendingCount => _pending.length;
+
+  @override
+  Future<T?> invoke<T>({
+    required CoreMethod method,
+    Object? arguments,
+    Duration? timeout,
+  }) async {
+    if (_closeOperation != null) {
+      throw const CoreMethodException(
+        code: 'transport_disconnected',
+        message: 'Core RPC client is closed',
+      );
+    }
+    final id = '${++_methodCallId}';
+    final completer = Completer<Object?>();
+    _pending[id] = completer;
+    final requestTimeout = timeout ?? const Duration(minutes: 3);
+    final stopwatch = Stopwatch()..start();
+    try {
+      await Future.any<Object?>([
+        transport.waitUntilConnected(const Duration(seconds: 10)),
+        completer.future,
+      ]);
+      if (completer.isCompleted) {
+        return await completer.future as T?;
+      }
+      await transport.send(
+        json.encode(
+          CoreMethodCall(id: id, method: method, arguments: arguments),
+        ),
+      );
+      final remainingTimeout = requestTimeout - stopwatch.elapsed;
+      if (remainingTimeout <= Duration.zero) {
+        throw TimeoutException('Core method ${method.name} timed out');
+      }
+      return await completer.future.timeout(remainingTimeout) as T?;
+    } on TimeoutException {
+      _removePending(id, completer);
+      return null;
+    } on CoreMethodException {
+      _pending.remove(id);
+      rethrow;
+    } catch (error) {
+      _removePending(id, completer);
+      throw CoreMethodException(
+        code: 'transport_error',
+        message: 'Unable to send ${method.name} to Core',
+        details: error.toString(),
+      );
+    } finally {
+      stopwatch.stop();
+    }
+  }
+
+  void _removePending(String id, Completer<Object?> completer) {
+    final removed = _pending.remove(id);
+    if (identical(removed, completer) && !completer.isCompleted) {
+      completer.complete(null);
+    }
+  }
+
+  void _handleFrame(Uint8List frame) {
+    try {
+      final decoded = json.decode(utf8.decode(frame));
+      if (decoded is! Map) {
+        throw const FormatException('Core transport data is not an object');
+      }
+      final data = Map<String, Object?>.from(decoded);
+      if (data.containsKey('method')) {
+        _handleMethodCall(CoreMethodCall.fromJson(data));
+      } else {
+        _handleResponse(CoreMethodResponse.fromJson(data));
+      }
+    } catch (error) {
+      commonPrint.log(
+        'Failed to parse transport data: $error',
+        logLevel: LogLevel.error,
+      );
+    }
+  }
+
+  void _handleMethodCall(CoreMethodCall call) {
+    if (call.method != CoreMethod.message) {
+      commonPrint.log(
+        'Unknown core callback method: ${call.method.name}',
+        logLevel: LogLevel.warning,
+      );
+      return;
+    }
+    for (final event in coreEventsFromData(call.arguments)) {
+      coreEventManager.sendEvent(event);
+    }
+  }
+
+  void _handleResponse(CoreMethodResponse response) {
+    final id = response.id;
+    final completer = id == null ? null : _pending.remove(id);
+    if (completer == null || completer.isCompleted) {
+      return;
+    }
+    final error = response.error;
+    if (error != null) {
+      completer.completeError(
+        CoreMethodException(
+          code: error.code,
+          message: error.message,
+          details: error.details,
+        ),
+      );
+      return;
+    }
+    completer.complete(response.result);
+  }
+
+  void _handleFrameError(Object error, StackTrace stackTrace) {
+    commonPrint.log(
+      'Transport data stream error: $error',
+      logLevel: LogLevel.error,
+    );
+  }
+
+  void _handleTransportEvent(DesktopTransportEvent event) {
+    switch (event) {
+      case TransportDisconnected():
+        _failPending(
+          const CoreMethodException(
+            code: 'transport_disconnected',
+            message: 'Core transport disconnected',
+          ),
+        );
+      case TransportFailed(:final error):
+        _failPending(
+          CoreMethodException(
+            code: 'transport_error',
+            message: 'Core transport failed',
+            details: error.toString(),
+          ),
+        );
+      case TransportReady() || TransportConnected():
+        break;
+    }
+  }
+
+  void _failPending(CoreMethodException error) {
+    final completers = _pending.values.toList(growable: false);
+    _pending.clear();
+    for (final completer in completers) {
+      if (!completer.isCompleted) {
+        completer.completeError(error);
+      }
+    }
+  }
+
+  @override
+  Future<void> close() {
+    return _closeOperation ??= _close();
+  }
+
+  Future<void> _close() async {
+    _failPending(
+      const CoreMethodException(
+        code: 'transport_disconnected',
+        message: 'Core RPC client is closed',
+      ),
+    );
+    await _frameSubscription.cancel();
+    await _eventSubscription.cancel();
+  }
+}
diff --git a/lib/core/desktop/transport.dart b/lib/core/desktop/transport.dart
new file mode 100644
index 0000000000..4de580583c
--- /dev/null
+++ b/lib/core/desktop/transport.dart
@@ -0,0 +1,397 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:rust_api/rust_api.dart';
+
+const _typeReady = 0x00;
+const _typeConnected = 0x01;
+const _typeDisconnected = 0x02;
+const _typeData = 0x03;
+const _typeError = 0x04;
+
+typedef IpcServerStarter = Stream<Uint8List> Function(String address);
+typedef IpcMessageSender = Future<void> Function(List<int> data);
+typedef IpcServerStopper = Future<void> Function();
+
+enum DesktopTransportState { idle, starting, ready, connected, failed, closed }
+
+sealed class DesktopTransportEvent {
+  const DesktopTransportEvent();
+}
+
+final class TransportReady extends DesktopTransportEvent {
+  const TransportReady();
+}
+
+final class TransportConnected extends DesktopTransportEvent {
+  final int? pid;
+  final int generation;
+
+  const TransportConnected({required this.pid, required this.generation});
+}
+
+final class TransportDisconnected extends DesktopTransportEvent {
+  final int generation;
+
+  const TransportDisconnected(this.generation);
+}
+
+final class TransportFailed extends DesktopTransportEvent {
+  final Object error;
+  final StackTrace stackTrace;
+
+  const TransportFailed(this.error, this.stackTrace);
+}
+
+abstract interface class DesktopCoreTransport {
+  String get address;
+
+  DesktopTransportState get state;
+
+  Stream<DesktopTransportEvent> get events;
+
+  Stream<Uint8List> get frames;
+
+  Future<void> open();
+
+  Future<TransportConnected> waitUntilConnected(Duration timeout);
+
+  Future<void> send(String message);
+
+  Future<void> close();
+}
+
+final class DesktopCoreTransportBinding implements DesktopCoreTransport {
+  DesktopCoreTransport _transport;
+  final StreamController<DesktopTransportEvent> _eventController =
+      StreamController<DesktopTransportEvent>.broadcast();
+  final StreamController<Uint8List> _frameController =
+      StreamController<Uint8List>.broadcast();
+  StreamSubscription<DesktopTransportEvent>? _eventSubscription;
+  StreamSubscription<Uint8List>? _frameSubscription;
+  Future<void>? _closeOperation;
+
+  DesktopCoreTransportBinding(DesktopCoreTransport transport)
+    : _transport = transport {
+    _bind(transport);
+  }
+
+  void _bind(DesktopCoreTransport transport) {
+    _eventSubscription = transport.events.listen(
+      _eventController.add,
+      onError: _eventController.addError,
+    );
+    _frameSubscription = transport.frames.listen(
+      _frameController.add,
+      onError: _frameController.addError,
+    );
+  }
+
+  @override
+  String get address => _transport.address;
+
+  @override
+  DesktopTransportState get state => _transport.state;
+
+  @override
+  Stream<DesktopTransportEvent> get events => _eventController.stream;
+
+  @override
+  Stream<Uint8List> get frames => _frameController.stream;
+
+  Future<void> replace(DesktopCoreTransport next) async {
+    if (_closeOperation != null) {
+      throw StateError('IPC transport binding is closed');
+    }
+    final previous = _transport;
+    if (previous.state == DesktopTransportState.connected &&
+        !_eventController.isClosed) {
+      _eventController.add(
+        TransportFailed(
+          StateError('Connected IPC transport was replaced'),
+          StackTrace.current,
+        ),
+      );
+    }
+    await _eventSubscription?.cancel();
+    await _frameSubscription?.cancel();
+    _eventSubscription = null;
+    _frameSubscription = null;
+    Object? closeError;
+    StackTrace? closeStackTrace;
+    try {
+      await previous.close();
+    } catch (error, stackTrace) {
+      closeError = error;
+      closeStackTrace = stackTrace;
+    }
+    _transport = next;
+    _bind(next);
+    if (closeError != null) {
+      Error.throwWithStackTrace(closeError, closeStackTrace!);
+    }
+  }
+
+  @override
+  Future<void> open() => _transport.open();
+
+  @override
+  Future<TransportConnected> waitUntilConnected(Duration timeout) {
+    return _transport.waitUntilConnected(timeout);
+  }
+
+  @override
+  Future<void> send(String message) => _transport.send(message);
+
+  @override
+  Future<void> close() {
+    return _closeOperation ??= _close();
+  }
+
+  Future<void> _close() async {
+    await _eventSubscription?.cancel();
+    await _frameSubscription?.cancel();
+    _eventSubscription = null;
+    _frameSubscription = null;
+    try {
+      await _transport.close();
+    } finally {
+      await _eventController.close();
+      await _frameController.close();
+    }
+  }
+}
+
+final class IPCCoreTransport implements DesktopCoreTransport {
+  @override
+  final String address;
+
+  final Duration readyTimeout;
+  final IpcServerStarter _startServer;
+  final IpcMessageSender _sendMessage;
+  final IpcServerStopper _stopServer;
+
+  final StreamController<DesktopTransportEvent> _eventController =
+      StreamController<DesktopTransportEvent>.broadcast();
+  final StreamController<Uint8List> _frameController =
+      StreamController<Uint8List>.broadcast();
+
+  StreamSubscription<Uint8List>? _subscription;
+  Future<void>? _openOperation;
+  Future<void>? _closeOperation;
+  DesktopTransportState _state = DesktopTransportState.idle;
+  TransportConnected? _connection;
+  TransportFailed? _failure;
+  int _connectionGeneration = 0;
+
+  IPCCoreTransport({
+    required this.address,
+    this.readyTimeout = const Duration(seconds: 10),
+    IpcServerStarter? startServer,
+    IpcMessageSender? sendMessage,
+    IpcServerStopper? stopServer,
+  }) : _startServer = startServer ?? _restartIpcServer,
+       _sendMessage = sendMessage ?? _sendIpcMessage,
+       _stopServer = stopServer ?? stopIpcServer;
+
+  static Stream<Uint8List> _restartIpcServer(String address) {
+    return restartIpcServer(name: address);
+  }
+
+  static Future<void> _sendIpcMessage(List<int> data) {
+    return sendIpcMessage(data: data);
+  }
+
+  @override
+  DesktopTransportState get state => _state;
+
+  @override
+  Stream<DesktopTransportEvent> get events => _eventController.stream;
+
+  @override
+  Stream<Uint8List> get frames => _frameController.stream;
+
+  @override
+  Future<void> open() {
+    if (_state == DesktopTransportState.ready ||
+        _state == DesktopTransportState.connected) {
+      return Future.value();
+    }
+    if (_state == DesktopTransportState.closed) {
+      return Future.error(StateError('IPC transport is closed'));
+    }
+    return _openOperation ??= _open();
+  }
+
+  Future<void> _open() async {
+    _state = DesktopTransportState.starting;
+    final readiness = events.firstWhere(
+      (event) => event is TransportReady || event is TransportFailed,
+    );
+    try {
+      _subscription = _startServer(address).listen(
+        _handleFrame,
+        onError: _handleStreamError,
+        onDone: _handleStreamDone,
+        cancelOnError: false,
+      );
+      final event = await readiness.timeout(readyTimeout);
+      if (event case TransportFailed(:final error, :final stackTrace)) {
+        Error.throwWithStackTrace(error, stackTrace);
+      }
+    } catch (error, stackTrace) {
+      if (_state != DesktopTransportState.failed &&
+          _state != DesktopTransportState.closed) {
+        _fail(error, stackTrace);
+      }
+      await _subscription?.cancel();
+      _subscription = null;
+      rethrow;
+    }
+  }
+
+  void _handleFrame(Uint8List data) {
+    if (data.isEmpty || _state == DesktopTransportState.closed) {
+      return;
+    }
+    final type = data[0];
+    final payload = data.length > 1 ? data.sublist(1) : Uint8List(0);
+    switch (type) {
+      case _typeReady:
+        commonPrint.log('IPC Ready');
+        _state = DesktopTransportState.ready;
+        _eventController.add(const TransportReady());
+      case _typeConnected:
+        final processId = _decodeConnectedProcessId(payload);
+        if (payload.isNotEmpty && processId == null) {
+          _fail(StateError('Invalid IPC connected frame'), StackTrace.current);
+          return;
+        }
+        commonPrint.log(
+          'IPC Connected${processId == null ? '' : ': $processId'}',
+        );
+        _connectionGeneration++;
+        _connection = TransportConnected(
+          pid: processId,
+          generation: _connectionGeneration,
+        );
+        _state = DesktopTransportState.connected;
+        _eventController.add(_connection!);
+      case _typeDisconnected:
+        _disconnect();
+      case _typeData:
+        if (!_frameController.isClosed) {
+          _frameController.add(payload);
+        }
+      case _typeError:
+        final message = utf8.decode(payload, allowMalformed: true);
+        _fail(StateError('IPC error: $message'), StackTrace.current);
+      default:
+        commonPrint.log(
+          'IPC unknown frame type: $type',
+          logLevel: LogLevel.warning,
+        );
+    }
+  }
+
+  int? _decodeConnectedProcessId(Uint8List payload) {
+    if (payload.isEmpty) {
+      return null;
+    }
+    if (payload.length != Uint32List.bytesPerElement) {
+      return null;
+    }
+    final processId = ByteData.sublistView(payload).getUint32(0, Endian.little);
+    return processId == 0 ? null : processId;
+  }
+
+  void _disconnect() {
+    final connection = _connection;
+    if (connection == null) {
+      return;
+    }
+    commonPrint.log('IPC Disconnected');
+    _connection = null;
+    _state = DesktopTransportState.ready;
+    _eventController.add(TransportDisconnected(connection.generation));
+  }
+
+  void _handleStreamError(Object error, StackTrace stackTrace) {
+    _fail(error, stackTrace);
+  }
+
+  void _handleStreamDone() {
+    if (_state == DesktopTransportState.closed) {
+      return;
+    }
+    _disconnect();
+    _fail(StateError('IPC server stopped unexpectedly'), StackTrace.current);
+  }
+
+  void _fail(Object error, StackTrace stackTrace) {
+    if (_state == DesktopTransportState.failed ||
+        _state == DesktopTransportState.closed) {
+      return;
+    }
+    commonPrint.log('IPC error: $error', logLevel: LogLevel.error);
+    _state = DesktopTransportState.failed;
+    _failure = TransportFailed(error, stackTrace);
+    _eventController.add(_failure!);
+  }
+
+  @override
+  Future<TransportConnected> waitUntilConnected(Duration timeout) {
+    final connection = _connection;
+    if (connection != null) {
+      return Future.value(connection);
+    }
+    final failure = _failure;
+    if (failure != null) {
+      return Future.error(failure.error, failure.stackTrace);
+    }
+    return events
+        .firstWhere(
+          (event) => event is TransportConnected || event is TransportFailed,
+        )
+        .then<TransportConnected>((event) {
+          if (event case TransportConnected()) {
+            return event;
+          }
+          final failure = event as TransportFailed;
+          Error.throwWithStackTrace(failure.error, failure.stackTrace);
+        })
+        .timeout(timeout);
+  }
+
+  @override
+  Future<void> send(String message) {
+    if (_state == DesktopTransportState.closed) {
+      return Future.error(StateError('IPC transport is closed'));
+    }
+    return _sendMessage(utf8.encode(message));
+  }
+
+  @override
+  Future<void> close() {
+    return _closeOperation ??= _close();
+  }
+
+  Future<void> _close() async {
+    if (_state == DesktopTransportState.closed) {
+      return;
+    }
+    _state = DesktopTransportState.closed;
+    _connection = null;
+    try {
+      await _stopServer();
+    } finally {
+      await _subscription?.cancel();
+      _subscription = null;
+      await _eventController.close();
+      await _frameController.close();
+    }
+  }
+}
diff --git a/lib/core/event.dart b/lib/core/event.dart
index a6719f7dec..911ce36475 100644
--- a/lib/core/event.dart
+++ b/lib/core/event.dart
@@ -1,9 +1,26 @@
 import 'dart:async';
 
+import 'package:fl_clash/common/common.dart';
 import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/models/models.dart';
 import 'package:flutter/foundation.dart';
 
+List<CoreEvent> coreEventsFromData(Object? data) {
+  final items = data is List ? data : [data];
+  final events = <CoreEvent>[];
+  for (final item in items.whereType<Map>()) {
+    try {
+      events.add(CoreEvent.fromJson(Map<String, Object?>.from(item)));
+    } catch (error) {
+      commonPrint.log(
+        'Unable to parse Core event: $error',
+        logLevel: LogLevel.error,
+      );
+    }
+  }
+  return events;
+}
+
 abstract mixin class CoreEventListener {
   void onLog(Log log) {}
 
@@ -29,31 +46,38 @@ class CoreEventManager {
   CoreEventManager._() {
     _controller.stream.listen((event) {
       for (final CoreEventListener listener in _listeners) {
-        switch (event.type) {
-          case CoreEventType.log:
-            listener.onLog(Log.fromJson(event.data));
-            break;
-          case CoreEventType.delay:
-            listener.onDelay(Delay.fromJson(event.data));
-            break;
-          case CoreEventType.request:
-            listener.onRequest(TrackerInfo.fromJson(event.data));
-            break;
-          case CoreEventType.loaded:
-            listener.onLoaded(event.data);
-            break;
-          case CoreEventType.crash:
-            listener.onCrash(event.data);
-            break;
-          case CoreEventType.geoUpdate:
-            final data = event.data as Map<String, dynamic>;
-            listener.onGeoUpdate(
-              data['type'] as String,
-              data['updating'] as bool,
-              data['skipped'] as bool? ?? false,
-              data['error'] as String?,
-            );
-            break;
+        try {
+          switch (event.type) {
+            case CoreEventType.log:
+              listener.onLog(Log.fromJson(event.data));
+              break;
+            case CoreEventType.delay:
+              listener.onDelay(Delay.fromJson(event.data));
+              break;
+            case CoreEventType.request:
+              listener.onRequest(TrackerInfo.fromJson(event.data));
+              break;
+            case CoreEventType.loaded:
+              listener.onLoaded(event.data);
+              break;
+            case CoreEventType.crash:
+              listener.onCrash(event.data);
+              break;
+            case CoreEventType.geoUpdate:
+              final data = event.data as Map<String, dynamic>;
+              listener.onGeoUpdate(
+                data['type'] as String,
+                data['updating'] as bool,
+                data['skipped'] as bool? ?? false,
+                data['error'] as String?,
+              );
+              break;
+          }
+        } catch (error) {
+          commonPrint.log(
+            'Unable to dispatch Core event ${event.type.name}: $error',
+            logLevel: LogLevel.error,
+          );
         }
       }
     });
diff --git a/lib/core/interface.dart b/lib/core/interface.dart
index 8154017297..e14d6baa86 100644
--- a/lib/core/interface.dart
+++ b/lib/core/interface.dart
@@ -1,16 +1,21 @@
 import 'dart:async';
-import 'dart:convert';
 
 import 'package:fl_clash/common/common.dart';
-import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/models/models.dart';
 
+import 'desktop/model.dart';
+import 'method.dart';
+
 mixin CoreInterface {
-  Future<bool> init(InitParams params);
+  Future<CoreLifecycleResult> start();
+
+  Future<CoreLifecycleResult> restart();
 
-  Future<String> preload();
+  Future<CoreLifecycleResult> stop();
 
-  Future<bool> shutdown(bool isUser);
+  Future<CoreLifecycleResult> close();
+
+  Future<bool> init(InitParams params);
 
   Future<bool> get isInit;
 
@@ -18,9 +23,9 @@ mixin CoreInterface {
 
   Future<String> validateConfig(String path);
 
-  Future<Result> getConfig(String path);
+  Future<Map<String, dynamic>> getConfig(String path);
 
-  Future<String> asyncTestDelay(String url, String proxyName);
+  Future<Delay> asyncTestDelay(String url, String proxyName);
 
   Future<String> updateConfig(UpdateParams updateParams);
 
@@ -34,9 +39,9 @@ mixin CoreInterface {
 
   Future<bool> stopListener();
 
-  Future<String> getExternalProviders();
+  Future<List<ExternalProvider>> getExternalProviders();
 
-  Future<String>? getExternalProvider(String externalProviderName);
+  Future<ExternalProvider?> getExternalProvider(String externalProviderName);
 
   Future<String> updateGeoData(String type);
 
@@ -47,13 +52,13 @@ mixin CoreInterface {
 
   Future<String> updateExternalProvider(String providerName);
 
-  FutureOr<String> getTraffic(bool onlyStatisticsProxy);
+  FutureOr<Traffic> getTraffic(bool onlyStatisticsProxy);
 
-  FutureOr<String> getTotalTraffic(bool onlyStatisticsProxy);
+  FutureOr<Traffic> getTotalTraffic(bool onlyStatisticsProxy);
 
   FutureOr<String> getCountryCode(String ip);
 
-  FutureOr<String> getMemory();
+  FutureOr<int> getMemory();
 
   FutureOr<void> resetTraffic();
 
@@ -63,11 +68,11 @@ mixin CoreInterface {
 
   Future<bool> crash();
 
-  FutureOr<String> getConnections();
+  FutureOr<List<TrackerInfo>> getConnections();
 
   FutureOr<bool> closeConnection(String id);
 
-  FutureOr<String> deleteFile(String path);
+  FutureOr<String> clearEffect(int profileId);
 
   FutureOr<bool> closeConnections();
 
@@ -75,114 +80,108 @@ mixin CoreInterface {
 }
 
 abstract class CoreHandlerInterface with CoreInterface {
-  Completer get completer;
-
-  FutureOr<bool> destroy();
-
-  Future<T?> _invoke<T>({
-    required ActionMethod method,
-    dynamic data,
+  Future<T?> _invokeMethod<T>({
+    required CoreMethod method,
+    Object? arguments,
     Duration? timeout,
   }) async {
-    try {
-      await completer.future.timeout(const Duration(seconds: 10));
-    } catch (e) {
-      commonPrint.log(
-        'Invoke pre ${method.name} timeout $e',
-        logLevel: LogLevel.error,
-      );
-      return null;
-    }
     return await utils.handleWatch(
       onStart: () {
-        commonPrint.log('Invoke ${method.name} ${DateTime.now()} $data');
+        commonPrint.log(
+          'Invoke method ${method.name} ${DateTime.now()} $arguments',
+        );
       },
       function: () async {
-        return invoke<T>(method: method, data: data, timeout: timeout);
+        return invokeMethod<T>(
+          method: method,
+          arguments: arguments,
+          timeout: timeout,
+        );
       },
-      onEnd: (data, elapsedMilliseconds) {
-        commonPrint.log('Invoke ${method.name} ${elapsedMilliseconds}ms');
+      onEnd: (result, elapsedMilliseconds) {
+        commonPrint.log(
+          'Invoke method ${method.name} completed in ${elapsedMilliseconds}ms',
+        );
       },
     );
   }
 
-  Future<T?> invoke<T>({
-    required ActionMethod method,
-    dynamic data,
+  Future<T?> invokeMethod<T>({
+    required CoreMethod method,
+    Object? arguments,
     Duration? timeout,
   });
 
-  Future<T> parasResult<T>(ActionResult result) async {
-    return switch (result.method) {
-      ActionMethod.getConfig => result.toResult as T,
-      _ => result.data as T,
-    };
-  }
-
   @override
   Future<bool> init(InitParams params) async {
-    return await _invoke<bool>(
-          method: ActionMethod.initClash,
-          data: json.encode(params),
+    return await _invokeMethod<bool>(
+          method: CoreMethod.initClash,
+          arguments: params.toJson(),
         ) ??
         false;
   }
 
-  @override
-  Future<bool> shutdown(bool isUser);
-
   @override
   Future<bool> get isInit async {
-    return await _invoke<bool>(method: ActionMethod.getIsInit) ?? false;
+    return await _invokeMethod<bool>(method: CoreMethod.getIsInit) ?? false;
   }
 
   @override
   Future<bool> forceGc() async {
-    return await _invoke<bool>(method: ActionMethod.forceGc) ?? false;
+    return await _invokeMethod<bool>(method: CoreMethod.forceGc) ?? false;
   }
 
   @override
   Future<String> validateConfig(String path) async {
-    return await _invoke<String>(
-          method: ActionMethod.validateConfig,
-          data: path,
+    return await _invokeMethod<String>(
+          method: CoreMethod.validateConfig,
+          arguments: path,
         ) ??
         '';
   }
 
   @override
   Future<String> updateConfig(UpdateParams updateParams) async {
-    return await _invoke<String>(
-          method: ActionMethod.updateConfig,
-          data: json.encode(updateParams),
+    return await _invokeMethod<String>(
+          method: CoreMethod.updateConfig,
+          arguments: updateParams.toJson(),
         ) ??
         '';
   }
 
   @override
-  Future<Result> getConfig(String path) async {
-    final res = await _invoke(method: ActionMethod.getConfig, data: path);
-    return res ?? Result.success({});
+  Future<Map<String, dynamic>> getConfig(String path) async {
+    final result = await _invokeMethod<Map<String, dynamic>>(
+      method: CoreMethod.getConfig,
+      arguments: path,
+    );
+    if (result == null) {
+      throw const CoreMethodException(
+        code: 'empty_result',
+        message: 'Core returned an empty config result',
+      );
+    }
+    return result;
   }
 
   @override
   Future<String> setupConfig(SetupParams setupParams) async {
-    return await _invoke<String>(
-          method: ActionMethod.setupConfig,
-          data: json.encode(setupParams),
+    return await _invokeMethod<String>(
+          method: CoreMethod.setupConfig,
+          arguments: setupParams.toJson(),
         ) ??
         '';
   }
 
   @override
   Future<bool> crash() async {
-    return await _invoke<bool>(method: ActionMethod.crash) ?? false;
+    return await _invokeMethod<bool>(method: CoreMethod.crash) ?? false;
   }
 
   @override
   Future<ProxiesData> getProxies() async {
-    final data = await _invoke<Map<String, dynamic>>(
-      method: ActionMethod.getProxies,
+    final data = await _invokeMethod<Map<String, dynamic>>(
+      method: CoreMethod.getProxies,
     );
     return data != null
         ? ProxiesData.fromJson(data)
@@ -191,33 +190,44 @@ abstract class CoreHandlerInterface with CoreInterface {
 
   @override
   Future<String> changeProxy(ChangeProxyParams changeProxyParams) async {
-    return await _invoke<String>(
-          method: ActionMethod.changeProxy,
-          data: json.encode(changeProxyParams),
+    return await _invokeMethod<String>(
+          method: CoreMethod.changeProxy,
+          arguments: changeProxyParams.toJson(),
         ) ??
         '';
   }
 
   @override
-  Future<String> getExternalProviders() async {
-    return await _invoke<String>(method: ActionMethod.getExternalProviders) ??
-        '';
+  Future<List<ExternalProvider>> getExternalProviders() async {
+    final data = await _invokeMethod<List<dynamic>>(
+      method: CoreMethod.getExternalProviders,
+    );
+    return data
+            ?.whereType<Map>()
+            .map(
+              (item) =>
+                  ExternalProvider.fromJson(Map<String, Object?>.from(item)),
+            )
+            .toList() ??
+        [];
   }
 
   @override
-  Future<String> getExternalProvider(String externalProviderName) async {
-    return await _invoke<String>(
-          method: ActionMethod.getExternalProvider,
-          data: externalProviderName,
-        ) ??
-        '';
+  Future<ExternalProvider?> getExternalProvider(
+    String externalProviderName,
+  ) async {
+    final data = await _invokeMethod<Map<String, dynamic>>(
+      method: CoreMethod.getExternalProvider,
+      arguments: externalProviderName,
+    );
+    return data == null ? null : ExternalProvider.fromJson(data);
   }
 
   @override
   Future<String> updateGeoData(String type) async {
-    return await _invoke<String>(
-          method: ActionMethod.updateGeoData,
-          data: type,
+    return await _invokeMethod<String>(
+          method: CoreMethod.updateGeoData,
+          arguments: type,
         ) ??
         '';
   }
@@ -227,121 +237,138 @@ abstract class CoreHandlerInterface with CoreInterface {
     required String providerName,
     required String data,
   }) async {
-    return await _invoke<String>(
-          method: ActionMethod.sideLoadExternalProvider,
-          data: json.encode({'providerName': providerName, 'data': data}),
+    return await _invokeMethod<String>(
+          method: CoreMethod.sideLoadExternalProvider,
+          arguments: {'providerName': providerName, 'data': data},
         ) ??
         '';
   }
 
   @override
   Future<String> updateExternalProvider(String providerName) async {
-    return await _invoke<String>(
-          method: ActionMethod.updateExternalProvider,
-          data: providerName,
+    return await _invokeMethod<String>(
+          method: CoreMethod.updateExternalProvider,
+          arguments: providerName,
         ) ??
         '';
   }
 
   @override
-  Future<String> getConnections() async {
-    return await _invoke<String>(method: ActionMethod.getConnections) ?? '';
+  Future<List<TrackerInfo>> getConnections() async {
+    final data = await _invokeMethod<Map<String, dynamic>>(
+      method: CoreMethod.getConnections,
+    );
+    final connections = data?['connections'];
+    if (connections is! List) {
+      return [];
+    }
+    return connections
+        .whereType<Map>()
+        .map((item) => TrackerInfo.fromJson(Map<String, Object?>.from(item)))
+        .toList();
   }
 
   @override
   Future<bool> closeConnections() async {
-    return await _invoke<bool>(method: ActionMethod.closeConnections) ?? false;
+    return await _invokeMethod<bool>(method: CoreMethod.closeConnections) ??
+        false;
   }
 
   @override
   Future<bool> resetConnections() async {
-    return await _invoke<bool>(method: ActionMethod.resetConnections) ?? false;
+    return await _invokeMethod<bool>(method: CoreMethod.resetConnections) ??
+        false;
   }
 
   @override
   Future<bool> closeConnection(String id) async {
-    return await _invoke<bool>(
-          method: ActionMethod.closeConnection,
-          data: id,
+    return await _invokeMethod<bool>(
+          method: CoreMethod.closeConnection,
+          arguments: id,
         ) ??
         false;
   }
 
   @override
-  Future<String> getTotalTraffic(bool onlyStatisticsProxy) async {
-    return await _invoke<String>(
-          method: ActionMethod.getTotalTraffic,
-          data: onlyStatisticsProxy,
-        ) ??
-        '';
+  Future<Traffic> getTotalTraffic(bool onlyStatisticsProxy) async {
+    final data = await _invokeMethod<Map<String, dynamic>>(
+      method: CoreMethod.getTotalTraffic,
+      arguments: onlyStatisticsProxy,
+    );
+    return data == null ? const Traffic() : Traffic.fromJson(data);
   }
 
   @override
-  Future<String> getTraffic(bool onlyStatisticsProxy) async {
-    return await _invoke<String>(
-          method: ActionMethod.getTraffic,
-          data: onlyStatisticsProxy,
-        ) ??
-        '';
+  Future<Traffic> getTraffic(bool onlyStatisticsProxy) async {
+    final data = await _invokeMethod<Map<String, dynamic>>(
+      method: CoreMethod.getTraffic,
+      arguments: onlyStatisticsProxy,
+    );
+    return data == null ? const Traffic() : Traffic.fromJson(data);
   }
 
   @override
-  Future<String> deleteFile(String path) async {
-    return await _invoke<String>(method: ActionMethod.deleteFile, data: path) ??
+  Future<String> clearEffect(int profileId) async {
+    return await _invokeMethod<String>(
+          method: CoreMethod.clearEffect,
+          arguments: profileId,
+        ) ??
         '';
   }
 
   @override
   FutureOr<void> resetTraffic() {
-    _invoke(method: ActionMethod.resetTraffic);
+    _invokeMethod(method: CoreMethod.resetTraffic);
   }
 
   @override
   FutureOr<void> startLog() {
-    _invoke(method: ActionMethod.startLog);
+    _invokeMethod(method: CoreMethod.startLog);
   }
 
   @override
   FutureOr<void> stopLog() {
-    _invoke<bool>(method: ActionMethod.stopLog);
+    _invokeMethod<bool>(method: CoreMethod.stopLog);
   }
 
   @override
   Future<bool> startListener() async {
-    return await _invoke<bool>(method: ActionMethod.startListener) ?? false;
+    return await _invokeMethod<bool>(method: CoreMethod.startListener) ?? false;
   }
 
   @override
   Future<bool> stopListener() async {
-    return await _invoke<bool>(method: ActionMethod.stopListener) ?? false;
+    return await _invokeMethod<bool>(method: CoreMethod.stopListener) ?? false;
   }
 
   @override
-  Future<String> asyncTestDelay(String url, String proxyName) async {
+  Future<Delay> asyncTestDelay(String url, String proxyName) async {
     final delayParams = {
       'proxy-name': proxyName,
       'timeout': httpTimeoutDuration.inMilliseconds,
       'test-url': url,
     };
-    return await _invoke<String>(
-          method: ActionMethod.asyncTestDelay,
-          data: json.encode(delayParams),
-          timeout: const Duration(seconds: 6),
-        ) ??
-        json.encode(Delay(name: proxyName, value: -1, url: url));
+    final data = await _invokeMethod<Map<String, dynamic>>(
+      method: CoreMethod.asyncTestDelay,
+      arguments: delayParams,
+      timeout: const Duration(seconds: 6),
+    );
+    return data == null
+        ? Delay(name: proxyName, value: -1, url: url)
+        : Delay.fromJson(data);
   }
 
   @override
   Future<String> getCountryCode(String ip) async {
-    return await _invoke<String>(
-          method: ActionMethod.getCountryCode,
-          data: ip,
+    return await _invokeMethod<String>(
+          method: CoreMethod.getCountryCode,
+          arguments: ip,
         ) ??
         '';
   }
 
   @override
-  Future<String> getMemory() async {
-    return await _invoke<String>(method: ActionMethod.getMemory) ?? '';
+  Future<int> getMemory() async {
+    return await _invokeMethod<int>(method: CoreMethod.getMemory) ?? 0;
   }
 }
diff --git a/lib/core/lib.dart b/lib/core/lib.dart
index 63369acecd..16a8e5740a 100644
--- a/lib/core/lib.dart
+++ b/lib/core/lib.dart
@@ -2,87 +2,144 @@ import 'dart:async';
 
 import 'package:fl_clash/common/common.dart';
 import 'package:fl_clash/enum/enum.dart';
-import 'package:fl_clash/models/core.dart';
 import 'package:fl_clash/plugins/service.dart';
 import 'package:fl_clash/providers/providers.dart';
 import 'package:fl_clash/state.dart';
 
+import 'desktop/model.dart';
 import 'interface.dart';
+import 'method.dart';
 
 class CoreLib extends CoreHandlerInterface {
   static CoreLib? _instance;
 
-  Completer<bool> _connectedCompleter = Completer();
+  Completer<bool> _connectedCompleter = Completer<bool>();
+  Future<CoreLifecycleResult>? _closeOperation;
+  int _lifecycleRevision = 0;
+  int _methodCallId = 0;
+  bool _closed = false;
 
   CoreLib._internal();
 
+  factory CoreLib() {
+    _instance ??= CoreLib._internal();
+    return _instance!;
+  }
+
   @override
-  Future<String> preload() async {
+  Future<CoreLifecycleResult> start() async {
+    if (_closed) {
+      throw StateError('Core lifecycle is closed');
+    }
+    final revision = ++_lifecycleRevision;
     if (_connectedCompleter.isCompleted) {
-      return 'core is connected';
+      return CoreLifecycleResult(
+        revision: revision,
+        outcome: CoreLifecycleOutcome.coalesced,
+      );
     }
-    final res = await service?.init();
-    if (res?.isEmpty != true) {
-      return res ?? '';
+    final initializationError = await service?.init() ?? '';
+    if (initializationError.isNotEmpty) {
+      throw StateError(initializationError);
     }
     _connectedCompleter.complete(true);
-    final syncRes = await service?.syncState(
-      globalState.container.read(sharedStateProvider),
+    final syncError =
+        await service?.syncState(
+          globalState.container.read(sharedStateProvider),
+        ) ??
+        '';
+    if (syncError.isNotEmpty) {
+      _connectedCompleter = Completer<bool>();
+      await service?.shutdown();
+      throw StateError(syncError);
+    }
+    return CoreLifecycleResult(
+      revision: revision,
+      outcome: CoreLifecycleOutcome.applied,
     );
-    return syncRes ?? '';
-  }
-
-  factory CoreLib() {
-    _instance ??= CoreLib._internal();
-    return _instance!;
   }
 
   @override
-  FutureOr<bool> destroy() async {
-    return true;
+  Future<CoreLifecycleResult> restart() async {
+    await stop();
+    return start();
   }
 
   @override
-  Future<bool> shutdown(_) async {
+  Future<CoreLifecycleResult> stop() => _stop();
+
+  Future<CoreLifecycleResult> _stop({bool allowClosed = false}) async {
+    if (_closed && !allowClosed) {
+      throw StateError('Core lifecycle is closed');
+    }
+    final revision = ++_lifecycleRevision;
     if (!_connectedCompleter.isCompleted) {
-      return false;
+      return CoreLifecycleResult(
+        revision: revision,
+        outcome: CoreLifecycleOutcome.coalesced,
+      );
+    }
+    _connectedCompleter = Completer<bool>();
+    final stopped = await service?.shutdown() ?? true;
+    if (!stopped) {
+      throw StateError('Android Core service shutdown failed');
     }
-    _connectedCompleter = Completer();
-    return service?.shutdown() ?? true;
+    return CoreLifecycleResult(
+      revision: revision,
+      outcome: CoreLifecycleOutcome.applied,
+    );
+  }
+
+  @override
+  Future<CoreLifecycleResult> close() {
+    return _closeOperation ??= _close();
+  }
+
+  Future<CoreLifecycleResult> _close() async {
+    _closed = true;
+    return _stop(allowClosed: true);
   }
 
   @override
   Future<bool> startListener() async {
-    await super.startListener();
-    await service?.start();
-    return true;
+    final listenerStarted = await super.startListener();
+    final serviceStarted = await service?.start() ?? false;
+    return listenerStarted && serviceStarted;
   }
 
   @override
   Future<bool> stopListener() async {
-    await super.stopListener();
-    await service?.stop();
-    return true;
+    final serviceStopped = await service?.stop() ?? false;
+    final listenerStopped = await super.stopListener();
+    return serviceStopped && listenerStopped;
   }
 
   @override
-  Future<T?> invoke<T>({
-    required ActionMethod method,
-    dynamic data,
+  Future<T?> invokeMethod<T>({
+    required CoreMethod method,
+    Object? arguments,
     Duration? timeout,
   }) async {
-    final id = '${method.name}#${utils.id}';
-    final result = await service
-        ?.invokeAction(Action(id: id, method: method, data: data))
-        .withTimeout(onTimeout: () => null);
-    if (result == null) {
+    try {
+      await _connectedCompleter.future.timeout(const Duration(seconds: 10));
+    } catch (error) {
+      commonPrint.log(
+        'Invoke method ${method.name} before connection timed out: $error',
+        logLevel: LogLevel.error,
+      );
+      return null;
+    }
+    final id = '${++_methodCallId}';
+    final response = await service
+        ?.invokeMethod(
+          CoreMethodCall(id: id, method: method, arguments: arguments),
+        )
+        .withTimeout(timeout: timeout, onTimeout: () => null);
+    if (response == null) {
       return null;
     }
-    return parasResult<T>(result);
+    return response.unwrap<T>();
   }
-
-  @override
-  Completer get completer => _connectedCompleter;
 }
 
 CoreLib? get coreLib => system.isAndroid ? CoreLib() : null;
diff --git a/lib/core/method.dart b/lib/core/method.dart
new file mode 100644
index 0000000000..69c28a70c3
--- /dev/null
+++ b/lib/core/method.dart
@@ -0,0 +1,137 @@
+enum CoreMethod {
+  message,
+  initClash,
+  getIsInit,
+  forceGc,
+  shutdown,
+  validateConfig,
+  updateConfig,
+  getConfig,
+  getProxies,
+  changeProxy,
+  getTraffic,
+  getTotalTraffic,
+  resetTraffic,
+  asyncTestDelay,
+  getConnections,
+  closeConnections,
+  resetConnections,
+  closeConnection,
+  getExternalProviders,
+  getExternalProvider,
+  updateGeoData,
+  updateExternalProvider,
+  sideLoadExternalProvider,
+  startLog,
+  stopLog,
+  startListener,
+  stopListener,
+  getCountryCode,
+  getMemory,
+  crash,
+  setupConfig,
+  clearEffect,
+  updateDns,
+}
+
+class CoreMethodCall {
+  final String? id;
+  final CoreMethod method;
+  final Object? arguments;
+
+  const CoreMethodCall({this.id, required this.method, this.arguments});
+
+  factory CoreMethodCall.fromJson(Map<String, Object?> json) {
+    return CoreMethodCall(
+      id: json['id'] as String?,
+      method: CoreMethod.values.byName(json['method'] as String),
+      arguments: json['arguments'],
+    );
+  }
+
+  Map<String, Object?> toJson() {
+    return {
+      if (id != null) 'id': id,
+      'method': method.name,
+      'arguments': arguments,
+    };
+  }
+}
+
+class CoreMethodError {
+  final String code;
+  final String message;
+  final Object? details;
+
+  const CoreMethodError({
+    required this.code,
+    required this.message,
+    this.details,
+  });
+
+  factory CoreMethodError.fromJson(Map<String, Object?> json) {
+    return CoreMethodError(
+      code: json['code'] as String,
+      message: json['message'] as String,
+      details: json['details'],
+    );
+  }
+
+  Map<String, Object?> toJson() {
+    return {'code': code, 'message': message, 'details': details};
+  }
+}
+
+class CoreMethodResponse {
+  final String? id;
+  final Object? result;
+  final CoreMethodError? error;
+
+  const CoreMethodResponse({this.id, this.result, this.error});
+
+  factory CoreMethodResponse.fromJson(Map<String, Object?> json) {
+    final error = json['error'];
+    return CoreMethodResponse(
+      id: json['id'] as String?,
+      result: json['result'],
+      error: error is Map
+          ? CoreMethodError.fromJson(Map<String, Object?>.from(error))
+          : null,
+    );
+  }
+
+  Map<String, Object?> toJson() {
+    return {
+      if (id != null) 'id': id,
+      'result': result,
+      if (error != null) 'error': error!.toJson(),
+    };
+  }
+
+  T? unwrap<T>() {
+    final error = this.error;
+    if (error != null) {
+      throw CoreMethodException(
+        code: error.code,
+        message: error.message,
+        details: error.details,
+      );
+    }
+    return result as T?;
+  }
+}
+
+class CoreMethodException implements Exception {
+  final String code;
+  final String message;
+  final Object? details;
+
+  const CoreMethodException({
+    required this.code,
+    required this.message,
+    this.details,
+  });
+
+  @override
+  String toString() => 'CoreMethodException($code, $message, $details)';
+}
diff --git a/lib/core/service.dart b/lib/core/service.dart
index 737eb39e32..a187531421 100644
--- a/lib/core/service.dart
+++ b/lib/core/service.dart
@@ -1,185 +1,109 @@
 import 'dart:async';
-import 'dart:convert';
-import 'dart:io';
 
-import 'package:fl_clash/common/common.dart';
-import 'package:fl_clash/core/core.dart';
+import 'package:fl_clash/common/constant.dart';
+import 'package:fl_clash/common/system.dart';
 import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/models/core.dart';
-
+import 'package:flutter/foundation.dart';
+
+import 'desktop/helper_client.dart';
+import 'desktop/launcher.dart';
+import 'desktop/lifecycle.dart';
+import 'desktop/model.dart';
+import 'desktop/rpc_client.dart';
+import 'desktop/transport.dart';
+import 'event.dart';
 import 'interface.dart';
-import 'transport.dart';
+import 'method.dart';
 
 class CoreService extends CoreHandlerInterface {
   static CoreService? _instance;
 
-  late final IPCCoreTransport _transport;
-
-  Completer<bool> _shutdownCompleter = Completer();
-
-  final Map<String, Completer> _callbackCompleterMap = {};
-
-  Process? _process;
+  final DesktopCoreLifecycleController _lifecycle;
+  final CoreRpcChannel _rpcClient;
+  late final StreamSubscription<DesktopCoreFailure> _crashSubscription;
+  Future<CoreLifecycleResult>? _closeOperation;
 
   factory CoreService() {
-    _instance ??= CoreService._internal();
-    return _instance!;
+    return _instance ??= CoreService._create();
   }
 
-  CoreService._internal() {
-    _transport = IPCCoreTransport(
-      address: system.isWindows ? windowsPipeName : unixSocketPath,
+  factory CoreService._create() {
+    final address = system.isWindows ? windowsPipeName : unixSocketPath;
+    final directLauncher = DirectCoreLauncher();
+    final helperLauncher = WindowsHelperLauncher(windowsHelperClient);
+    final lifecycle = DesktopCoreLifecycle(
+      transportFactory: () => IPCCoreTransport(address: address),
+      launcherResolver: WindowsHelperLauncherResolver(
+        isWindows: system.isWindows,
+        directLauncher: directLauncher,
+        helperLauncher: helperLauncher,
+        helperReady: windowsHelperClient.isReady,
+      ),
+      verifyPeerPid: system.isWindows,
     );
-    _initServer();
-  }
-
-  Future<void> handleResult(ActionResult result) async {
-    final completer = _callbackCompleterMap[result.id];
-    final data = await parasResult(result);
-    if (result.id?.isEmpty == true) {
-      coreEventManager.sendEvent(CoreEvent.fromJson(result.data));
-    }
-    if (completer?.isCompleted == true) {
-      return;
-    }
-    completer?.complete(data);
-  }
-
-  Future<void> _initServer() async {
-    await _transport.init();
-
-    _transport.onDisconnect = () {
-      _handleInvokeCrashEvent();
-      if (!_shutdownCompleter.isCompleted) {
-        _shutdownCompleter.complete(true);
-      }
-    };
-
-    _transport.dataStream
-        .transform(uint8ListToListIntConverter)
-        .transform(utf8.decoder)
-        .listen(
-          (data) async {
-            try {
-              final dataJson = await data.trim().commonToJSON<dynamic>();
-              handleResult(ActionResult.fromJson(dataJson));
-            } catch (e) {
-              commonPrint.log(
-                'Failed to parse transport data: $e',
-                logLevel: LogLevel.error,
-              );
-            }
-          },
-          onError: (error) {
-            commonPrint.log(
-              'Transport data stream error: $error',
-              logLevel: LogLevel.error,
-            );
-          },
-        );
-  }
-
-  void _handleInvokeCrashEvent() {
-    coreEventManager.sendEvent(
-      const CoreEvent(type: CoreEventType.crash, data: 'core done'),
+    return CoreService._(
+      lifecycle: lifecycle,
+      rpcClient: CoreRpcClient(lifecycle.transport),
     );
   }
 
-  Future<void> start() async {
-    if (_process != null) {
-      await shutdown(false);
-    }
-    if (system.isWindows && await system.checkIsAdmin()) {
-      final isSuccess = await request.startCoreByHelper(_transport.address);
-      if (isSuccess) {
-        await _transport.connectionCompleter.future;
-        return;
-      }
-    }
-    try {
-      _process = await Process.start(appPath.corePath, [_transport.address]);
-    } catch (e) {
-      commonPrint.log(
-        'Failed to start core process: $e',
-        logLevel: LogLevel.error,
+  @visibleForTesting
+  CoreService.forTesting({
+    required DesktopCoreLifecycleController lifecycle,
+    required CoreRpcChannel rpcClient,
+  }) : this._(lifecycle: lifecycle, rpcClient: rpcClient);
+
+  CoreService._({
+    required DesktopCoreLifecycleController lifecycle,
+    required CoreRpcChannel rpcClient,
+  }) : _lifecycle = lifecycle,
+       _rpcClient = rpcClient {
+    _crashSubscription = _lifecycle.crashEvents.listen((failure) {
+      coreEventManager.sendEvent(
+        CoreEvent(
+          type: CoreEventType.crash,
+          data: failure.cause?.toString() ?? 'core done',
+        ),
       );
-      _handleInvokeCrashEvent();
-      return;
-    }
-    _process?.stdout.listen((_) {});
-    _process?.stderr.listen((e) {
-      final error = utf8.decode(e);
-      if (error.isNotEmpty) {
-        commonPrint.log(error, logLevel: LogLevel.warning);
-      }
     });
-    await _transport.connectionCompleter.future;
   }
 
   @override
-  FutureOr<bool> destroy() async {
-    await shutdown(false);
-    await _transport.close();
-    return true;
-  }
+  Future<CoreLifecycleResult> start() => _lifecycle.start();
 
-  Future<void> sendMessage(String message) async {
-    await _transport.connectionCompleter.future;
-    _transport.send(message);
-  }
+  @override
+  Future<CoreLifecycleResult> restart() => _lifecycle.restart();
 
   @override
-  Future<bool> shutdown(bool isUser) async {
-    _shutdownCompleter = Completer();
-    if (system.isWindows) {
-      await request.stopCoreByHelper();
-    }
-    _transport.disconnected();
-    _process?.kill();
-    _process = null;
-    _clearCompleter();
-    if (isUser) {
-      return _shutdownCompleter.future;
-    } else {
-      return true;
-    }
-  }
+  Future<CoreLifecycleResult> stop() => _lifecycle.stop();
 
-  void _clearCompleter() {
-    for (final completer in _callbackCompleterMap.values) {
-      completer.safeCompleter(null);
-    }
+  @override
+  Future<CoreLifecycleResult> close() {
+    return _closeOperation ??= _close();
   }
 
-  @override
-  Future<String> preload() async {
-    await start();
-    return '';
+  Future<CoreLifecycleResult> _close() async {
+    try {
+      return await _lifecycle.close();
+    } finally {
+      await _rpcClient.close();
+      await _crashSubscription.cancel();
+    }
   }
 
   @override
-  Future<T?> invoke<T>({
-    required ActionMethod method,
-    dynamic data,
+  Future<T?> invokeMethod<T>({
+    required CoreMethod method,
+    Object? arguments,
     Duration? timeout,
-  }) async {
-    final id = '${method.name}#${utils.id}';
-    _callbackCompleterMap[id] = Completer<T?>();
-    sendMessage(json.encode(Action(id: id, method: method, data: data)));
-    return (_callbackCompleterMap[id] as Completer<T?>).future.withTimeout(
+  }) {
+    return _rpcClient.invoke<T>(
+      method: method,
+      arguments: arguments,
       timeout: timeout,
-      onLast: () {
-        final completer = _callbackCompleterMap[id];
-        completer?.safeCompleter(null);
-        _callbackCompleterMap.remove(id);
-      },
-      tag: id,
-      onTimeout: () => null,
     );
   }
-
-  @override
-  Completer get completer => _transport.connectionCompleter;
 }
 
 final coreService = system.isDesktop ? CoreService() : null;
diff --git a/lib/core/transport.dart b/lib/core/transport.dart
deleted file mode 100644
index e7481bca98..0000000000
--- a/lib/core/transport.dart
+++ /dev/null
@@ -1,106 +0,0 @@
-import 'dart:async';
-import 'dart:convert';
-import 'dart:typed_data';
-
-import 'package:fl_clash/common/common.dart';
-import 'package:fl_clash/enum/enum.dart';
-import 'package:rust_api/rust_api.dart';
-
-// ── Binary frame types (mirrors Rust ipc.rs) ────────────────────────────────
-
-const _typeReady = 0x00;
-const _typeConnected = 0x01;
-const _typeDisconnected = 0x02;
-const _typeData = 0x03;
-const _typeError = 0x04;
-
-class IPCCoreTransport {
-  final String address;
-  final StreamController<Uint8List> _dataController =
-      StreamController<Uint8List>();
-  StreamSubscription<Uint8List>? _subscription;
-  Completer<void> _completer = Completer<void>();
-  Completer<void> _readyCompleter = Completer<void>();
-
-  void Function()? onDisconnect;
-
-  IPCCoreTransport({required this.address});
-
-  Completer<void> get connectionCompleter => _completer;
-
-  Stream<Uint8List> get dataStream => _dataController.stream;
-
-  Future<void> init() async {
-    try {
-      final stream = restartIpcServer(name: address);
-      _subscription = stream.listen(
-        (data) {
-          if (data.isEmpty) return;
-          final type = data[0];
-          final payload = data.length > 1 ? data.sublist(1) : Uint8List(0);
-          switch (type) {
-            case _typeReady:
-              commonPrint.log('IPC Ready');
-              if (_readyCompleter.isCompleted) {
-                break;
-              }
-              _readyCompleter.complete();
-              break;
-            case _typeConnected:
-              commonPrint.log('IPC Connected');
-              if (_completer.isCompleted) {
-                break;
-              }
-              _completer.complete();
-              break;
-            case _typeDisconnected:
-              commonPrint.log('IPC Disconnected');
-              _completer = Completer<void>();
-              onDisconnect?.call();
-              break;
-            case _typeData:
-              _dataController.add(payload);
-              break;
-            case _typeError:
-              final msg = utf8.decode(payload);
-              commonPrint.log('IPC error: $msg', logLevel: LogLevel.error);
-              break;
-            default:
-              commonPrint.log(
-                'IPC unknown frame type: $type',
-                logLevel: LogLevel.warning,
-              );
-          }
-        },
-        onError: (error) {
-          commonPrint.log('IPC error: $error', logLevel: LogLevel.error);
-        },
-        cancelOnError: false,
-      );
-      await _readyCompleter.future;
-    } catch (e) {
-      commonPrint.log(
-        'Failed to start IPC server: $e',
-        logLevel: LogLevel.error,
-      );
-      rethrow;
-    }
-  }
-
-  void send(String message) {
-    sendIpcMessage(data: utf8.encode(message));
-  }
-
-  void disconnected() {
-    _completer = Completer<void>();
-  }
-
-  Future<void> close() async {
-    await _subscription?.cancel();
-    _subscription = null;
-    await stopIpcServer();
-    _readyCompleter = Completer<void>();
-    _completer = Completer<void>();
-    await _dataController.close();
-  }
-}
diff --git a/lib/database/generated/database.g.dart b/lib/database/generated/database.g.dart
index 7748f403c4..239d2a2265 100644
--- a/lib/database/generated/database.g.dart
+++ b/lib/database/generated/database.g.dart
@@ -3505,10 +3505,7 @@ final class $$ProfilesTableReferences
   static MultiTypedResultKey<$ProfileRuleLinksTable, List<RawProfileRuleLink>>
   _profileRuleLinksRefsTable(_$Database db) => MultiTypedResultKey.fromTable(
     db.profileRuleLinks,
-    aliasName: $_aliasNameGenerator(
-      db.profiles.id,
-      db.profileRuleLinks.profileId,
-    ),
+    aliasName: 'profiles__id__profile_rule_mapping__profile_id',
   );
 
   $$ProfileRuleLinksTableProcessedTableManager get profileRuleLinksRefs {
@@ -3528,7 +3525,7 @@ final class $$ProfilesTableReferences
   static MultiTypedResultKey<$ProxyGroupsTable, List<RawProxyGroup>>
   _proxyGroupsRefsTable(_$Database db) => MultiTypedResultKey.fromTable(
     db.proxyGroups,
-    aliasName: $_aliasNameGenerator(db.profiles.id, db.proxyGroups.profileId),
+    aliasName: 'profiles__id__proxy_groups__profile_id',
   );
 
   $$ProxyGroupsTableProcessedTableManager get proxyGroupsRefs {
@@ -4223,7 +4220,7 @@ final class $$RulesTableReferences
   static MultiTypedResultKey<$ProfileRuleLinksTable, List<RawProfileRuleLink>>
   _profileRuleLinksRefsTable(_$Database db) => MultiTypedResultKey.fromTable(
     db.profileRuleLinks,
-    aliasName: $_aliasNameGenerator(db.rules.id, db.profileRuleLinks.ruleId),
+    aliasName: 'rules__id__profile_rule_mapping__rule_id',
   );
 
   $$ProfileRuleLinksTableProcessedTableManager get profileRuleLinksRefs {
@@ -4580,9 +4577,7 @@ final class $$ProfileRuleLinksTableReferences
   );
 
   static $ProfilesTable _profileIdTable(_$Database db) =>
-      db.profiles.createAlias(
-        $_aliasNameGenerator(db.profileRuleLinks.profileId, db.profiles.id),
-      );
+      db.profiles.createAlias('profile_rule_mapping__profile_id__profiles__id');
 
   $$ProfilesTableProcessedTableManager? get profileId {
     final $_column = $_itemColumn<int>('profile_id');
@@ -4598,9 +4593,8 @@ final class $$ProfileRuleLinksTableReferences
     );
   }
 
-  static $RulesTable _ruleIdTable(_$Database db) => db.rules.createAlias(
-    $_aliasNameGenerator(db.profileRuleLinks.ruleId, db.rules.id),
-  );
+  static $RulesTable _ruleIdTable(_$Database db) =>
+      db.rules.createAlias('profile_rule_mapping__rule_id__rules__id');
 
   $$RulesTableProcessedTableManager get ruleId {
     final $_column = $_itemColumn<int>('rule_id')!;
@@ -5025,9 +5019,7 @@ final class $$ProxyGroupsTableReferences
   $$ProxyGroupsTableReferences(super.$_db, super.$_table, super.$_typedResult);
 
   static $ProfilesTable _profileIdTable(_$Database db) =>
-      db.profiles.createAlias(
-        $_aliasNameGenerator(db.proxyGroups.profileId, db.profiles.id),
-      );
+      db.profiles.createAlias('proxy_groups__profile_id__profiles__id');
 
   $$ProfilesTableProcessedTableManager? get profileId {
     final $_column = $_itemColumn<int>('profile_id');
diff --git a/lib/database/rules.dart b/lib/database/rules.dart
index 1e4ec052fc..eedfb776fb 100644
--- a/lib/database/rules.dart
+++ b/lib/database/rules.dart
@@ -74,13 +74,13 @@ class RulesDao extends DatabaseAccessor<Database> with _$RulesDaoMixin {
     );
 
     query.orderBy([
-      OrderingTerm.desc(
+      OrderingTerm.asc(
         profileRuleLinks.profileId.isNull().caseMatch<int>(
           when: {const Constant(true): const Constant(1)},
           orElse: const Constant(0),
         ),
       ),
-      OrderingTerm.desc(profileRuleLinks.order),
+      OrderingTerm.asc(profileRuleLinks.order),
     ]);
 
     return query.map((row) {
diff --git a/lib/enum/enum.dart b/lib/enum/enum.dart
index 6a25b6458a..28a2c5784d 100644
--- a/lib/enum/enum.dart
+++ b/lib/enum/enum.dart
@@ -219,58 +219,13 @@ enum FontFamily {
 
 enum RouteMode { bypassPrivate, config }
 
-enum ActionMethod {
-  message,
-  initClash,
-  getIsInit,
-  forceGc,
-  shutdown,
-  validateConfig,
-  updateConfig,
-  getConfig,
-  getProxies,
-  changeProxy,
-  getTraffic,
-  getTotalTraffic,
-  resetTraffic,
-  asyncTestDelay,
-  getConnections,
-  closeConnections,
-  resetConnections,
-  closeConnection,
-  getExternalProviders,
-  getExternalProvider,
-  updateGeoData,
-  updateExternalProvider,
-  sideLoadExternalProvider,
-  startLog,
-  stopLog,
-  startListener,
-  stopListener,
-  getCountryCode,
-  getMemory,
-  crash,
-  setupConfig,
-  deleteFile,
-
-  ///Android,
-  setState,
-  startTun,
-  stopTun,
-  getRunTime,
-  updateDns,
-  getAndroidVpnOptions,
-  getCurrentProfileName,
-}
-
 enum AuthorizeCode { none, success, error }
 
-enum WindowsHelperServiceStatus { none, presence, running }
+enum TunAuthorizationState { none, authorized, unauthorized }
 
 enum FunctionTag {
   updateConfig,
   setupConfig,
-  updateStatus,
   updateGroups,
   addCheckIpNum,
   applyProfile,
@@ -336,9 +291,9 @@ enum GeoResource {
   MMDB,
   @JsonValue('asn')
   ASN,
-  @JsonValue('geo-ip')
+  @JsonValue('geoip')
   GEOIP,
-  @JsonValue('geo-site')
+  @JsonValue('geosite')
   GEOSITE;
 
   static GeoResource fromJson(String value) {
@@ -353,12 +308,12 @@ enum GeoResource {
 }
 
 extension GeoResourceExt on GeoResource {
-  String get value {
+  String get configKey {
     return switch (this) {
       GeoResource.MMDB => 'mmdb',
       GeoResource.ASN => 'asn',
-      GeoResource.GEOIP => 'geo-ip',
-      GeoResource.GEOSITE => 'geo-site',
+      GeoResource.GEOIP => 'geoip',
+      GeoResource.GEOSITE => 'geosite',
     };
   }
 
diff --git a/lib/l10n/intl/messages_en.dart b/lib/l10n/intl/messages_en.dart
index c4da298db0..06a4155787 100644
--- a/lib/l10n/intl/messages_en.dart
+++ b/lib/l10n/intl/messages_en.dart
@@ -37,7 +37,7 @@ class MessageLookup extends MessageLookupByLibrary {
 
   static String m6(label) => "Current ${label} already exists";
 
-  static String m7(name) => "${name} skipped";
+  static String m7(name) => "${name} is already up to date";
 
   static String m8(name) => "${name} updated";
 
@@ -76,9 +76,14 @@ class MessageLookup extends MessageLookupByLibrary {
 
   static String m23(count) => "${count} items have been selected";
 
-  static String m24(label) => "${label} must be a url";
+  static String m24(count) => "${count} route(s)";
 
   static String m25(count) =>
+      "${count} node(s) active. Tap ping on a node to test connectivity.";
+
+  static String m26(label) => "${label} must be a url";
+
+  static String m27(count) =>
       "${Intl.plural(count, one: '1 year ago', other: '${count} years ago')}";
 
   final messages = _notInlinedMessages(_notInlinedMessages);
@@ -113,6 +118,9 @@ class MessageLookup extends MessageLookupByLibrary {
     ),
     "addRule": MessageLookupByLibrary.simpleMessage("Add rule"),
     "addSsid": MessageLookupByLibrary.simpleMessage("Add SSID"),
+    "addTailscaleNode": MessageLookupByLibrary.simpleMessage(
+      "Add Tailscale node",
+    ),
     "addedRules": MessageLookupByLibrary.simpleMessage("Added rules"),
     "additionalParameters": MessageLookupByLibrary.simpleMessage(
       "Additional parameters",
@@ -272,6 +280,10 @@ class MessageLookup extends MessageLookupByLibrary {
     "core": MessageLookupByLibrary.simpleMessage("Core"),
     "coreStatus": MessageLookupByLibrary.simpleMessage("Core status"),
     "country": MessageLookupByLibrary.simpleMessage("Country"),
+    "crashDetected": MessageLookupByLibrary.simpleMessage("Crash detected"),
+    "crashDetectedTip": MessageLookupByLibrary.simpleMessage(
+      "The app crashed during the previous run. To prevent repeated crashes, the current profile has been cleared and automatic configuration setup was skipped.",
+    ),
     "crashTest": MessageLookupByLibrary.simpleMessage("Crash test"),
     "crashlytics": MessageLookupByLibrary.simpleMessage("Crash Analysis"),
     "crashlyticsTip": MessageLookupByLibrary.simpleMessage(
@@ -352,6 +364,9 @@ class MessageLookup extends MessageLookupByLibrary {
     "editProxyGroup": MessageLookupByLibrary.simpleMessage("Edit proxy group"),
     "editRule": MessageLookupByLibrary.simpleMessage("Edit rule"),
     "editSsid": MessageLookupByLibrary.simpleMessage("Edit SSID"),
+    "editTailscaleNode": MessageLookupByLibrary.simpleMessage(
+      "Edit Tailscale node",
+    ),
     "emptyTip": m4,
     "en": MessageLookupByLibrary.simpleMessage("English"),
     "entries": MessageLookupByLibrary.simpleMessage(" entries"),
@@ -391,6 +406,7 @@ class MessageLookup extends MessageLookupByLibrary {
       "Generally use offshore DNS",
     ),
     "fallbackFilter": MessageLookupByLibrary.simpleMessage("Fallback filter"),
+    "features": MessageLookupByLibrary.simpleMessage("Features"),
     "fidelityScheme": MessageLookupByLibrary.simpleMessage("Fidelity"),
     "file": MessageLookupByLibrary.simpleMessage("File"),
     "fileDesc": MessageLookupByLibrary.simpleMessage("Directly upload profile"),
@@ -435,6 +451,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "hasCacheChange": MessageLookupByLibrary.simpleMessage(
       "Do you want to cache the changes?",
     ),
+    "hideAdvanced": MessageLookupByLibrary.simpleMessage("Hide advanced"),
     "hideFromList": MessageLookupByLibrary.simpleMessage("Hide from list"),
     "host": MessageLookupByLibrary.simpleMessage("Host"),
     "hostsDesc": MessageLookupByLibrary.simpleMessage("Add Hosts"),
@@ -934,6 +951,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "selectedCountTitle": m23,
     "settings": MessageLookupByLibrary.simpleMessage("Settings"),
     "show": MessageLookupByLibrary.simpleMessage("Show"),
+    "showAdvanced": MessageLookupByLibrary.simpleMessage("Show advanced"),
     "shrink": MessageLookupByLibrary.simpleMessage("Shrink"),
     "silentLaunch": MessageLookupByLibrary.simpleMessage("SilentLaunch"),
     "silentLaunchDesc": MessageLookupByLibrary.simpleMessage(
@@ -985,6 +1003,147 @@ class MessageLookup extends MessageLookupByLibrary {
     "tabAnimationDesc": MessageLookupByLibrary.simpleMessage(
       "Effective only in mobile view",
     ),
+    "tailscale": MessageLookupByLibrary.simpleMessage("Tailscale"),
+    "tailscaleAcceptRoutes": MessageLookupByLibrary.simpleMessage(
+      "Accept routes",
+    ),
+    "tailscaleAndroidStep1": MessageLookupByLibrary.simpleMessage(
+      "Get an auth key from the Tailscale admin console (Settings → Keys).",
+    ),
+    "tailscaleAndroidStep2": MessageLookupByLibrary.simpleMessage(
+      "Add a node, paste the auth key, and put your home device IP or MagicDNS name in Route destinations.",
+    ),
+    "tailscaleAndroidStep3": MessageLookupByLibrary.simpleMessage(
+      "Turn on Enable Tailscale. Leave \"Keep Tailscale traffic direct\" off unless the Tailscale app is also installed.",
+    ),
+    "tailscaleAndroidStep4": MessageLookupByLibrary.simpleMessage(
+      "Start FlClash VPN, then tap the ping button on a node to verify the connection.",
+    ),
+    "tailscaleAuthKey": MessageLookupByLibrary.simpleMessage("Auth key"),
+    "tailscaleAuthKeyHint": MessageLookupByLibrary.simpleMessage(
+      "From the Tailscale admin console → Settings → Keys. Required to authenticate the node.",
+    ),
+    "tailscaleBypass": MessageLookupByLibrary.simpleMessage(
+      "Keep Tailscale traffic direct",
+    ),
+    "tailscaleBypassAndroidHint": MessageLookupByLibrary.simpleMessage(
+      "Usually leave this off on Android. Turn on only if the Tailscale app is also installed on this phone.",
+    ),
+    "tailscaleBypassNudge": MessageLookupByLibrary.simpleMessage(
+      "This device likely runs Tailscale already — turn on “Keep Tailscale traffic direct” to avoid fake-IP / control-plane breakage.",
+    ),
+    "tailscaleBypassRecommended": MessageLookupByLibrary.simpleMessage(
+      "Recommended on desktop when the Tailscale app/service is installed. Auto-manages DIRECT rules and Fake IP Filter.",
+    ),
+    "tailscaleControlUrl": MessageLookupByLibrary.simpleMessage("Control URL"),
+    "tailscaleControlUrlHint": MessageLookupByLibrary.simpleMessage(
+      "Optional. Only for self-hosted control servers such as Headscale.",
+    ),
+    "tailscaleDesc": MessageLookupByLibrary.simpleMessage(
+      "Manage Tailscale outbound nodes",
+    ),
+    "tailscaleDesktopStep1": MessageLookupByLibrary.simpleMessage(
+      "If this PC also runs the Tailscale app/service, turn on \"Keep Tailscale traffic direct\".",
+    ),
+    "tailscaleDesktopStep2": MessageLookupByLibrary.simpleMessage(
+      "Optional: add an embedded Tailscale node with an auth key to route selected traffic through the tailnet from FlClash.",
+    ),
+    "tailscaleDesktopStep3": MessageLookupByLibrary.simpleMessage(
+      "Put destinations (home IPs / MagicDNS) in Route destinations, then turn on Enable Tailscale.",
+    ),
+    "tailscaleDesktopStep4": MessageLookupByLibrary.simpleMessage(
+      "Start FlClash, then tap the ping button on a node to verify the connection is solid.",
+    ),
+    "tailscaleEmptyTip": MessageLookupByLibrary.simpleMessage(
+      "No Tailscale nodes yet. Add one to route traffic through your tailnet.",
+    ),
+    "tailscaleEnable": MessageLookupByLibrary.simpleMessage("Enable Tailscale"),
+    "tailscaleEnableBypassAction": MessageLookupByLibrary.simpleMessage(
+      "Enable",
+    ),
+    "tailscaleEnableDesc": MessageLookupByLibrary.simpleMessage(
+      "Inject Tailscale nodes as outbounds. Turning this off stops Tailscale from handling traffic; normal traffic is unaffected.",
+    ),
+    "tailscaleEphemeral": MessageLookupByLibrary.simpleMessage("Ephemeral"),
+    "tailscaleExitNode": MessageLookupByLibrary.simpleMessage("Exit node"),
+    "tailscaleExitNodeAllowLanAccess": MessageLookupByLibrary.simpleMessage(
+      "Allow LAN access via exit node",
+    ),
+    "tailscaleExitNodeHint": MessageLookupByLibrary.simpleMessage(
+      "Optional. IP or name of a tailnet exit node to route all traffic through.",
+    ),
+    "tailscaleGuideTitle": MessageLookupByLibrary.simpleMessage(
+      "How Tailscale works",
+    ),
+    "tailscaleHostname": MessageLookupByLibrary.simpleMessage("Hostname"),
+    "tailscaleHostnameHint": MessageLookupByLibrary.simpleMessage(
+      "Optional. Device name shown in your tailnet.",
+    ),
+    "tailscaleNameExistsTip": MessageLookupByLibrary.simpleMessage(
+      "A node with this name already exists",
+    ),
+    "tailscaleNameHelper": MessageLookupByLibrary.simpleMessage(
+      "Outbound name used in Proxies. Renaming changes how selections and delay tests key this node.",
+    ),
+    "tailscaleNoRoutes": MessageLookupByLibrary.simpleMessage(
+      "No route destinations",
+    ),
+    "tailscaleNodesTitle": MessageLookupByLibrary.simpleMessage("Nodes"),
+    "tailscaleNotTested": MessageLookupByLibrary.simpleMessage("Not tested"),
+    "tailscaleRoutes": MessageLookupByLibrary.simpleMessage(
+      "Route destinations",
+    ),
+    "tailscaleRoutesCount": m24,
+    "tailscaleRoutesHint": MessageLookupByLibrary.simpleMessage(
+      "Domains or IPs sent through this node, one per line (e.g. your home PC\'s Tailscale IP or MagicDNS name).",
+    ),
+    "tailscaleScenarioAndroidBody": MessageLookupByLibrary.simpleMessage(
+      "Keep FlClash as the only VPN. Do not run the Tailscale app VPN at the same time (Android allows only one). Use an embedded Tailscale node below, then add your home device to Route destinations.",
+    ),
+    "tailscaleScenarioAndroidTitle": MessageLookupByLibrary.simpleMessage(
+      "Android client setup",
+    ),
+    "tailscaleScenarioDesktopBody": MessageLookupByLibrary.simpleMessage(
+      "You can run FlClash and the real Tailscale app together. Turn on \"Keep Tailscale traffic direct\" so FlClash does not hijack Tailscale\'s control plane or fake-IP DNS.",
+    ),
+    "tailscaleScenarioDesktopTitle": MessageLookupByLibrary.simpleMessage(
+      "Desktop / host setup",
+    ),
+    "tailscaleShowSetupGuide": MessageLookupByLibrary.simpleMessage(
+      "Setup guide",
+    ),
+    "tailscaleStateDir": MessageLookupByLibrary.simpleMessage(
+      "State directory",
+    ),
+    "tailscaleStateDirHint": MessageLookupByLibrary.simpleMessage(
+      "Optional. Directory used to persist Tailscale state.",
+    ),
+    "tailscaleStatusDisabled": MessageLookupByLibrary.simpleMessage(
+      "Tailscale is off — nodes are not injected into the running profile.",
+    ),
+    "tailscaleStatusNeedRoutes": MessageLookupByLibrary.simpleMessage(
+      "Nodes are added, but no route destinations yet — traffic will not match until you add routes (or pick the node manually).",
+    ),
+    "tailscaleStatusNeedStart": MessageLookupByLibrary.simpleMessage(
+      "Nodes are ready. Start FlClash VPN, then tap ping to test.",
+    ),
+    "tailscaleStatusNoNodes": MessageLookupByLibrary.simpleMessage(
+      "Enabled, but no nodes yet. Add a node to get started.",
+    ),
+    "tailscaleStatusReady": m25,
+    "tailscaleTestNeedEnable": MessageLookupByLibrary.simpleMessage(
+      "Turn on Enable Tailscale before testing.",
+    ),
+    "tailscaleTestNeedStart": MessageLookupByLibrary.simpleMessage(
+      "Start FlClash VPN before testing the connection.",
+    ),
+    "tailscaleTestNode": MessageLookupByLibrary.simpleMessage(
+      "Test connection",
+    ),
+    "tailscaleTestTip": MessageLookupByLibrary.simpleMessage(
+      "Use the ping button next to a node to check whether the Tailscale outbound can dial out. A latency value means the connection is working; Timeout means check the auth key, Enable switch, and that FlClash VPN is started.",
+    ),
+    "tailscaleUdp": MessageLookupByLibrary.simpleMessage("UDP relay"),
     "tapToAuthorize": MessageLookupByLibrary.simpleMessage("Tap to authorize"),
     "tcpConcurrent": MessageLookupByLibrary.simpleMessage("TCP concurrent"),
     "tcpConcurrentDesc": MessageLookupByLibrary.simpleMessage(
@@ -1031,7 +1190,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "urlDesc": MessageLookupByLibrary.simpleMessage(
       "Obtain profile through URL",
     ),
-    "urlTip": m24,
+    "urlTip": m26,
     "useHosts": MessageLookupByLibrary.simpleMessage("Use hosts"),
     "useSystemHosts": MessageLookupByLibrary.simpleMessage("Use system hosts"),
     "userAgent": MessageLookupByLibrary.simpleMessage("User-Agent"),
@@ -1051,7 +1210,7 @@ class MessageLookup extends MessageLookupByLibrary {
       "WebDAV configuration",
     ),
     "whitelistMode": MessageLookupByLibrary.simpleMessage("Whitelist mode"),
-    "yearsAgo": m25,
+    "yearsAgo": m27,
     "zh_CN": MessageLookupByLibrary.simpleMessage("Simplified Chinese"),
   };
 }
diff --git a/lib/l10n/intl/messages_ja.dart b/lib/l10n/intl/messages_ja.dart
index ceac8a469b..cb55e2cbe9 100644
--- a/lib/l10n/intl/messages_ja.dart
+++ b/lib/l10n/intl/messages_ja.dart
@@ -34,7 +34,7 @@ class MessageLookup extends MessageLookupByLibrary {
 
   static String m6(label) => "現在の${label}は既に存在しています";
 
-  static String m7(name) => "${name} スキップ済み";
+  static String m7(name) => "${name} はすでに最新です";
 
   static String m8(name) => "${name} 更新済み";
 
@@ -69,9 +69,13 @@ class MessageLookup extends MessageLookupByLibrary {
 
   static String m23(count) => "${count} 項目が選択されています";
 
-  static String m24(label) => "${label}はURLである必要があります";
+  static String m24(count) => "ルーティング先 ${count} 件";
 
-  static String m25(count) => "${count}年前";
+  static String m25(count) => "${count} 個のノードが有効です。ノード横のピンで接続をテストできます。";
+
+  static String m26(label) => "${label}はURLである必要があります";
+
+  static String m27(count) => "${count}年前";
 
   final messages = _notInlinedMessages(_notInlinedMessages);
   static Map<String, Function> _notInlinedMessages(_) => <String, Function>{
@@ -101,6 +105,9 @@ class MessageLookup extends MessageLookupByLibrary {
     "addProxyProviders": MessageLookupByLibrary.simpleMessage("プロキシプロバイダーを追加"),
     "addRule": MessageLookupByLibrary.simpleMessage("ルールを追加"),
     "addSsid": MessageLookupByLibrary.simpleMessage("SSIDを追加"),
+    "addTailscaleNode": MessageLookupByLibrary.simpleMessage(
+      "Tailscale ノードを追加",
+    ),
     "addedRules": MessageLookupByLibrary.simpleMessage("追加ルール"),
     "additionalParameters": MessageLookupByLibrary.simpleMessage("追加パラメータ"),
     "address": MessageLookupByLibrary.simpleMessage("アドレス"),
@@ -212,6 +219,10 @@ class MessageLookup extends MessageLookupByLibrary {
     "core": MessageLookupByLibrary.simpleMessage("コア"),
     "coreStatus": MessageLookupByLibrary.simpleMessage("コアステータス"),
     "country": MessageLookupByLibrary.simpleMessage("国"),
+    "crashDetected": MessageLookupByLibrary.simpleMessage("クラッシュを検出しました"),
+    "crashDetectedTip": MessageLookupByLibrary.simpleMessage(
+      "前回の実行中にアプリがクラッシュしました。クラッシュの繰り返しを防ぐため、現在のプロファイルを解除し、設定の自動セットアップをスキップしました。",
+    ),
     "crashTest": MessageLookupByLibrary.simpleMessage("クラッシュテスト"),
     "crashlytics": MessageLookupByLibrary.simpleMessage("クラッシュ分析"),
     "crashlyticsTip": MessageLookupByLibrary.simpleMessage(
@@ -274,6 +285,9 @@ class MessageLookup extends MessageLookupByLibrary {
     "editProxyGroup": MessageLookupByLibrary.simpleMessage("プロキシグループを編集"),
     "editRule": MessageLookupByLibrary.simpleMessage("ルールを編集"),
     "editSsid": MessageLookupByLibrary.simpleMessage("SSIDを編集"),
+    "editTailscaleNode": MessageLookupByLibrary.simpleMessage(
+      "Tailscale ノードを編集",
+    ),
     "emptyTip": m4,
     "en": MessageLookupByLibrary.simpleMessage("英語"),
     "entries": MessageLookupByLibrary.simpleMessage(" エントリ"),
@@ -307,6 +321,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "fallback": MessageLookupByLibrary.simpleMessage("フォールバック"),
     "fallbackDesc": MessageLookupByLibrary.simpleMessage("通常はオフショアDNSを使用"),
     "fallbackFilter": MessageLookupByLibrary.simpleMessage("フォールバックフィルター"),
+    "features": MessageLookupByLibrary.simpleMessage("機能"),
     "fidelityScheme": MessageLookupByLibrary.simpleMessage("ハイファイデリティー"),
     "file": MessageLookupByLibrary.simpleMessage("ファイル"),
     "fileDesc": MessageLookupByLibrary.simpleMessage("プロファイルを直接アップロード"),
@@ -343,6 +358,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "goDownload": MessageLookupByLibrary.simpleMessage("ダウンロードへ"),
     "goToConfigureScript": MessageLookupByLibrary.simpleMessage("スクリプト設定に移動"),
     "hasCacheChange": MessageLookupByLibrary.simpleMessage("変更をキャッシュしますか？"),
+    "hideAdvanced": MessageLookupByLibrary.simpleMessage("詳細設定を隠す"),
     "hideFromList": MessageLookupByLibrary.simpleMessage("リストから隠す"),
     "host": MessageLookupByLibrary.simpleMessage("ホスト"),
     "hostsDesc": MessageLookupByLibrary.simpleMessage("ホストを追加"),
@@ -756,6 +772,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "selectedCountTitle": m23,
     "settings": MessageLookupByLibrary.simpleMessage("設定"),
     "show": MessageLookupByLibrary.simpleMessage("表示"),
+    "showAdvanced": MessageLookupByLibrary.simpleMessage("詳細設定を表示"),
     "shrink": MessageLookupByLibrary.simpleMessage("縮小"),
     "silentLaunch": MessageLookupByLibrary.simpleMessage("バックグラウンド起動"),
     "silentLaunchDesc": MessageLookupByLibrary.simpleMessage("バックグラウンドで起動"),
@@ -799,6 +816,137 @@ class MessageLookup extends MessageLookupByLibrary {
     "tab": MessageLookupByLibrary.simpleMessage("タブ"),
     "tabAnimation": MessageLookupByLibrary.simpleMessage("タブアニメーション"),
     "tabAnimationDesc": MessageLookupByLibrary.simpleMessage("モバイル表示でのみ有効"),
+    "tailscale": MessageLookupByLibrary.simpleMessage("Tailscale"),
+    "tailscaleAcceptRoutes": MessageLookupByLibrary.simpleMessage("ルートを受け入れる"),
+    "tailscaleAndroidStep1": MessageLookupByLibrary.simpleMessage(
+      "Tailscale 管理コンソール（設定 → Keys）で認証キーを取得します。",
+    ),
+    "tailscaleAndroidStep2": MessageLookupByLibrary.simpleMessage(
+      "ノードを追加し、認証キーを貼り付け、ルーティング先に自宅デバイスの IP または MagicDNS 名を入れます。",
+    ),
+    "tailscaleAndroidStep3": MessageLookupByLibrary.simpleMessage(
+      "「Tailscale を有効化」をオンにします。Tailscale アプリも入れている場合以外は「直結に保つ」はオフのままで構いません。",
+    ),
+    "tailscaleAndroidStep4": MessageLookupByLibrary.simpleMessage(
+      "FlClash VPN を開始し、ノード横のピンボタンで接続を確認します。",
+    ),
+    "tailscaleAuthKey": MessageLookupByLibrary.simpleMessage("認証キー"),
+    "tailscaleAuthKeyHint": MessageLookupByLibrary.simpleMessage(
+      "Tailscale 管理コンソール → 設定 → Keys から取得します。ノードの認証に必要です。",
+    ),
+    "tailscaleBypass": MessageLookupByLibrary.simpleMessage(
+      "Tailscale のトラフィックを直結に保つ",
+    ),
+    "tailscaleBypassAndroidHint": MessageLookupByLibrary.simpleMessage(
+      "Android では通常オフのまま。この端末にも Tailscale アプリがある場合だけオンにしてください。",
+    ),
+    "tailscaleBypassNudge": MessageLookupByLibrary.simpleMessage(
+      "この端末では Tailscale も動いている可能性があります — 「Tailscale 通信を直通」をオンにして Fake IP / 制御面の不具合を避けてください。",
+    ),
+    "tailscaleBypassRecommended": MessageLookupByLibrary.simpleMessage(
+      "Tailscale アプリ/サービスが入っているデスクトップでは推奨。DIRECT ルールと Fake IP Filter を自動管理します。",
+    ),
+    "tailscaleControlUrl": MessageLookupByLibrary.simpleMessage("コントロール URL"),
+    "tailscaleControlUrlHint": MessageLookupByLibrary.simpleMessage(
+      "任意。Headscale などの自己ホスト型コントロールサーバー用です。",
+    ),
+    "tailscaleDesc": MessageLookupByLibrary.simpleMessage(
+      "Tailscale アウトバウンドノードを管理",
+    ),
+    "tailscaleDesktopStep1": MessageLookupByLibrary.simpleMessage(
+      "この PC で Tailscale アプリ/サービスも動かす場合は「Tailscale のトラフィックを直結に保つ」をオンにします。",
+    ),
+    "tailscaleDesktopStep2": MessageLookupByLibrary.simpleMessage(
+      "任意: 認証キー付きの内蔵 Tailscale ノードを追加し、選択した通信を FlClash から tailnet 経由にします。",
+    ),
+    "tailscaleDesktopStep3": MessageLookupByLibrary.simpleMessage(
+      "ルーティング先に宛先（自宅 IP / MagicDNS）を入れ、「Tailscale を有効化」をオンにします。",
+    ),
+    "tailscaleDesktopStep4": MessageLookupByLibrary.simpleMessage(
+      "FlClash を開始し、ノード横のピンボタンで接続が安定しているか確認します。",
+    ),
+    "tailscaleEmptyTip": MessageLookupByLibrary.simpleMessage(
+      "Tailscale ノードがありません。追加すると、トラフィックを tailnet 経由で転送できます。",
+    ),
+    "tailscaleEnable": MessageLookupByLibrary.simpleMessage("Tailscale を有効化"),
+    "tailscaleEnableBypassAction": MessageLookupByLibrary.simpleMessage(
+      "有効にする",
+    ),
+    "tailscaleEnableDesc": MessageLookupByLibrary.simpleMessage(
+      "Tailscale ノードをアウトバウンドとして注入します。オフにすると Tailscale はトラフィックを処理しなくなりますが、通常のトラフィックには影響しません。",
+    ),
+    "tailscaleEphemeral": MessageLookupByLibrary.simpleMessage("エフェメラル"),
+    "tailscaleExitNode": MessageLookupByLibrary.simpleMessage("出口ノード"),
+    "tailscaleExitNodeAllowLanAccess": MessageLookupByLibrary.simpleMessage(
+      "出口ノード経由の LAN アクセスを許可",
+    ),
+    "tailscaleExitNodeHint": MessageLookupByLibrary.simpleMessage(
+      "任意。すべてのトラフィックを転送する tailnet 出口ノードの IP または名前です。",
+    ),
+    "tailscaleGuideTitle": MessageLookupByLibrary.simpleMessage(
+      "Tailscale の仕組み",
+    ),
+    "tailscaleHostname": MessageLookupByLibrary.simpleMessage("ホスト名"),
+    "tailscaleHostnameHint": MessageLookupByLibrary.simpleMessage(
+      "任意。tailnet に表示されるデバイス名です。",
+    ),
+    "tailscaleNameExistsTip": MessageLookupByLibrary.simpleMessage(
+      "同じ名前のノードが既に存在します",
+    ),
+    "tailscaleNameHelper": MessageLookupByLibrary.simpleMessage(
+      "プロキシ一覧の出站名です。名前を変えると選択や遅延テストの対応も変わります。",
+    ),
+    "tailscaleNoRoutes": MessageLookupByLibrary.simpleMessage("ルーティング先なし"),
+    "tailscaleNodesTitle": MessageLookupByLibrary.simpleMessage("ノード"),
+    "tailscaleNotTested": MessageLookupByLibrary.simpleMessage("未テスト"),
+    "tailscaleRoutes": MessageLookupByLibrary.simpleMessage("ルーティング先"),
+    "tailscaleRoutesCount": m24,
+    "tailscaleRoutesHint": MessageLookupByLibrary.simpleMessage(
+      "このノード経由で送るドメインまたは IP（1 行に 1 つ、例: 自宅 PC の Tailscale IP や MagicDNS 名）。",
+    ),
+    "tailscaleScenarioAndroidBody": MessageLookupByLibrary.simpleMessage(
+      "VPN は FlClash だけにしてください。Tailscale アプリの VPN と同時には使えません（Android は VPN を 1 つだけ許可）。下で内蔵 Tailscale ノードを追加し、自宅デバイスをルーティング先に入れてください。",
+    ),
+    "tailscaleScenarioAndroidTitle": MessageLookupByLibrary.simpleMessage(
+      "Android クライアント設定",
+    ),
+    "tailscaleScenarioDesktopBody": MessageLookupByLibrary.simpleMessage(
+      "FlClash と正式な Tailscale アプリを同時に使えます。「Tailscale のトラフィックを直結に保つ」をオンにして、FlClash が制御プレーンや fake-IP DNS を横取りしないようにします。",
+    ),
+    "tailscaleScenarioDesktopTitle": MessageLookupByLibrary.simpleMessage(
+      "デスクトップ / ホスト設定",
+    ),
+    "tailscaleShowSetupGuide": MessageLookupByLibrary.simpleMessage(
+      "セットアップガイド",
+    ),
+    "tailscaleStateDir": MessageLookupByLibrary.simpleMessage("状態ディレクトリ"),
+    "tailscaleStateDirHint": MessageLookupByLibrary.simpleMessage(
+      "任意。Tailscale の状態を保存するディレクトリです。",
+    ),
+    "tailscaleStatusDisabled": MessageLookupByLibrary.simpleMessage(
+      "Tailscale はオフです — ノードは実行中の設定に注入されません。",
+    ),
+    "tailscaleStatusNeedRoutes": MessageLookupByLibrary.simpleMessage(
+      "ノードは追加済みですがルート先がありません — ルートを追加するまで自動一致しません（または手動でノードを選択）。",
+    ),
+    "tailscaleStatusNeedStart": MessageLookupByLibrary.simpleMessage(
+      "ノードの準備ができました。FlClash VPN を開始してからピンでテストしてください。",
+    ),
+    "tailscaleStatusNoNodes": MessageLookupByLibrary.simpleMessage(
+      "有効ですが、ノードがありません。まずノードを追加してください。",
+    ),
+    "tailscaleStatusReady": m25,
+    "tailscaleTestNeedEnable": MessageLookupByLibrary.simpleMessage(
+      "テストする前に「Tailscale を有効化」をオンにしてください。",
+    ),
+    "tailscaleTestNeedStart": MessageLookupByLibrary.simpleMessage(
+      "接続をテストする前に FlClash VPN を開始してください。",
+    ),
+    "tailscaleTestNode": MessageLookupByLibrary.simpleMessage("接続をテスト"),
+    "tailscaleTestTip": MessageLookupByLibrary.simpleMessage(
+      "ノード横のピンボタンで、Tailscale アウトバウンドが発信できるか確認できます。遅延が表示されれば接続は正常です。Timeout の場合は認証キー、「有効化」、FlClash VPN の起動を確認してください。",
+    ),
+    "tailscaleUdp": MessageLookupByLibrary.simpleMessage("UDP リレー"),
     "tapToAuthorize": MessageLookupByLibrary.simpleMessage("タップして許可"),
     "tcpConcurrent": MessageLookupByLibrary.simpleMessage("TCP並列処理"),
     "tcpConcurrentDesc": MessageLookupByLibrary.simpleMessage("TCP並列処理を許可"),
@@ -835,7 +983,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "upload": MessageLookupByLibrary.simpleMessage("アップロード"),
     "url": MessageLookupByLibrary.simpleMessage("URL"),
     "urlDesc": MessageLookupByLibrary.simpleMessage("URL経由でプロファイルを取得"),
-    "urlTip": m24,
+    "urlTip": m26,
     "useHosts": MessageLookupByLibrary.simpleMessage("ホストを使用"),
     "useSystemHosts": MessageLookupByLibrary.simpleMessage("システムホストを使用"),
     "userAgent": MessageLookupByLibrary.simpleMessage("ユーザーエージェント"),
@@ -851,7 +999,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "vpnTip": MessageLookupByLibrary.simpleMessage("変更はVPN再起動後に有効"),
     "webDAVConfiguration": MessageLookupByLibrary.simpleMessage("WebDAV設定"),
     "whitelistMode": MessageLookupByLibrary.simpleMessage("ホワイトリストモード"),
-    "yearsAgo": m25,
+    "yearsAgo": m27,
     "zh_CN": MessageLookupByLibrary.simpleMessage("簡体字中国語"),
   };
 }
diff --git a/lib/l10n/intl/messages_ru.dart b/lib/l10n/intl/messages_ru.dart
index adf4d6de1e..4704144dce 100644
--- a/lib/l10n/intl/messages_ru.dart
+++ b/lib/l10n/intl/messages_ru.dart
@@ -36,7 +36,7 @@ class MessageLookup extends MessageLookupByLibrary {
 
   static String m6(label) => "Текущий ${label} уже существует";
 
-  static String m7(name) => "${name} пропущено";
+  static String m7(name) => "Для ${name} уже установлена последняя версия";
 
   static String m8(name) => "${name} обновлено";
 
@@ -75,9 +75,14 @@ class MessageLookup extends MessageLookupByLibrary {
 
   static String m23(count) => "Выбрано ${count} элементов";
 
-  static String m24(label) => "${label} должен быть URL";
+  static String m24(count) => "Маршрутов: ${count}";
 
   static String m25(count) =>
+      "Активных узлов: ${count}. Нажмите ping у узла, чтобы проверить связь.";
+
+  static String m26(label) => "${label} должен быть URL";
+
+  static String m27(count) =>
       "${Intl.plural(count, one: '${count} год назад', few: '${count} года назад', many: '${count} лет назад', other: '${count} года назад')}";
 
   final messages = _notInlinedMessages(_notInlinedMessages);
@@ -114,6 +119,9 @@ class MessageLookup extends MessageLookupByLibrary {
     ),
     "addRule": MessageLookupByLibrary.simpleMessage("Добавить правило"),
     "addSsid": MessageLookupByLibrary.simpleMessage("Добавить SSID"),
+    "addTailscaleNode": MessageLookupByLibrary.simpleMessage(
+      "Добавить узел Tailscale",
+    ),
     "addedRules": MessageLookupByLibrary.simpleMessage("Добавленные правила"),
     "additionalParameters": MessageLookupByLibrary.simpleMessage(
       "Дополнительные параметры",
@@ -279,6 +287,10 @@ class MessageLookup extends MessageLookupByLibrary {
     "core": MessageLookupByLibrary.simpleMessage("Ядро"),
     "coreStatus": MessageLookupByLibrary.simpleMessage("Основной статус"),
     "country": MessageLookupByLibrary.simpleMessage("Страна"),
+    "crashDetected": MessageLookupByLibrary.simpleMessage("Обнаружен сбой"),
+    "crashDetectedTip": MessageLookupByLibrary.simpleMessage(
+      "Во время предыдущего запуска произошёл сбой приложения. Чтобы предотвратить повторный сбой, текущий профиль был сброшен, а автоматическая настройка конфигурации пропущена.",
+    ),
     "crashTest": MessageLookupByLibrary.simpleMessage("Тест на сбои"),
     "crashlytics": MessageLookupByLibrary.simpleMessage("Анализ сбоев"),
     "crashlyticsTip": MessageLookupByLibrary.simpleMessage(
@@ -361,6 +373,9 @@ class MessageLookup extends MessageLookupByLibrary {
     ),
     "editRule": MessageLookupByLibrary.simpleMessage("Редактировать правило"),
     "editSsid": MessageLookupByLibrary.simpleMessage("Изменить SSID"),
+    "editTailscaleNode": MessageLookupByLibrary.simpleMessage(
+      "Изменить узел Tailscale",
+    ),
     "emptyTip": m4,
     "en": MessageLookupByLibrary.simpleMessage("Английский"),
     "entries": MessageLookupByLibrary.simpleMessage(" записей"),
@@ -404,6 +419,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "fallbackFilter": MessageLookupByLibrary.simpleMessage(
       "Фильтр резервного DNS",
     ),
+    "features": MessageLookupByLibrary.simpleMessage("Функции"),
     "fidelityScheme": MessageLookupByLibrary.simpleMessage("Точная передача"),
     "file": MessageLookupByLibrary.simpleMessage("Файл"),
     "fileDesc": MessageLookupByLibrary.simpleMessage("Прямая загрузка профиля"),
@@ -450,6 +466,9 @@ class MessageLookup extends MessageLookupByLibrary {
     "hasCacheChange": MessageLookupByLibrary.simpleMessage(
       "Хотите сохранить изменения в кэше?",
     ),
+    "hideAdvanced": MessageLookupByLibrary.simpleMessage(
+      "Скрыть дополнительно",
+    ),
     "hideFromList": MessageLookupByLibrary.simpleMessage("Скрыть из списка"),
     "host": MessageLookupByLibrary.simpleMessage("Хост"),
     "hostsDesc": MessageLookupByLibrary.simpleMessage("Добавить Hosts"),
@@ -981,6 +1000,9 @@ class MessageLookup extends MessageLookupByLibrary {
     "selectedCountTitle": m23,
     "settings": MessageLookupByLibrary.simpleMessage("Настройки"),
     "show": MessageLookupByLibrary.simpleMessage("Показать"),
+    "showAdvanced": MessageLookupByLibrary.simpleMessage(
+      "Показать дополнительно",
+    ),
     "shrink": MessageLookupByLibrary.simpleMessage("Сжать"),
     "silentLaunch": MessageLookupByLibrary.simpleMessage("Тихий запуск"),
     "silentLaunchDesc": MessageLookupByLibrary.simpleMessage(
@@ -1036,6 +1058,155 @@ class MessageLookup extends MessageLookupByLibrary {
     "tabAnimationDesc": MessageLookupByLibrary.simpleMessage(
       "Действительно только в мобильном виде",
     ),
+    "tailscale": MessageLookupByLibrary.simpleMessage("Tailscale"),
+    "tailscaleAcceptRoutes": MessageLookupByLibrary.simpleMessage(
+      "Принимать маршруты",
+    ),
+    "tailscaleAndroidStep1": MessageLookupByLibrary.simpleMessage(
+      "Получите ключ аутентификации в консоли администратора Tailscale (Settings → Keys).",
+    ),
+    "tailscaleAndroidStep2": MessageLookupByLibrary.simpleMessage(
+      "Добавьте узел, вставьте ключ и укажите IP или имя MagicDNS домашнего устройства в пунктах назначения маршрута.",
+    ),
+    "tailscaleAndroidStep3": MessageLookupByLibrary.simpleMessage(
+      "Включите Tailscale. «Оставлять трафик напрямую» обычно выключайте, если приложение Tailscale на телефоне не установлено.",
+    ),
+    "tailscaleAndroidStep4": MessageLookupByLibrary.simpleMessage(
+      "Запустите VPN FlClash, затем нажмите кнопку ping у узла, чтобы проверить соединение.",
+    ),
+    "tailscaleAuthKey": MessageLookupByLibrary.simpleMessage(
+      "Ключ аутентификации",
+    ),
+    "tailscaleAuthKeyHint": MessageLookupByLibrary.simpleMessage(
+      "Из консоли администратора Tailscale → Settings → Keys. Требуется для аутентификации узла.",
+    ),
+    "tailscaleBypass": MessageLookupByLibrary.simpleMessage(
+      "Оставлять трафик Tailscale напрямую",
+    ),
+    "tailscaleBypassAndroidHint": MessageLookupByLibrary.simpleMessage(
+      "На Android обычно оставляйте выключенным. Включайте только если на телефоне также установлено приложение Tailscale.",
+    ),
+    "tailscaleBypassNudge": MessageLookupByLibrary.simpleMessage(
+      "На этом устройстве, возможно, уже запущен Tailscale — включите «Прямой трафик Tailscale», чтобы избежать проблем Fake IP / control plane.",
+    ),
+    "tailscaleBypassRecommended": MessageLookupByLibrary.simpleMessage(
+      "Рекомендуется на ПК, где установлено приложение/служба Tailscale. Автоматически управляет правилами DIRECT и Fake IP Filter.",
+    ),
+    "tailscaleControlUrl": MessageLookupByLibrary.simpleMessage(
+      "URL сервера управления",
+    ),
+    "tailscaleControlUrlHint": MessageLookupByLibrary.simpleMessage(
+      "Необязательно. Только для собственных серверов управления, например Headscale.",
+    ),
+    "tailscaleDesc": MessageLookupByLibrary.simpleMessage(
+      "Управление исходящими узлами Tailscale",
+    ),
+    "tailscaleDesktopStep1": MessageLookupByLibrary.simpleMessage(
+      "Если на этом ПК также работает приложение/служба Tailscale, включите «Оставлять трафик Tailscale напрямую».",
+    ),
+    "tailscaleDesktopStep2": MessageLookupByLibrary.simpleMessage(
+      "Необязательно: добавьте встроенный узел Tailscale с ключом, чтобы направлять выбранный трафик через tailnet из FlClash.",
+    ),
+    "tailscaleDesktopStep3": MessageLookupByLibrary.simpleMessage(
+      "Укажите назначения (домашние IP / MagicDNS) в пунктах назначения маршрута и включите Tailscale.",
+    ),
+    "tailscaleDesktopStep4": MessageLookupByLibrary.simpleMessage(
+      "Запустите FlClash и нажмите ping у узла, чтобы убедиться, что соединение стабильно.",
+    ),
+    "tailscaleEmptyTip": MessageLookupByLibrary.simpleMessage(
+      "Узлов Tailscale пока нет. Добавьте узел, чтобы направлять трафик через вашу сеть tailnet.",
+    ),
+    "tailscaleEnable": MessageLookupByLibrary.simpleMessage(
+      "Включить Tailscale",
+    ),
+    "tailscaleEnableBypassAction": MessageLookupByLibrary.simpleMessage(
+      "Включить",
+    ),
+    "tailscaleEnableDesc": MessageLookupByLibrary.simpleMessage(
+      "Добавлять узлы Tailscale как исходящие. При отключении Tailscale перестаёт обрабатывать трафик; обычный трафик не затрагивается.",
+    ),
+    "tailscaleEphemeral": MessageLookupByLibrary.simpleMessage(
+      "Временный узел",
+    ),
+    "tailscaleExitNode": MessageLookupByLibrary.simpleMessage("Выходной узел"),
+    "tailscaleExitNodeAllowLanAccess": MessageLookupByLibrary.simpleMessage(
+      "Разрешить доступ к локальной сети через выходной узел",
+    ),
+    "tailscaleExitNodeHint": MessageLookupByLibrary.simpleMessage(
+      "Необязательно. IP-адрес или имя выходного узла tailnet для маршрутизации всего трафика.",
+    ),
+    "tailscaleGuideTitle": MessageLookupByLibrary.simpleMessage(
+      "Как работает Tailscale",
+    ),
+    "tailscaleHostname": MessageLookupByLibrary.simpleMessage("Имя хоста"),
+    "tailscaleHostnameHint": MessageLookupByLibrary.simpleMessage(
+      "Необязательно. Имя устройства, отображаемое в вашей сети tailnet.",
+    ),
+    "tailscaleNameExistsTip": MessageLookupByLibrary.simpleMessage(
+      "Узел с таким именем уже существует",
+    ),
+    "tailscaleNameHelper": MessageLookupByLibrary.simpleMessage(
+      "Имя исходящего узла в Proxies. Переименование меняет привязку выбора и тестов задержки.",
+    ),
+    "tailscaleNoRoutes": MessageLookupByLibrary.simpleMessage(
+      "Нет пунктов назначения",
+    ),
+    "tailscaleNodesTitle": MessageLookupByLibrary.simpleMessage("Узлы"),
+    "tailscaleNotTested": MessageLookupByLibrary.simpleMessage("Не проверено"),
+    "tailscaleRoutes": MessageLookupByLibrary.simpleMessage(
+      "Пункты назначения маршрута",
+    ),
+    "tailscaleRoutesCount": m24,
+    "tailscaleRoutesHint": MessageLookupByLibrary.simpleMessage(
+      "Домены или IP, направляемые через этот узел, по одному в строке (например, Tailscale IP или имя MagicDNS вашего домашнего ПК).",
+    ),
+    "tailscaleScenarioAndroidBody": MessageLookupByLibrary.simpleMessage(
+      "Оставьте FlClash единственным VPN. Не запускайте VPN приложения Tailscale одновременно (Android допускает только один). Добавьте встроенный узел Tailscale ниже и укажите домашнее устройство в пунктах назначения маршрута.",
+    ),
+    "tailscaleScenarioAndroidTitle": MessageLookupByLibrary.simpleMessage(
+      "Настройка клиента Android",
+    ),
+    "tailscaleScenarioDesktopBody": MessageLookupByLibrary.simpleMessage(
+      "Можно запускать FlClash и настоящее приложение Tailscale вместе. Включите «Оставлять трафик Tailscale напрямую», чтобы FlClash не перехватывал плоскость управления Tailscale и fake-IP DNS.",
+    ),
+    "tailscaleScenarioDesktopTitle": MessageLookupByLibrary.simpleMessage(
+      "Настройка ПК / хоста",
+    ),
+    "tailscaleShowSetupGuide": MessageLookupByLibrary.simpleMessage(
+      "Инструкция",
+    ),
+    "tailscaleStateDir": MessageLookupByLibrary.simpleMessage(
+      "Каталог состояния",
+    ),
+    "tailscaleStateDirHint": MessageLookupByLibrary.simpleMessage(
+      "Необязательно. Каталог для хранения состояния Tailscale.",
+    ),
+    "tailscaleStatusDisabled": MessageLookupByLibrary.simpleMessage(
+      "Tailscale выключен — узлы не добавляются в рабочий профиль.",
+    ),
+    "tailscaleStatusNeedRoutes": MessageLookupByLibrary.simpleMessage(
+      "Узлы добавлены, но нет маршрутов — трафик не совпадёт, пока не добавите маршруты (или выберите узел вручную).",
+    ),
+    "tailscaleStatusNeedStart": MessageLookupByLibrary.simpleMessage(
+      "Узлы готовы. Запустите VPN FlClash, затем нажмите ping для проверки.",
+    ),
+    "tailscaleStatusNoNodes": MessageLookupByLibrary.simpleMessage(
+      "Включено, но узлов ещё нет. Добавьте узел, чтобы начать.",
+    ),
+    "tailscaleStatusReady": m25,
+    "tailscaleTestNeedEnable": MessageLookupByLibrary.simpleMessage(
+      "Перед проверкой включите Tailscale.",
+    ),
+    "tailscaleTestNeedStart": MessageLookupByLibrary.simpleMessage(
+      "Перед проверкой соединения запустите VPN FlClash.",
+    ),
+    "tailscaleTestNode": MessageLookupByLibrary.simpleMessage(
+      "Проверить соединение",
+    ),
+    "tailscaleTestTip": MessageLookupByLibrary.simpleMessage(
+      "Кнопка ping рядом с узлом проверяет, может ли исходящий Tailscale установить соединение. Задержка означает, что связь есть; Timeout — проверьте ключ, переключатель включения и что VPN FlClash запущен.",
+    ),
+    "tailscaleUdp": MessageLookupByLibrary.simpleMessage("Ретрансляция UDP"),
     "tapToAuthorize": MessageLookupByLibrary.simpleMessage(
       "Нажмите, чтобы разрешить",
     ),
@@ -1092,7 +1263,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "urlDesc": MessageLookupByLibrary.simpleMessage(
       "Получить профиль через URL",
     ),
-    "urlTip": m24,
+    "urlTip": m26,
     "useHosts": MessageLookupByLibrary.simpleMessage("Использовать hosts"),
     "useSystemHosts": MessageLookupByLibrary.simpleMessage(
       "Использовать системные hosts",
@@ -1116,7 +1287,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "whitelistMode": MessageLookupByLibrary.simpleMessage(
       "Режим белого списка",
     ),
-    "yearsAgo": m25,
+    "yearsAgo": m27,
     "zh_CN": MessageLookupByLibrary.simpleMessage("Упрощенный китайский"),
   };
 }
diff --git a/lib/l10n/intl/messages_zh_CN.dart b/lib/l10n/intl/messages_zh_CN.dart
index e198261265..8e3829b78e 100644
--- a/lib/l10n/intl/messages_zh_CN.dart
+++ b/lib/l10n/intl/messages_zh_CN.dart
@@ -34,7 +34,7 @@ class MessageLookup extends MessageLookupByLibrary {
 
   static String m6(label) => "${label}当前已存在";
 
-  static String m7(name) => "${name} 已跳过";
+  static String m7(name) => "${name} 已是最新版本";
 
   static String m8(name) => "${name} 已更新";
 
@@ -69,9 +69,13 @@ class MessageLookup extends MessageLookupByLibrary {
 
   static String m23(count) => "已选择 ${count} 项";
 
-  static String m24(label) => "${label}必须为URL";
+  static String m24(count) => "${count} 个路由目标";
 
-  static String m25(count) => "${count} 年前";
+  static String m25(count) => "已有 ${count} 个节点。点击节点旁的测速按钮检查连通性。";
+
+  static String m26(label) => "${label}必须为URL";
+
+  static String m27(count) => "${count} 年前";
 
   final messages = _notInlinedMessages(_notInlinedMessages);
   static Map<String, Function> _notInlinedMessages(_) => <String, Function>{
@@ -99,6 +103,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "addProxyProviders": MessageLookupByLibrary.simpleMessage("添加代理集"),
     "addRule": MessageLookupByLibrary.simpleMessage("添加规则"),
     "addSsid": MessageLookupByLibrary.simpleMessage("添加SSID"),
+    "addTailscaleNode": MessageLookupByLibrary.simpleMessage("添加 Tailscale 节点"),
     "addedRules": MessageLookupByLibrary.simpleMessage("附加规则"),
     "additionalParameters": MessageLookupByLibrary.simpleMessage("附加参数"),
     "address": MessageLookupByLibrary.simpleMessage("地址"),
@@ -190,6 +195,10 @@ class MessageLookup extends MessageLookupByLibrary {
     "core": MessageLookupByLibrary.simpleMessage("内核"),
     "coreStatus": MessageLookupByLibrary.simpleMessage("核心状态"),
     "country": MessageLookupByLibrary.simpleMessage("区域"),
+    "crashDetected": MessageLookupByLibrary.simpleMessage("检测到崩溃"),
+    "crashDetectedTip": MessageLookupByLibrary.simpleMessage(
+      "检测到应用上次运行发生崩溃。为避免重复崩溃，已清除当前配置选择，并跳过本次自动配置。",
+    ),
     "crashTest": MessageLookupByLibrary.simpleMessage("崩溃测试"),
     "crashlytics": MessageLookupByLibrary.simpleMessage("崩溃分析"),
     "crashlyticsTip": MessageLookupByLibrary.simpleMessage(
@@ -246,6 +255,9 @@ class MessageLookup extends MessageLookupByLibrary {
     "editProxyGroup": MessageLookupByLibrary.simpleMessage("编辑策略组"),
     "editRule": MessageLookupByLibrary.simpleMessage("编辑规则"),
     "editSsid": MessageLookupByLibrary.simpleMessage("编辑SSID"),
+    "editTailscaleNode": MessageLookupByLibrary.simpleMessage(
+      "编辑 Tailscale 节点",
+    ),
     "emptyTip": m4,
     "en": MessageLookupByLibrary.simpleMessage("英语"),
     "entries": MessageLookupByLibrary.simpleMessage("个条目"),
@@ -277,6 +289,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "fallback": MessageLookupByLibrary.simpleMessage("Fallback"),
     "fallbackDesc": MessageLookupByLibrary.simpleMessage("一般情况下使用境外DNS"),
     "fallbackFilter": MessageLookupByLibrary.simpleMessage("Fallback过滤"),
+    "features": MessageLookupByLibrary.simpleMessage("功能"),
     "fidelityScheme": MessageLookupByLibrary.simpleMessage("高保真"),
     "file": MessageLookupByLibrary.simpleMessage("文件"),
     "fileDesc": MessageLookupByLibrary.simpleMessage("直接上传配置文件"),
@@ -305,6 +318,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "goDownload": MessageLookupByLibrary.simpleMessage("前往下载"),
     "goToConfigureScript": MessageLookupByLibrary.simpleMessage("前往配置脚本"),
     "hasCacheChange": MessageLookupByLibrary.simpleMessage("是否缓存修改"),
+    "hideAdvanced": MessageLookupByLibrary.simpleMessage("隐藏高级选项"),
     "hideFromList": MessageLookupByLibrary.simpleMessage("从列表中隐藏"),
     "host": MessageLookupByLibrary.simpleMessage("主机"),
     "hostsDesc": MessageLookupByLibrary.simpleMessage("追加Hosts"),
@@ -650,6 +664,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "selectedCountTitle": m23,
     "settings": MessageLookupByLibrary.simpleMessage("设置"),
     "show": MessageLookupByLibrary.simpleMessage("显示"),
+    "showAdvanced": MessageLookupByLibrary.simpleMessage("显示高级选项"),
     "shrink": MessageLookupByLibrary.simpleMessage("紧凑"),
     "silentLaunch": MessageLookupByLibrary.simpleMessage("静默启动"),
     "silentLaunchDesc": MessageLookupByLibrary.simpleMessage("后台启动"),
@@ -689,6 +704,129 @@ class MessageLookup extends MessageLookupByLibrary {
     "tab": MessageLookupByLibrary.simpleMessage("标签页"),
     "tabAnimation": MessageLookupByLibrary.simpleMessage("选项卡动画"),
     "tabAnimationDesc": MessageLookupByLibrary.simpleMessage("仅在移动视图中有效"),
+    "tailscale": MessageLookupByLibrary.simpleMessage("Tailscale"),
+    "tailscaleAcceptRoutes": MessageLookupByLibrary.simpleMessage("接受路由"),
+    "tailscaleAndroidStep1": MessageLookupByLibrary.simpleMessage(
+      "在 Tailscale 管理后台（设置 → Keys）获取认证密钥。",
+    ),
+    "tailscaleAndroidStep2": MessageLookupByLibrary.simpleMessage(
+      "添加节点，粘贴认证密钥，并在“路由目标”中填入家里设备的 IP 或 MagicDNS 名称。",
+    ),
+    "tailscaleAndroidStep3": MessageLookupByLibrary.simpleMessage(
+      "打开“启用 Tailscale”。除非本机也安装了 Tailscale 应用，否则请关闭“保持 Tailscale 流量直连”。",
+    ),
+    "tailscaleAndroidStep4": MessageLookupByLibrary.simpleMessage(
+      "启动 FlClash VPN，然后点击节点旁的测速按钮检查连接。",
+    ),
+    "tailscaleAuthKey": MessageLookupByLibrary.simpleMessage("认证密钥"),
+    "tailscaleAuthKeyHint": MessageLookupByLibrary.simpleMessage(
+      "来自 Tailscale 管理后台 → 设置 → Keys，用于对节点进行认证。",
+    ),
+    "tailscaleBypass": MessageLookupByLibrary.simpleMessage(
+      "保持 Tailscale 流量直连",
+    ),
+    "tailscaleBypassAndroidHint": MessageLookupByLibrary.simpleMessage(
+      "Android 上通常保持关闭。仅当本机也安装了 Tailscale 应用时再开启。",
+    ),
+    "tailscaleBypassNudge": MessageLookupByLibrary.simpleMessage(
+      "本机可能已安装 Tailscale — 建议开启“Tailscale 流量直连”，避免 Fake IP / 控制面被劫持。",
+    ),
+    "tailscaleBypassRecommended": MessageLookupByLibrary.simpleMessage(
+      "在已安装 Tailscale 应用/服务的桌面上建议开启。会自动管理直连规则与 Fake IP Filter。",
+    ),
+    "tailscaleControlUrl": MessageLookupByLibrary.simpleMessage("控制服务器地址"),
+    "tailscaleControlUrlHint": MessageLookupByLibrary.simpleMessage(
+      "可选。仅用于自建控制服务器（如 Headscale）。",
+    ),
+    "tailscaleDesc": MessageLookupByLibrary.simpleMessage("管理 Tailscale 出站节点"),
+    "tailscaleDesktopStep1": MessageLookupByLibrary.simpleMessage(
+      "如果这台电脑同时运行 Tailscale 应用/服务，请开启“保持 Tailscale 流量直连”。",
+    ),
+    "tailscaleDesktopStep2": MessageLookupByLibrary.simpleMessage(
+      "可选：用认证密钥添加一个内置 Tailscale 节点，让 FlClash 将选定流量经由 tailnet 转发。",
+    ),
+    "tailscaleDesktopStep3": MessageLookupByLibrary.simpleMessage(
+      "在“路由目标”中填写目标（家里的 IP / MagicDNS），然后打开“启用 Tailscale”。",
+    ),
+    "tailscaleDesktopStep4": MessageLookupByLibrary.simpleMessage(
+      "启动 FlClash，然后点击节点旁的测速按钮确认连接是否正常。",
+    ),
+    "tailscaleEmptyTip": MessageLookupByLibrary.simpleMessage(
+      "暂无 Tailscale 节点。添加一个即可让流量经由你的 tailnet 转发。",
+    ),
+    "tailscaleEnable": MessageLookupByLibrary.simpleMessage("启用 Tailscale"),
+    "tailscaleEnableBypassAction": MessageLookupByLibrary.simpleMessage("开启"),
+    "tailscaleEnableDesc": MessageLookupByLibrary.simpleMessage(
+      "将 Tailscale 节点作为出站注入。关闭后 Tailscale 将不再处理流量，普通流量不受影响。",
+    ),
+    "tailscaleEphemeral": MessageLookupByLibrary.simpleMessage("临时节点"),
+    "tailscaleExitNode": MessageLookupByLibrary.simpleMessage("出口节点"),
+    "tailscaleExitNodeAllowLanAccess": MessageLookupByLibrary.simpleMessage(
+      "允许通过出口节点访问局域网",
+    ),
+    "tailscaleExitNodeHint": MessageLookupByLibrary.simpleMessage(
+      "可选。tailnet 出口节点的 IP 或名称，用于转发全部流量。",
+    ),
+    "tailscaleGuideTitle": MessageLookupByLibrary.simpleMessage(
+      "Tailscale 使用说明",
+    ),
+    "tailscaleHostname": MessageLookupByLibrary.simpleMessage("主机名"),
+    "tailscaleHostnameHint": MessageLookupByLibrary.simpleMessage(
+      "可选。在 tailnet 中显示的设备名称。",
+    ),
+    "tailscaleNameExistsTip": MessageLookupByLibrary.simpleMessage("已存在同名节点"),
+    "tailscaleNameHelper": MessageLookupByLibrary.simpleMessage(
+      "代理列表中的出站名称。重命名会改变选中项与延迟测试的对应关系。",
+    ),
+    "tailscaleNoRoutes": MessageLookupByLibrary.simpleMessage("无路由目标"),
+    "tailscaleNodesTitle": MessageLookupByLibrary.simpleMessage("节点"),
+    "tailscaleNotTested": MessageLookupByLibrary.simpleMessage("未测试"),
+    "tailscaleRoutes": MessageLookupByLibrary.simpleMessage("路由目标"),
+    "tailscaleRoutesCount": m24,
+    "tailscaleRoutesHint": MessageLookupByLibrary.simpleMessage(
+      "经由该节点转发的域名或 IP，每行一个（例如你家用电脑的 Tailscale IP 或 MagicDNS 名称）。",
+    ),
+    "tailscaleScenarioAndroidBody": MessageLookupByLibrary.simpleMessage(
+      "请只保留 FlClash 作为 VPN。不要同时开启 Tailscale 应用的 VPN（Android 同一时间只允许一个）。在下方添加内置 Tailscale 节点，并把家里的设备填入“路由目标”。",
+    ),
+    "tailscaleScenarioAndroidTitle": MessageLookupByLibrary.simpleMessage(
+      "Android 客户端设置",
+    ),
+    "tailscaleScenarioDesktopBody": MessageLookupByLibrary.simpleMessage(
+      "可以同时运行 FlClash 与正式的 Tailscale 应用。请开启“保持 Tailscale 流量直连”，避免 FlClash 劫持 Tailscale 控制面或 fake-IP DNS。",
+    ),
+    "tailscaleScenarioDesktopTitle": MessageLookupByLibrary.simpleMessage(
+      "桌面 / 主机设置",
+    ),
+    "tailscaleShowSetupGuide": MessageLookupByLibrary.simpleMessage("设置指南"),
+    "tailscaleStateDir": MessageLookupByLibrary.simpleMessage("状态目录"),
+    "tailscaleStateDirHint": MessageLookupByLibrary.simpleMessage(
+      "可选。用于持久化 Tailscale 状态的目录。",
+    ),
+    "tailscaleStatusDisabled": MessageLookupByLibrary.simpleMessage(
+      "Tailscale 已关闭 — 节点不会注入到运行配置中。",
+    ),
+    "tailscaleStatusNeedRoutes": MessageLookupByLibrary.simpleMessage(
+      "已添加节点，但还没有路由目标 — 在填写路由之前流量不会自动匹配（或请手动选择该节点）。",
+    ),
+    "tailscaleStatusNeedStart": MessageLookupByLibrary.simpleMessage(
+      "节点已就绪。请先启动 FlClash VPN，再点击测速。",
+    ),
+    "tailscaleStatusNoNodes": MessageLookupByLibrary.simpleMessage(
+      "已启用，但还没有节点。请先添加一个节点。",
+    ),
+    "tailscaleStatusReady": m25,
+    "tailscaleTestNeedEnable": MessageLookupByLibrary.simpleMessage(
+      "请先打开“启用 Tailscale”再测试。",
+    ),
+    "tailscaleTestNeedStart": MessageLookupByLibrary.simpleMessage(
+      "请先启动 FlClash VPN 再测试连接。",
+    ),
+    "tailscaleTestNode": MessageLookupByLibrary.simpleMessage("测试连接"),
+    "tailscaleTestTip": MessageLookupByLibrary.simpleMessage(
+      "点击节点旁的测速按钮，检查 Tailscale 出站是否能拨号。显示延迟表示连接正常；显示超时请检查认证密钥、“启用”开关，以及 FlClash VPN 是否已启动。",
+    ),
+    "tailscaleUdp": MessageLookupByLibrary.simpleMessage("UDP 转发"),
     "tapToAuthorize": MessageLookupByLibrary.simpleMessage("点击授权"),
     "tcpConcurrent": MessageLookupByLibrary.simpleMessage("TCP并发"),
     "tcpConcurrentDesc": MessageLookupByLibrary.simpleMessage("开启后允许TCP并发"),
@@ -723,7 +861,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "upload": MessageLookupByLibrary.simpleMessage("上传"),
     "url": MessageLookupByLibrary.simpleMessage("URL"),
     "urlDesc": MessageLookupByLibrary.simpleMessage("通过URL获取配置文件"),
-    "urlTip": m24,
+    "urlTip": m26,
     "useHosts": MessageLookupByLibrary.simpleMessage("使用Hosts"),
     "useSystemHosts": MessageLookupByLibrary.simpleMessage("使用系统Hosts"),
     "userAgent": MessageLookupByLibrary.simpleMessage("用户代理"),
@@ -739,7 +877,7 @@ class MessageLookup extends MessageLookupByLibrary {
     "vpnTip": MessageLookupByLibrary.simpleMessage("重启VPN后改变生效"),
     "webDAVConfiguration": MessageLookupByLibrary.simpleMessage("WebDAV配置"),
     "whitelistMode": MessageLookupByLibrary.simpleMessage("白名单模式"),
-    "yearsAgo": m25,
+    "yearsAgo": m27,
     "zh_CN": MessageLookupByLibrary.simpleMessage("中文简体"),
   };
 }
diff --git a/lib/l10n/l10n.dart b/lib/l10n/l10n.dart
index 3b96b136b2..1b9f30df54 100644
--- a/lib/l10n/l10n.dart
+++ b/lib/l10n/l10n.dart
@@ -2429,6 +2429,26 @@ class AppLocalizations {
     return Intl.message('Crash test', name: 'crashTest', desc: '', args: []);
   }
 
+  /// `Crash detected`
+  String get crashDetected {
+    return Intl.message(
+      'Crash detected',
+      name: 'crashDetected',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `The app crashed during the previous run. To prevent repeated crashes, the current profile has been cleared and automatic configuration setup was skipped.`
+  String get crashDetectedTip {
+    return Intl.message(
+      'The app crashed during the previous run. To prevent repeated crashes, the current profile has been cleared and automatic configuration setup was skipped.',
+      name: 'crashDetectedTip',
+      desc: '',
+      args: [],
+    );
+  }
+
   /// `Clear Data`
   String get clearData {
     return Intl.message('Clear Data', name: 'clearData', desc: '', args: []);
@@ -4454,10 +4474,10 @@ class AppLocalizations {
     );
   }
 
-  /// `{name} skipped`
+  /// `{name} is already up to date`
   String geoSkipped(Object name) {
     return Intl.message(
-      '$name skipped',
+      '$name is already up to date',
       name: 'geoSkipped',
       desc: '',
       args: [name],
@@ -4493,6 +4513,591 @@ class AppLocalizations {
       args: [count],
     );
   }
+
+  /// `Features`
+  String get features {
+    return Intl.message('Features', name: 'features', desc: '', args: []);
+  }
+
+  /// `Hide advanced`
+  String get hideAdvanced {
+    return Intl.message(
+      'Hide advanced',
+      name: 'hideAdvanced',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Show advanced`
+  String get showAdvanced {
+    return Intl.message(
+      'Show advanced',
+      name: 'showAdvanced',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Tailscale`
+  String get tailscale {
+    return Intl.message('Tailscale', name: 'tailscale', desc: '', args: []);
+  }
+
+  /// `Manage Tailscale outbound nodes`
+  String get tailscaleDesc {
+    return Intl.message(
+      'Manage Tailscale outbound nodes',
+      name: 'tailscaleDesc',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Enable Tailscale`
+  String get tailscaleEnable {
+    return Intl.message(
+      'Enable Tailscale',
+      name: 'tailscaleEnable',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Inject Tailscale nodes as outbounds. Turning this off stops Tailscale from handling traffic; normal traffic is unaffected.`
+  String get tailscaleEnableDesc {
+    return Intl.message(
+      'Inject Tailscale nodes as outbounds. Turning this off stops Tailscale from handling traffic; normal traffic is unaffected.',
+      name: 'tailscaleEnableDesc',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `No Tailscale nodes yet. Add one to route traffic through your tailnet.`
+  String get tailscaleEmptyTip {
+    return Intl.message(
+      'No Tailscale nodes yet. Add one to route traffic through your tailnet.',
+      name: 'tailscaleEmptyTip',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Add Tailscale node`
+  String get addTailscaleNode {
+    return Intl.message(
+      'Add Tailscale node',
+      name: 'addTailscaleNode',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Edit Tailscale node`
+  String get editTailscaleNode {
+    return Intl.message(
+      'Edit Tailscale node',
+      name: 'editTailscaleNode',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Auth key`
+  String get tailscaleAuthKey {
+    return Intl.message(
+      'Auth key',
+      name: 'tailscaleAuthKey',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Hostname`
+  String get tailscaleHostname {
+    return Intl.message(
+      'Hostname',
+      name: 'tailscaleHostname',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Control URL`
+  String get tailscaleControlUrl {
+    return Intl.message(
+      'Control URL',
+      name: 'tailscaleControlUrl',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `State directory`
+  String get tailscaleStateDir {
+    return Intl.message(
+      'State directory',
+      name: 'tailscaleStateDir',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Ephemeral`
+  String get tailscaleEphemeral {
+    return Intl.message(
+      'Ephemeral',
+      name: 'tailscaleEphemeral',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `UDP relay`
+  String get tailscaleUdp {
+    return Intl.message('UDP relay', name: 'tailscaleUdp', desc: '', args: []);
+  }
+
+  /// `Accept routes`
+  String get tailscaleAcceptRoutes {
+    return Intl.message(
+      'Accept routes',
+      name: 'tailscaleAcceptRoutes',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Exit node`
+  String get tailscaleExitNode {
+    return Intl.message(
+      'Exit node',
+      name: 'tailscaleExitNode',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Allow LAN access via exit node`
+  String get tailscaleExitNodeAllowLanAccess {
+    return Intl.message(
+      'Allow LAN access via exit node',
+      name: 'tailscaleExitNodeAllowLanAccess',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `A node with this name already exists`
+  String get tailscaleNameExistsTip {
+    return Intl.message(
+      'A node with this name already exists',
+      name: 'tailscaleNameExistsTip',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `How Tailscale works`
+  String get tailscaleGuideTitle {
+    return Intl.message(
+      'How Tailscale works',
+      name: 'tailscaleGuideTitle',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `From the Tailscale admin console → Settings → Keys. Required to authenticate the node.`
+  String get tailscaleAuthKeyHint {
+    return Intl.message(
+      'From the Tailscale admin console → Settings → Keys. Required to authenticate the node.',
+      name: 'tailscaleAuthKeyHint',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Optional. Device name shown in your tailnet.`
+  String get tailscaleHostnameHint {
+    return Intl.message(
+      'Optional. Device name shown in your tailnet.',
+      name: 'tailscaleHostnameHint',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Optional. Only for self-hosted control servers such as Headscale.`
+  String get tailscaleControlUrlHint {
+    return Intl.message(
+      'Optional. Only for self-hosted control servers such as Headscale.',
+      name: 'tailscaleControlUrlHint',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Optional. Directory used to persist Tailscale state.`
+  String get tailscaleStateDirHint {
+    return Intl.message(
+      'Optional. Directory used to persist Tailscale state.',
+      name: 'tailscaleStateDirHint',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Optional. IP or name of a tailnet exit node to route all traffic through.`
+  String get tailscaleExitNodeHint {
+    return Intl.message(
+      'Optional. IP or name of a tailnet exit node to route all traffic through.',
+      name: 'tailscaleExitNodeHint',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Keep Tailscale traffic direct`
+  String get tailscaleBypass {
+    return Intl.message(
+      'Keep Tailscale traffic direct',
+      name: 'tailscaleBypass',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Route destinations`
+  String get tailscaleRoutes {
+    return Intl.message(
+      'Route destinations',
+      name: 'tailscaleRoutes',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Domains or IPs sent through this node, one per line (e.g. your home PC's Tailscale IP or MagicDNS name).`
+  String get tailscaleRoutesHint {
+    return Intl.message(
+      'Domains or IPs sent through this node, one per line (e.g. your home PC\'s Tailscale IP or MagicDNS name).',
+      name: 'tailscaleRoutesHint',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Android client setup`
+  String get tailscaleScenarioAndroidTitle {
+    return Intl.message(
+      'Android client setup',
+      name: 'tailscaleScenarioAndroidTitle',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Keep FlClash as the only VPN. Do not run the Tailscale app VPN at the same time (Android allows only one). Use an embedded Tailscale node below, then add your home device to Route destinations.`
+  String get tailscaleScenarioAndroidBody {
+    return Intl.message(
+      'Keep FlClash as the only VPN. Do not run the Tailscale app VPN at the same time (Android allows only one). Use an embedded Tailscale node below, then add your home device to Route destinations.',
+      name: 'tailscaleScenarioAndroidBody',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Desktop / host setup`
+  String get tailscaleScenarioDesktopTitle {
+    return Intl.message(
+      'Desktop / host setup',
+      name: 'tailscaleScenarioDesktopTitle',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `You can run FlClash and the real Tailscale app together. Turn on "Keep Tailscale traffic direct" so FlClash does not hijack Tailscale's control plane or fake-IP DNS.`
+  String get tailscaleScenarioDesktopBody {
+    return Intl.message(
+      'You can run FlClash and the real Tailscale app together. Turn on "Keep Tailscale traffic direct" so FlClash does not hijack Tailscale\'s control plane or fake-IP DNS.',
+      name: 'tailscaleScenarioDesktopBody',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Get an auth key from the Tailscale admin console (Settings → Keys).`
+  String get tailscaleAndroidStep1 {
+    return Intl.message(
+      'Get an auth key from the Tailscale admin console (Settings → Keys).',
+      name: 'tailscaleAndroidStep1',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Add a node, paste the auth key, and put your home device IP or MagicDNS name in Route destinations.`
+  String get tailscaleAndroidStep2 {
+    return Intl.message(
+      'Add a node, paste the auth key, and put your home device IP or MagicDNS name in Route destinations.',
+      name: 'tailscaleAndroidStep2',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Turn on Enable Tailscale. Leave "Keep Tailscale traffic direct" off unless the Tailscale app is also installed.`
+  String get tailscaleAndroidStep3 {
+    return Intl.message(
+      'Turn on Enable Tailscale. Leave "Keep Tailscale traffic direct" off unless the Tailscale app is also installed.',
+      name: 'tailscaleAndroidStep3',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Start FlClash VPN, then tap the ping button on a node to verify the connection.`
+  String get tailscaleAndroidStep4 {
+    return Intl.message(
+      'Start FlClash VPN, then tap the ping button on a node to verify the connection.',
+      name: 'tailscaleAndroidStep4',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `If this PC also runs the Tailscale app/service, turn on "Keep Tailscale traffic direct".`
+  String get tailscaleDesktopStep1 {
+    return Intl.message(
+      'If this PC also runs the Tailscale app/service, turn on "Keep Tailscale traffic direct".',
+      name: 'tailscaleDesktopStep1',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Optional: add an embedded Tailscale node with an auth key to route selected traffic through the tailnet from FlClash.`
+  String get tailscaleDesktopStep2 {
+    return Intl.message(
+      'Optional: add an embedded Tailscale node with an auth key to route selected traffic through the tailnet from FlClash.',
+      name: 'tailscaleDesktopStep2',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Put destinations (home IPs / MagicDNS) in Route destinations, then turn on Enable Tailscale.`
+  String get tailscaleDesktopStep3 {
+    return Intl.message(
+      'Put destinations (home IPs / MagicDNS) in Route destinations, then turn on Enable Tailscale.',
+      name: 'tailscaleDesktopStep3',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Start FlClash, then tap the ping button on a node to verify the connection is solid.`
+  String get tailscaleDesktopStep4 {
+    return Intl.message(
+      'Start FlClash, then tap the ping button on a node to verify the connection is solid.',
+      name: 'tailscaleDesktopStep4',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Recommended on desktop when the Tailscale app/service is installed. Auto-manages DIRECT rules and Fake IP Filter.`
+  String get tailscaleBypassRecommended {
+    return Intl.message(
+      'Recommended on desktop when the Tailscale app/service is installed. Auto-manages DIRECT rules and Fake IP Filter.',
+      name: 'tailscaleBypassRecommended',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Usually leave this off on Android. Turn on only if the Tailscale app is also installed on this phone.`
+  String get tailscaleBypassAndroidHint {
+    return Intl.message(
+      'Usually leave this off on Android. Turn on only if the Tailscale app is also installed on this phone.',
+      name: 'tailscaleBypassAndroidHint',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Tailscale is off — nodes are not injected into the running profile.`
+  String get tailscaleStatusDisabled {
+    return Intl.message(
+      'Tailscale is off — nodes are not injected into the running profile.',
+      name: 'tailscaleStatusDisabled',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Enabled, but no nodes yet. Add a node to get started.`
+  String get tailscaleStatusNoNodes {
+    return Intl.message(
+      'Enabled, but no nodes yet. Add a node to get started.',
+      name: 'tailscaleStatusNoNodes',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Nodes are ready. Start FlClash VPN, then tap ping to test.`
+  String get tailscaleStatusNeedStart {
+    return Intl.message(
+      'Nodes are ready. Start FlClash VPN, then tap ping to test.',
+      name: 'tailscaleStatusNeedStart',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `{count} node(s) active. Tap ping on a node to test connectivity.`
+  String tailscaleStatusReady(Object count) {
+    return Intl.message(
+      '$count node(s) active. Tap ping on a node to test connectivity.',
+      name: 'tailscaleStatusReady',
+      desc: '',
+      args: [count],
+    );
+  }
+
+  /// `Nodes are added, but no route destinations yet — traffic will not match until you add routes (or pick the node manually).`
+  String get tailscaleStatusNeedRoutes {
+    return Intl.message(
+      'Nodes are added, but no route destinations yet — traffic will not match until you add routes (or pick the node manually).',
+      name: 'tailscaleStatusNeedRoutes',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `This device likely runs Tailscale already — turn on “Keep Tailscale traffic direct” to avoid fake-IP / control-plane breakage.`
+  String get tailscaleBypassNudge {
+    return Intl.message(
+      'This device likely runs Tailscale already — turn on “Keep Tailscale traffic direct” to avoid fake-IP / control-plane breakage.',
+      name: 'tailscaleBypassNudge',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Setup guide`
+  String get tailscaleShowSetupGuide {
+    return Intl.message(
+      'Setup guide',
+      name: 'tailscaleShowSetupGuide',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Enable`
+  String get tailscaleEnableBypassAction {
+    return Intl.message(
+      'Enable',
+      name: 'tailscaleEnableBypassAction',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Outbound name used in Proxies. Renaming changes how selections and delay tests key this node.`
+  String get tailscaleNameHelper {
+    return Intl.message(
+      'Outbound name used in Proxies. Renaming changes how selections and delay tests key this node.',
+      name: 'tailscaleNameHelper',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Turn on Enable Tailscale before testing.`
+  String get tailscaleTestNeedEnable {
+    return Intl.message(
+      'Turn on Enable Tailscale before testing.',
+      name: 'tailscaleTestNeedEnable',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Start FlClash VPN before testing the connection.`
+  String get tailscaleTestNeedStart {
+    return Intl.message(
+      'Start FlClash VPN before testing the connection.',
+      name: 'tailscaleTestNeedStart',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Test connection`
+  String get tailscaleTestNode {
+    return Intl.message(
+      'Test connection',
+      name: 'tailscaleTestNode',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Not tested`
+  String get tailscaleNotTested {
+    return Intl.message(
+      'Not tested',
+      name: 'tailscaleNotTested',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `No route destinations`
+  String get tailscaleNoRoutes {
+    return Intl.message(
+      'No route destinations',
+      name: 'tailscaleNoRoutes',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `{count} route(s)`
+  String tailscaleRoutesCount(Object count) {
+    return Intl.message(
+      '$count route(s)',
+      name: 'tailscaleRoutesCount',
+      desc: '',
+      args: [count],
+    );
+  }
+
+  /// `Nodes`
+  String get tailscaleNodesTitle {
+    return Intl.message(
+      'Nodes',
+      name: 'tailscaleNodesTitle',
+      desc: '',
+      args: [],
+    );
+  }
+
+  /// `Use the ping button next to a node to check whether the Tailscale outbound can dial out. A latency value means the connection is working; Timeout means check the auth key, Enable switch, and that FlClash VPN is started.`
+  String get tailscaleTestTip {
+    return Intl.message(
+      'Use the ping button next to a node to check whether the Tailscale outbound can dial out. A latency value means the connection is working; Timeout means check the auth key, Enable switch, and that FlClash VPN is started.',
+      name: 'tailscaleTestTip',
+      desc: '',
+      args: [],
+    );
+  }
 }
 
 class AppLocalizationDelegate extends LocalizationsDelegate<AppLocalizations> {
diff --git a/lib/manager/android_manager.dart b/lib/manager/android_manager.dart
index bba334a88a..240239d87a 100644
--- a/lib/manager/android_manager.dart
+++ b/lib/manager/android_manager.dart
@@ -53,14 +53,6 @@ class _AndroidContainerState extends ConsumerState<AndroidManager>
     super.onServiceEvent(event);
   }
 
-  @override
-  void onServiceCrash(String message) {
-    coreEventManager.sendEvent(
-      CoreEvent(type: CoreEventType.crash, data: message),
-    );
-    super.onServiceCrash(message);
-  }
-
   @override
   Widget build(BuildContext context) {
     return widget.child;
diff --git a/lib/manager/app_manager.dart b/lib/manager/app_manager.dart
index 6f8377c6d3..093824af06 100644
--- a/lib/manager/app_manager.dart
+++ b/lib/manager/app_manager.dart
@@ -6,6 +6,7 @@ import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/manager/window_manager.dart';
 import 'package:fl_clash/providers/providers.dart';
 import 'package:fl_clash/state.dart';
+import 'package:fl_clash/widgets/animated_visibility.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
@@ -87,9 +88,6 @@ class _AppStateManagerState extends ConsumerState<AppStateManager>
       WidgetsBinding.instance.addPostFrameCallback((_) {
         final ref = globalState.container;
         ref.read(setupActionProvider.notifier).tryCheckIp();
-        if (system.isAndroid) {
-          ref.read(coreActionProvider.notifier).tryStartCore();
-        }
       });
     }
   }
@@ -128,7 +126,7 @@ class AppEnvManager extends StatelessWidget {
     }
     if (globalState.isPre) {
       return Banner(
-        message: 'PRE',
+        message: globalState.appEnv.toUpperCase(),
         location: BannerLocation.topEnd,
         child: child,
       );
@@ -193,98 +191,105 @@ class AppSidebarContainer extends ConsumerWidget {
     final navigationState = ref.watch(navigationStateProvider);
     final navigationItems = navigationState.navigationItems;
     final isMobileView = navigationState.viewMode == ViewMode.mobile;
-    if (isMobileView) {
-      return child;
-    }
     final currentIndex = navigationState.currentIndex;
     final showLabel = ref.watch(appSettingProvider).showLabel;
-    return Row(
-      children: [
-        _buildBackground(
-          context: context,
-          child: SafeArea(
-            child: Column(
-              crossAxisAlignment: CrossAxisAlignment.center,
-              children: [
-                if (system.isMacOS) const SizedBox(height: 22),
-                const SizedBox(height: 10),
-                if (!system.isMacOS) ...[
-                  const ClipRect(child: AppIcon()),
-                  const SizedBox(height: 12),
-                ],
-                Expanded(
-                  child: ScrollConfiguration(
-                    behavior: HiddenBarScrollBehavior(),
-                    child: Column(
-                      crossAxisAlignment: CrossAxisAlignment.start,
-                      children: [
-                        Expanded(
-                          child: NavigationRail(
-                            scrollable: true,
-                            minExtendedWidth: 200,
-                            backgroundColor: Colors.transparent,
-                            selectedLabelTextStyle: context
-                                .textTheme
-                                .labelLarge!
-                                .copyWith(color: context.colorScheme.onSurface),
-                            unselectedLabelTextStyle: context
-                                .textTheme
-                                .labelLarge!
-                                .copyWith(color: context.colorScheme.onSurface),
-                            destinations: navigationItems
-                                .map(
-                                  (e) => NavigationRailDestination(
-                                    icon: e.icon,
-                                    label: Text(Intl.message(e.label.name)),
-                                  ),
-                                )
-                                .toList(),
-                            onDestinationSelected: (index) {
-                              _handleToPage(navigationItems[index].label);
-                            },
-                            extended: false,
-                            selectedIndex: currentIndex,
-                            labelType: showLabel
-                                ? NavigationRailLabelType.all
-                                : NavigationRailLabelType.none,
-                          ),
+    return Container(
+      color: context.colorScheme.surfaceContainer,
+      child: Row(
+        children: [
+          AnimatedVisibility.sidebar(
+            visible: !isMobileView,
+            child: _buildBackground(
+              context: context,
+              child: SafeArea(
+                child: Column(
+                  crossAxisAlignment: CrossAxisAlignment.center,
+                  children: [
+                    if (system.isMacOS) const SizedBox(height: 22),
+                    const SizedBox(height: 10),
+                    if (!system.isMacOS) ...[
+                      const ClipRect(child: AppIcon()),
+                      const SizedBox(height: 12),
+                    ],
+                    Expanded(
+                      child: ScrollConfiguration(
+                        behavior: HiddenBarScrollBehavior(),
+                        child: Column(
+                          crossAxisAlignment: CrossAxisAlignment.start,
+                          children: [
+                            Expanded(
+                              child: NavigationRail(
+                                scrollable: true,
+                                minExtendedWidth: 200,
+                                backgroundColor: Colors.transparent,
+                                selectedLabelTextStyle: context
+                                    .textTheme
+                                    .labelLarge!
+                                    .copyWith(
+                                      color: context.colorScheme.onSurface,
+                                    ),
+                                unselectedLabelTextStyle: context
+                                    .textTheme
+                                    .labelLarge!
+                                    .copyWith(
+                                      color: context.colorScheme.onSurface,
+                                    ),
+                                destinations: navigationItems
+                                    .map(
+                                      (e) => NavigationRailDestination(
+                                        icon: e.icon,
+                                        label: Text(Intl.message(e.label.name)),
+                                      ),
+                                    )
+                                    .toList(),
+                                onDestinationSelected: (index) {
+                                  _handleToPage(navigationItems[index].label);
+                                },
+                                extended: false,
+                                selectedIndex: currentIndex,
+                                labelType: showLabel
+                                    ? NavigationRailLabelType.all
+                                    : NavigationRailLabelType.none,
+                              ),
+                            ),
+                          ],
                         ),
-                      ],
+                      ),
                     ),
-                  ),
-                ),
-                const SizedBox(height: 16),
-                IconButton(
-                  onPressed: () {
-                    ref
-                        .read(appSettingProvider.notifier)
-                        .update(
-                          (state) =>
-                              state.copyWith(showLabel: !state.showLabel),
-                        );
-                  },
-                  icon: Icon(
-                    Icons.menu,
-                    color: context.colorScheme.onSurfaceVariant,
-                  ),
+                    const SizedBox(height: 16),
+                    IconButton(
+                      onPressed: () {
+                        ref
+                            .read(appSettingProvider.notifier)
+                            .update(
+                              (state) =>
+                                  state.copyWith(showLabel: !state.showLabel),
+                            );
+                      },
+                      icon: Icon(
+                        Icons.menu,
+                        color: context.colorScheme.onSurfaceVariant,
+                      ),
+                    ),
+                    const SizedBox(height: 16),
+                  ],
                 ),
-                const SizedBox(height: 16),
-              ],
+              ),
             ),
           ),
-        ),
-        Expanded(
-          flex: 1,
-          child: ClipRect(
-            child: LayoutBuilder(
-              builder: (_, constraints) {
-                _updateSideBarWidth(ref, constraints.maxWidth);
-                return child;
-              },
+          Expanded(
+            flex: 1,
+            child: ClipRect(
+              child: LayoutBuilder(
+                builder: (_, constraints) {
+                  _updateSideBarWidth(ref, constraints.maxWidth);
+                  return child;
+                },
+              ),
             ),
           ),
-        ),
-      ],
+        ],
+      ),
     );
   }
 }
diff --git a/lib/manager/core_manager.dart b/lib/manager/core_manager.dart
index 0ae0927a71..1879f767a6 100644
--- a/lib/manager/core_manager.dart
+++ b/lib/manager/core_manager.dart
@@ -14,8 +14,10 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 class CoreManager extends ConsumerStatefulWidget {
   final Widget child;
+  final CoreController controller;
 
-  const CoreManager({super.key, required this.child});
+  CoreManager({super.key, required this.child, CoreController? controller})
+    : controller = controller ?? coreController;
 
   @override
   ConsumerState<CoreManager> createState() => _CoreContainerState();
@@ -49,15 +51,15 @@ class _CoreContainerState extends ConsumerState<CoreManager>
       next,
     ) {
       if (next) {
-        coreController.startLog();
+        widget.controller.startLog();
       } else {
-        coreController.stopLog();
+        widget.controller.stopLog();
       }
     }, fireImmediately: true);
   }
 
   @override
-  Future<void> dispose() async {
+  void dispose() {
     coreEventManager.removeListener(this);
     super.dispose();
   }
@@ -92,7 +94,7 @@ class _CoreContainerState extends ConsumerState<CoreManager>
     final ref = globalState.container;
     ref
         .read(providersProvider.notifier)
-        .setProvider(await coreController.getExternalProvider(providerName));
+        .setProvider(await widget.controller.getExternalProvider(providerName));
     debouncer.call(FunctionTag.loadedProvider, () async {
       ref.read(proxiesActionProvider.notifier).updateGroupsDebounce();
     }, duration: const Duration(milliseconds: 5000));
@@ -108,7 +110,6 @@ class _CoreContainerState extends ConsumerState<CoreManager>
     if (WidgetsBinding.instance.lifecycleState == AppLifecycleState.resumed) {
       context.showNotifier(message);
     }
-    await coreController.shutdown(false);
     super.onCrash(message);
   }
 
diff --git a/lib/manager/hotkey_manager.dart b/lib/manager/hotkey_manager.dart
index f70f0e531f..661cf90887 100644
--- a/lib/manager/hotkey_manager.dart
+++ b/lib/manager/hotkey_manager.dart
@@ -37,7 +37,7 @@ class _HotKeyManagerState extends ConsumerState<HotKeyManager> {
       case HotAction.mode:
         commonAction.updateMode();
       case HotAction.start:
-        commonAction.updateStart();
+        commonAction.toggleRunning();
       case HotAction.view:
         systemAction.updateVisible();
       case HotAction.proxy:
diff --git a/lib/manager/tile_manager.dart b/lib/manager/tile_manager.dart
index 29248741a1..d0d0a6fdca 100644
--- a/lib/manager/tile_manager.dart
+++ b/lib/manager/tile_manager.dart
@@ -1,5 +1,5 @@
 import 'package:fl_clash/common/app_localizations.dart';
-import 'package:fl_clash/core/controller.dart';
+import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/plugins/app.dart';
 import 'package:fl_clash/plugins/tile.dart';
 import 'package:fl_clash/providers/providers.dart';
@@ -25,10 +25,10 @@ class _TileContainerState extends ConsumerState<TileManager> with TileListener {
 
   @override
   Future<void> onStart() async {
-    if (isStart && coreController.isCompleted) {
+    if (isStart && ref.read(coreStatusProvider) == CoreStatus.connected) {
       return;
     }
-    ref.read(setupActionProvider.notifier).updateStatus(true);
+    ref.read(setupActionProvider.notifier).setRunning(true);
     app?.tip(currentAppLocalizations.startVpn);
     super.onStart();
   }
@@ -38,7 +38,7 @@ class _TileContainerState extends ConsumerState<TileManager> with TileListener {
     if (!isStart) {
       return;
     }
-    ref.read(setupActionProvider.notifier).updateStatus(false);
+    ref.read(setupActionProvider.notifier).setRunning(false);
     app?.tip(currentAppLocalizations.stopVpn);
     super.onStop();
   }
diff --git a/lib/manager/vpn_manager.dart b/lib/manager/vpn_manager.dart
index 4beec0b777..3c3d58aaf2 100644
--- a/lib/manager/vpn_manager.dart
+++ b/lib/manager/vpn_manager.dart
@@ -40,8 +40,8 @@ class _VpnContainerState extends ConsumerState<VpnManager> {
             actionText: currentAppLocalizations.restart,
             action: () async {
               final setupAction = ref.read(setupActionProvider.notifier);
-              await setupAction.handleStop();
-              await setupAction.updateStatus(true);
+              await setupAction.setRunning(false);
+              await setupAction.setRunning(true);
             },
           ),
         );
diff --git a/lib/models/app.dart b/lib/models/app.dart
index 6ea055a311..a10f83d157 100644
--- a/lib/models/app.dart
+++ b/lib/models/app.dart
@@ -10,7 +10,7 @@ part 'generated/app.freezed.dart';
 
 typedef DelayMap = Map<String, Map<String, int?>>;
 
-@freezed
+@Freezed(toStringOverride: false)
 abstract class AppState with _$AppState {
   const factory AppState({
     @Default(false) bool isInit,
@@ -32,7 +32,8 @@ abstract class AppState with _$AppState {
     required FixedList<Log> logs,
     required FixedList<Traffic> traffics,
     required Traffic totalTraffic,
-    @Default(false) bool realTunEnable,
+    @Default(TunAuthorizationState.none)
+    TunAuthorizationState authorizedTunEnable,
     @Default(false) bool loading,
     required SystemUiOverlayStyle systemUiOverlayStyle,
     @Default(CoreStatus.connecting) CoreStatus coreStatus,
diff --git a/lib/models/clash_config.dart b/lib/models/clash_config.dart
index 19fe746e14..4ee4a8654a 100644
--- a/lib/models/clash_config.dart
+++ b/lib/models/clash_config.dart
@@ -518,7 +518,7 @@ abstract class ClashConfig with _$ClashConfig {
 
 extension GeoResourceUrlMapExt on Map<GeoResource, String> {
   Map<String, String> get raw =>
-      map((key, value) => MapEntry(key.value, value));
+      map((key, value) => MapEntry(key.configKey, value));
 }
 
 Map<GeoResource, String> _geoXUrlFromJson(Map<String, Object?>? json) {
diff --git a/lib/models/common.dart b/lib/models/common.dart
index aa88a7ff51..e5946161c2 100644
--- a/lib/models/common.dart
+++ b/lib/models/common.dart
@@ -1,4 +1,6 @@
+import 'dart:convert';
 import 'dart:io';
+import 'dart:math';
 
 import 'package:collection/collection.dart';
 import 'package:fl_clash/common/common.dart';
@@ -218,29 +220,138 @@ extension TrackerInfosStateExt on TrackerInfosState {
 }
 
 const defaultDavFileName = 'backup.zip';
+const _davPasswordFormatVersion = 'v1';
+const _davPasswordNonceLength = 16;
+const _davPasswordObfuscationMask = <int>[
+  0x9d,
+  0x42,
+  0xe7,
+  0x1b,
+  0x68,
+  0xb4,
+  0x35,
+  0xca,
+  0x7f,
+  0x20,
+  0xd1,
+  0x56,
+  0x83,
+  0xfa,
+  0x0c,
+  0xa9,
+];
+
+// This only prevents accidental plain-text disclosure. It is deliberately not
+// a security boundary against reverse engineering or same-user access.
+String _encodeDavPassword(String password) {
+  if (password.isEmpty) {
+    return '';
+  }
+  final random = Random.secure();
+  final nonce = List<int>.generate(
+    _davPasswordNonceLength,
+    (_) => random.nextInt(256),
+    growable: false,
+  );
+  final passwordBytes = utf8.encode(password);
+  final obfuscated = List<int>.generate(
+    passwordBytes.length,
+    (index) =>
+        passwordBytes[index] ^
+        nonce[index % nonce.length] ^
+        _davPasswordObfuscationMask[index % _davPasswordObfuscationMask.length],
+    growable: false,
+  );
+  return [
+    _davPasswordFormatVersion,
+    base64UrlEncode(nonce),
+    base64UrlEncode(obfuscated),
+  ].join('.');
+}
+
+String _decodeDavPassword(String? value) {
+  if (value == null || value.isEmpty) {
+    return '';
+  }
+  final parts = value.split('.');
+  if (parts.length != 3 || parts[0] != _davPasswordFormatVersion) {
+    return value;
+  }
+  try {
+    final nonce = base64Url.decode(parts[1]);
+    final obfuscated = base64Url.decode(parts[2]);
+    if (nonce.length != _davPasswordNonceLength) {
+      return '';
+    }
+    final passwordBytes = List<int>.generate(
+      obfuscated.length,
+      (index) =>
+          obfuscated[index] ^
+          nonce[index % nonce.length] ^
+          _davPasswordObfuscationMask[index %
+              _davPasswordObfuscationMask.length],
+      growable: false,
+    );
+    return utf8.decode(passwordBytes);
+  } on FormatException {
+    return '';
+  }
+}
 
-@freezed
+@Freezed(toStringOverride: false)
 abstract class DAVProps with _$DAVProps {
+  const DAVProps._();
+
   const factory DAVProps({
     required String uri,
     required String user,
-    required String password,
+    @JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword)
+    @Default('')
+    String password,
     @Default(defaultDavFileName) String fileName,
   }) = _DAVProps;
 
   factory DAVProps.fromJson(Map<String, Object?> json) =>
       _$DAVPropsFromJson(json);
+
+  @override
+  String toString() =>
+      'DAVProps(uri: $uri, user: $user, password: ***, fileName: $fileName)';
 }
 
 @freezed
 abstract class FileInfo with _$FileInfo {
-  const factory FileInfo({required int size, required DateTime lastModified}) =
+  const factory FileInfo({required int size, DateTime? lastModified}) =
       _FileInfo;
 }
 
+extension FileInfoFileExt on File {
+  Future<FileInfo?> getFileInfo() async {
+    if (!await exists()) {
+      return null;
+    }
+    final size = await length();
+    final lastModified = await _getValidLastModified();
+    return FileInfo(size: size, lastModified: lastModified);
+  }
+
+  Future<DateTime?> _getValidLastModified() async {
+    try {
+      final value = await lastModified();
+      return value.year > 1970 ? value : null;
+    } on FileSystemException {
+      return null;
+    }
+  }
+}
+
 extension FileInfoExt on FileInfo {
-  String getDesc(BuildContext context) =>
-      '${size.traffic.show}  ·  ${lastModified.getLastUpdateTimeDesc(context)}';
+  String getDesc(BuildContext context) {
+    final lastModifiedDesc =
+        lastModified?.getLastUpdateTimeDesc(context) ??
+        context.appLocalizations.unknown;
+    return '${size.traffic.show}  ·  $lastModifiedDesc';
+  }
 }
 
 @freezed
diff --git a/lib/models/config.dart b/lib/models/config.dart
index a71ee4e6bf..10b643e6af 100644
--- a/lib/models/config.dart
+++ b/lib/models/config.dart
@@ -246,6 +246,9 @@ abstract class Config with _$Config {
     @Default(defaultWindowProps) WindowProps windowProps,
     @Default(defaultClashConfig) PatchClashConfig patchClashConfig,
     @Default([]) List<String> excludeSSIDs,
+    @JsonKey(fromJson: TailscaleProps.safeFromJson)
+    @Default(defaultTailscaleProps)
+    TailscaleProps tailscaleProps,
   }) = _Config;
 
   factory Config.fromJson(Map<String, Object?> json) => _$ConfigFromJson(json);
diff --git a/lib/models/core.dart b/lib/models/core.dart
index 7cd12576c7..3c4788ed1b 100644
--- a/lib/models/core.dart
+++ b/lib/models/core.dart
@@ -168,17 +168,6 @@ extension ExternalProviderExt on ExternalProvider {
   String get updatingKey => 'provider_$name';
 }
 
-@freezed
-abstract class Action with _$Action {
-  const factory Action({
-    required ActionMethod method,
-    required dynamic data,
-    required String id,
-  }) = _Action;
-
-  factory Action.fromJson(Map<String, Object?> json) => _$ActionFromJson(json);
-}
-
 @freezed
 abstract class ProxiesData with _$ProxiesData {
   const factory ProxiesData({
@@ -189,26 +178,3 @@ abstract class ProxiesData with _$ProxiesData {
   factory ProxiesData.fromJson(Map<String, Object?> json) =>
       _$ProxiesDataFromJson(json);
 }
-
-@freezed
-abstract class ActionResult with _$ActionResult {
-  const factory ActionResult({
-    required ActionMethod method,
-    required dynamic data,
-    String? id,
-    @Default(ResultType.success) ResultType code,
-  }) = _ActionResult;
-
-  factory ActionResult.fromJson(Map<String, Object?> json) =>
-      _$ActionResultFromJson(json);
-}
-
-extension ActionResultExt on ActionResult {
-  Result get toResult {
-    if (code == ResultType.success) {
-      return Result.success(data);
-    } else {
-      return Result.error('$data');
-    }
-  }
-}
diff --git a/lib/models/generated/app.freezed.dart b/lib/models/generated/app.freezed.dart
index 4e11773fbf..5e822ae33e 100644
--- a/lib/models/generated/app.freezed.dart
+++ b/lib/models/generated/app.freezed.dart
@@ -14,7 +14,7 @@ T _$identity<T>(T value) => value;
 /// @nodoc
 mixin _$AppState {
 
- bool get isInit; bool get backBlock; PageLabel get pageLabel; List<Package> get packages; int get sortNum; Size get viewSize; double get sideWidth; DelayMap get delayMap; List<Group> get groups; int get checkIpNum; Brightness get brightness; int? get runTime; List<ExternalProvider> get providers; String? get localIp; FixedList<TrackerInfo> get requests; int get version; FixedList<Log> get logs; FixedList<Traffic> get traffics; Traffic get totalTraffic; bool get realTunEnable; bool get loading; SystemUiOverlayStyle get systemUiOverlayStyle; CoreStatus get coreStatus;
+ bool get isInit; bool get backBlock; PageLabel get pageLabel; List<Package> get packages; int get sortNum; Size get viewSize; double get sideWidth; DelayMap get delayMap; List<Group> get groups; int get checkIpNum; Brightness get brightness; int? get runTime; List<ExternalProvider> get providers; String? get localIp; FixedList<TrackerInfo> get requests; int get version; FixedList<Log> get logs; FixedList<Traffic> get traffics; Traffic get totalTraffic; TunAuthorizationState get authorizedTunEnable; bool get loading; SystemUiOverlayStyle get systemUiOverlayStyle; CoreStatus get coreStatus;
 /// Create a copy of AppState
 /// with the given fields replaced by the non-null parameter values.
 @JsonKey(includeFromJson: false, includeToJson: false)
@@ -25,17 +25,13 @@ $AppStateCopyWith<AppState> get copyWith => _$AppStateCopyWithImpl<AppState>(thi
 
 @override
 bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is AppState&&(identical(other.isInit, isInit) || other.isInit == isInit)&&(identical(other.backBlock, backBlock) || other.backBlock == backBlock)&&(identical(other.pageLabel, pageLabel) || other.pageLabel == pageLabel)&&const DeepCollectionEquality().equals(other.packages, packages)&&(identical(other.sortNum, sortNum) || other.sortNum == sortNum)&&(identical(other.viewSize, viewSize) || other.viewSize == viewSize)&&(identical(other.sideWidth, sideWidth) || other.sideWidth == sideWidth)&&const DeepCollectionEquality().equals(other.delayMap, delayMap)&&const DeepCollectionEquality().equals(other.groups, groups)&&(identical(other.checkIpNum, checkIpNum) || other.checkIpNum == checkIpNum)&&(identical(other.brightness, brightness) || other.brightness == brightness)&&(identical(other.runTime, runTime) || other.runTime == runTime)&&const DeepCollectionEquality().equals(other.providers, providers)&&(identical(other.localIp, localIp) || other.localIp == localIp)&&(identical(other.requests, requests) || other.requests == requests)&&(identical(other.version, version) || other.version == version)&&(identical(other.logs, logs) || other.logs == logs)&&(identical(other.traffics, traffics) || other.traffics == traffics)&&(identical(other.totalTraffic, totalTraffic) || other.totalTraffic == totalTraffic)&&(identical(other.realTunEnable, realTunEnable) || other.realTunEnable == realTunEnable)&&(identical(other.loading, loading) || other.loading == loading)&&(identical(other.systemUiOverlayStyle, systemUiOverlayStyle) || other.systemUiOverlayStyle == systemUiOverlayStyle)&&(identical(other.coreStatus, coreStatus) || other.coreStatus == coreStatus));
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is AppState&&(identical(other.isInit, isInit) || other.isInit == isInit)&&(identical(other.backBlock, backBlock) || other.backBlock == backBlock)&&(identical(other.pageLabel, pageLabel) || other.pageLabel == pageLabel)&&const DeepCollectionEquality().equals(other.packages, packages)&&(identical(other.sortNum, sortNum) || other.sortNum == sortNum)&&(identical(other.viewSize, viewSize) || other.viewSize == viewSize)&&(identical(other.sideWidth, sideWidth) || other.sideWidth == sideWidth)&&const DeepCollectionEquality().equals(other.delayMap, delayMap)&&const DeepCollectionEquality().equals(other.groups, groups)&&(identical(other.checkIpNum, checkIpNum) || other.checkIpNum == checkIpNum)&&(identical(other.brightness, brightness) || other.brightness == brightness)&&(identical(other.runTime, runTime) || other.runTime == runTime)&&const DeepCollectionEquality().equals(other.providers, providers)&&(identical(other.localIp, localIp) || other.localIp == localIp)&&(identical(other.requests, requests) || other.requests == requests)&&(identical(other.version, version) || other.version == version)&&(identical(other.logs, logs) || other.logs == logs)&&(identical(other.traffics, traffics) || other.traffics == traffics)&&(identical(other.totalTraffic, totalTraffic) || other.totalTraffic == totalTraffic)&&(identical(other.authorizedTunEnable, authorizedTunEnable) || other.authorizedTunEnable == authorizedTunEnable)&&(identical(other.loading, loading) || other.loading == loading)&&(identical(other.systemUiOverlayStyle, systemUiOverlayStyle) || other.systemUiOverlayStyle == systemUiOverlayStyle)&&(identical(other.coreStatus, coreStatus) || other.coreStatus == coreStatus));
 }
 
 
 @override
-int get hashCode => Object.hashAll([runtimeType,isInit,backBlock,pageLabel,const DeepCollectionEquality().hash(packages),sortNum,viewSize,sideWidth,const DeepCollectionEquality().hash(delayMap),const DeepCollectionEquality().hash(groups),checkIpNum,brightness,runTime,const DeepCollectionEquality().hash(providers),localIp,requests,version,logs,traffics,totalTraffic,realTunEnable,loading,systemUiOverlayStyle,coreStatus]);
+int get hashCode => Object.hashAll([runtimeType,isInit,backBlock,pageLabel,const DeepCollectionEquality().hash(packages),sortNum,viewSize,sideWidth,const DeepCollectionEquality().hash(delayMap),const DeepCollectionEquality().hash(groups),checkIpNum,brightness,runTime,const DeepCollectionEquality().hash(providers),localIp,requests,version,logs,traffics,totalTraffic,authorizedTunEnable,loading,systemUiOverlayStyle,coreStatus]);
 
-@override
-String toString() {
-  return 'AppState(isInit: $isInit, backBlock: $backBlock, pageLabel: $pageLabel, packages: $packages, sortNum: $sortNum, viewSize: $viewSize, sideWidth: $sideWidth, delayMap: $delayMap, groups: $groups, checkIpNum: $checkIpNum, brightness: $brightness, runTime: $runTime, providers: $providers, localIp: $localIp, requests: $requests, version: $version, logs: $logs, traffics: $traffics, totalTraffic: $totalTraffic, realTunEnable: $realTunEnable, loading: $loading, systemUiOverlayStyle: $systemUiOverlayStyle, coreStatus: $coreStatus)';
-}
 
 
 }
@@ -45,7 +41,7 @@ abstract mixin class $AppStateCopyWith<$Res>  {
   factory $AppStateCopyWith(AppState value, $Res Function(AppState) _then) = _$AppStateCopyWithImpl;
 @useResult
 $Res call({
- bool isInit, bool backBlock, PageLabel pageLabel, List<Package> packages, int sortNum, Size viewSize, double sideWidth, DelayMap delayMap, List<Group> groups, int checkIpNum, Brightness brightness, int? runTime, List<ExternalProvider> providers, String? localIp, FixedList<TrackerInfo> requests, int version, FixedList<Log> logs, FixedList<Traffic> traffics, Traffic totalTraffic, bool realTunEnable, bool loading, SystemUiOverlayStyle systemUiOverlayStyle, CoreStatus coreStatus
+ bool isInit, bool backBlock, PageLabel pageLabel, List<Package> packages, int sortNum, Size viewSize, double sideWidth, DelayMap delayMap, List<Group> groups, int checkIpNum, Brightness brightness, int? runTime, List<ExternalProvider> providers, String? localIp, FixedList<TrackerInfo> requests, int version, FixedList<Log> logs, FixedList<Traffic> traffics, Traffic totalTraffic, TunAuthorizationState authorizedTunEnable, bool loading, SystemUiOverlayStyle systemUiOverlayStyle, CoreStatus coreStatus
 });
 
 
@@ -62,7 +58,7 @@ class _$AppStateCopyWithImpl<$Res>
 
 /// Create a copy of AppState
 /// with the given fields replaced by the non-null parameter values.
-@pragma('vm:prefer-inline') @override $Res call({Object? isInit = null,Object? backBlock = null,Object? pageLabel = null,Object? packages = null,Object? sortNum = null,Object? viewSize = null,Object? sideWidth = null,Object? delayMap = null,Object? groups = null,Object? checkIpNum = null,Object? brightness = null,Object? runTime = freezed,Object? providers = null,Object? localIp = freezed,Object? requests = null,Object? version = null,Object? logs = null,Object? traffics = null,Object? totalTraffic = null,Object? realTunEnable = null,Object? loading = null,Object? systemUiOverlayStyle = null,Object? coreStatus = null,}) {
+@pragma('vm:prefer-inline') @override $Res call({Object? isInit = null,Object? backBlock = null,Object? pageLabel = null,Object? packages = null,Object? sortNum = null,Object? viewSize = null,Object? sideWidth = null,Object? delayMap = null,Object? groups = null,Object? checkIpNum = null,Object? brightness = null,Object? runTime = freezed,Object? providers = null,Object? localIp = freezed,Object? requests = null,Object? version = null,Object? logs = null,Object? traffics = null,Object? totalTraffic = null,Object? authorizedTunEnable = null,Object? loading = null,Object? systemUiOverlayStyle = null,Object? coreStatus = null,}) {
   return _then(_self.copyWith(
 isInit: null == isInit ? _self.isInit : isInit // ignore: cast_nullable_to_non_nullable
 as bool,backBlock: null == backBlock ? _self.backBlock : backBlock // ignore: cast_nullable_to_non_nullable
@@ -83,8 +79,8 @@ as FixedList<TrackerInfo>,version: null == version ? _self.version : version //
 as int,logs: null == logs ? _self.logs : logs // ignore: cast_nullable_to_non_nullable
 as FixedList<Log>,traffics: null == traffics ? _self.traffics : traffics // ignore: cast_nullable_to_non_nullable
 as FixedList<Traffic>,totalTraffic: null == totalTraffic ? _self.totalTraffic : totalTraffic // ignore: cast_nullable_to_non_nullable
-as Traffic,realTunEnable: null == realTunEnable ? _self.realTunEnable : realTunEnable // ignore: cast_nullable_to_non_nullable
-as bool,loading: null == loading ? _self.loading : loading // ignore: cast_nullable_to_non_nullable
+as Traffic,authorizedTunEnable: null == authorizedTunEnable ? _self.authorizedTunEnable : authorizedTunEnable // ignore: cast_nullable_to_non_nullable
+as TunAuthorizationState,loading: null == loading ? _self.loading : loading // ignore: cast_nullable_to_non_nullable
 as bool,systemUiOverlayStyle: null == systemUiOverlayStyle ? _self.systemUiOverlayStyle : systemUiOverlayStyle // ignore: cast_nullable_to_non_nullable
 as SystemUiOverlayStyle,coreStatus: null == coreStatus ? _self.coreStatus : coreStatus // ignore: cast_nullable_to_non_nullable
 as CoreStatus,
@@ -181,10 +177,10 @@ return $default(_that);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( bool isInit,  bool backBlock,  PageLabel pageLabel,  List<Package> packages,  int sortNum,  Size viewSize,  double sideWidth,  DelayMap delayMap,  List<Group> groups,  int checkIpNum,  Brightness brightness,  int? runTime,  List<ExternalProvider> providers,  String? localIp,  FixedList<TrackerInfo> requests,  int version,  FixedList<Log> logs,  FixedList<Traffic> traffics,  Traffic totalTraffic,  bool realTunEnable,  bool loading,  SystemUiOverlayStyle systemUiOverlayStyle,  CoreStatus coreStatus)?  $default,{required TResult orElse(),}) {final _that = this;
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( bool isInit,  bool backBlock,  PageLabel pageLabel,  List<Package> packages,  int sortNum,  Size viewSize,  double sideWidth,  DelayMap delayMap,  List<Group> groups,  int checkIpNum,  Brightness brightness,  int? runTime,  List<ExternalProvider> providers,  String? localIp,  FixedList<TrackerInfo> requests,  int version,  FixedList<Log> logs,  FixedList<Traffic> traffics,  Traffic totalTraffic,  TunAuthorizationState authorizedTunEnable,  bool loading,  SystemUiOverlayStyle systemUiOverlayStyle,  CoreStatus coreStatus)?  $default,{required TResult orElse(),}) {final _that = this;
 switch (_that) {
 case _AppState() when $default != null:
-return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_that.sortNum,_that.viewSize,_that.sideWidth,_that.delayMap,_that.groups,_that.checkIpNum,_that.brightness,_that.runTime,_that.providers,_that.localIp,_that.requests,_that.version,_that.logs,_that.traffics,_that.totalTraffic,_that.realTunEnable,_that.loading,_that.systemUiOverlayStyle,_that.coreStatus);case _:
+return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_that.sortNum,_that.viewSize,_that.sideWidth,_that.delayMap,_that.groups,_that.checkIpNum,_that.brightness,_that.runTime,_that.providers,_that.localIp,_that.requests,_that.version,_that.logs,_that.traffics,_that.totalTraffic,_that.authorizedTunEnable,_that.loading,_that.systemUiOverlayStyle,_that.coreStatus);case _:
   return orElse();
 
 }
@@ -202,10 +198,10 @@ return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_tha
 /// }
 /// ```
 
-@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( bool isInit,  bool backBlock,  PageLabel pageLabel,  List<Package> packages,  int sortNum,  Size viewSize,  double sideWidth,  DelayMap delayMap,  List<Group> groups,  int checkIpNum,  Brightness brightness,  int? runTime,  List<ExternalProvider> providers,  String? localIp,  FixedList<TrackerInfo> requests,  int version,  FixedList<Log> logs,  FixedList<Traffic> traffics,  Traffic totalTraffic,  bool realTunEnable,  bool loading,  SystemUiOverlayStyle systemUiOverlayStyle,  CoreStatus coreStatus)  $default,) {final _that = this;
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( bool isInit,  bool backBlock,  PageLabel pageLabel,  List<Package> packages,  int sortNum,  Size viewSize,  double sideWidth,  DelayMap delayMap,  List<Group> groups,  int checkIpNum,  Brightness brightness,  int? runTime,  List<ExternalProvider> providers,  String? localIp,  FixedList<TrackerInfo> requests,  int version,  FixedList<Log> logs,  FixedList<Traffic> traffics,  Traffic totalTraffic,  TunAuthorizationState authorizedTunEnable,  bool loading,  SystemUiOverlayStyle systemUiOverlayStyle,  CoreStatus coreStatus)  $default,) {final _that = this;
 switch (_that) {
 case _AppState():
-return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_that.sortNum,_that.viewSize,_that.sideWidth,_that.delayMap,_that.groups,_that.checkIpNum,_that.brightness,_that.runTime,_that.providers,_that.localIp,_that.requests,_that.version,_that.logs,_that.traffics,_that.totalTraffic,_that.realTunEnable,_that.loading,_that.systemUiOverlayStyle,_that.coreStatus);case _:
+return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_that.sortNum,_that.viewSize,_that.sideWidth,_that.delayMap,_that.groups,_that.checkIpNum,_that.brightness,_that.runTime,_that.providers,_that.localIp,_that.requests,_that.version,_that.logs,_that.traffics,_that.totalTraffic,_that.authorizedTunEnable,_that.loading,_that.systemUiOverlayStyle,_that.coreStatus);case _:
   throw StateError('Unexpected subclass');
 
 }
@@ -222,10 +218,10 @@ return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_tha
 /// }
 /// ```
 
-@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( bool isInit,  bool backBlock,  PageLabel pageLabel,  List<Package> packages,  int sortNum,  Size viewSize,  double sideWidth,  DelayMap delayMap,  List<Group> groups,  int checkIpNum,  Brightness brightness,  int? runTime,  List<ExternalProvider> providers,  String? localIp,  FixedList<TrackerInfo> requests,  int version,  FixedList<Log> logs,  FixedList<Traffic> traffics,  Traffic totalTraffic,  bool realTunEnable,  bool loading,  SystemUiOverlayStyle systemUiOverlayStyle,  CoreStatus coreStatus)?  $default,) {final _that = this;
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( bool isInit,  bool backBlock,  PageLabel pageLabel,  List<Package> packages,  int sortNum,  Size viewSize,  double sideWidth,  DelayMap delayMap,  List<Group> groups,  int checkIpNum,  Brightness brightness,  int? runTime,  List<ExternalProvider> providers,  String? localIp,  FixedList<TrackerInfo> requests,  int version,  FixedList<Log> logs,  FixedList<Traffic> traffics,  Traffic totalTraffic,  TunAuthorizationState authorizedTunEnable,  bool loading,  SystemUiOverlayStyle systemUiOverlayStyle,  CoreStatus coreStatus)?  $default,) {final _that = this;
 switch (_that) {
 case _AppState() when $default != null:
-return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_that.sortNum,_that.viewSize,_that.sideWidth,_that.delayMap,_that.groups,_that.checkIpNum,_that.brightness,_that.runTime,_that.providers,_that.localIp,_that.requests,_that.version,_that.logs,_that.traffics,_that.totalTraffic,_that.realTunEnable,_that.loading,_that.systemUiOverlayStyle,_that.coreStatus);case _:
+return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_that.sortNum,_that.viewSize,_that.sideWidth,_that.delayMap,_that.groups,_that.checkIpNum,_that.brightness,_that.runTime,_that.providers,_that.localIp,_that.requests,_that.version,_that.logs,_that.traffics,_that.totalTraffic,_that.authorizedTunEnable,_that.loading,_that.systemUiOverlayStyle,_that.coreStatus);case _:
   return null;
 
 }
@@ -237,7 +233,7 @@ return $default(_that.isInit,_that.backBlock,_that.pageLabel,_that.packages,_tha
 
 
 class _AppState implements AppState {
-  const _AppState({this.isInit = false, this.backBlock = false, this.pageLabel = PageLabel.dashboard, final  List<Package> packages = const [], this.sortNum = 0, required this.viewSize, this.sideWidth = 0, final  DelayMap delayMap = const {}, final  List<Group> groups = const [], this.checkIpNum = 0, required this.brightness, this.runTime, final  List<ExternalProvider> providers = const [], this.localIp, required this.requests, required this.version, required this.logs, required this.traffics, required this.totalTraffic, this.realTunEnable = false, this.loading = false, required this.systemUiOverlayStyle, this.coreStatus = CoreStatus.connecting}): _packages = packages,_delayMap = delayMap,_groups = groups,_providers = providers;
+  const _AppState({this.isInit = false, this.backBlock = false, this.pageLabel = PageLabel.dashboard, final  List<Package> packages = const [], this.sortNum = 0, required this.viewSize, this.sideWidth = 0, final  DelayMap delayMap = const {}, final  List<Group> groups = const [], this.checkIpNum = 0, required this.brightness, this.runTime, final  List<ExternalProvider> providers = const [], this.localIp, required this.requests, required this.version, required this.logs, required this.traffics, required this.totalTraffic, this.authorizedTunEnable = TunAuthorizationState.none, this.loading = false, required this.systemUiOverlayStyle, this.coreStatus = CoreStatus.connecting}): _packages = packages,_delayMap = delayMap,_groups = groups,_providers = providers;
   
 
 @override@JsonKey() final  bool isInit;
@@ -283,7 +279,7 @@ class _AppState implements AppState {
 @override final  FixedList<Log> logs;
 @override final  FixedList<Traffic> traffics;
 @override final  Traffic totalTraffic;
-@override@JsonKey() final  bool realTunEnable;
+@override@JsonKey() final  TunAuthorizationState authorizedTunEnable;
 @override@JsonKey() final  bool loading;
 @override final  SystemUiOverlayStyle systemUiOverlayStyle;
 @override@JsonKey() final  CoreStatus coreStatus;
@@ -298,17 +294,13 @@ _$AppStateCopyWith<_AppState> get copyWith => __$AppStateCopyWithImpl<_AppState>
 
 @override
 bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is _AppState&&(identical(other.isInit, isInit) || other.isInit == isInit)&&(identical(other.backBlock, backBlock) || other.backBlock == backBlock)&&(identical(other.pageLabel, pageLabel) || other.pageLabel == pageLabel)&&const DeepCollectionEquality().equals(other._packages, _packages)&&(identical(other.sortNum, sortNum) || other.sortNum == sortNum)&&(identical(other.viewSize, viewSize) || other.viewSize == viewSize)&&(identical(other.sideWidth, sideWidth) || other.sideWidth == sideWidth)&&const DeepCollectionEquality().equals(other._delayMap, _delayMap)&&const DeepCollectionEquality().equals(other._groups, _groups)&&(identical(other.checkIpNum, checkIpNum) || other.checkIpNum == checkIpNum)&&(identical(other.brightness, brightness) || other.brightness == brightness)&&(identical(other.runTime, runTime) || other.runTime == runTime)&&const DeepCollectionEquality().equals(other._providers, _providers)&&(identical(other.localIp, localIp) || other.localIp == localIp)&&(identical(other.requests, requests) || other.requests == requests)&&(identical(other.version, version) || other.version == version)&&(identical(other.logs, logs) || other.logs == logs)&&(identical(other.traffics, traffics) || other.traffics == traffics)&&(identical(other.totalTraffic, totalTraffic) || other.totalTraffic == totalTraffic)&&(identical(other.realTunEnable, realTunEnable) || other.realTunEnable == realTunEnable)&&(identical(other.loading, loading) || other.loading == loading)&&(identical(other.systemUiOverlayStyle, systemUiOverlayStyle) || other.systemUiOverlayStyle == systemUiOverlayStyle)&&(identical(other.coreStatus, coreStatus) || other.coreStatus == coreStatus));
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is _AppState&&(identical(other.isInit, isInit) || other.isInit == isInit)&&(identical(other.backBlock, backBlock) || other.backBlock == backBlock)&&(identical(other.pageLabel, pageLabel) || other.pageLabel == pageLabel)&&const DeepCollectionEquality().equals(other._packages, _packages)&&(identical(other.sortNum, sortNum) || other.sortNum == sortNum)&&(identical(other.viewSize, viewSize) || other.viewSize == viewSize)&&(identical(other.sideWidth, sideWidth) || other.sideWidth == sideWidth)&&const DeepCollectionEquality().equals(other._delayMap, _delayMap)&&const DeepCollectionEquality().equals(other._groups, _groups)&&(identical(other.checkIpNum, checkIpNum) || other.checkIpNum == checkIpNum)&&(identical(other.brightness, brightness) || other.brightness == brightness)&&(identical(other.runTime, runTime) || other.runTime == runTime)&&const DeepCollectionEquality().equals(other._providers, _providers)&&(identical(other.localIp, localIp) || other.localIp == localIp)&&(identical(other.requests, requests) || other.requests == requests)&&(identical(other.version, version) || other.version == version)&&(identical(other.logs, logs) || other.logs == logs)&&(identical(other.traffics, traffics) || other.traffics == traffics)&&(identical(other.totalTraffic, totalTraffic) || other.totalTraffic == totalTraffic)&&(identical(other.authorizedTunEnable, authorizedTunEnable) || other.authorizedTunEnable == authorizedTunEnable)&&(identical(other.loading, loading) || other.loading == loading)&&(identical(other.systemUiOverlayStyle, systemUiOverlayStyle) || other.systemUiOverlayStyle == systemUiOverlayStyle)&&(identical(other.coreStatus, coreStatus) || other.coreStatus == coreStatus));
 }
 
 
 @override
-int get hashCode => Object.hashAll([runtimeType,isInit,backBlock,pageLabel,const DeepCollectionEquality().hash(_packages),sortNum,viewSize,sideWidth,const DeepCollectionEquality().hash(_delayMap),const DeepCollectionEquality().hash(_groups),checkIpNum,brightness,runTime,const DeepCollectionEquality().hash(_providers),localIp,requests,version,logs,traffics,totalTraffic,realTunEnable,loading,systemUiOverlayStyle,coreStatus]);
+int get hashCode => Object.hashAll([runtimeType,isInit,backBlock,pageLabel,const DeepCollectionEquality().hash(_packages),sortNum,viewSize,sideWidth,const DeepCollectionEquality().hash(_delayMap),const DeepCollectionEquality().hash(_groups),checkIpNum,brightness,runTime,const DeepCollectionEquality().hash(_providers),localIp,requests,version,logs,traffics,totalTraffic,authorizedTunEnable,loading,systemUiOverlayStyle,coreStatus]);
 
-@override
-String toString() {
-  return 'AppState(isInit: $isInit, backBlock: $backBlock, pageLabel: $pageLabel, packages: $packages, sortNum: $sortNum, viewSize: $viewSize, sideWidth: $sideWidth, delayMap: $delayMap, groups: $groups, checkIpNum: $checkIpNum, brightness: $brightness, runTime: $runTime, providers: $providers, localIp: $localIp, requests: $requests, version: $version, logs: $logs, traffics: $traffics, totalTraffic: $totalTraffic, realTunEnable: $realTunEnable, loading: $loading, systemUiOverlayStyle: $systemUiOverlayStyle, coreStatus: $coreStatus)';
-}
 
 
 }
@@ -318,7 +310,7 @@ abstract mixin class _$AppStateCopyWith<$Res> implements $AppStateCopyWith<$Res>
   factory _$AppStateCopyWith(_AppState value, $Res Function(_AppState) _then) = __$AppStateCopyWithImpl;
 @override @useResult
 $Res call({
- bool isInit, bool backBlock, PageLabel pageLabel, List<Package> packages, int sortNum, Size viewSize, double sideWidth, DelayMap delayMap, List<Group> groups, int checkIpNum, Brightness brightness, int? runTime, List<ExternalProvider> providers, String? localIp, FixedList<TrackerInfo> requests, int version, FixedList<Log> logs, FixedList<Traffic> traffics, Traffic totalTraffic, bool realTunEnable, bool loading, SystemUiOverlayStyle systemUiOverlayStyle, CoreStatus coreStatus
+ bool isInit, bool backBlock, PageLabel pageLabel, List<Package> packages, int sortNum, Size viewSize, double sideWidth, DelayMap delayMap, List<Group> groups, int checkIpNum, Brightness brightness, int? runTime, List<ExternalProvider> providers, String? localIp, FixedList<TrackerInfo> requests, int version, FixedList<Log> logs, FixedList<Traffic> traffics, Traffic totalTraffic, TunAuthorizationState authorizedTunEnable, bool loading, SystemUiOverlayStyle systemUiOverlayStyle, CoreStatus coreStatus
 });
 
 
@@ -335,7 +327,7 @@ class __$AppStateCopyWithImpl<$Res>
 
 /// Create a copy of AppState
 /// with the given fields replaced by the non-null parameter values.
-@override @pragma('vm:prefer-inline') $Res call({Object? isInit = null,Object? backBlock = null,Object? pageLabel = null,Object? packages = null,Object? sortNum = null,Object? viewSize = null,Object? sideWidth = null,Object? delayMap = null,Object? groups = null,Object? checkIpNum = null,Object? brightness = null,Object? runTime = freezed,Object? providers = null,Object? localIp = freezed,Object? requests = null,Object? version = null,Object? logs = null,Object? traffics = null,Object? totalTraffic = null,Object? realTunEnable = null,Object? loading = null,Object? systemUiOverlayStyle = null,Object? coreStatus = null,}) {
+@override @pragma('vm:prefer-inline') $Res call({Object? isInit = null,Object? backBlock = null,Object? pageLabel = null,Object? packages = null,Object? sortNum = null,Object? viewSize = null,Object? sideWidth = null,Object? delayMap = null,Object? groups = null,Object? checkIpNum = null,Object? brightness = null,Object? runTime = freezed,Object? providers = null,Object? localIp = freezed,Object? requests = null,Object? version = null,Object? logs = null,Object? traffics = null,Object? totalTraffic = null,Object? authorizedTunEnable = null,Object? loading = null,Object? systemUiOverlayStyle = null,Object? coreStatus = null,}) {
   return _then(_AppState(
 isInit: null == isInit ? _self.isInit : isInit // ignore: cast_nullable_to_non_nullable
 as bool,backBlock: null == backBlock ? _self.backBlock : backBlock // ignore: cast_nullable_to_non_nullable
@@ -356,8 +348,8 @@ as FixedList<TrackerInfo>,version: null == version ? _self.version : version //
 as int,logs: null == logs ? _self.logs : logs // ignore: cast_nullable_to_non_nullable
 as FixedList<Log>,traffics: null == traffics ? _self.traffics : traffics // ignore: cast_nullable_to_non_nullable
 as FixedList<Traffic>,totalTraffic: null == totalTraffic ? _self.totalTraffic : totalTraffic // ignore: cast_nullable_to_non_nullable
-as Traffic,realTunEnable: null == realTunEnable ? _self.realTunEnable : realTunEnable // ignore: cast_nullable_to_non_nullable
-as bool,loading: null == loading ? _self.loading : loading // ignore: cast_nullable_to_non_nullable
+as Traffic,authorizedTunEnable: null == authorizedTunEnable ? _self.authorizedTunEnable : authorizedTunEnable // ignore: cast_nullable_to_non_nullable
+as TunAuthorizationState,loading: null == loading ? _self.loading : loading // ignore: cast_nullable_to_non_nullable
 as bool,systemUiOverlayStyle: null == systemUiOverlayStyle ? _self.systemUiOverlayStyle : systemUiOverlayStyle // ignore: cast_nullable_to_non_nullable
 as SystemUiOverlayStyle,coreStatus: null == coreStatus ? _self.coreStatus : coreStatus // ignore: cast_nullable_to_non_nullable
 as CoreStatus,
diff --git a/lib/models/generated/common.freezed.dart b/lib/models/generated/common.freezed.dart
index e9af61c650..c41c215392 100644
--- a/lib/models/generated/common.freezed.dart
+++ b/lib/models/generated/common.freezed.dart
@@ -1208,7 +1208,6 @@ $MetadataCopyWith<$Res> get metadata {
 /// @nodoc
 mixin _$Log {
 
-// @JsonKey(fromJson: _logId) required String id,
 @JsonKey(name: 'LogLevel') LogLevel get logLevel;@JsonKey(name: 'Payload') String get payload;@JsonKey(fromJson: _logDateTime) String get dateTime;
 /// Create a copy of Log
 /// with the given fields replaced by the non-null parameter values.
@@ -1408,7 +1407,6 @@ class _Log implements Log {
   const _Log({@JsonKey(name: 'LogLevel') this.logLevel = LogLevel.info, @JsonKey(name: 'Payload') this.payload = '', @JsonKey(fromJson: _logDateTime) required this.dateTime});
   factory _Log.fromJson(Map<String, dynamic> json) => _$LogFromJson(json);
 
-// @JsonKey(fromJson: _logId) required String id,
 @override@JsonKey(name: 'LogLevel') final  LogLevel logLevel;
 @override@JsonKey(name: 'Payload') final  String payload;
 @override@JsonKey(fromJson: _logDateTime) final  String dateTime;
@@ -2035,7 +2033,7 @@ as bool,
 /// @nodoc
 mixin _$DAVProps {
 
- String get uri; String get user; String get password; String get fileName;
+ String get uri; String get user;@JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword) String get password; String get fileName;
 /// Create a copy of DAVProps
 /// with the given fields replaced by the non-null parameter values.
 @JsonKey(includeFromJson: false, includeToJson: false)
@@ -2055,10 +2053,6 @@ bool operator ==(Object other) {
 @override
 int get hashCode => Object.hash(runtimeType,uri,user,password,fileName);
 
-@override
-String toString() {
-  return 'DAVProps(uri: $uri, user: $user, password: $password, fileName: $fileName)';
-}
 
 
 }
@@ -2068,7 +2062,7 @@ abstract mixin class $DAVPropsCopyWith<$Res>  {
   factory $DAVPropsCopyWith(DAVProps value, $Res Function(DAVProps) _then) = _$DAVPropsCopyWithImpl;
 @useResult
 $Res call({
- String uri, String user, String password, String fileName
+ String uri, String user,@JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword) String password, String fileName
 });
 
 
@@ -2176,7 +2170,7 @@ return $default(_that);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( String uri,  String user,  String password,  String fileName)?  $default,{required TResult orElse(),}) {final _that = this;
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( String uri,  String user, @JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword)  String password,  String fileName)?  $default,{required TResult orElse(),}) {final _that = this;
 switch (_that) {
 case _DAVProps() when $default != null:
 return $default(_that.uri,_that.user,_that.password,_that.fileName);case _:
@@ -2197,7 +2191,7 @@ return $default(_that.uri,_that.user,_that.password,_that.fileName);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( String uri,  String user,  String password,  String fileName)  $default,) {final _that = this;
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( String uri,  String user, @JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword)  String password,  String fileName)  $default,) {final _that = this;
 switch (_that) {
 case _DAVProps():
 return $default(_that.uri,_that.user,_that.password,_that.fileName);case _:
@@ -2217,7 +2211,7 @@ return $default(_that.uri,_that.user,_that.password,_that.fileName);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( String uri,  String user,  String password,  String fileName)?  $default,) {final _that = this;
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( String uri,  String user, @JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword)  String password,  String fileName)?  $default,) {final _that = this;
 switch (_that) {
 case _DAVProps() when $default != null:
 return $default(_that.uri,_that.user,_that.password,_that.fileName);case _:
@@ -2231,13 +2225,13 @@ return $default(_that.uri,_that.user,_that.password,_that.fileName);case _:
 /// @nodoc
 @JsonSerializable()
 
-class _DAVProps implements DAVProps {
-  const _DAVProps({required this.uri, required this.user, required this.password, this.fileName = defaultDavFileName});
+class _DAVProps extends DAVProps {
+  const _DAVProps({required this.uri, required this.user, @JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword) this.password = '', this.fileName = defaultDavFileName}): super._();
   factory _DAVProps.fromJson(Map<String, dynamic> json) => _$DAVPropsFromJson(json);
 
 @override final  String uri;
 @override final  String user;
-@override final  String password;
+@override@JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword) final  String password;
 @override@JsonKey() final  String fileName;
 
 /// Create a copy of DAVProps
@@ -2260,10 +2254,6 @@ bool operator ==(Object other) {
 @override
 int get hashCode => Object.hash(runtimeType,uri,user,password,fileName);
 
-@override
-String toString() {
-  return 'DAVProps(uri: $uri, user: $user, password: $password, fileName: $fileName)';
-}
 
 
 }
@@ -2273,7 +2263,7 @@ abstract mixin class _$DAVPropsCopyWith<$Res> implements $DAVPropsCopyWith<$Res>
   factory _$DAVPropsCopyWith(_DAVProps value, $Res Function(_DAVProps) _then) = __$DAVPropsCopyWithImpl;
 @override @useResult
 $Res call({
- String uri, String user, String password, String fileName
+ String uri, String user,@JsonKey(fromJson: _decodeDavPassword, toJson: _encodeDavPassword) String password, String fileName
 });
 
 
@@ -2306,7 +2296,7 @@ as String,
 /// @nodoc
 mixin _$FileInfo {
 
- int get size; DateTime get lastModified;
+ int get size; DateTime? get lastModified;
 /// Create a copy of FileInfo
 /// with the given fields replaced by the non-null parameter values.
 @JsonKey(includeFromJson: false, includeToJson: false)
@@ -2337,7 +2327,7 @@ abstract mixin class $FileInfoCopyWith<$Res>  {
   factory $FileInfoCopyWith(FileInfo value, $Res Function(FileInfo) _then) = _$FileInfoCopyWithImpl;
 @useResult
 $Res call({
- int size, DateTime lastModified
+ int size, DateTime? lastModified
 });
 
 
@@ -2354,11 +2344,11 @@ class _$FileInfoCopyWithImpl<$Res>
 
 /// Create a copy of FileInfo
 /// with the given fields replaced by the non-null parameter values.
-@pragma('vm:prefer-inline') @override $Res call({Object? size = null,Object? lastModified = null,}) {
+@pragma('vm:prefer-inline') @override $Res call({Object? size = null,Object? lastModified = freezed,}) {
   return _then(_self.copyWith(
 size: null == size ? _self.size : size // ignore: cast_nullable_to_non_nullable
-as int,lastModified: null == lastModified ? _self.lastModified : lastModified // ignore: cast_nullable_to_non_nullable
-as DateTime,
+as int,lastModified: freezed == lastModified ? _self.lastModified : lastModified // ignore: cast_nullable_to_non_nullable
+as DateTime?,
   ));
 }
 
@@ -2443,7 +2433,7 @@ return $default(_that);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( int size,  DateTime lastModified)?  $default,{required TResult orElse(),}) {final _that = this;
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( int size,  DateTime? lastModified)?  $default,{required TResult orElse(),}) {final _that = this;
 switch (_that) {
 case _FileInfo() when $default != null:
 return $default(_that.size,_that.lastModified);case _:
@@ -2464,7 +2454,7 @@ return $default(_that.size,_that.lastModified);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( int size,  DateTime lastModified)  $default,) {final _that = this;
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( int size,  DateTime? lastModified)  $default,) {final _that = this;
 switch (_that) {
 case _FileInfo():
 return $default(_that.size,_that.lastModified);case _:
@@ -2484,7 +2474,7 @@ return $default(_that.size,_that.lastModified);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( int size,  DateTime lastModified)?  $default,) {final _that = this;
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( int size,  DateTime? lastModified)?  $default,) {final _that = this;
 switch (_that) {
 case _FileInfo() when $default != null:
 return $default(_that.size,_that.lastModified);case _:
@@ -2499,11 +2489,11 @@ return $default(_that.size,_that.lastModified);case _:
 
 
 class _FileInfo implements FileInfo {
-  const _FileInfo({required this.size, required this.lastModified});
+  const _FileInfo({required this.size, this.lastModified});
   
 
 @override final  int size;
-@override final  DateTime lastModified;
+@override final  DateTime? lastModified;
 
 /// Create a copy of FileInfo
 /// with the given fields replaced by the non-null parameter values.
@@ -2535,7 +2525,7 @@ abstract mixin class _$FileInfoCopyWith<$Res> implements $FileInfoCopyWith<$Res>
   factory _$FileInfoCopyWith(_FileInfo value, $Res Function(_FileInfo) _then) = __$FileInfoCopyWithImpl;
 @override @useResult
 $Res call({
- int size, DateTime lastModified
+ int size, DateTime? lastModified
 });
 
 
@@ -2552,11 +2542,11 @@ class __$FileInfoCopyWithImpl<$Res>
 
 /// Create a copy of FileInfo
 /// with the given fields replaced by the non-null parameter values.
-@override @pragma('vm:prefer-inline') $Res call({Object? size = null,Object? lastModified = null,}) {
+@override @pragma('vm:prefer-inline') $Res call({Object? size = null,Object? lastModified = freezed,}) {
   return _then(_FileInfo(
 size: null == size ? _self.size : size // ignore: cast_nullable_to_non_nullable
-as int,lastModified: null == lastModified ? _self.lastModified : lastModified // ignore: cast_nullable_to_non_nullable
-as DateTime,
+as int,lastModified: freezed == lastModified ? _self.lastModified : lastModified // ignore: cast_nullable_to_non_nullable
+as DateTime?,
   ));
 }
 
diff --git a/lib/models/generated/common.g.dart b/lib/models/generated/common.g.dart
index efd7254946..6c5d4b5f90 100644
--- a/lib/models/generated/common.g.dart
+++ b/lib/models/generated/common.g.dart
@@ -128,14 +128,16 @@ const _$LogLevelEnumMap = {
 _DAVProps _$DAVPropsFromJson(Map<String, dynamic> json) => _DAVProps(
   uri: json['uri'] as String,
   user: json['user'] as String,
-  password: json['password'] as String,
+  password: json['password'] == null
+      ? ''
+      : _decodeDavPassword(json['password'] as String?),
   fileName: json['fileName'] as String? ?? defaultDavFileName,
 );
 
 Map<String, dynamic> _$DAVPropsToJson(_DAVProps instance) => <String, dynamic>{
   'uri': instance.uri,
   'user': instance.user,
-  'password': instance.password,
+  'password': _encodeDavPassword(instance.password),
   'fileName': instance.fileName,
 };
 
diff --git a/lib/models/generated/config.freezed.dart b/lib/models/generated/config.freezed.dart
index e776a21159..18587c4e5a 100644
--- a/lib/models/generated/config.freezed.dart
+++ b/lib/models/generated/config.freezed.dart
@@ -2329,7 +2329,7 @@ $TextScaleCopyWith<$Res> get textScale {
 /// @nodoc
 mixin _$Config {
 
- int? get currentProfileId; bool get overrideDns; List<HotKeyAction> get hotKeyActions;@JsonKey(fromJson: AppSettingProps.safeFromJson) AppSettingProps get appSettingProps; DAVProps? get davProps; NetworkProps get networkProps; VpnProps get vpnProps;@JsonKey(fromJson: ThemeProps.safeFromJson) ThemeProps get themeProps; ProxiesStyleProps get proxiesStyleProps; WindowProps get windowProps; PatchClashConfig get patchClashConfig; List<String> get excludeSSIDs;
+ int? get currentProfileId; bool get overrideDns; List<HotKeyAction> get hotKeyActions;@JsonKey(fromJson: AppSettingProps.safeFromJson) AppSettingProps get appSettingProps; DAVProps? get davProps; NetworkProps get networkProps; VpnProps get vpnProps;@JsonKey(fromJson: ThemeProps.safeFromJson) ThemeProps get themeProps; ProxiesStyleProps get proxiesStyleProps; WindowProps get windowProps; PatchClashConfig get patchClashConfig; List<String> get excludeSSIDs;@JsonKey(fromJson: TailscaleProps.safeFromJson) TailscaleProps get tailscaleProps;
 /// Create a copy of Config
 /// with the given fields replaced by the non-null parameter values.
 @JsonKey(includeFromJson: false, includeToJson: false)
@@ -2342,16 +2342,16 @@ $ConfigCopyWith<Config> get copyWith => _$ConfigCopyWithImpl<Config>(this as Con
 
 @override
 bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is Config&&(identical(other.currentProfileId, currentProfileId) || other.currentProfileId == currentProfileId)&&(identical(other.overrideDns, overrideDns) || other.overrideDns == overrideDns)&&const DeepCollectionEquality().equals(other.hotKeyActions, hotKeyActions)&&(identical(other.appSettingProps, appSettingProps) || other.appSettingProps == appSettingProps)&&(identical(other.davProps, davProps) || other.davProps == davProps)&&(identical(other.networkProps, networkProps) || other.networkProps == networkProps)&&(identical(other.vpnProps, vpnProps) || other.vpnProps == vpnProps)&&(identical(other.themeProps, themeProps) || other.themeProps == themeProps)&&(identical(other.proxiesStyleProps, proxiesStyleProps) || other.proxiesStyleProps == proxiesStyleProps)&&(identical(other.windowProps, windowProps) || other.windowProps == windowProps)&&(identical(other.patchClashConfig, patchClashConfig) || other.patchClashConfig == patchClashConfig)&&const DeepCollectionEquality().equals(other.excludeSSIDs, excludeSSIDs));
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is Config&&(identical(other.currentProfileId, currentProfileId) || other.currentProfileId == currentProfileId)&&(identical(other.overrideDns, overrideDns) || other.overrideDns == overrideDns)&&const DeepCollectionEquality().equals(other.hotKeyActions, hotKeyActions)&&(identical(other.appSettingProps, appSettingProps) || other.appSettingProps == appSettingProps)&&(identical(other.davProps, davProps) || other.davProps == davProps)&&(identical(other.networkProps, networkProps) || other.networkProps == networkProps)&&(identical(other.vpnProps, vpnProps) || other.vpnProps == vpnProps)&&(identical(other.themeProps, themeProps) || other.themeProps == themeProps)&&(identical(other.proxiesStyleProps, proxiesStyleProps) || other.proxiesStyleProps == proxiesStyleProps)&&(identical(other.windowProps, windowProps) || other.windowProps == windowProps)&&(identical(other.patchClashConfig, patchClashConfig) || other.patchClashConfig == patchClashConfig)&&const DeepCollectionEquality().equals(other.excludeSSIDs, excludeSSIDs)&&(identical(other.tailscaleProps, tailscaleProps) || other.tailscaleProps == tailscaleProps));
 }
 
 @JsonKey(includeFromJson: false, includeToJson: false)
 @override
-int get hashCode => Object.hash(runtimeType,currentProfileId,overrideDns,const DeepCollectionEquality().hash(hotKeyActions),appSettingProps,davProps,networkProps,vpnProps,themeProps,proxiesStyleProps,windowProps,patchClashConfig,const DeepCollectionEquality().hash(excludeSSIDs));
+int get hashCode => Object.hash(runtimeType,currentProfileId,overrideDns,const DeepCollectionEquality().hash(hotKeyActions),appSettingProps,davProps,networkProps,vpnProps,themeProps,proxiesStyleProps,windowProps,patchClashConfig,const DeepCollectionEquality().hash(excludeSSIDs),tailscaleProps);
 
 @override
 String toString() {
-  return 'Config(currentProfileId: $currentProfileId, overrideDns: $overrideDns, hotKeyActions: $hotKeyActions, appSettingProps: $appSettingProps, davProps: $davProps, networkProps: $networkProps, vpnProps: $vpnProps, themeProps: $themeProps, proxiesStyleProps: $proxiesStyleProps, windowProps: $windowProps, patchClashConfig: $patchClashConfig, excludeSSIDs: $excludeSSIDs)';
+  return 'Config(currentProfileId: $currentProfileId, overrideDns: $overrideDns, hotKeyActions: $hotKeyActions, appSettingProps: $appSettingProps, davProps: $davProps, networkProps: $networkProps, vpnProps: $vpnProps, themeProps: $themeProps, proxiesStyleProps: $proxiesStyleProps, windowProps: $windowProps, patchClashConfig: $patchClashConfig, excludeSSIDs: $excludeSSIDs, tailscaleProps: $tailscaleProps)';
 }
 
 
@@ -2362,11 +2362,11 @@ abstract mixin class $ConfigCopyWith<$Res>  {
   factory $ConfigCopyWith(Config value, $Res Function(Config) _then) = _$ConfigCopyWithImpl;
 @useResult
 $Res call({
- int? currentProfileId, bool overrideDns, List<HotKeyAction> hotKeyActions,@JsonKey(fromJson: AppSettingProps.safeFromJson) AppSettingProps appSettingProps, DAVProps? davProps, NetworkProps networkProps, VpnProps vpnProps,@JsonKey(fromJson: ThemeProps.safeFromJson) ThemeProps themeProps, ProxiesStyleProps proxiesStyleProps, WindowProps windowProps, PatchClashConfig patchClashConfig, List<String> excludeSSIDs
+ int? currentProfileId, bool overrideDns, List<HotKeyAction> hotKeyActions,@JsonKey(fromJson: AppSettingProps.safeFromJson) AppSettingProps appSettingProps, DAVProps? davProps, NetworkProps networkProps, VpnProps vpnProps,@JsonKey(fromJson: ThemeProps.safeFromJson) ThemeProps themeProps, ProxiesStyleProps proxiesStyleProps, WindowProps windowProps, PatchClashConfig patchClashConfig, List<String> excludeSSIDs,@JsonKey(fromJson: TailscaleProps.safeFromJson) TailscaleProps tailscaleProps
 });
 
 
-$AppSettingPropsCopyWith<$Res> get appSettingProps;$DAVPropsCopyWith<$Res>? get davProps;$NetworkPropsCopyWith<$Res> get networkProps;$VpnPropsCopyWith<$Res> get vpnProps;$ThemePropsCopyWith<$Res> get themeProps;$ProxiesStylePropsCopyWith<$Res> get proxiesStyleProps;$WindowPropsCopyWith<$Res> get windowProps;$PatchClashConfigCopyWith<$Res> get patchClashConfig;
+$AppSettingPropsCopyWith<$Res> get appSettingProps;$DAVPropsCopyWith<$Res>? get davProps;$NetworkPropsCopyWith<$Res> get networkProps;$VpnPropsCopyWith<$Res> get vpnProps;$ThemePropsCopyWith<$Res> get themeProps;$ProxiesStylePropsCopyWith<$Res> get proxiesStyleProps;$WindowPropsCopyWith<$Res> get windowProps;$PatchClashConfigCopyWith<$Res> get patchClashConfig;$TailscalePropsCopyWith<$Res> get tailscaleProps;
 
 }
 /// @nodoc
@@ -2379,7 +2379,7 @@ class _$ConfigCopyWithImpl<$Res>
 
 /// Create a copy of Config
 /// with the given fields replaced by the non-null parameter values.
-@pragma('vm:prefer-inline') @override $Res call({Object? currentProfileId = freezed,Object? overrideDns = null,Object? hotKeyActions = null,Object? appSettingProps = null,Object? davProps = freezed,Object? networkProps = null,Object? vpnProps = null,Object? themeProps = null,Object? proxiesStyleProps = null,Object? windowProps = null,Object? patchClashConfig = null,Object? excludeSSIDs = null,}) {
+@pragma('vm:prefer-inline') @override $Res call({Object? currentProfileId = freezed,Object? overrideDns = null,Object? hotKeyActions = null,Object? appSettingProps = null,Object? davProps = freezed,Object? networkProps = null,Object? vpnProps = null,Object? themeProps = null,Object? proxiesStyleProps = null,Object? windowProps = null,Object? patchClashConfig = null,Object? excludeSSIDs = null,Object? tailscaleProps = null,}) {
   return _then(_self.copyWith(
 currentProfileId: freezed == currentProfileId ? _self.currentProfileId : currentProfileId // ignore: cast_nullable_to_non_nullable
 as int?,overrideDns: null == overrideDns ? _self.overrideDns : overrideDns // ignore: cast_nullable_to_non_nullable
@@ -2393,7 +2393,8 @@ as ThemeProps,proxiesStyleProps: null == proxiesStyleProps ? _self.proxiesStyleP
 as ProxiesStyleProps,windowProps: null == windowProps ? _self.windowProps : windowProps // ignore: cast_nullable_to_non_nullable
 as WindowProps,patchClashConfig: null == patchClashConfig ? _self.patchClashConfig : patchClashConfig // ignore: cast_nullable_to_non_nullable
 as PatchClashConfig,excludeSSIDs: null == excludeSSIDs ? _self.excludeSSIDs : excludeSSIDs // ignore: cast_nullable_to_non_nullable
-as List<String>,
+as List<String>,tailscaleProps: null == tailscaleProps ? _self.tailscaleProps : tailscaleProps // ignore: cast_nullable_to_non_nullable
+as TailscaleProps,
   ));
 }
 /// Create a copy of Config
@@ -2471,6 +2472,15 @@ $PatchClashConfigCopyWith<$Res> get patchClashConfig {
   return $PatchClashConfigCopyWith<$Res>(_self.patchClashConfig, (value) {
     return _then(_self.copyWith(patchClashConfig: value));
   });
+}/// Create a copy of Config
+/// with the given fields replaced by the non-null parameter values.
+@override
+@pragma('vm:prefer-inline')
+$TailscalePropsCopyWith<$Res> get tailscaleProps {
+  
+  return $TailscalePropsCopyWith<$Res>(_self.tailscaleProps, (value) {
+    return _then(_self.copyWith(tailscaleProps: value));
+  });
 }
 }
 
@@ -2553,10 +2563,10 @@ return $default(_that);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( int? currentProfileId,  bool overrideDns,  List<HotKeyAction> hotKeyActions, @JsonKey(fromJson: AppSettingProps.safeFromJson)  AppSettingProps appSettingProps,  DAVProps? davProps,  NetworkProps networkProps,  VpnProps vpnProps, @JsonKey(fromJson: ThemeProps.safeFromJson)  ThemeProps themeProps,  ProxiesStyleProps proxiesStyleProps,  WindowProps windowProps,  PatchClashConfig patchClashConfig,  List<String> excludeSSIDs)?  $default,{required TResult orElse(),}) {final _that = this;
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( int? currentProfileId,  bool overrideDns,  List<HotKeyAction> hotKeyActions, @JsonKey(fromJson: AppSettingProps.safeFromJson)  AppSettingProps appSettingProps,  DAVProps? davProps,  NetworkProps networkProps,  VpnProps vpnProps, @JsonKey(fromJson: ThemeProps.safeFromJson)  ThemeProps themeProps,  ProxiesStyleProps proxiesStyleProps,  WindowProps windowProps,  PatchClashConfig patchClashConfig,  List<String> excludeSSIDs, @JsonKey(fromJson: TailscaleProps.safeFromJson)  TailscaleProps tailscaleProps)?  $default,{required TResult orElse(),}) {final _that = this;
 switch (_that) {
 case _Config() when $default != null:
-return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_that.appSettingProps,_that.davProps,_that.networkProps,_that.vpnProps,_that.themeProps,_that.proxiesStyleProps,_that.windowProps,_that.patchClashConfig,_that.excludeSSIDs);case _:
+return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_that.appSettingProps,_that.davProps,_that.networkProps,_that.vpnProps,_that.themeProps,_that.proxiesStyleProps,_that.windowProps,_that.patchClashConfig,_that.excludeSSIDs,_that.tailscaleProps);case _:
   return orElse();
 
 }
@@ -2574,10 +2584,10 @@ return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_th
 /// }
 /// ```
 
-@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( int? currentProfileId,  bool overrideDns,  List<HotKeyAction> hotKeyActions, @JsonKey(fromJson: AppSettingProps.safeFromJson)  AppSettingProps appSettingProps,  DAVProps? davProps,  NetworkProps networkProps,  VpnProps vpnProps, @JsonKey(fromJson: ThemeProps.safeFromJson)  ThemeProps themeProps,  ProxiesStyleProps proxiesStyleProps,  WindowProps windowProps,  PatchClashConfig patchClashConfig,  List<String> excludeSSIDs)  $default,) {final _that = this;
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( int? currentProfileId,  bool overrideDns,  List<HotKeyAction> hotKeyActions, @JsonKey(fromJson: AppSettingProps.safeFromJson)  AppSettingProps appSettingProps,  DAVProps? davProps,  NetworkProps networkProps,  VpnProps vpnProps, @JsonKey(fromJson: ThemeProps.safeFromJson)  ThemeProps themeProps,  ProxiesStyleProps proxiesStyleProps,  WindowProps windowProps,  PatchClashConfig patchClashConfig,  List<String> excludeSSIDs, @JsonKey(fromJson: TailscaleProps.safeFromJson)  TailscaleProps tailscaleProps)  $default,) {final _that = this;
 switch (_that) {
 case _Config():
-return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_that.appSettingProps,_that.davProps,_that.networkProps,_that.vpnProps,_that.themeProps,_that.proxiesStyleProps,_that.windowProps,_that.patchClashConfig,_that.excludeSSIDs);case _:
+return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_that.appSettingProps,_that.davProps,_that.networkProps,_that.vpnProps,_that.themeProps,_that.proxiesStyleProps,_that.windowProps,_that.patchClashConfig,_that.excludeSSIDs,_that.tailscaleProps);case _:
   throw StateError('Unexpected subclass');
 
 }
@@ -2594,10 +2604,10 @@ return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_th
 /// }
 /// ```
 
-@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( int? currentProfileId,  bool overrideDns,  List<HotKeyAction> hotKeyActions, @JsonKey(fromJson: AppSettingProps.safeFromJson)  AppSettingProps appSettingProps,  DAVProps? davProps,  NetworkProps networkProps,  VpnProps vpnProps, @JsonKey(fromJson: ThemeProps.safeFromJson)  ThemeProps themeProps,  ProxiesStyleProps proxiesStyleProps,  WindowProps windowProps,  PatchClashConfig patchClashConfig,  List<String> excludeSSIDs)?  $default,) {final _that = this;
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( int? currentProfileId,  bool overrideDns,  List<HotKeyAction> hotKeyActions, @JsonKey(fromJson: AppSettingProps.safeFromJson)  AppSettingProps appSettingProps,  DAVProps? davProps,  NetworkProps networkProps,  VpnProps vpnProps, @JsonKey(fromJson: ThemeProps.safeFromJson)  ThemeProps themeProps,  ProxiesStyleProps proxiesStyleProps,  WindowProps windowProps,  PatchClashConfig patchClashConfig,  List<String> excludeSSIDs, @JsonKey(fromJson: TailscaleProps.safeFromJson)  TailscaleProps tailscaleProps)?  $default,) {final _that = this;
 switch (_that) {
 case _Config() when $default != null:
-return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_that.appSettingProps,_that.davProps,_that.networkProps,_that.vpnProps,_that.themeProps,_that.proxiesStyleProps,_that.windowProps,_that.patchClashConfig,_that.excludeSSIDs);case _:
+return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_that.appSettingProps,_that.davProps,_that.networkProps,_that.vpnProps,_that.themeProps,_that.proxiesStyleProps,_that.windowProps,_that.patchClashConfig,_that.excludeSSIDs,_that.tailscaleProps);case _:
   return null;
 
 }
@@ -2609,7 +2619,7 @@ return $default(_that.currentProfileId,_that.overrideDns,_that.hotKeyActions,_th
 @JsonSerializable()
 
 class _Config implements Config {
-  const _Config({this.currentProfileId, this.overrideDns = false, final  List<HotKeyAction> hotKeyActions = const [], @JsonKey(fromJson: AppSettingProps.safeFromJson) this.appSettingProps = defaultAppSettingProps, this.davProps, this.networkProps = defaultNetworkProps, this.vpnProps = defaultVpnProps, @JsonKey(fromJson: ThemeProps.safeFromJson) required this.themeProps, this.proxiesStyleProps = defaultProxiesStyleProps, this.windowProps = defaultWindowProps, this.patchClashConfig = defaultClashConfig, final  List<String> excludeSSIDs = const []}): _hotKeyActions = hotKeyActions,_excludeSSIDs = excludeSSIDs;
+  const _Config({this.currentProfileId, this.overrideDns = false, final  List<HotKeyAction> hotKeyActions = const [], @JsonKey(fromJson: AppSettingProps.safeFromJson) this.appSettingProps = defaultAppSettingProps, this.davProps, this.networkProps = defaultNetworkProps, this.vpnProps = defaultVpnProps, @JsonKey(fromJson: ThemeProps.safeFromJson) required this.themeProps, this.proxiesStyleProps = defaultProxiesStyleProps, this.windowProps = defaultWindowProps, this.patchClashConfig = defaultClashConfig, final  List<String> excludeSSIDs = const [], @JsonKey(fromJson: TailscaleProps.safeFromJson) this.tailscaleProps = defaultTailscaleProps}): _hotKeyActions = hotKeyActions,_excludeSSIDs = excludeSSIDs;
   factory _Config.fromJson(Map<String, dynamic> json) => _$ConfigFromJson(json);
 
 @override final  int? currentProfileId;
@@ -2636,6 +2646,7 @@ class _Config implements Config {
   return EqualUnmodifiableListView(_excludeSSIDs);
 }
 
+@override@JsonKey(fromJson: TailscaleProps.safeFromJson) final  TailscaleProps tailscaleProps;
 
 /// Create a copy of Config
 /// with the given fields replaced by the non-null parameter values.
@@ -2650,16 +2661,16 @@ Map<String, dynamic> toJson() {
 
 @override
 bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is _Config&&(identical(other.currentProfileId, currentProfileId) || other.currentProfileId == currentProfileId)&&(identical(other.overrideDns, overrideDns) || other.overrideDns == overrideDns)&&const DeepCollectionEquality().equals(other._hotKeyActions, _hotKeyActions)&&(identical(other.appSettingProps, appSettingProps) || other.appSettingProps == appSettingProps)&&(identical(other.davProps, davProps) || other.davProps == davProps)&&(identical(other.networkProps, networkProps) || other.networkProps == networkProps)&&(identical(other.vpnProps, vpnProps) || other.vpnProps == vpnProps)&&(identical(other.themeProps, themeProps) || other.themeProps == themeProps)&&(identical(other.proxiesStyleProps, proxiesStyleProps) || other.proxiesStyleProps == proxiesStyleProps)&&(identical(other.windowProps, windowProps) || other.windowProps == windowProps)&&(identical(other.patchClashConfig, patchClashConfig) || other.patchClashConfig == patchClashConfig)&&const DeepCollectionEquality().equals(other._excludeSSIDs, _excludeSSIDs));
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is _Config&&(identical(other.currentProfileId, currentProfileId) || other.currentProfileId == currentProfileId)&&(identical(other.overrideDns, overrideDns) || other.overrideDns == overrideDns)&&const DeepCollectionEquality().equals(other._hotKeyActions, _hotKeyActions)&&(identical(other.appSettingProps, appSettingProps) || other.appSettingProps == appSettingProps)&&(identical(other.davProps, davProps) || other.davProps == davProps)&&(identical(other.networkProps, networkProps) || other.networkProps == networkProps)&&(identical(other.vpnProps, vpnProps) || other.vpnProps == vpnProps)&&(identical(other.themeProps, themeProps) || other.themeProps == themeProps)&&(identical(other.proxiesStyleProps, proxiesStyleProps) || other.proxiesStyleProps == proxiesStyleProps)&&(identical(other.windowProps, windowProps) || other.windowProps == windowProps)&&(identical(other.patchClashConfig, patchClashConfig) || other.patchClashConfig == patchClashConfig)&&const DeepCollectionEquality().equals(other._excludeSSIDs, _excludeSSIDs)&&(identical(other.tailscaleProps, tailscaleProps) || other.tailscaleProps == tailscaleProps));
 }
 
 @JsonKey(includeFromJson: false, includeToJson: false)
 @override
-int get hashCode => Object.hash(runtimeType,currentProfileId,overrideDns,const DeepCollectionEquality().hash(_hotKeyActions),appSettingProps,davProps,networkProps,vpnProps,themeProps,proxiesStyleProps,windowProps,patchClashConfig,const DeepCollectionEquality().hash(_excludeSSIDs));
+int get hashCode => Object.hash(runtimeType,currentProfileId,overrideDns,const DeepCollectionEquality().hash(_hotKeyActions),appSettingProps,davProps,networkProps,vpnProps,themeProps,proxiesStyleProps,windowProps,patchClashConfig,const DeepCollectionEquality().hash(_excludeSSIDs),tailscaleProps);
 
 @override
 String toString() {
-  return 'Config(currentProfileId: $currentProfileId, overrideDns: $overrideDns, hotKeyActions: $hotKeyActions, appSettingProps: $appSettingProps, davProps: $davProps, networkProps: $networkProps, vpnProps: $vpnProps, themeProps: $themeProps, proxiesStyleProps: $proxiesStyleProps, windowProps: $windowProps, patchClashConfig: $patchClashConfig, excludeSSIDs: $excludeSSIDs)';
+  return 'Config(currentProfileId: $currentProfileId, overrideDns: $overrideDns, hotKeyActions: $hotKeyActions, appSettingProps: $appSettingProps, davProps: $davProps, networkProps: $networkProps, vpnProps: $vpnProps, themeProps: $themeProps, proxiesStyleProps: $proxiesStyleProps, windowProps: $windowProps, patchClashConfig: $patchClashConfig, excludeSSIDs: $excludeSSIDs, tailscaleProps: $tailscaleProps)';
 }
 
 
@@ -2670,11 +2681,11 @@ abstract mixin class _$ConfigCopyWith<$Res> implements $ConfigCopyWith<$Res> {
   factory _$ConfigCopyWith(_Config value, $Res Function(_Config) _then) = __$ConfigCopyWithImpl;
 @override @useResult
 $Res call({
- int? currentProfileId, bool overrideDns, List<HotKeyAction> hotKeyActions,@JsonKey(fromJson: AppSettingProps.safeFromJson) AppSettingProps appSettingProps, DAVProps? davProps, NetworkProps networkProps, VpnProps vpnProps,@JsonKey(fromJson: ThemeProps.safeFromJson) ThemeProps themeProps, ProxiesStyleProps proxiesStyleProps, WindowProps windowProps, PatchClashConfig patchClashConfig, List<String> excludeSSIDs
+ int? currentProfileId, bool overrideDns, List<HotKeyAction> hotKeyActions,@JsonKey(fromJson: AppSettingProps.safeFromJson) AppSettingProps appSettingProps, DAVProps? davProps, NetworkProps networkProps, VpnProps vpnProps,@JsonKey(fromJson: ThemeProps.safeFromJson) ThemeProps themeProps, ProxiesStyleProps proxiesStyleProps, WindowProps windowProps, PatchClashConfig patchClashConfig, List<String> excludeSSIDs,@JsonKey(fromJson: TailscaleProps.safeFromJson) TailscaleProps tailscaleProps
 });
 
 
-@override $AppSettingPropsCopyWith<$Res> get appSettingProps;@override $DAVPropsCopyWith<$Res>? get davProps;@override $NetworkPropsCopyWith<$Res> get networkProps;@override $VpnPropsCopyWith<$Res> get vpnProps;@override $ThemePropsCopyWith<$Res> get themeProps;@override $ProxiesStylePropsCopyWith<$Res> get proxiesStyleProps;@override $WindowPropsCopyWith<$Res> get windowProps;@override $PatchClashConfigCopyWith<$Res> get patchClashConfig;
+@override $AppSettingPropsCopyWith<$Res> get appSettingProps;@override $DAVPropsCopyWith<$Res>? get davProps;@override $NetworkPropsCopyWith<$Res> get networkProps;@override $VpnPropsCopyWith<$Res> get vpnProps;@override $ThemePropsCopyWith<$Res> get themeProps;@override $ProxiesStylePropsCopyWith<$Res> get proxiesStyleProps;@override $WindowPropsCopyWith<$Res> get windowProps;@override $PatchClashConfigCopyWith<$Res> get patchClashConfig;@override $TailscalePropsCopyWith<$Res> get tailscaleProps;
 
 }
 /// @nodoc
@@ -2687,7 +2698,7 @@ class __$ConfigCopyWithImpl<$Res>
 
 /// Create a copy of Config
 /// with the given fields replaced by the non-null parameter values.
-@override @pragma('vm:prefer-inline') $Res call({Object? currentProfileId = freezed,Object? overrideDns = null,Object? hotKeyActions = null,Object? appSettingProps = null,Object? davProps = freezed,Object? networkProps = null,Object? vpnProps = null,Object? themeProps = null,Object? proxiesStyleProps = null,Object? windowProps = null,Object? patchClashConfig = null,Object? excludeSSIDs = null,}) {
+@override @pragma('vm:prefer-inline') $Res call({Object? currentProfileId = freezed,Object? overrideDns = null,Object? hotKeyActions = null,Object? appSettingProps = null,Object? davProps = freezed,Object? networkProps = null,Object? vpnProps = null,Object? themeProps = null,Object? proxiesStyleProps = null,Object? windowProps = null,Object? patchClashConfig = null,Object? excludeSSIDs = null,Object? tailscaleProps = null,}) {
   return _then(_Config(
 currentProfileId: freezed == currentProfileId ? _self.currentProfileId : currentProfileId // ignore: cast_nullable_to_non_nullable
 as int?,overrideDns: null == overrideDns ? _self.overrideDns : overrideDns // ignore: cast_nullable_to_non_nullable
@@ -2701,7 +2712,8 @@ as ThemeProps,proxiesStyleProps: null == proxiesStyleProps ? _self.proxiesStyleP
 as ProxiesStyleProps,windowProps: null == windowProps ? _self.windowProps : windowProps // ignore: cast_nullable_to_non_nullable
 as WindowProps,patchClashConfig: null == patchClashConfig ? _self.patchClashConfig : patchClashConfig // ignore: cast_nullable_to_non_nullable
 as PatchClashConfig,excludeSSIDs: null == excludeSSIDs ? _self._excludeSSIDs : excludeSSIDs // ignore: cast_nullable_to_non_nullable
-as List<String>,
+as List<String>,tailscaleProps: null == tailscaleProps ? _self.tailscaleProps : tailscaleProps // ignore: cast_nullable_to_non_nullable
+as TailscaleProps,
   ));
 }
 
@@ -2780,6 +2792,15 @@ $PatchClashConfigCopyWith<$Res> get patchClashConfig {
   return $PatchClashConfigCopyWith<$Res>(_self.patchClashConfig, (value) {
     return _then(_self.copyWith(patchClashConfig: value));
   });
+}/// Create a copy of Config
+/// with the given fields replaced by the non-null parameter values.
+@override
+@pragma('vm:prefer-inline')
+$TailscalePropsCopyWith<$Res> get tailscaleProps {
+  
+  return $TailscalePropsCopyWith<$Res>(_self.tailscaleProps, (value) {
+    return _then(_self.copyWith(tailscaleProps: value));
+  });
 }
 }
 
diff --git a/lib/models/generated/config.g.dart b/lib/models/generated/config.g.dart
index 76d3d60445..d2aec8f296 100644
--- a/lib/models/generated/config.g.dart
+++ b/lib/models/generated/config.g.dart
@@ -349,6 +349,11 @@ _Config _$ConfigFromJson(Map<String, dynamic> json) => _Config(
           ?.map((e) => e as String)
           .toList() ??
       const [],
+  tailscaleProps: json['tailscaleProps'] == null
+      ? defaultTailscaleProps
+      : TailscaleProps.safeFromJson(
+          json['tailscaleProps'] as Map<String, Object?>?,
+        ),
 );
 
 Map<String, dynamic> _$ConfigToJson(_Config instance) => <String, dynamic>{
@@ -364,4 +369,5 @@ Map<String, dynamic> _$ConfigToJson(_Config instance) => <String, dynamic>{
   'windowProps': instance.windowProps,
   'patchClashConfig': instance.patchClashConfig,
   'excludeSSIDs': instance.excludeSSIDs,
+  'tailscaleProps': instance.tailscaleProps,
 };
diff --git a/lib/models/generated/core.freezed.dart b/lib/models/generated/core.freezed.dart
index bc15672f9c..11647c217d 100644
--- a/lib/models/generated/core.freezed.dart
+++ b/lib/models/generated/core.freezed.dart
@@ -3360,275 +3360,6 @@ $SubscriptionInfoCopyWith<$Res>? get subscriptionInfo {
 }
 
 
-/// @nodoc
-mixin _$Action {
-
- ActionMethod get method; dynamic get data; String get id;
-/// Create a copy of Action
-/// with the given fields replaced by the non-null parameter values.
-@JsonKey(includeFromJson: false, includeToJson: false)
-@pragma('vm:prefer-inline')
-$ActionCopyWith<Action> get copyWith => _$ActionCopyWithImpl<Action>(this as Action, _$identity);
-
-  /// Serializes this Action to a JSON map.
-  Map<String, dynamic> toJson();
-
-
-@override
-bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is Action&&(identical(other.method, method) || other.method == method)&&const DeepCollectionEquality().equals(other.data, data)&&(identical(other.id, id) || other.id == id));
-}
-
-@JsonKey(includeFromJson: false, includeToJson: false)
-@override
-int get hashCode => Object.hash(runtimeType,method,const DeepCollectionEquality().hash(data),id);
-
-@override
-String toString() {
-  return 'Action(method: $method, data: $data, id: $id)';
-}
-
-
-}
-
-/// @nodoc
-abstract mixin class $ActionCopyWith<$Res>  {
-  factory $ActionCopyWith(Action value, $Res Function(Action) _then) = _$ActionCopyWithImpl;
-@useResult
-$Res call({
- ActionMethod method, dynamic data, String id
-});
-
-
-
-
-}
-/// @nodoc
-class _$ActionCopyWithImpl<$Res>
-    implements $ActionCopyWith<$Res> {
-  _$ActionCopyWithImpl(this._self, this._then);
-
-  final Action _self;
-  final $Res Function(Action) _then;
-
-/// Create a copy of Action
-/// with the given fields replaced by the non-null parameter values.
-@pragma('vm:prefer-inline') @override $Res call({Object? method = null,Object? data = freezed,Object? id = null,}) {
-  return _then(_self.copyWith(
-method: null == method ? _self.method : method // ignore: cast_nullable_to_non_nullable
-as ActionMethod,data: freezed == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
-as dynamic,id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
-as String,
-  ));
-}
-
-}
-
-
-/// Adds pattern-matching-related methods to [Action].
-extension ActionPatterns on Action {
-/// A variant of `map` that fallback to returning `orElse`.
-///
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case final Subclass value:
-///     return ...;
-///   case _:
-///     return orElse();
-/// }
-/// ```
-
-@optionalTypeArgs TResult maybeMap<TResult extends Object?>(TResult Function( _Action value)?  $default,{required TResult orElse(),}){
-final _that = this;
-switch (_that) {
-case _Action() when $default != null:
-return $default(_that);case _:
-  return orElse();
-
-}
-}
-/// A `switch`-like method, using callbacks.
-///
-/// Callbacks receives the raw object, upcasted.
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case final Subclass value:
-///     return ...;
-///   case final Subclass2 value:
-///     return ...;
-/// }
-/// ```
-
-@optionalTypeArgs TResult map<TResult extends Object?>(TResult Function( _Action value)  $default,){
-final _that = this;
-switch (_that) {
-case _Action():
-return $default(_that);case _:
-  throw StateError('Unexpected subclass');
-
-}
-}
-/// A variant of `map` that fallback to returning `null`.
-///
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case final Subclass value:
-///     return ...;
-///   case _:
-///     return null;
-/// }
-/// ```
-
-@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>(TResult? Function( _Action value)?  $default,){
-final _that = this;
-switch (_that) {
-case _Action() when $default != null:
-return $default(_that);case _:
-  return null;
-
-}
-}
-/// A variant of `when` that fallback to an `orElse` callback.
-///
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case Subclass(:final field):
-///     return ...;
-///   case _:
-///     return orElse();
-/// }
-/// ```
-
-@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( ActionMethod method,  dynamic data,  String id)?  $default,{required TResult orElse(),}) {final _that = this;
-switch (_that) {
-case _Action() when $default != null:
-return $default(_that.method,_that.data,_that.id);case _:
-  return orElse();
-
-}
-}
-/// A `switch`-like method, using callbacks.
-///
-/// As opposed to `map`, this offers destructuring.
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case Subclass(:final field):
-///     return ...;
-///   case Subclass2(:final field2):
-///     return ...;
-/// }
-/// ```
-
-@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( ActionMethod method,  dynamic data,  String id)  $default,) {final _that = this;
-switch (_that) {
-case _Action():
-return $default(_that.method,_that.data,_that.id);case _:
-  throw StateError('Unexpected subclass');
-
-}
-}
-/// A variant of `when` that fallback to returning `null`
-///
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case Subclass(:final field):
-///     return ...;
-///   case _:
-///     return null;
-/// }
-/// ```
-
-@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( ActionMethod method,  dynamic data,  String id)?  $default,) {final _that = this;
-switch (_that) {
-case _Action() when $default != null:
-return $default(_that.method,_that.data,_that.id);case _:
-  return null;
-
-}
-}
-
-}
-
-/// @nodoc
-@JsonSerializable()
-
-class _Action implements Action {
-  const _Action({required this.method, required this.data, required this.id});
-  factory _Action.fromJson(Map<String, dynamic> json) => _$ActionFromJson(json);
-
-@override final  ActionMethod method;
-@override final  dynamic data;
-@override final  String id;
-
-/// Create a copy of Action
-/// with the given fields replaced by the non-null parameter values.
-@override @JsonKey(includeFromJson: false, includeToJson: false)
-@pragma('vm:prefer-inline')
-_$ActionCopyWith<_Action> get copyWith => __$ActionCopyWithImpl<_Action>(this, _$identity);
-
-@override
-Map<String, dynamic> toJson() {
-  return _$ActionToJson(this, );
-}
-
-@override
-bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is _Action&&(identical(other.method, method) || other.method == method)&&const DeepCollectionEquality().equals(other.data, data)&&(identical(other.id, id) || other.id == id));
-}
-
-@JsonKey(includeFromJson: false, includeToJson: false)
-@override
-int get hashCode => Object.hash(runtimeType,method,const DeepCollectionEquality().hash(data),id);
-
-@override
-String toString() {
-  return 'Action(method: $method, data: $data, id: $id)';
-}
-
-
-}
-
-/// @nodoc
-abstract mixin class _$ActionCopyWith<$Res> implements $ActionCopyWith<$Res> {
-  factory _$ActionCopyWith(_Action value, $Res Function(_Action) _then) = __$ActionCopyWithImpl;
-@override @useResult
-$Res call({
- ActionMethod method, dynamic data, String id
-});
-
-
-
-
-}
-/// @nodoc
-class __$ActionCopyWithImpl<$Res>
-    implements _$ActionCopyWith<$Res> {
-  __$ActionCopyWithImpl(this._self, this._then);
-
-  final _Action _self;
-  final $Res Function(_Action) _then;
-
-/// Create a copy of Action
-/// with the given fields replaced by the non-null parameter values.
-@override @pragma('vm:prefer-inline') $Res call({Object? method = null,Object? data = freezed,Object? id = null,}) {
-  return _then(_Action(
-method: null == method ? _self.method : method // ignore: cast_nullable_to_non_nullable
-as ActionMethod,data: freezed == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
-as dynamic,id: null == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
-as String,
-  ));
-}
-
-
-}
-
-
 /// @nodoc
 mixin _$ProxiesData {
 
@@ -3904,278 +3635,6 @@ as List<String>,
 }
 
 
-}
-
-
-/// @nodoc
-mixin _$ActionResult {
-
- ActionMethod get method; dynamic get data; String? get id; ResultType get code;
-/// Create a copy of ActionResult
-/// with the given fields replaced by the non-null parameter values.
-@JsonKey(includeFromJson: false, includeToJson: false)
-@pragma('vm:prefer-inline')
-$ActionResultCopyWith<ActionResult> get copyWith => _$ActionResultCopyWithImpl<ActionResult>(this as ActionResult, _$identity);
-
-  /// Serializes this ActionResult to a JSON map.
-  Map<String, dynamic> toJson();
-
-
-@override
-bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is ActionResult&&(identical(other.method, method) || other.method == method)&&const DeepCollectionEquality().equals(other.data, data)&&(identical(other.id, id) || other.id == id)&&(identical(other.code, code) || other.code == code));
-}
-
-@JsonKey(includeFromJson: false, includeToJson: false)
-@override
-int get hashCode => Object.hash(runtimeType,method,const DeepCollectionEquality().hash(data),id,code);
-
-@override
-String toString() {
-  return 'ActionResult(method: $method, data: $data, id: $id, code: $code)';
-}
-
-
-}
-
-/// @nodoc
-abstract mixin class $ActionResultCopyWith<$Res>  {
-  factory $ActionResultCopyWith(ActionResult value, $Res Function(ActionResult) _then) = _$ActionResultCopyWithImpl;
-@useResult
-$Res call({
- ActionMethod method, dynamic data, String? id, ResultType code
-});
-
-
-
-
-}
-/// @nodoc
-class _$ActionResultCopyWithImpl<$Res>
-    implements $ActionResultCopyWith<$Res> {
-  _$ActionResultCopyWithImpl(this._self, this._then);
-
-  final ActionResult _self;
-  final $Res Function(ActionResult) _then;
-
-/// Create a copy of ActionResult
-/// with the given fields replaced by the non-null parameter values.
-@pragma('vm:prefer-inline') @override $Res call({Object? method = null,Object? data = freezed,Object? id = freezed,Object? code = null,}) {
-  return _then(_self.copyWith(
-method: null == method ? _self.method : method // ignore: cast_nullable_to_non_nullable
-as ActionMethod,data: freezed == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
-as dynamic,id: freezed == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
-as String?,code: null == code ? _self.code : code // ignore: cast_nullable_to_non_nullable
-as ResultType,
-  ));
-}
-
-}
-
-
-/// Adds pattern-matching-related methods to [ActionResult].
-extension ActionResultPatterns on ActionResult {
-/// A variant of `map` that fallback to returning `orElse`.
-///
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case final Subclass value:
-///     return ...;
-///   case _:
-///     return orElse();
-/// }
-/// ```
-
-@optionalTypeArgs TResult maybeMap<TResult extends Object?>(TResult Function( _ActionResult value)?  $default,{required TResult orElse(),}){
-final _that = this;
-switch (_that) {
-case _ActionResult() when $default != null:
-return $default(_that);case _:
-  return orElse();
-
-}
-}
-/// A `switch`-like method, using callbacks.
-///
-/// Callbacks receives the raw object, upcasted.
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case final Subclass value:
-///     return ...;
-///   case final Subclass2 value:
-///     return ...;
-/// }
-/// ```
-
-@optionalTypeArgs TResult map<TResult extends Object?>(TResult Function( _ActionResult value)  $default,){
-final _that = this;
-switch (_that) {
-case _ActionResult():
-return $default(_that);case _:
-  throw StateError('Unexpected subclass');
-
-}
-}
-/// A variant of `map` that fallback to returning `null`.
-///
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case final Subclass value:
-///     return ...;
-///   case _:
-///     return null;
-/// }
-/// ```
-
-@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>(TResult? Function( _ActionResult value)?  $default,){
-final _that = this;
-switch (_that) {
-case _ActionResult() when $default != null:
-return $default(_that);case _:
-  return null;
-
-}
-}
-/// A variant of `when` that fallback to an `orElse` callback.
-///
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case Subclass(:final field):
-///     return ...;
-///   case _:
-///     return orElse();
-/// }
-/// ```
-
-@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( ActionMethod method,  dynamic data,  String? id,  ResultType code)?  $default,{required TResult orElse(),}) {final _that = this;
-switch (_that) {
-case _ActionResult() when $default != null:
-return $default(_that.method,_that.data,_that.id,_that.code);case _:
-  return orElse();
-
-}
-}
-/// A `switch`-like method, using callbacks.
-///
-/// As opposed to `map`, this offers destructuring.
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case Subclass(:final field):
-///     return ...;
-///   case Subclass2(:final field2):
-///     return ...;
-/// }
-/// ```
-
-@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( ActionMethod method,  dynamic data,  String? id,  ResultType code)  $default,) {final _that = this;
-switch (_that) {
-case _ActionResult():
-return $default(_that.method,_that.data,_that.id,_that.code);case _:
-  throw StateError('Unexpected subclass');
-
-}
-}
-/// A variant of `when` that fallback to returning `null`
-///
-/// It is equivalent to doing:
-/// ```dart
-/// switch (sealedClass) {
-///   case Subclass(:final field):
-///     return ...;
-///   case _:
-///     return null;
-/// }
-/// ```
-
-@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( ActionMethod method,  dynamic data,  String? id,  ResultType code)?  $default,) {final _that = this;
-switch (_that) {
-case _ActionResult() when $default != null:
-return $default(_that.method,_that.data,_that.id,_that.code);case _:
-  return null;
-
-}
-}
-
-}
-
-/// @nodoc
-@JsonSerializable()
-
-class _ActionResult implements ActionResult {
-  const _ActionResult({required this.method, required this.data, this.id, this.code = ResultType.success});
-  factory _ActionResult.fromJson(Map<String, dynamic> json) => _$ActionResultFromJson(json);
-
-@override final  ActionMethod method;
-@override final  dynamic data;
-@override final  String? id;
-@override@JsonKey() final  ResultType code;
-
-/// Create a copy of ActionResult
-/// with the given fields replaced by the non-null parameter values.
-@override @JsonKey(includeFromJson: false, includeToJson: false)
-@pragma('vm:prefer-inline')
-_$ActionResultCopyWith<_ActionResult> get copyWith => __$ActionResultCopyWithImpl<_ActionResult>(this, _$identity);
-
-@override
-Map<String, dynamic> toJson() {
-  return _$ActionResultToJson(this, );
-}
-
-@override
-bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is _ActionResult&&(identical(other.method, method) || other.method == method)&&const DeepCollectionEquality().equals(other.data, data)&&(identical(other.id, id) || other.id == id)&&(identical(other.code, code) || other.code == code));
-}
-
-@JsonKey(includeFromJson: false, includeToJson: false)
-@override
-int get hashCode => Object.hash(runtimeType,method,const DeepCollectionEquality().hash(data),id,code);
-
-@override
-String toString() {
-  return 'ActionResult(method: $method, data: $data, id: $id, code: $code)';
-}
-
-
-}
-
-/// @nodoc
-abstract mixin class _$ActionResultCopyWith<$Res> implements $ActionResultCopyWith<$Res> {
-  factory _$ActionResultCopyWith(_ActionResult value, $Res Function(_ActionResult) _then) = __$ActionResultCopyWithImpl;
-@override @useResult
-$Res call({
- ActionMethod method, dynamic data, String? id, ResultType code
-});
-
-
-
-
-}
-/// @nodoc
-class __$ActionResultCopyWithImpl<$Res>
-    implements _$ActionResultCopyWith<$Res> {
-  __$ActionResultCopyWithImpl(this._self, this._then);
-
-  final _ActionResult _self;
-  final $Res Function(_ActionResult) _then;
-
-/// Create a copy of ActionResult
-/// with the given fields replaced by the non-null parameter values.
-@override @pragma('vm:prefer-inline') $Res call({Object? method = null,Object? data = freezed,Object? id = freezed,Object? code = null,}) {
-  return _then(_ActionResult(
-method: null == method ? _self.method : method // ignore: cast_nullable_to_non_nullable
-as ActionMethod,data: freezed == data ? _self.data : data // ignore: cast_nullable_to_non_nullable
-as dynamic,id: freezed == id ? _self.id : id // ignore: cast_nullable_to_non_nullable
-as String?,code: null == code ? _self.code : code // ignore: cast_nullable_to_non_nullable
-as ResultType,
-  ));
-}
-
-
 }
 
 // dart format on
diff --git a/lib/models/generated/core.g.dart b/lib/models/generated/core.g.dart
index 7e785dfad3..8db5436cb2 100644
--- a/lib/models/generated/core.g.dart
+++ b/lib/models/generated/core.g.dart
@@ -250,60 +250,6 @@ Map<String, dynamic> _$ExternalProviderToJson(_ExternalProvider instance) =>
       'update-at': instance.updateAt.toIso8601String(),
     };
 
-_Action _$ActionFromJson(Map<String, dynamic> json) => _Action(
-  method: $enumDecode(_$ActionMethodEnumMap, json['method']),
-  data: json['data'],
-  id: json['id'] as String,
-);
-
-Map<String, dynamic> _$ActionToJson(_Action instance) => <String, dynamic>{
-  'method': _$ActionMethodEnumMap[instance.method]!,
-  'data': instance.data,
-  'id': instance.id,
-};
-
-const _$ActionMethodEnumMap = {
-  ActionMethod.message: 'message',
-  ActionMethod.initClash: 'initClash',
-  ActionMethod.getIsInit: 'getIsInit',
-  ActionMethod.forceGc: 'forceGc',
-  ActionMethod.shutdown: 'shutdown',
-  ActionMethod.validateConfig: 'validateConfig',
-  ActionMethod.updateConfig: 'updateConfig',
-  ActionMethod.getConfig: 'getConfig',
-  ActionMethod.getProxies: 'getProxies',
-  ActionMethod.changeProxy: 'changeProxy',
-  ActionMethod.getTraffic: 'getTraffic',
-  ActionMethod.getTotalTraffic: 'getTotalTraffic',
-  ActionMethod.resetTraffic: 'resetTraffic',
-  ActionMethod.asyncTestDelay: 'asyncTestDelay',
-  ActionMethod.getConnections: 'getConnections',
-  ActionMethod.closeConnections: 'closeConnections',
-  ActionMethod.resetConnections: 'resetConnections',
-  ActionMethod.closeConnection: 'closeConnection',
-  ActionMethod.getExternalProviders: 'getExternalProviders',
-  ActionMethod.getExternalProvider: 'getExternalProvider',
-  ActionMethod.updateGeoData: 'updateGeoData',
-  ActionMethod.updateExternalProvider: 'updateExternalProvider',
-  ActionMethod.sideLoadExternalProvider: 'sideLoadExternalProvider',
-  ActionMethod.startLog: 'startLog',
-  ActionMethod.stopLog: 'stopLog',
-  ActionMethod.startListener: 'startListener',
-  ActionMethod.stopListener: 'stopListener',
-  ActionMethod.getCountryCode: 'getCountryCode',
-  ActionMethod.getMemory: 'getMemory',
-  ActionMethod.crash: 'crash',
-  ActionMethod.setupConfig: 'setupConfig',
-  ActionMethod.deleteFile: 'deleteFile',
-  ActionMethod.setState: 'setState',
-  ActionMethod.startTun: 'startTun',
-  ActionMethod.stopTun: 'stopTun',
-  ActionMethod.getRunTime: 'getRunTime',
-  ActionMethod.updateDns: 'updateDns',
-  ActionMethod.getAndroidVpnOptions: 'getAndroidVpnOptions',
-  ActionMethod.getCurrentProfileName: 'getCurrentProfileName',
-};
-
 _ProxiesData _$ProxiesDataFromJson(Map<String, dynamic> json) => _ProxiesData(
   proxies: json['proxies'] as Map<String, dynamic>,
   all: (json['all'] as List<dynamic>).map((e) => e as String).toList(),
@@ -311,23 +257,3 @@ _ProxiesData _$ProxiesDataFromJson(Map<String, dynamic> json) => _ProxiesData(
 
 Map<String, dynamic> _$ProxiesDataToJson(_ProxiesData instance) =>
     <String, dynamic>{'proxies': instance.proxies, 'all': instance.all};
-
-_ActionResult _$ActionResultFromJson(Map<String, dynamic> json) =>
-    _ActionResult(
-      method: $enumDecode(_$ActionMethodEnumMap, json['method']),
-      data: json['data'],
-      id: json['id'] as String?,
-      code:
-          $enumDecodeNullable(_$ResultTypeEnumMap, json['code']) ??
-          ResultType.success,
-    );
-
-Map<String, dynamic> _$ActionResultToJson(_ActionResult instance) =>
-    <String, dynamic>{
-      'method': _$ActionMethodEnumMap[instance.method]!,
-      'data': instance.data,
-      'id': instance.id,
-      'code': _$ResultTypeEnumMap[instance.code]!,
-    };
-
-const _$ResultTypeEnumMap = {ResultType.success: 0, ResultType.error: -1};
diff --git a/lib/models/generated/state.freezed.dart b/lib/models/generated/state.freezed.dart
index ae57583f99..e0d0809a66 100644
--- a/lib/models/generated/state.freezed.dart
+++ b/lib/models/generated/state.freezed.dart
@@ -9062,7 +9062,7 @@ $ProxiesDataCopyWith<$Res> get proxiesData {
 /// @nodoc
 mixin _$MakeRealProfileState {
 
- String get profilesPath; int get profileId; Map<String, dynamic> get rawConfig; PatchClashConfig get realPatchConfig; bool get overrideDns; bool get appendSystemDns; List<ProxyGroup> get proxyGroups; List<Rule> get rules; List<Rule> get addedRules; String get defaultUA;
+ String get profilesPath; int get profileId; Map<String, dynamic> get rawConfig; PatchClashConfig get realPatchConfig; bool get overrideDns; bool get appendSystemDns; List<ProxyGroup> get proxyGroups; List<Rule> get rules; List<Rule> get addedRules; String get defaultUA; List<TailscaleProxy> get tailscaleProxies; List<String> get tailscaleRules; List<String> get tailscaleFakeIpFilters;
 /// Create a copy of MakeRealProfileState
 /// with the given fields replaced by the non-null parameter values.
 @JsonKey(includeFromJson: false, includeToJson: false)
@@ -9073,16 +9073,16 @@ $MakeRealProfileStateCopyWith<MakeRealProfileState> get copyWith => _$MakeRealPr
 
 @override
 bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is MakeRealProfileState&&(identical(other.profilesPath, profilesPath) || other.profilesPath == profilesPath)&&(identical(other.profileId, profileId) || other.profileId == profileId)&&const DeepCollectionEquality().equals(other.rawConfig, rawConfig)&&(identical(other.realPatchConfig, realPatchConfig) || other.realPatchConfig == realPatchConfig)&&(identical(other.overrideDns, overrideDns) || other.overrideDns == overrideDns)&&(identical(other.appendSystemDns, appendSystemDns) || other.appendSystemDns == appendSystemDns)&&const DeepCollectionEquality().equals(other.proxyGroups, proxyGroups)&&const DeepCollectionEquality().equals(other.rules, rules)&&const DeepCollectionEquality().equals(other.addedRules, addedRules)&&(identical(other.defaultUA, defaultUA) || other.defaultUA == defaultUA));
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is MakeRealProfileState&&(identical(other.profilesPath, profilesPath) || other.profilesPath == profilesPath)&&(identical(other.profileId, profileId) || other.profileId == profileId)&&const DeepCollectionEquality().equals(other.rawConfig, rawConfig)&&(identical(other.realPatchConfig, realPatchConfig) || other.realPatchConfig == realPatchConfig)&&(identical(other.overrideDns, overrideDns) || other.overrideDns == overrideDns)&&(identical(other.appendSystemDns, appendSystemDns) || other.appendSystemDns == appendSystemDns)&&const DeepCollectionEquality().equals(other.proxyGroups, proxyGroups)&&const DeepCollectionEquality().equals(other.rules, rules)&&const DeepCollectionEquality().equals(other.addedRules, addedRules)&&(identical(other.defaultUA, defaultUA) || other.defaultUA == defaultUA)&&const DeepCollectionEquality().equals(other.tailscaleProxies, tailscaleProxies)&&const DeepCollectionEquality().equals(other.tailscaleRules, tailscaleRules)&&const DeepCollectionEquality().equals(other.tailscaleFakeIpFilters, tailscaleFakeIpFilters));
 }
 
 
 @override
-int get hashCode => Object.hash(runtimeType,profilesPath,profileId,const DeepCollectionEquality().hash(rawConfig),realPatchConfig,overrideDns,appendSystemDns,const DeepCollectionEquality().hash(proxyGroups),const DeepCollectionEquality().hash(rules),const DeepCollectionEquality().hash(addedRules),defaultUA);
+int get hashCode => Object.hash(runtimeType,profilesPath,profileId,const DeepCollectionEquality().hash(rawConfig),realPatchConfig,overrideDns,appendSystemDns,const DeepCollectionEquality().hash(proxyGroups),const DeepCollectionEquality().hash(rules),const DeepCollectionEquality().hash(addedRules),defaultUA,const DeepCollectionEquality().hash(tailscaleProxies),const DeepCollectionEquality().hash(tailscaleRules),const DeepCollectionEquality().hash(tailscaleFakeIpFilters));
 
 @override
 String toString() {
-  return 'MakeRealProfileState(profilesPath: $profilesPath, profileId: $profileId, rawConfig: $rawConfig, realPatchConfig: $realPatchConfig, overrideDns: $overrideDns, appendSystemDns: $appendSystemDns, proxyGroups: $proxyGroups, rules: $rules, addedRules: $addedRules, defaultUA: $defaultUA)';
+  return 'MakeRealProfileState(profilesPath: $profilesPath, profileId: $profileId, rawConfig: $rawConfig, realPatchConfig: $realPatchConfig, overrideDns: $overrideDns, appendSystemDns: $appendSystemDns, proxyGroups: $proxyGroups, rules: $rules, addedRules: $addedRules, defaultUA: $defaultUA, tailscaleProxies: $tailscaleProxies, tailscaleRules: $tailscaleRules, tailscaleFakeIpFilters: $tailscaleFakeIpFilters)';
 }
 
 
@@ -9093,7 +9093,7 @@ abstract mixin class $MakeRealProfileStateCopyWith<$Res>  {
   factory $MakeRealProfileStateCopyWith(MakeRealProfileState value, $Res Function(MakeRealProfileState) _then) = _$MakeRealProfileStateCopyWithImpl;
 @useResult
 $Res call({
- String profilesPath, int profileId, Map<String, dynamic> rawConfig, PatchClashConfig realPatchConfig, bool overrideDns, bool appendSystemDns, List<ProxyGroup> proxyGroups, List<Rule> rules, List<Rule> addedRules, String defaultUA
+ String profilesPath, int profileId, Map<String, dynamic> rawConfig, PatchClashConfig realPatchConfig, bool overrideDns, bool appendSystemDns, List<ProxyGroup> proxyGroups, List<Rule> rules, List<Rule> addedRules, String defaultUA, List<TailscaleProxy> tailscaleProxies, List<String> tailscaleRules, List<String> tailscaleFakeIpFilters
 });
 
 
@@ -9110,7 +9110,7 @@ class _$MakeRealProfileStateCopyWithImpl<$Res>
 
 /// Create a copy of MakeRealProfileState
 /// with the given fields replaced by the non-null parameter values.
-@pragma('vm:prefer-inline') @override $Res call({Object? profilesPath = null,Object? profileId = null,Object? rawConfig = null,Object? realPatchConfig = null,Object? overrideDns = null,Object? appendSystemDns = null,Object? proxyGroups = null,Object? rules = null,Object? addedRules = null,Object? defaultUA = null,}) {
+@pragma('vm:prefer-inline') @override $Res call({Object? profilesPath = null,Object? profileId = null,Object? rawConfig = null,Object? realPatchConfig = null,Object? overrideDns = null,Object? appendSystemDns = null,Object? proxyGroups = null,Object? rules = null,Object? addedRules = null,Object? defaultUA = null,Object? tailscaleProxies = null,Object? tailscaleRules = null,Object? tailscaleFakeIpFilters = null,}) {
   return _then(_self.copyWith(
 profilesPath: null == profilesPath ? _self.profilesPath : profilesPath // ignore: cast_nullable_to_non_nullable
 as String,profileId: null == profileId ? _self.profileId : profileId // ignore: cast_nullable_to_non_nullable
@@ -9122,7 +9122,10 @@ as bool,proxyGroups: null == proxyGroups ? _self.proxyGroups : proxyGroups // ig
 as List<ProxyGroup>,rules: null == rules ? _self.rules : rules // ignore: cast_nullable_to_non_nullable
 as List<Rule>,addedRules: null == addedRules ? _self.addedRules : addedRules // ignore: cast_nullable_to_non_nullable
 as List<Rule>,defaultUA: null == defaultUA ? _self.defaultUA : defaultUA // ignore: cast_nullable_to_non_nullable
-as String,
+as String,tailscaleProxies: null == tailscaleProxies ? _self.tailscaleProxies : tailscaleProxies // ignore: cast_nullable_to_non_nullable
+as List<TailscaleProxy>,tailscaleRules: null == tailscaleRules ? _self.tailscaleRules : tailscaleRules // ignore: cast_nullable_to_non_nullable
+as List<String>,tailscaleFakeIpFilters: null == tailscaleFakeIpFilters ? _self.tailscaleFakeIpFilters : tailscaleFakeIpFilters // ignore: cast_nullable_to_non_nullable
+as List<String>,
   ));
 }
 /// Create a copy of MakeRealProfileState
@@ -9216,10 +9219,10 @@ return $default(_that);case _:
 /// }
 /// ```
 
-@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( String profilesPath,  int profileId,  Map<String, dynamic> rawConfig,  PatchClashConfig realPatchConfig,  bool overrideDns,  bool appendSystemDns,  List<ProxyGroup> proxyGroups,  List<Rule> rules,  List<Rule> addedRules,  String defaultUA)?  $default,{required TResult orElse(),}) {final _that = this;
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( String profilesPath,  int profileId,  Map<String, dynamic> rawConfig,  PatchClashConfig realPatchConfig,  bool overrideDns,  bool appendSystemDns,  List<ProxyGroup> proxyGroups,  List<Rule> rules,  List<Rule> addedRules,  String defaultUA,  List<TailscaleProxy> tailscaleProxies,  List<String> tailscaleRules,  List<String> tailscaleFakeIpFilters)?  $default,{required TResult orElse(),}) {final _that = this;
 switch (_that) {
 case _MakeRealProfileState() when $default != null:
-return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPatchConfig,_that.overrideDns,_that.appendSystemDns,_that.proxyGroups,_that.rules,_that.addedRules,_that.defaultUA);case _:
+return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPatchConfig,_that.overrideDns,_that.appendSystemDns,_that.proxyGroups,_that.rules,_that.addedRules,_that.defaultUA,_that.tailscaleProxies,_that.tailscaleRules,_that.tailscaleFakeIpFilters);case _:
   return orElse();
 
 }
@@ -9237,10 +9240,10 @@ return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPat
 /// }
 /// ```
 
-@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( String profilesPath,  int profileId,  Map<String, dynamic> rawConfig,  PatchClashConfig realPatchConfig,  bool overrideDns,  bool appendSystemDns,  List<ProxyGroup> proxyGroups,  List<Rule> rules,  List<Rule> addedRules,  String defaultUA)  $default,) {final _that = this;
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( String profilesPath,  int profileId,  Map<String, dynamic> rawConfig,  PatchClashConfig realPatchConfig,  bool overrideDns,  bool appendSystemDns,  List<ProxyGroup> proxyGroups,  List<Rule> rules,  List<Rule> addedRules,  String defaultUA,  List<TailscaleProxy> tailscaleProxies,  List<String> tailscaleRules,  List<String> tailscaleFakeIpFilters)  $default,) {final _that = this;
 switch (_that) {
 case _MakeRealProfileState():
-return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPatchConfig,_that.overrideDns,_that.appendSystemDns,_that.proxyGroups,_that.rules,_that.addedRules,_that.defaultUA);case _:
+return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPatchConfig,_that.overrideDns,_that.appendSystemDns,_that.proxyGroups,_that.rules,_that.addedRules,_that.defaultUA,_that.tailscaleProxies,_that.tailscaleRules,_that.tailscaleFakeIpFilters);case _:
   throw StateError('Unexpected subclass');
 
 }
@@ -9257,10 +9260,10 @@ return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPat
 /// }
 /// ```
 
-@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( String profilesPath,  int profileId,  Map<String, dynamic> rawConfig,  PatchClashConfig realPatchConfig,  bool overrideDns,  bool appendSystemDns,  List<ProxyGroup> proxyGroups,  List<Rule> rules,  List<Rule> addedRules,  String defaultUA)?  $default,) {final _that = this;
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( String profilesPath,  int profileId,  Map<String, dynamic> rawConfig,  PatchClashConfig realPatchConfig,  bool overrideDns,  bool appendSystemDns,  List<ProxyGroup> proxyGroups,  List<Rule> rules,  List<Rule> addedRules,  String defaultUA,  List<TailscaleProxy> tailscaleProxies,  List<String> tailscaleRules,  List<String> tailscaleFakeIpFilters)?  $default,) {final _that = this;
 switch (_that) {
 case _MakeRealProfileState() when $default != null:
-return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPatchConfig,_that.overrideDns,_that.appendSystemDns,_that.proxyGroups,_that.rules,_that.addedRules,_that.defaultUA);case _:
+return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPatchConfig,_that.overrideDns,_that.appendSystemDns,_that.proxyGroups,_that.rules,_that.addedRules,_that.defaultUA,_that.tailscaleProxies,_that.tailscaleRules,_that.tailscaleFakeIpFilters);case _:
   return null;
 
 }
@@ -9272,7 +9275,7 @@ return $default(_that.profilesPath,_that.profileId,_that.rawConfig,_that.realPat
 
 
 class _MakeRealProfileState implements MakeRealProfileState {
-  const _MakeRealProfileState({required this.profilesPath, required this.profileId, required final  Map<String, dynamic> rawConfig, required this.realPatchConfig, required this.overrideDns, required this.appendSystemDns, required final  List<ProxyGroup> proxyGroups, required final  List<Rule> rules, required final  List<Rule> addedRules, required this.defaultUA}): _rawConfig = rawConfig,_proxyGroups = proxyGroups,_rules = rules,_addedRules = addedRules;
+  const _MakeRealProfileState({required this.profilesPath, required this.profileId, required final  Map<String, dynamic> rawConfig, required this.realPatchConfig, required this.overrideDns, required this.appendSystemDns, required final  List<ProxyGroup> proxyGroups, required final  List<Rule> rules, required final  List<Rule> addedRules, required this.defaultUA, final  List<TailscaleProxy> tailscaleProxies = const [], final  List<String> tailscaleRules = const [], final  List<String> tailscaleFakeIpFilters = const []}): _rawConfig = rawConfig,_proxyGroups = proxyGroups,_rules = rules,_addedRules = addedRules,_tailscaleProxies = tailscaleProxies,_tailscaleRules = tailscaleRules,_tailscaleFakeIpFilters = tailscaleFakeIpFilters;
   
 
 @override final  String profilesPath;
@@ -9309,6 +9312,27 @@ class _MakeRealProfileState implements MakeRealProfileState {
 }
 
 @override final  String defaultUA;
+ final  List<TailscaleProxy> _tailscaleProxies;
+@override@JsonKey() List<TailscaleProxy> get tailscaleProxies {
+  if (_tailscaleProxies is EqualUnmodifiableListView) return _tailscaleProxies;
+  // ignore: implicit_dynamic_type
+  return EqualUnmodifiableListView(_tailscaleProxies);
+}
+
+ final  List<String> _tailscaleRules;
+@override@JsonKey() List<String> get tailscaleRules {
+  if (_tailscaleRules is EqualUnmodifiableListView) return _tailscaleRules;
+  // ignore: implicit_dynamic_type
+  return EqualUnmodifiableListView(_tailscaleRules);
+}
+
+ final  List<String> _tailscaleFakeIpFilters;
+@override@JsonKey() List<String> get tailscaleFakeIpFilters {
+  if (_tailscaleFakeIpFilters is EqualUnmodifiableListView) return _tailscaleFakeIpFilters;
+  // ignore: implicit_dynamic_type
+  return EqualUnmodifiableListView(_tailscaleFakeIpFilters);
+}
+
 
 /// Create a copy of MakeRealProfileState
 /// with the given fields replaced by the non-null parameter values.
@@ -9320,16 +9344,16 @@ _$MakeRealProfileStateCopyWith<_MakeRealProfileState> get copyWith => __$MakeRea
 
 @override
 bool operator ==(Object other) {
-  return identical(this, other) || (other.runtimeType == runtimeType&&other is _MakeRealProfileState&&(identical(other.profilesPath, profilesPath) || other.profilesPath == profilesPath)&&(identical(other.profileId, profileId) || other.profileId == profileId)&&const DeepCollectionEquality().equals(other._rawConfig, _rawConfig)&&(identical(other.realPatchConfig, realPatchConfig) || other.realPatchConfig == realPatchConfig)&&(identical(other.overrideDns, overrideDns) || other.overrideDns == overrideDns)&&(identical(other.appendSystemDns, appendSystemDns) || other.appendSystemDns == appendSystemDns)&&const DeepCollectionEquality().equals(other._proxyGroups, _proxyGroups)&&const DeepCollectionEquality().equals(other._rules, _rules)&&const DeepCollectionEquality().equals(other._addedRules, _addedRules)&&(identical(other.defaultUA, defaultUA) || other.defaultUA == defaultUA));
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is _MakeRealProfileState&&(identical(other.profilesPath, profilesPath) || other.profilesPath == profilesPath)&&(identical(other.profileId, profileId) || other.profileId == profileId)&&const DeepCollectionEquality().equals(other._rawConfig, _rawConfig)&&(identical(other.realPatchConfig, realPatchConfig) || other.realPatchConfig == realPatchConfig)&&(identical(other.overrideDns, overrideDns) || other.overrideDns == overrideDns)&&(identical(other.appendSystemDns, appendSystemDns) || other.appendSystemDns == appendSystemDns)&&const DeepCollectionEquality().equals(other._proxyGroups, _proxyGroups)&&const DeepCollectionEquality().equals(other._rules, _rules)&&const DeepCollectionEquality().equals(other._addedRules, _addedRules)&&(identical(other.defaultUA, defaultUA) || other.defaultUA == defaultUA)&&const DeepCollectionEquality().equals(other._tailscaleProxies, _tailscaleProxies)&&const DeepCollectionEquality().equals(other._tailscaleRules, _tailscaleRules)&&const DeepCollectionEquality().equals(other._tailscaleFakeIpFilters, _tailscaleFakeIpFilters));
 }
 
 
 @override
-int get hashCode => Object.hash(runtimeType,profilesPath,profileId,const DeepCollectionEquality().hash(_rawConfig),realPatchConfig,overrideDns,appendSystemDns,const DeepCollectionEquality().hash(_proxyGroups),const DeepCollectionEquality().hash(_rules),const DeepCollectionEquality().hash(_addedRules),defaultUA);
+int get hashCode => Object.hash(runtimeType,profilesPath,profileId,const DeepCollectionEquality().hash(_rawConfig),realPatchConfig,overrideDns,appendSystemDns,const DeepCollectionEquality().hash(_proxyGroups),const DeepCollectionEquality().hash(_rules),const DeepCollectionEquality().hash(_addedRules),defaultUA,const DeepCollectionEquality().hash(_tailscaleProxies),const DeepCollectionEquality().hash(_tailscaleRules),const DeepCollectionEquality().hash(_tailscaleFakeIpFilters));
 
 @override
 String toString() {
-  return 'MakeRealProfileState(profilesPath: $profilesPath, profileId: $profileId, rawConfig: $rawConfig, realPatchConfig: $realPatchConfig, overrideDns: $overrideDns, appendSystemDns: $appendSystemDns, proxyGroups: $proxyGroups, rules: $rules, addedRules: $addedRules, defaultUA: $defaultUA)';
+  return 'MakeRealProfileState(profilesPath: $profilesPath, profileId: $profileId, rawConfig: $rawConfig, realPatchConfig: $realPatchConfig, overrideDns: $overrideDns, appendSystemDns: $appendSystemDns, proxyGroups: $proxyGroups, rules: $rules, addedRules: $addedRules, defaultUA: $defaultUA, tailscaleProxies: $tailscaleProxies, tailscaleRules: $tailscaleRules, tailscaleFakeIpFilters: $tailscaleFakeIpFilters)';
 }
 
 
@@ -9340,7 +9364,7 @@ abstract mixin class _$MakeRealProfileStateCopyWith<$Res> implements $MakeRealPr
   factory _$MakeRealProfileStateCopyWith(_MakeRealProfileState value, $Res Function(_MakeRealProfileState) _then) = __$MakeRealProfileStateCopyWithImpl;
 @override @useResult
 $Res call({
- String profilesPath, int profileId, Map<String, dynamic> rawConfig, PatchClashConfig realPatchConfig, bool overrideDns, bool appendSystemDns, List<ProxyGroup> proxyGroups, List<Rule> rules, List<Rule> addedRules, String defaultUA
+ String profilesPath, int profileId, Map<String, dynamic> rawConfig, PatchClashConfig realPatchConfig, bool overrideDns, bool appendSystemDns, List<ProxyGroup> proxyGroups, List<Rule> rules, List<Rule> addedRules, String defaultUA, List<TailscaleProxy> tailscaleProxies, List<String> tailscaleRules, List<String> tailscaleFakeIpFilters
 });
 
 
@@ -9357,7 +9381,7 @@ class __$MakeRealProfileStateCopyWithImpl<$Res>
 
 /// Create a copy of MakeRealProfileState
 /// with the given fields replaced by the non-null parameter values.
-@override @pragma('vm:prefer-inline') $Res call({Object? profilesPath = null,Object? profileId = null,Object? rawConfig = null,Object? realPatchConfig = null,Object? overrideDns = null,Object? appendSystemDns = null,Object? proxyGroups = null,Object? rules = null,Object? addedRules = null,Object? defaultUA = null,}) {
+@override @pragma('vm:prefer-inline') $Res call({Object? profilesPath = null,Object? profileId = null,Object? rawConfig = null,Object? realPatchConfig = null,Object? overrideDns = null,Object? appendSystemDns = null,Object? proxyGroups = null,Object? rules = null,Object? addedRules = null,Object? defaultUA = null,Object? tailscaleProxies = null,Object? tailscaleRules = null,Object? tailscaleFakeIpFilters = null,}) {
   return _then(_MakeRealProfileState(
 profilesPath: null == profilesPath ? _self.profilesPath : profilesPath // ignore: cast_nullable_to_non_nullable
 as String,profileId: null == profileId ? _self.profileId : profileId // ignore: cast_nullable_to_non_nullable
@@ -9369,7 +9393,10 @@ as bool,proxyGroups: null == proxyGroups ? _self._proxyGroups : proxyGroups // i
 as List<ProxyGroup>,rules: null == rules ? _self._rules : rules // ignore: cast_nullable_to_non_nullable
 as List<Rule>,addedRules: null == addedRules ? _self._addedRules : addedRules // ignore: cast_nullable_to_non_nullable
 as List<Rule>,defaultUA: null == defaultUA ? _self.defaultUA : defaultUA // ignore: cast_nullable_to_non_nullable
-as String,
+as String,tailscaleProxies: null == tailscaleProxies ? _self._tailscaleProxies : tailscaleProxies // ignore: cast_nullable_to_non_nullable
+as List<TailscaleProxy>,tailscaleRules: null == tailscaleRules ? _self._tailscaleRules : tailscaleRules // ignore: cast_nullable_to_non_nullable
+as List<String>,tailscaleFakeIpFilters: null == tailscaleFakeIpFilters ? _self._tailscaleFakeIpFilters : tailscaleFakeIpFilters // ignore: cast_nullable_to_non_nullable
+as List<String>,
   ));
 }
 
diff --git a/lib/models/generated/tailscale.freezed.dart b/lib/models/generated/tailscale.freezed.dart
new file mode 100644
index 0000000000..1d2c8db2fb
--- /dev/null
+++ b/lib/models/generated/tailscale.freezed.dart
@@ -0,0 +1,588 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+// coverage:ignore-file
+// ignore_for_file: type=lint
+// ignore_for_file: unused_element, deprecated_member_use, deprecated_member_use_from_same_package, use_function_type_syntax_for_parameters, unnecessary_const, avoid_init_to_null, invalid_override_different_default_values_named, prefer_expression_function_bodies, annotate_overrides, invalid_annotation_target, unnecessary_question_mark
+
+part of '../tailscale.dart';
+
+// **************************************************************************
+// FreezedGenerator
+// **************************************************************************
+
+// dart format off
+T _$identity<T>(T value) => value;
+
+/// @nodoc
+mixin _$TailscaleProps {
+
+ bool get enable; bool get bypassTraffic; List<TailscaleProxy> get proxies;
+/// Create a copy of TailscaleProps
+/// with the given fields replaced by the non-null parameter values.
+@JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$TailscalePropsCopyWith<TailscaleProps> get copyWith => _$TailscalePropsCopyWithImpl<TailscaleProps>(this as TailscaleProps, _$identity);
+
+  /// Serializes this TailscaleProps to a JSON map.
+  Map<String, dynamic> toJson();
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is TailscaleProps&&(identical(other.enable, enable) || other.enable == enable)&&(identical(other.bypassTraffic, bypassTraffic) || other.bypassTraffic == bypassTraffic)&&const DeepCollectionEquality().equals(other.proxies, proxies));
+}
+
+@JsonKey(includeFromJson: false, includeToJson: false)
+@override
+int get hashCode => Object.hash(runtimeType,enable,bypassTraffic,const DeepCollectionEquality().hash(proxies));
+
+@override
+String toString() {
+  return 'TailscaleProps(enable: $enable, bypassTraffic: $bypassTraffic, proxies: $proxies)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $TailscalePropsCopyWith<$Res>  {
+  factory $TailscalePropsCopyWith(TailscaleProps value, $Res Function(TailscaleProps) _then) = _$TailscalePropsCopyWithImpl;
+@useResult
+$Res call({
+ bool enable, bool bypassTraffic, List<TailscaleProxy> proxies
+});
+
+
+
+
+}
+/// @nodoc
+class _$TailscalePropsCopyWithImpl<$Res>
+    implements $TailscalePropsCopyWith<$Res> {
+  _$TailscalePropsCopyWithImpl(this._self, this._then);
+
+  final TailscaleProps _self;
+  final $Res Function(TailscaleProps) _then;
+
+/// Create a copy of TailscaleProps
+/// with the given fields replaced by the non-null parameter values.
+@pragma('vm:prefer-inline') @override $Res call({Object? enable = null,Object? bypassTraffic = null,Object? proxies = null,}) {
+  return _then(_self.copyWith(
+enable: null == enable ? _self.enable : enable // ignore: cast_nullable_to_non_nullable
+as bool,bypassTraffic: null == bypassTraffic ? _self.bypassTraffic : bypassTraffic // ignore: cast_nullable_to_non_nullable
+as bool,proxies: null == proxies ? _self.proxies : proxies // ignore: cast_nullable_to_non_nullable
+as List<TailscaleProxy>,
+  ));
+}
+
+}
+
+
+/// Adds pattern-matching-related methods to [TailscaleProps].
+extension TailscalePropsPatterns on TailscaleProps {
+/// A variant of `map` that fallback to returning `orElse`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeMap<TResult extends Object?>(TResult Function( _TailscaleProps value)?  $default,{required TResult orElse(),}){
+final _that = this;
+switch (_that) {
+case _TailscaleProps() when $default != null:
+return $default(_that);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// Callbacks receives the raw object, upcasted.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case final Subclass2 value:
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult map<TResult extends Object?>(TResult Function( _TailscaleProps value)  $default,){
+final _that = this;
+switch (_that) {
+case _TailscaleProps():
+return $default(_that);case _:
+  throw StateError('Unexpected subclass');
+
+}
+}
+/// A variant of `map` that fallback to returning `null`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>(TResult? Function( _TailscaleProps value)?  $default,){
+final _that = this;
+switch (_that) {
+case _TailscaleProps() when $default != null:
+return $default(_that);case _:
+  return null;
+
+}
+}
+/// A variant of `when` that fallback to an `orElse` callback.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( bool enable,  bool bypassTraffic,  List<TailscaleProxy> proxies)?  $default,{required TResult orElse(),}) {final _that = this;
+switch (_that) {
+case _TailscaleProps() when $default != null:
+return $default(_that.enable,_that.bypassTraffic,_that.proxies);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// As opposed to `map`, this offers destructuring.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case Subclass2(:final field2):
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( bool enable,  bool bypassTraffic,  List<TailscaleProxy> proxies)  $default,) {final _that = this;
+switch (_that) {
+case _TailscaleProps():
+return $default(_that.enable,_that.bypassTraffic,_that.proxies);case _:
+  throw StateError('Unexpected subclass');
+
+}
+}
+/// A variant of `when` that fallback to returning `null`
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( bool enable,  bool bypassTraffic,  List<TailscaleProxy> proxies)?  $default,) {final _that = this;
+switch (_that) {
+case _TailscaleProps() when $default != null:
+return $default(_that.enable,_that.bypassTraffic,_that.proxies);case _:
+  return null;
+
+}
+}
+
+}
+
+/// @nodoc
+@JsonSerializable()
+
+class _TailscaleProps implements TailscaleProps {
+  const _TailscaleProps({this.enable = false, this.bypassTraffic = false, final  List<TailscaleProxy> proxies = const []}): _proxies = proxies;
+  factory _TailscaleProps.fromJson(Map<String, dynamic> json) => _$TailscalePropsFromJson(json);
+
+@override@JsonKey() final  bool enable;
+@override@JsonKey() final  bool bypassTraffic;
+ final  List<TailscaleProxy> _proxies;
+@override@JsonKey() List<TailscaleProxy> get proxies {
+  if (_proxies is EqualUnmodifiableListView) return _proxies;
+  // ignore: implicit_dynamic_type
+  return EqualUnmodifiableListView(_proxies);
+}
+
+
+/// Create a copy of TailscaleProps
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+_$TailscalePropsCopyWith<_TailscaleProps> get copyWith => __$TailscalePropsCopyWithImpl<_TailscaleProps>(this, _$identity);
+
+@override
+Map<String, dynamic> toJson() {
+  return _$TailscalePropsToJson(this, );
+}
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is _TailscaleProps&&(identical(other.enable, enable) || other.enable == enable)&&(identical(other.bypassTraffic, bypassTraffic) || other.bypassTraffic == bypassTraffic)&&const DeepCollectionEquality().equals(other._proxies, _proxies));
+}
+
+@JsonKey(includeFromJson: false, includeToJson: false)
+@override
+int get hashCode => Object.hash(runtimeType,enable,bypassTraffic,const DeepCollectionEquality().hash(_proxies));
+
+@override
+String toString() {
+  return 'TailscaleProps(enable: $enable, bypassTraffic: $bypassTraffic, proxies: $proxies)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class _$TailscalePropsCopyWith<$Res> implements $TailscalePropsCopyWith<$Res> {
+  factory _$TailscalePropsCopyWith(_TailscaleProps value, $Res Function(_TailscaleProps) _then) = __$TailscalePropsCopyWithImpl;
+@override @useResult
+$Res call({
+ bool enable, bool bypassTraffic, List<TailscaleProxy> proxies
+});
+
+
+
+
+}
+/// @nodoc
+class __$TailscalePropsCopyWithImpl<$Res>
+    implements _$TailscalePropsCopyWith<$Res> {
+  __$TailscalePropsCopyWithImpl(this._self, this._then);
+
+  final _TailscaleProps _self;
+  final $Res Function(_TailscaleProps) _then;
+
+/// Create a copy of TailscaleProps
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? enable = null,Object? bypassTraffic = null,Object? proxies = null,}) {
+  return _then(_TailscaleProps(
+enable: null == enable ? _self.enable : enable // ignore: cast_nullable_to_non_nullable
+as bool,bypassTraffic: null == bypassTraffic ? _self.bypassTraffic : bypassTraffic // ignore: cast_nullable_to_non_nullable
+as bool,proxies: null == proxies ? _self._proxies : proxies // ignore: cast_nullable_to_non_nullable
+as List<TailscaleProxy>,
+  ));
+}
+
+
+}
+
+
+/// @nodoc
+mixin _$TailscaleProxy {
+
+ String get name; String get authKey; String get hostname; String get controlUrl; String get stateDir; bool get ephemeral; bool get udp; bool get acceptRoutes; String get exitNode; bool get exitNodeAllowLanAccess; List<String> get routes;
+/// Create a copy of TailscaleProxy
+/// with the given fields replaced by the non-null parameter values.
+@JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+$TailscaleProxyCopyWith<TailscaleProxy> get copyWith => _$TailscaleProxyCopyWithImpl<TailscaleProxy>(this as TailscaleProxy, _$identity);
+
+  /// Serializes this TailscaleProxy to a JSON map.
+  Map<String, dynamic> toJson();
+
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is TailscaleProxy&&(identical(other.name, name) || other.name == name)&&(identical(other.authKey, authKey) || other.authKey == authKey)&&(identical(other.hostname, hostname) || other.hostname == hostname)&&(identical(other.controlUrl, controlUrl) || other.controlUrl == controlUrl)&&(identical(other.stateDir, stateDir) || other.stateDir == stateDir)&&(identical(other.ephemeral, ephemeral) || other.ephemeral == ephemeral)&&(identical(other.udp, udp) || other.udp == udp)&&(identical(other.acceptRoutes, acceptRoutes) || other.acceptRoutes == acceptRoutes)&&(identical(other.exitNode, exitNode) || other.exitNode == exitNode)&&(identical(other.exitNodeAllowLanAccess, exitNodeAllowLanAccess) || other.exitNodeAllowLanAccess == exitNodeAllowLanAccess)&&const DeepCollectionEquality().equals(other.routes, routes));
+}
+
+@JsonKey(includeFromJson: false, includeToJson: false)
+@override
+int get hashCode => Object.hash(runtimeType,name,authKey,hostname,controlUrl,stateDir,ephemeral,udp,acceptRoutes,exitNode,exitNodeAllowLanAccess,const DeepCollectionEquality().hash(routes));
+
+@override
+String toString() {
+  return 'TailscaleProxy(name: $name, authKey: $authKey, hostname: $hostname, controlUrl: $controlUrl, stateDir: $stateDir, ephemeral: $ephemeral, udp: $udp, acceptRoutes: $acceptRoutes, exitNode: $exitNode, exitNodeAllowLanAccess: $exitNodeAllowLanAccess, routes: $routes)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class $TailscaleProxyCopyWith<$Res>  {
+  factory $TailscaleProxyCopyWith(TailscaleProxy value, $Res Function(TailscaleProxy) _then) = _$TailscaleProxyCopyWithImpl;
+@useResult
+$Res call({
+ String name, String authKey, String hostname, String controlUrl, String stateDir, bool ephemeral, bool udp, bool acceptRoutes, String exitNode, bool exitNodeAllowLanAccess, List<String> routes
+});
+
+
+
+
+}
+/// @nodoc
+class _$TailscaleProxyCopyWithImpl<$Res>
+    implements $TailscaleProxyCopyWith<$Res> {
+  _$TailscaleProxyCopyWithImpl(this._self, this._then);
+
+  final TailscaleProxy _self;
+  final $Res Function(TailscaleProxy) _then;
+
+/// Create a copy of TailscaleProxy
+/// with the given fields replaced by the non-null parameter values.
+@pragma('vm:prefer-inline') @override $Res call({Object? name = null,Object? authKey = null,Object? hostname = null,Object? controlUrl = null,Object? stateDir = null,Object? ephemeral = null,Object? udp = null,Object? acceptRoutes = null,Object? exitNode = null,Object? exitNodeAllowLanAccess = null,Object? routes = null,}) {
+  return _then(_self.copyWith(
+name: null == name ? _self.name : name // ignore: cast_nullable_to_non_nullable
+as String,authKey: null == authKey ? _self.authKey : authKey // ignore: cast_nullable_to_non_nullable
+as String,hostname: null == hostname ? _self.hostname : hostname // ignore: cast_nullable_to_non_nullable
+as String,controlUrl: null == controlUrl ? _self.controlUrl : controlUrl // ignore: cast_nullable_to_non_nullable
+as String,stateDir: null == stateDir ? _self.stateDir : stateDir // ignore: cast_nullable_to_non_nullable
+as String,ephemeral: null == ephemeral ? _self.ephemeral : ephemeral // ignore: cast_nullable_to_non_nullable
+as bool,udp: null == udp ? _self.udp : udp // ignore: cast_nullable_to_non_nullable
+as bool,acceptRoutes: null == acceptRoutes ? _self.acceptRoutes : acceptRoutes // ignore: cast_nullable_to_non_nullable
+as bool,exitNode: null == exitNode ? _self.exitNode : exitNode // ignore: cast_nullable_to_non_nullable
+as String,exitNodeAllowLanAccess: null == exitNodeAllowLanAccess ? _self.exitNodeAllowLanAccess : exitNodeAllowLanAccess // ignore: cast_nullable_to_non_nullable
+as bool,routes: null == routes ? _self.routes : routes // ignore: cast_nullable_to_non_nullable
+as List<String>,
+  ));
+}
+
+}
+
+
+/// Adds pattern-matching-related methods to [TailscaleProxy].
+extension TailscaleProxyPatterns on TailscaleProxy {
+/// A variant of `map` that fallback to returning `orElse`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeMap<TResult extends Object?>(TResult Function( _TailscaleProxy value)?  $default,{required TResult orElse(),}){
+final _that = this;
+switch (_that) {
+case _TailscaleProxy() when $default != null:
+return $default(_that);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// Callbacks receives the raw object, upcasted.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case final Subclass2 value:
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult map<TResult extends Object?>(TResult Function( _TailscaleProxy value)  $default,){
+final _that = this;
+switch (_that) {
+case _TailscaleProxy():
+return $default(_that);case _:
+  throw StateError('Unexpected subclass');
+
+}
+}
+/// A variant of `map` that fallback to returning `null`.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case final Subclass value:
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? mapOrNull<TResult extends Object?>(TResult? Function( _TailscaleProxy value)?  $default,){
+final _that = this;
+switch (_that) {
+case _TailscaleProxy() when $default != null:
+return $default(_that);case _:
+  return null;
+
+}
+}
+/// A variant of `when` that fallback to an `orElse` callback.
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return orElse();
+/// }
+/// ```
+
+@optionalTypeArgs TResult maybeWhen<TResult extends Object?>(TResult Function( String name,  String authKey,  String hostname,  String controlUrl,  String stateDir,  bool ephemeral,  bool udp,  bool acceptRoutes,  String exitNode,  bool exitNodeAllowLanAccess,  List<String> routes)?  $default,{required TResult orElse(),}) {final _that = this;
+switch (_that) {
+case _TailscaleProxy() when $default != null:
+return $default(_that.name,_that.authKey,_that.hostname,_that.controlUrl,_that.stateDir,_that.ephemeral,_that.udp,_that.acceptRoutes,_that.exitNode,_that.exitNodeAllowLanAccess,_that.routes);case _:
+  return orElse();
+
+}
+}
+/// A `switch`-like method, using callbacks.
+///
+/// As opposed to `map`, this offers destructuring.
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case Subclass2(:final field2):
+///     return ...;
+/// }
+/// ```
+
+@optionalTypeArgs TResult when<TResult extends Object?>(TResult Function( String name,  String authKey,  String hostname,  String controlUrl,  String stateDir,  bool ephemeral,  bool udp,  bool acceptRoutes,  String exitNode,  bool exitNodeAllowLanAccess,  List<String> routes)  $default,) {final _that = this;
+switch (_that) {
+case _TailscaleProxy():
+return $default(_that.name,_that.authKey,_that.hostname,_that.controlUrl,_that.stateDir,_that.ephemeral,_that.udp,_that.acceptRoutes,_that.exitNode,_that.exitNodeAllowLanAccess,_that.routes);case _:
+  throw StateError('Unexpected subclass');
+
+}
+}
+/// A variant of `when` that fallback to returning `null`
+///
+/// It is equivalent to doing:
+/// ```dart
+/// switch (sealedClass) {
+///   case Subclass(:final field):
+///     return ...;
+///   case _:
+///     return null;
+/// }
+/// ```
+
+@optionalTypeArgs TResult? whenOrNull<TResult extends Object?>(TResult? Function( String name,  String authKey,  String hostname,  String controlUrl,  String stateDir,  bool ephemeral,  bool udp,  bool acceptRoutes,  String exitNode,  bool exitNodeAllowLanAccess,  List<String> routes)?  $default,) {final _that = this;
+switch (_that) {
+case _TailscaleProxy() when $default != null:
+return $default(_that.name,_that.authKey,_that.hostname,_that.controlUrl,_that.stateDir,_that.ephemeral,_that.udp,_that.acceptRoutes,_that.exitNode,_that.exitNodeAllowLanAccess,_that.routes);case _:
+  return null;
+
+}
+}
+
+}
+
+/// @nodoc
+@JsonSerializable()
+
+class _TailscaleProxy implements TailscaleProxy {
+  const _TailscaleProxy({required this.name, this.authKey = '', this.hostname = '', this.controlUrl = '', this.stateDir = '', this.ephemeral = false, this.udp = false, this.acceptRoutes = false, this.exitNode = '', this.exitNodeAllowLanAccess = false, final  List<String> routes = const []}): _routes = routes;
+  factory _TailscaleProxy.fromJson(Map<String, dynamic> json) => _$TailscaleProxyFromJson(json);
+
+@override final  String name;
+@override@JsonKey() final  String authKey;
+@override@JsonKey() final  String hostname;
+@override@JsonKey() final  String controlUrl;
+@override@JsonKey() final  String stateDir;
+@override@JsonKey() final  bool ephemeral;
+@override@JsonKey() final  bool udp;
+@override@JsonKey() final  bool acceptRoutes;
+@override@JsonKey() final  String exitNode;
+@override@JsonKey() final  bool exitNodeAllowLanAccess;
+ final  List<String> _routes;
+@override@JsonKey() List<String> get routes {
+  if (_routes is EqualUnmodifiableListView) return _routes;
+  // ignore: implicit_dynamic_type
+  return EqualUnmodifiableListView(_routes);
+}
+
+
+/// Create a copy of TailscaleProxy
+/// with the given fields replaced by the non-null parameter values.
+@override @JsonKey(includeFromJson: false, includeToJson: false)
+@pragma('vm:prefer-inline')
+_$TailscaleProxyCopyWith<_TailscaleProxy> get copyWith => __$TailscaleProxyCopyWithImpl<_TailscaleProxy>(this, _$identity);
+
+@override
+Map<String, dynamic> toJson() {
+  return _$TailscaleProxyToJson(this, );
+}
+
+@override
+bool operator ==(Object other) {
+  return identical(this, other) || (other.runtimeType == runtimeType&&other is _TailscaleProxy&&(identical(other.name, name) || other.name == name)&&(identical(other.authKey, authKey) || other.authKey == authKey)&&(identical(other.hostname, hostname) || other.hostname == hostname)&&(identical(other.controlUrl, controlUrl) || other.controlUrl == controlUrl)&&(identical(other.stateDir, stateDir) || other.stateDir == stateDir)&&(identical(other.ephemeral, ephemeral) || other.ephemeral == ephemeral)&&(identical(other.udp, udp) || other.udp == udp)&&(identical(other.acceptRoutes, acceptRoutes) || other.acceptRoutes == acceptRoutes)&&(identical(other.exitNode, exitNode) || other.exitNode == exitNode)&&(identical(other.exitNodeAllowLanAccess, exitNodeAllowLanAccess) || other.exitNodeAllowLanAccess == exitNodeAllowLanAccess)&&const DeepCollectionEquality().equals(other._routes, _routes));
+}
+
+@JsonKey(includeFromJson: false, includeToJson: false)
+@override
+int get hashCode => Object.hash(runtimeType,name,authKey,hostname,controlUrl,stateDir,ephemeral,udp,acceptRoutes,exitNode,exitNodeAllowLanAccess,const DeepCollectionEquality().hash(_routes));
+
+@override
+String toString() {
+  return 'TailscaleProxy(name: $name, authKey: $authKey, hostname: $hostname, controlUrl: $controlUrl, stateDir: $stateDir, ephemeral: $ephemeral, udp: $udp, acceptRoutes: $acceptRoutes, exitNode: $exitNode, exitNodeAllowLanAccess: $exitNodeAllowLanAccess, routes: $routes)';
+}
+
+
+}
+
+/// @nodoc
+abstract mixin class _$TailscaleProxyCopyWith<$Res> implements $TailscaleProxyCopyWith<$Res> {
+  factory _$TailscaleProxyCopyWith(_TailscaleProxy value, $Res Function(_TailscaleProxy) _then) = __$TailscaleProxyCopyWithImpl;
+@override @useResult
+$Res call({
+ String name, String authKey, String hostname, String controlUrl, String stateDir, bool ephemeral, bool udp, bool acceptRoutes, String exitNode, bool exitNodeAllowLanAccess, List<String> routes
+});
+
+
+
+
+}
+/// @nodoc
+class __$TailscaleProxyCopyWithImpl<$Res>
+    implements _$TailscaleProxyCopyWith<$Res> {
+  __$TailscaleProxyCopyWithImpl(this._self, this._then);
+
+  final _TailscaleProxy _self;
+  final $Res Function(_TailscaleProxy) _then;
+
+/// Create a copy of TailscaleProxy
+/// with the given fields replaced by the non-null parameter values.
+@override @pragma('vm:prefer-inline') $Res call({Object? name = null,Object? authKey = null,Object? hostname = null,Object? controlUrl = null,Object? stateDir = null,Object? ephemeral = null,Object? udp = null,Object? acceptRoutes = null,Object? exitNode = null,Object? exitNodeAllowLanAccess = null,Object? routes = null,}) {
+  return _then(_TailscaleProxy(
+name: null == name ? _self.name : name // ignore: cast_nullable_to_non_nullable
+as String,authKey: null == authKey ? _self.authKey : authKey // ignore: cast_nullable_to_non_nullable
+as String,hostname: null == hostname ? _self.hostname : hostname // ignore: cast_nullable_to_non_nullable
+as String,controlUrl: null == controlUrl ? _self.controlUrl : controlUrl // ignore: cast_nullable_to_non_nullable
+as String,stateDir: null == stateDir ? _self.stateDir : stateDir // ignore: cast_nullable_to_non_nullable
+as String,ephemeral: null == ephemeral ? _self.ephemeral : ephemeral // ignore: cast_nullable_to_non_nullable
+as bool,udp: null == udp ? _self.udp : udp // ignore: cast_nullable_to_non_nullable
+as bool,acceptRoutes: null == acceptRoutes ? _self.acceptRoutes : acceptRoutes // ignore: cast_nullable_to_non_nullable
+as bool,exitNode: null == exitNode ? _self.exitNode : exitNode // ignore: cast_nullable_to_non_nullable
+as String,exitNodeAllowLanAccess: null == exitNodeAllowLanAccess ? _self.exitNodeAllowLanAccess : exitNodeAllowLanAccess // ignore: cast_nullable_to_non_nullable
+as bool,routes: null == routes ? _self._routes : routes // ignore: cast_nullable_to_non_nullable
+as List<String>,
+  ));
+}
+
+
+}
+
+// dart format on
diff --git a/lib/models/generated/tailscale.g.dart b/lib/models/generated/tailscale.g.dart
new file mode 100644
index 0000000000..cbb2e565bc
--- /dev/null
+++ b/lib/models/generated/tailscale.g.dart
@@ -0,0 +1,59 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of '../tailscale.dart';
+
+// **************************************************************************
+// JsonSerializableGenerator
+// **************************************************************************
+
+_TailscaleProps _$TailscalePropsFromJson(Map<String, dynamic> json) =>
+    _TailscaleProps(
+      enable: json['enable'] as bool? ?? false,
+      bypassTraffic: json['bypassTraffic'] as bool? ?? false,
+      proxies:
+          (json['proxies'] as List<dynamic>?)
+              ?.map((e) => TailscaleProxy.fromJson(e as Map<String, dynamic>))
+              .toList() ??
+          const [],
+    );
+
+Map<String, dynamic> _$TailscalePropsToJson(_TailscaleProps instance) =>
+    <String, dynamic>{
+      'enable': instance.enable,
+      'bypassTraffic': instance.bypassTraffic,
+      'proxies': instance.proxies,
+    };
+
+_TailscaleProxy _$TailscaleProxyFromJson(Map<String, dynamic> json) =>
+    _TailscaleProxy(
+      name: json['name'] as String,
+      authKey: json['authKey'] as String? ?? '',
+      hostname: json['hostname'] as String? ?? '',
+      controlUrl: json['controlUrl'] as String? ?? '',
+      stateDir: json['stateDir'] as String? ?? '',
+      ephemeral: json['ephemeral'] as bool? ?? false,
+      udp: json['udp'] as bool? ?? false,
+      acceptRoutes: json['acceptRoutes'] as bool? ?? false,
+      exitNode: json['exitNode'] as String? ?? '',
+      exitNodeAllowLanAccess: json['exitNodeAllowLanAccess'] as bool? ?? false,
+      routes:
+          (json['routes'] as List<dynamic>?)
+              ?.map((e) => e as String)
+              .toList() ??
+          const [],
+    );
+
+Map<String, dynamic> _$TailscaleProxyToJson(_TailscaleProxy instance) =>
+    <String, dynamic>{
+      'name': instance.name,
+      'authKey': instance.authKey,
+      'hostname': instance.hostname,
+      'controlUrl': instance.controlUrl,
+      'stateDir': instance.stateDir,
+      'ephemeral': instance.ephemeral,
+      'udp': instance.udp,
+      'acceptRoutes': instance.acceptRoutes,
+      'exitNode': instance.exitNode,
+      'exitNodeAllowLanAccess': instance.exitNodeAllowLanAccess,
+      'routes': instance.routes,
+    };
diff --git a/lib/models/models.dart b/lib/models/models.dart
index 78ab4e862f..ea8a27e5ad 100644
--- a/lib/models/models.dart
+++ b/lib/models/models.dart
@@ -2,6 +2,7 @@ export 'app.dart';
 export 'clash_config.dart';
 export 'common.dart';
 export 'config.dart';
+export 'tailscale.dart';
 export 'core.dart';
 export 'profile.dart';
 export 'state.dart';
diff --git a/lib/models/state.dart b/lib/models/state.dart
index ef30099eef..2ddcc82413 100644
--- a/lib/models/state.dart
+++ b/lib/models/state.dart
@@ -7,6 +7,7 @@ import 'app.dart';
 import 'clash_config.dart';
 import 'common.dart';
 import 'config.dart';
+import 'tailscale.dart';
 import 'core.dart';
 import 'profile.dart';
 
@@ -345,6 +346,9 @@ abstract class MakeRealProfileState with _$MakeRealProfileState {
     required List<Rule> rules,
     required List<Rule> addedRules,
     required String defaultUA,
+    @Default([]) List<TailscaleProxy> tailscaleProxies,
+    @Default([]) List<String> tailscaleRules,
+    @Default([]) List<String> tailscaleFakeIpFilters,
   }) = _MakeRealProfileState;
 }
 
diff --git a/lib/models/tailscale.dart b/lib/models/tailscale.dart
new file mode 100644
index 0000000000..8882d16211
--- /dev/null
+++ b/lib/models/tailscale.dart
@@ -0,0 +1,247 @@
+import 'package:freezed_annotation/freezed_annotation.dart';
+
+part 'generated/tailscale.freezed.dart';
+
+part 'generated/tailscale.g.dart';
+
+/// The outbound `type` value understood by the mihomo core for Tailscale nodes.
+const tailscaleProxyType = 'tailscale';
+
+const defaultTailscaleProps = TailscaleProps();
+
+/// User configurable Tailscale support.
+///
+/// Tailscale is opt-in: [enable] gates whether the authored [proxies] are
+/// injected into the running configuration. When disabled the generated config
+/// is identical to the plain profile config, so normal traffic keeps flowing
+/// globally just like before.
+@freezed
+abstract class TailscaleProps with _$TailscaleProps {
+  const factory TailscaleProps({
+    @Default(false) bool enable,
+    @Default(false) bool bypassTraffic,
+    @Default([]) List<TailscaleProxy> proxies,
+  }) = _TailscaleProps;
+
+  factory TailscaleProps.fromJson(Map<String, Object?> json) =>
+      _$TailscalePropsFromJson(json);
+
+  factory TailscaleProps.safeFromJson(Map<String, Object?>? json) {
+    if (json == null) {
+      return defaultTailscaleProps;
+    }
+    try {
+      return TailscaleProps.fromJson(json);
+    } catch (_) {
+      return defaultTailscaleProps;
+    }
+  }
+}
+
+/// Domains that must leave FlClash's tunnel alone when the host also runs the
+/// real Tailscale app/daemon (control plane, DERP, MagicDNS).
+const tailscaleBypassDomains = <String>[
+  'tailscale.com',
+  'tailscale.io',
+  'ts.net',
+];
+
+/// Clash `fake-ip-filter` entries so Tailscale domains resolve to real public
+/// IPs instead of Clash's `198.18.0.0/16` fake-IP range.
+///
+/// Without these, `controlplane.tailscale.com` is answered as something like
+/// `198.18.0.12`, the TLS handshake to the control plane hangs mid-certificate,
+/// and `tailscale up` never completes — even if DOMAIN-SUFFIX DIRECT rules are
+/// present. Prefix `+.` matches the domain and all subdomains in mihomo.
+const tailscaleFakeIpFilters = <String>[
+  '+.tailscale.com',
+  '+.tailscale.io',
+  '+.ts.net',
+];
+
+/// Rules that keep the host's own Tailscale traffic outside FlClash's tunnel.
+///
+/// This is for the case where the same device *also* runs the real Tailscale
+/// app/daemon (e.g. a home PC that must stay reachable from outside). Sending
+/// the tailnet CGNAT ranges, the control/DERP domains and the `tailscaled`
+/// process straight to `DIRECT` stops FlClash from hijacking that traffic, so
+/// inbound Tailscale connections keep working regardless of which VPN provider
+/// profile is loaded. Pair with [tailscaleFakeIpFilters] so DNS is not
+/// poisoned by fake-IP either.
+const tailscaleBypassRules = <String>[
+  'IP-CIDR,100.64.0.0/10,DIRECT,no-resolve',
+  'IP-CIDR6,fd7a:115c:a1e0::/48,DIRECT,no-resolve',
+  'PROCESS-NAME,tailscaled,DIRECT',
+  'PROCESS-NAME,tailscaled.exe,DIRECT',
+  'PROCESS-NAME,tailscale,DIRECT',
+  'PROCESS-NAME,tailscale.exe,DIRECT',
+  'DOMAIN-SUFFIX,tailscale.com,DIRECT',
+  'DOMAIN-SUFFIX,tailscale.io,DIRECT',
+  'DOMAIN-SUFFIX,ts.net,DIRECT',
+];
+
+/// Builds a single clash rule that routes [dest] through [target].
+///
+/// The rule type is inferred from [dest]: a CIDR or bare IP becomes an
+/// `IP-CIDR`/`IP-CIDR6` rule (bare IPs get a /32 or /128 mask and `no-resolve`),
+/// anything else is treated as a domain via `DOMAIN-SUFFIX`.
+String buildTailscaleRouteRule(String dest, String target) {
+  final value = dest.trim();
+  final isV6 = value.contains(':');
+  if (value.contains('/')) {
+    final type = isV6 ? 'IP-CIDR6' : 'IP-CIDR';
+    return '$type,$value,$target,no-resolve';
+  }
+  final isV4 = RegExp(r'^\d{1,3}(\.\d{1,3}){3}$').hasMatch(value);
+  if (isV4) {
+    return 'IP-CIDR,$value/32,$target,no-resolve';
+  }
+  if (isV6) {
+    return 'IP-CIDR6,$value/128,$target,no-resolve';
+  }
+  return 'DOMAIN-SUFFIX,$value,$target';
+}
+
+extension TailscalePropsExt on TailscaleProps {
+  /// The nodes that should actually be merged into the config. Empty when the
+  /// feature is switched off so Tailscale stops handling any traffic.
+  List<TailscaleProxy> get activeProxies =>
+      enable ? proxies : const <TailscaleProxy>[];
+
+  /// Clash rules that FlClash injects at the top of the running configuration.
+  ///
+  /// These are prepended (highest priority) so they win over whatever the
+  /// imported VPN provider profile does, which means the user does not have to
+  /// hand-edit rules for every profile. Two independent things are produced:
+  ///
+  /// * Per-node [TailscaleProxy.routes] -> a rule sending that destination
+  ///   through the node (only when [enable] is on, since the outbound only
+  ///   exists then). This is how a phone reaches the home host through
+  ///   FlClash's built-in tailnet node without running the Tailscale app.
+  /// * [bypassTraffic] -> the [tailscaleBypassRules] so a device that also runs
+  ///   the Tailscale service keeps that traffic direct.
+  ///
+  /// Route rules come first so a specific destination still wins over the broad
+  /// bypass range even if both options are enabled at once.
+  List<String> buildInjectedRules() {
+    final rules = <String>[];
+    if (enable) {
+      for (final proxy in proxies.where((item) => item.isValid)) {
+        for (final dest in proxy.routes) {
+          if (dest.trim().isEmpty) {
+            continue;
+          }
+          rules.add(buildTailscaleRouteRule(dest, proxy.name.trim()));
+        }
+      }
+    }
+    if (bypassTraffic) {
+      rules.addAll(tailscaleBypassRules);
+    }
+    return rules;
+  }
+
+  /// Fake-IP filter entries injected when [bypassTraffic] is on.
+  ///
+  /// Empty when the toggle is off so DNS behaviour is unchanged. See
+  /// [tailscaleFakeIpFilters].
+  List<String> buildFakeIpFilters() =>
+      bypassTraffic ? tailscaleFakeIpFilters : const <String>[];
+}
+
+/// A user authored Tailscale outbound node.
+///
+/// The mihomo core (built with the `with_gvisor` tag and without
+/// `no_tailscale`) already supports a `tailscale` outbound. FlClash only ever
+/// received proxies from imported subscription YAML, so there was no way to add
+/// a Tailscale node from the app. This model captures the fields the core
+/// understands and can serialize them into a proxy map that is merged into the
+/// generated config through [toOutboundJson].
+@freezed
+abstract class TailscaleProxy with _$TailscaleProxy {
+  const factory TailscaleProxy({
+    required String name,
+    @Default('') String authKey,
+    @Default('') String hostname,
+    @Default('') String controlUrl,
+    @Default('') String stateDir,
+    @Default(false) bool ephemeral,
+    @Default(false) bool udp,
+    @Default(false) bool acceptRoutes,
+    @Default('') String exitNode,
+    @Default(false) bool exitNodeAllowLanAccess,
+    @Default([]) List<String> routes,
+  }) = _TailscaleProxy;
+
+  factory TailscaleProxy.fromJson(Map<String, Object?> json) =>
+      _$TailscaleProxyFromJson(json);
+}
+
+extension TailscaleProxyExt on TailscaleProxy {
+  /// Whether the node has the minimum data required to build a valid outbound.
+  bool get isValid => name.trim().isNotEmpty;
+
+  /// Builds the mihomo `proxies` entry for this node.
+  ///
+  /// Only non empty optional values are emitted so the core keeps its own
+  /// defaults for anything left blank. Keys use the kebab-case names the core
+  /// parser expects (see `adapter/outbound/tailscale.go`).
+  Map<String, dynamic> toOutboundJson() {
+    final map = <String, dynamic>{
+      'name': name.trim(),
+      'type': tailscaleProxyType,
+    };
+    if (authKey.trim().isNotEmpty) {
+      map['auth-key'] = authKey.trim();
+    }
+    if (hostname.trim().isNotEmpty) {
+      map['hostname'] = hostname.trim();
+    }
+    if (controlUrl.trim().isNotEmpty) {
+      map['control-url'] = controlUrl.trim();
+    }
+    if (stateDir.trim().isNotEmpty) {
+      map['state-dir'] = stateDir.trim();
+    }
+    if (ephemeral) {
+      map['ephemeral'] = true;
+    }
+    if (udp) {
+      map['udp'] = true;
+    }
+    if (acceptRoutes) {
+      map['accept-routes'] = true;
+    }
+    if (exitNode.trim().isNotEmpty) {
+      map['exit-node'] = exitNode.trim();
+      map['exit-node-allow-lan-access'] = exitNodeAllowLanAccess;
+    }
+    return map;
+  }
+}
+
+extension TailscaleProxyListExt on List<TailscaleProxy> {
+  /// Merges the valid Tailscale nodes in this list into a raw clash config
+  /// [rawConfig]'s `proxies` list.
+  ///
+  /// Nodes are matched by `name`; an existing proxy with the same name is
+  /// replaced so the app authored value always wins. The input map is not
+  /// mutated. Returns a new config map ready to be serialized to YAML.
+  Map<String, dynamic> mergeInto(Map<String, dynamic> rawConfig) {
+    final validProxies = where((item) => item.isValid).toList();
+    if (validProxies.isEmpty) {
+      return Map<String, dynamic>.from(rawConfig);
+    }
+    final nextConfig = Map<String, dynamic>.from(rawConfig);
+    final existing = <dynamic>[
+      ...?(nextConfig['proxies'] as List?),
+    ];
+    final tailscaleNames = validProxies.map((item) => item.name.trim()).toSet();
+    existing.removeWhere((item) {
+      return item is Map && tailscaleNames.contains(item['name']);
+    });
+    existing.addAll(validProxies.map((item) => item.toOutboundJson()));
+    nextConfig['proxies'] = existing;
+    return nextConfig;
+  }
+}
diff --git a/lib/pages/home.dart b/lib/pages/home.dart
index c5742a8742..7879ce44d1 100644
--- a/lib/pages/home.dart
+++ b/lib/pages/home.dart
@@ -49,21 +49,22 @@ class HomePage extends StatelessWidget {
                   selectedIndex: currentIndex,
                 ),
               );
-              if (isMobile) {
-                return Column(
-                  children: [
-                    Flexible(
-                      flex: 1,
-                      child: MediaQuery.removePadding(
-                        removeTop: false,
-                        removeBottom: true,
-                        removeLeft: true,
-                        removeRight: true,
-                        context: context,
-                        child: child!,
-                      ),
+              return Column(
+                children: [
+                  Flexible(
+                    flex: 1,
+                    child: MediaQuery.removePadding(
+                      removeTop: false,
+                      removeBottom: isMobile,
+                      removeLeft: isMobile,
+                      removeRight: isMobile,
+                      context: context,
+                      child: child!,
                     ),
-                    MediaQuery.removePadding(
+                  ),
+                  AnimatedVisibility.bottomNavigation(
+                    visible: isMobile,
+                    child: MediaQuery.removePadding(
                       removeTop: true,
                       removeBottom: false,
                       removeLeft: true,
@@ -71,11 +72,9 @@ class HomePage extends StatelessWidget {
                       context: context,
                       child: bottomNavigationBar,
                     ),
-                  ],
-                );
-              } else {
-                return child!;
-              }
+                  ),
+                ],
+              );
             },
             child: Consumer(
               builder: (_, ref, _) {
@@ -89,10 +88,14 @@ class HomePage extends StatelessWidget {
                     final navigationItem = navigationItems[index];
                     final navigationView = navigationItem.builder(context);
                     final view = KeepScope(
+                      key: ValueKey(navigationItem.label),
                       keep: navigationItem.keep,
                       child: isMobile
                           ? navigationView
                           : Navigator(
+                              key: ValueKey(
+                                '${navigationItem.label.name}_navigator',
+                              ),
                               pages: [MaterialPage(child: navigationView)],
                               onDidRemovePage: (_) {},
                             ),
@@ -195,6 +198,15 @@ class _HomePageViewState extends ConsumerState<_HomePageView> {
       controller: _pageController,
       physics: const NeverScrollableScrollPhysics(),
       itemCount: itemCount,
+      findChildIndexCallback: (key) {
+        if (key is! ValueKey<PageLabel>) {
+          return null;
+        }
+        final index = widget.navigationItems.indexWhere(
+          (item) => item.label == key.value,
+        );
+        return index == -1 ? null : index;
+      },
       itemBuilder: (context, index) {
         return widget.pageBuilder(context, index);
       },
diff --git a/lib/plugins/app.dart b/lib/plugins/app.dart
index 612b7cc40e..39452d9c70 100644
--- a/lib/plugins/app.dart
+++ b/lib/plugins/app.dart
@@ -102,6 +102,17 @@ class App {
     if (!Platform.isAndroid) return false;
     return methodChannel.invokeMethod<bool>('openAppSettings');
   }
+
+  Future<bool> didCrashOnPreviousExecution() async {
+    try {
+      return await methodChannel.invokeMethod<bool>(
+            'didCrashOnPreviousExecution',
+          ) ??
+          false;
+    } catch (_) {
+      return false;
+    }
+  }
 }
 
 final app = system.isAndroid ? App() : null;
diff --git a/lib/plugins/service.dart b/lib/plugins/service.dart
index bb5f3ca4c1..17a1c2991f 100644
--- a/lib/plugins/service.dart
+++ b/lib/plugins/service.dart
@@ -3,14 +3,15 @@ import 'dart:convert';
 import 'dart:isolate';
 
 import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/core/event.dart';
+import 'package:fl_clash/core/method.dart';
+import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/models/models.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter/services.dart';
 
 abstract mixin class ServiceListener {
   void onServiceEvent(CoreEvent event) {}
-
-  void onServiceCrash(String message) {}
 }
 
 class Service {
@@ -32,15 +33,21 @@ class Service {
       switch (call.method) {
         case 'event':
           final data = call.arguments as String? ?? '';
-          final result = ActionResult.fromJson(json.decode(data));
-          for (final listener in _listeners) {
-            listener.onServiceEvent(CoreEvent.fromJson(result.data));
-          }
-          break;
-        case 'crash':
-          final message = call.arguments as String? ?? '';
-          for (final listener in _listeners) {
-            listener.onServiceCrash(message);
+          final methodCall = CoreMethodCall.fromJson(
+            Map<String, Object?>.from(json.decode(data) as Map),
+          );
+          for (final event in coreEventsFromData(methodCall.arguments)) {
+            for (final listener in _listeners) {
+              try {
+                listener.onServiceEvent(event);
+              } catch (error) {
+                commonPrint.log(
+                  'Unable to dispatch Android Core event '
+                  '${event.type.name}: $error',
+                  logLevel: LogLevel.error,
+                );
+              }
+            }
           }
           break;
         default:
@@ -49,16 +56,16 @@ class Service {
     });
   }
 
-  Future<ActionResult?> invokeAction(Action action) async {
+  Future<CoreMethodResponse?> invokeMethod(CoreMethodCall call) async {
     final data = await methodChannel.invokeMethod<String>(
-      'invokeAction',
-      json.encode(action),
+      'invokeMethod',
+      json.encode(call),
     );
     if (data == null) {
       return null;
     }
     final dataJson = await data.commonToJSON<dynamic>();
-    return ActionResult.fromJson(dataJson);
+    return CoreMethodResponse.fromJson(dataJson);
   }
 
   Future<bool> start() async {
diff --git a/lib/providers/action.dart b/lib/providers/action.dart
index c444723c7c..9ea44cd0ed 100644
--- a/lib/providers/action.dart
+++ b/lib/providers/action.dart
@@ -9,988 +9,22 @@ import 'package:fl_clash/models/models.dart';
 import 'package:fl_clash/plugins/app.dart';
 import 'package:fl_clash/plugins/service.dart';
 import 'package:fl_clash/providers/providers.dart';
+import 'package:fl_clash/providers/actions/system_exit.dart';
 import 'package:fl_clash/state.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:path/path.dart' show basename;
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 import 'package:url_launcher/url_launcher.dart';
 
+part 'actions/common.dart';
+part 'actions/setup.dart';
+part 'actions/backup.dart';
+part 'actions/core.dart';
+part 'actions/system.dart';
+part 'actions/store.dart';
+part 'actions/theme.dart';
+part 'actions/proxies.dart';
+part 'actions/profiles.dart';
+part 'actions/geo_resource.dart';
 part 'generated/action.g.dart';
-
-@Riverpod(keepAlive: true)
-class CommonAction extends _$CommonAction {
-  @override
-  void build() {}
-
-  void updateStart() {
-    ref
-        .read(setupActionProvider.notifier)
-        .updateStatus(!ref.read(isStartProvider));
-  }
-
-  void updateSpeedStatistics() {
-    ref
-        .read(appSettingProvider.notifier)
-        .update((state) => state.copyWith(showTrayTitle: !state.showTrayTitle));
-  }
-
-  void updateMode() {
-    ref.read(patchClashConfigProvider.notifier).update((state) {
-      final index = Mode.values.indexWhere((item) => item == state.mode);
-      if (index == -1) return state;
-      final nextIndex = index + 1 > Mode.values.length - 1 ? 0 : index + 1;
-      return state.copyWith(mode: Mode.values[nextIndex]);
-    });
-  }
-
-  void updateRunTime() {
-    final startTime = ref.read(setupActionProvider.notifier).startTime;
-    if (startTime != null) {
-      final startTimeStamp = startTime.millisecondsSinceEpoch;
-      final nowTimeStamp = DateTime.now().millisecondsSinceEpoch;
-      ref.read(runTimeProvider.notifier).value = nowTimeStamp - startTimeStamp;
-    } else {
-      ref.read(runTimeProvider.notifier).value = null;
-    }
-  }
-
-  Future<void> updateTraffic() async {
-    final onlyStatisticsProxy = ref.read(
-      appSettingProvider.select((state) => state.onlyStatisticsProxy),
-    );
-    final traffic = await coreController.getTraffic(onlyStatisticsProxy);
-    ref.read(trafficsProvider.notifier).addTraffic(traffic);
-    ref.read(totalTrafficProvider.notifier).value = await coreController
-        .getTotalTraffic(onlyStatisticsProxy);
-  }
-
-  Future<void> autoCheckUpdate() async {
-    if (!ref.read(appSettingProvider).autoCheckUpdate) return;
-    final res = await request.checkForUpdate();
-    checkUpdateResultHandle(data: res);
-  }
-
-  Future<void> checkUpdateResultHandle({
-    Map<String, dynamic>? data,
-    bool isUser = false,
-  }) async {
-    if (data != null) {
-      final tagName = data['tag_name'];
-      final body = data['body'];
-      final submits = utils.parseReleaseBody(body);
-      final context = globalState.navigatorKey.currentContext!;
-      final textTheme = context.textTheme;
-      final res = await globalState.showMessage(
-        title: currentAppLocalizations.discoverNewVersion,
-        message: TextSpan(
-          text: '$tagName \n',
-          style: textTheme.headlineSmall,
-          children: [
-            TextSpan(text: '\n', style: textTheme.bodyMedium),
-            for (final submit in submits)
-              TextSpan(text: '- $submit \n', style: textTheme.bodyMedium),
-          ],
-        ),
-        confirmText: currentAppLocalizations.goDownload,
-        cancelText: isUser ? null : currentAppLocalizations.noLongerRemind,
-      );
-      if (res == true) {
-        launchUrl(Uri.parse('https://github.com/$repository/releases/latest'));
-      } else if (!isUser && res == false) {
-        ref
-            .read(appSettingProvider.notifier)
-            .update((state) => state.copyWith(autoCheckUpdate: false));
-      }
-    } else if (isUser) {
-      globalState.showMessage(
-        title: currentAppLocalizations.checkUpdate,
-        message: TextSpan(text: currentAppLocalizations.checkUpdateError),
-      );
-    }
-  }
-}
-
-@Riverpod(keepAlive: true)
-class SetupAction extends _$SetupAction {
-  Timer? _updateTimer;
-  DateTime? startTime;
-
-  bool get isStart => startTime != null && startTime!.isBeforeNow;
-
-  @override
-  void build() {}
-
-  SetupParams get _setupParams {
-    final selectedMap = ref.read(selectedMapProvider);
-    final testUrl = ref.read(
-      appSettingProvider.select((state) => state.testUrl),
-    );
-    return SetupParams(selectedMap: selectedMap, testUrl: testUrl);
-  }
-
-  void fullSetup() {
-    if (!ref.read(initProvider)) return;
-    ref.read(delayDataSourceProvider.notifier).value = {};
-    applyProfile(force: true);
-    ref.read(logsProvider.notifier).value = FixedList(500);
-    ref.read(requestsProvider.notifier).value = FixedList(500);
-  }
-
-  Future<void> _handleStart() async {
-    startTime ??= DateTime.now();
-    //The local status must be updated when performing the run task
-    ref.read(commonActionProvider.notifier).updateRunTime();
-    ref.read(commonActionProvider.notifier).updateTraffic();
-    if (!ref.read(suspendProvider)) {
-      await coreController.startListener();
-    }
-    _updateTimer = Timer.periodic(const Duration(seconds: 1), (_) {
-      ref.read(commonActionProvider.notifier).updateRunTime();
-      ref.read(commonActionProvider.notifier).updateTraffic();
-    });
-  }
-
-  Future _updateStartTime() async {
-    startTime = await service?.getRunTime();
-  }
-
-  Future handleStop() async {
-    startTime = null;
-    _updateTimer?.cancel();
-    _updateTimer = null;
-    await coreController.stopListener();
-  }
-
-  Future<void> initStatus() async {
-    if (!globalState.needInitStatus) {
-      commonPrint.log('init status cancel');
-      return;
-    }
-    commonPrint.log('init status');
-    if (system.isAndroid) {
-      await _updateStartTime();
-    }
-    final status = isStart == true
-        ? true
-        : ref.read(appSettingProvider).autoRun;
-    if (status == true) {
-      await updateStatus(true, isInit: true);
-    } else {
-      await applyProfile(force: true);
-    }
-  }
-
-  Future<void> updateStatus(bool isStart, {bool isInit = false}) async {
-    if (isStart) {
-      if (!isInit) {
-        final res = await ref
-            .read(coreActionProvider.notifier)
-            .tryStartCore(true);
-        if (res) return;
-        if (!ref.read(initProvider)) return;
-        await _handleStart();
-        applyProfileDebounce(force: true, silence: true);
-      } else {
-        globalState.needInitStatus = false;
-        ref.read(runTimeProvider.notifier).value = 0;
-        try {
-          await applyProfile(
-            force: true,
-            preloadInvoke: () async {
-              await _handleStart();
-            },
-          );
-        } catch (_) {
-          ref.read(runTimeProvider.notifier).value = null;
-        }
-      }
-    } else {
-      await handleStop();
-      coreController.resetTraffic();
-      ref.read(trafficsProvider.notifier).clear();
-      ref.read(totalTrafficProvider.notifier).value = const Traffic();
-      ref.read(runTimeProvider.notifier).value = null;
-      ref.read(checkIpNumProvider.notifier).add();
-    }
-  }
-
-  Future<void> updateConfigDebounce() async {
-    debouncer.call(FunctionTag.updateConfig, () async {
-      await globalState.safeRun(() async {
-        final updateParams = ref.read(updateParamsProvider);
-        final res = await _requestAdmin(updateParams.tun.enable);
-        if (res.isError) return;
-        final realTunEnable = ref.read(realTunEnableProvider);
-        final message = await coreController.updateConfig(
-          updateParams.copyWith.tun(enable: realTunEnable),
-        );
-        ref.read(checkIpNumProvider.notifier).add();
-        if (message.isNotEmpty) throw message;
-      });
-    });
-  }
-
-  void tryCheckIp() {
-    final isTimeout = ref.read(
-      networkDetectionProvider.select(
-        (state) => state.ipInfo == null && state.isLoading == false,
-      ),
-    );
-    if (!isTimeout) return;
-    ref.read(checkIpNumProvider.notifier).add();
-  }
-
-  void applyProfileDebounce({bool silence = false, bool force = false}) {
-    debouncer.call(FunctionTag.applyProfile, (silence, force) {
-      applyProfile(silence: silence, force: force);
-    }, args: [silence, force]);
-  }
-
-  void changeMode(Mode mode) {
-    ref
-        .read(patchClashConfigProvider.notifier)
-        .update((state) => state.copyWith(mode: mode));
-    if (mode == Mode.global) {
-      ref
-          .read(proxiesActionProvider.notifier)
-          .updateCurrentGroupName(GroupName.GLOBAL.name);
-    }
-  }
-
-  void autoApplyProfile() {
-    WidgetsBinding.instance.addPostFrameCallback((_) {
-      applyProfile();
-    });
-  }
-
-  Future<void> applyProfile({
-    bool silence = false,
-    bool force = false,
-    VoidCallback? preloadInvoke,
-  }) async {
-    await _setupConfig(
-      force: force,
-      silence: silence,
-      preloadInvoke: preloadInvoke,
-      onUpdated: () async {
-        await ref.read(proxiesActionProvider.notifier).updateGroups();
-        await ref.read(providersProvider.notifier).syncProviders();
-      },
-    );
-  }
-
-  Future<VM2<String, String>> getProfile({
-    required SetupState setupState,
-    required PatchClashConfig patchConfig,
-  }) async {
-    final profileId = setupState.profileId;
-    if (profileId == null) return const VM2('', '');
-    final defaultUA = globalState.packageInfo.ua;
-    final networkVM2 = ref.read(
-      networkSettingProvider.select(
-        (state) => VM2(state.appendSystemDns, state.routeMode),
-      ),
-    );
-    final overrideDns = ref.read(overrideDnsProvider);
-    final appendSystemDns = networkVM2.a;
-    final routeMode = networkVM2.b;
-    final configMap = await coreController.getConfig(profileId);
-    String? scriptContent;
-    final List<Rule> addedRules = [];
-    final List<ProxyGroup> proxyGroups = [];
-    final List<Rule> rules = [];
-    if (setupState.overwriteType == OverwriteType.script) {
-      scriptContent = await setupState.script?.content;
-    } else if (setupState.overwriteType == OverwriteType.standard) {
-      addedRules.addAll(setupState.addedRules);
-    } else {
-      proxyGroups.addAll(setupState.proxyGroups);
-      rules.addAll(setupState.rules);
-    }
-    final realPatchConfig = patchConfig.copyWith(
-      tun: patchConfig.tun.getRealTun(routeMode),
-    );
-    Map<String, dynamic> rawConfig = configMap;
-    if (scriptContent?.isNotEmpty == true) {
-      rawConfig = await handleEvaluate(scriptContent!, rawConfig);
-    }
-    final directory = await appPath.profilesPath;
-    final res = makeRealProfileTask(
-      MakeRealProfileState(
-        rules: rules,
-        proxyGroups: proxyGroups,
-        profilesPath: directory,
-        profileId: profileId,
-        rawConfig: rawConfig,
-        realPatchConfig: realPatchConfig,
-        overrideDns: overrideDns,
-        appendSystemDns: appendSystemDns,
-        addedRules: addedRules,
-        defaultUA: defaultUA,
-      ),
-    );
-    return res;
-  }
-
-  Future<String> getProfileWithId(int profileId) async {
-    try {
-      final setupState = await ref.read(setupStateProvider(profileId).future);
-      final patchClashConfig = ref.read(patchClashConfigProvider);
-      final res = await getProfile(
-        setupState: setupState,
-        patchConfig: patchClashConfig,
-      );
-      return res.a;
-    } catch (e) {
-      globalState.showNotifier(e.toString());
-    }
-    return '';
-  }
-
-  Future<Result<bool>> _requestAdmin(bool enableTun) async {
-    final realTunEnable = ref.read(realTunEnableProvider);
-    if (enableTun != realTunEnable && realTunEnable == false) {
-      final code = await system.authorizeCore();
-      switch (code) {
-        case AuthorizeCode.success:
-          await ref.read(coreActionProvider.notifier).restartCore();
-          return Result.error('');
-        case AuthorizeCode.none:
-          break;
-        case AuthorizeCode.error:
-          enableTun = false;
-          break;
-      }
-    }
-    ref.read(realTunEnableProvider.notifier).value = enableTun;
-    return Result.success(enableTun);
-  }
-
-  Future<void> _setupConfig({
-    bool force = false,
-    bool silence = false,
-    VoidCallback? preloadInvoke,
-    FutureOr Function()? onUpdated,
-  }) async {
-    var profile = ref.read(currentProfileProvider);
-    final nextProfile = await profile?.checkAndUpdateAndCopy();
-    if (nextProfile != null) {
-      profile = nextProfile;
-      ref.read(profilesProvider.notifier).put(nextProfile);
-    }
-    commonPrint.log('setup ===> ${profile?.id}');
-    final patchConfig = ref.read(patchClashConfigProvider);
-    final res = await _requestAdmin(patchConfig.tun.enable);
-    if (res.isError) return;
-    final realTunEnable = ref.read(realTunEnableProvider);
-    final realPatchConfig = patchConfig.copyWith.tun(enable: realTunEnable);
-    final setupState = await ref.read(setupStateProvider(profile?.id).future);
-    if (system.isAndroid) {
-      globalState.lastVpnState = ref.read(vpnStateProvider);
-      final sharedState = ref.read(sharedStateProvider);
-      preferences.saveShareState(sharedState);
-    }
-    final vm2 = await getProfile(
-      setupState: setupState,
-      patchConfig: realPatchConfig,
-    );
-    final yamlString = vm2.a;
-    final yamlMd5 = vm2.b;
-    if (yamlMd5 == globalState.lastConfigMd5 && force == false) return;
-    await globalState.loadingRun(
-      () async {
-        final configFilePath = await appPath.configFilePath;
-        await File(configFilePath).safeWriteAsString(yamlString);
-        globalState.lastConfigMd5 = yamlMd5;
-        final message = await coreController.setupConfig(
-          setupState: setupState,
-          params: _setupParams,
-          preloadInvoke: preloadInvoke,
-        );
-        if (message.isNotEmpty && !message.endsWith('is empty')) {
-          throw message;
-        }
-        ref.read(checkIpNumProvider.notifier).add();
-        await onUpdated?.call();
-      },
-      silence: true,
-      tag: !silence ? LoadingTag.proxies : null,
-    );
-  }
-}
-
-@Riverpod(keepAlive: true)
-class BackupAction extends _$BackupAction {
-  @override
-  void build() {}
-
-  Future<String> backup() async {
-    final res = await Future.wait([
-      database.profilesDao.fileNames().get(),
-      database.scriptsDao.fileNames().get(),
-    ]);
-    final profileFileNames = res[0];
-    final scriptFileNames = res[1];
-    final configMap = ref.read(configProvider).toJson();
-    configMap['version'] = await preferences.getVersion();
-    return backupTask(configMap, [...profileFileNames, ...scriptFileNames]);
-  }
-
-  Future<void> restore(RestoreOption option) async {
-    final restoreDirPath = await appPath.restoreDirPath;
-    final restoreDir = Directory(restoreDirPath);
-    final restoreStrategy = ref.read(
-      appSettingProvider.select((state) => state.restoreStrategy),
-    );
-    final isOverride = restoreStrategy == RestoreStrategy.override;
-    try {
-      final migrationData = await restoreTask();
-      if (!await restoreDir.exists()) {
-        throw currentAppLocalizations.restoreException;
-      }
-      await database.restore(
-        migrationData.profiles,
-        migrationData.scripts,
-        migrationData.rules,
-        migrationData.links,
-        migrationData.proxyGroups,
-        isOverride: isOverride,
-      );
-      final configMap = migrationData.configMap;
-      if (option == RestoreOption.onlyProfiles || configMap == null) return;
-      final config = Config.fromJson(configMap);
-      ref.read(patchClashConfigProvider.notifier).value =
-          config.patchClashConfig;
-      ref.read(appSettingProvider.notifier).value = config.appSettingProps;
-      ref.read(currentProfileIdProvider.notifier).value =
-          config.currentProfileId;
-      ref.read(davSettingProvider.notifier).value = config.davProps;
-      ref.read(themeSettingProvider.notifier).value = config.themeProps;
-      ref.read(windowSettingProvider.notifier).value = config.windowProps;
-      ref.read(vpnSettingProvider.notifier).value = config.vpnProps;
-      ref.read(proxiesStyleSettingProvider.notifier).value =
-          config.proxiesStyleProps;
-      ref.read(overrideDnsProvider.notifier).value = config.overrideDns;
-      ref.read(networkSettingProvider.notifier).value = config.networkProps;
-      ref.read(hotKeyActionsProvider.notifier).value = config.hotKeyActions;
-      return;
-    } finally {
-      await restoreDir.safeDelete(recursive: true);
-    }
-  }
-}
-
-@Riverpod(keepAlive: true)
-class CoreAction extends _$CoreAction {
-  @override
-  void build() {}
-
-  Future<void> initCore() async {
-    final isInit = await coreController.isInit;
-
-    final version = ref.read(versionProvider);
-    if (!isInit) {
-      final res = await coreController.init(version);
-      commonPrint.log('init result: $res');
-    } else {
-      await ref.read(proxiesActionProvider.notifier).updateGroups();
-    }
-  }
-
-  Future<void> connectCore() async {
-    ref.read(coreStatusProvider.notifier).value = CoreStatus.connecting;
-    final result = await Future.wait([
-      coreController.preload(),
-      Future.delayed(const Duration(milliseconds: 300)),
-    ]);
-    final String message = result[0];
-    if (message.isNotEmpty) {
-      ref.read(coreStatusProvider.notifier).value = CoreStatus.disconnected;
-      globalState.showNotifier(message);
-      return;
-    }
-    ref.read(coreStatusProvider.notifier).value = CoreStatus.connected;
-  }
-
-  Future<Result<bool>> requestAdmin(bool enableTun) async {
-    final realTunEnable = ref.read(realTunEnableProvider);
-    if (enableTun != realTunEnable && realTunEnable == false) {
-      final code = await system.authorizeCore();
-      switch (code) {
-        case AuthorizeCode.success:
-          await restartCore();
-          return Result.error('');
-        case AuthorizeCode.none:
-          break;
-        case AuthorizeCode.error:
-          enableTun = false;
-          break;
-      }
-    }
-    ref.read(realTunEnableProvider.notifier).value = enableTun;
-    return Result.success(enableTun);
-  }
-
-  Future<void> restartCore([bool start = false]) async {
-    final isDisconnected =
-        ref.read(coreStatusProvider) == CoreStatus.disconnected;
-    ref.read(coreStatusProvider.notifier).value = CoreStatus.disconnected;
-    await coreController.shutdown(!isDisconnected);
-    await connectCore();
-    await initCore();
-    if (start || ref.read(isStartProvider)) {
-      await ref
-          .read(setupActionProvider.notifier)
-          .updateStatus(true, isInit: true);
-    } else {
-      await ref.read(setupActionProvider.notifier).applyProfile(force: true);
-    }
-  }
-
-  Future<bool> tryStartCore([bool start = false]) async {
-    if (coreController.isCompleted) return false;
-    await restartCore(start);
-    return true;
-  }
-
-  void handleCoreDisconnected() {
-    ref.read(coreStatusProvider.notifier).value = CoreStatus.disconnected;
-  }
-}
-
-@Riverpod(keepAlive: true)
-class SystemAction extends _$SystemAction {
-  @override
-  void build() {}
-
-  Future<List<Package>> getPackages() async {
-    if (ref.read(isMobileViewProvider)) {
-      await Future.delayed(commonDuration);
-    }
-    if (ref.read(packagesProvider).isEmpty) {
-      ref.read(packagesProvider.notifier).value =
-          await app?.getPackages() ?? [];
-    }
-    return ref.read(packagesProvider);
-  }
-
-  Future<void> handleExit([bool needSave = false]) async {
-    Future.delayed(const Duration(seconds: 3), () {
-      system.exit();
-    });
-    try {
-      await Future.wait([
-        if (needSave) preferences.saveConfig(ref.read(configProvider)),
-        if (macOS != null) macOS!.updateDns(true),
-        if (proxy != null) proxy!.stopProxy(),
-        if (tray != null) tray!.destroy(),
-      ]);
-      await window?.close();
-      await coreController.destroy();
-      commonPrint.log('exit');
-    } finally {
-      system.exit();
-    }
-  }
-
-  Future<void> handleClose([bool exit = true]) async {
-    if (!system.isDesktop) {
-      if (ref.read(backBlockProvider)) return;
-    }
-    if (ref.read(appSettingProvider).minimizeOnExit || !exit) {
-      if (system.isDesktop) {
-        await preferences.saveConfig(ref.read(configProvider));
-      }
-      await system.back();
-    } else {
-      await handleExit();
-    }
-  }
-
-  Future<void> updateVisible() async {
-    final visible = await window?.isVisible;
-    if (visible != null && !visible) {
-      window?.show();
-    } else {
-      window?.hide();
-    }
-  }
-
-  void updateTun() {
-    ref
-        .read(patchClashConfigProvider.notifier)
-        .update((state) => state.copyWith.tun(enable: !state.tun.enable));
-  }
-
-  void updateSystemProxy() {
-    ref
-        .read(networkSettingProvider.notifier)
-        .update((state) => state.copyWith(systemProxy: !state.systemProxy));
-  }
-
-  void updateAutoLaunch() {
-    ref
-        .read(appSettingProvider.notifier)
-        .update((state) => state.copyWith(autoLaunch: !state.autoLaunch));
-  }
-
-  Future<void> updateTray() async {
-    tray?.update(
-      trayState: ref.read(trayStateProvider),
-      traffic: ref.read(
-        trafficsProvider.select(
-          (state) => state.list.safeLast(const Traffic()),
-        ),
-      ),
-    );
-  }
-
-  Future<void> updateLocalIp() async {
-    ref.read(localIpProvider.notifier).value = null;
-    await Future.delayed(commonDuration);
-    ref.read(localIpProvider.notifier).value = await utils.getLocalIpAddress();
-  }
-}
-
-@Riverpod(keepAlive: true)
-class StoreAction extends _$StoreAction {
-  @override
-  void build() {}
-
-  Future<void> shakingStore() async {
-    final profileIds = ref.read(
-      profilesProvider.select((state) => state.map((item) => item.id)),
-    );
-    final scriptIds = await ref.read(
-      scriptsProvider.future.select(
-        (state) async => (await state).map((item) => item.id),
-      ),
-    );
-    final pathsToDelete = await shakingProfileTask(VM2(profileIds, scriptIds));
-    if (pathsToDelete.isNotEmpty) {
-      final deleteFutures = pathsToDelete.map((path) async {
-        try {
-          final res = await coreController.deleteFile(path);
-          if (res.isNotEmpty) throw res;
-        } catch (e) {
-          rethrow;
-        }
-      });
-      await Future.wait(deleteFutures);
-    }
-  }
-
-  void savePreferencesDebounce() {
-    debouncer.call(FunctionTag.savePreferences, () async {
-      await preferences.saveConfig(ref.read(configProvider));
-    });
-  }
-
-  Future handleClear() async {
-    await preferences.clearPreferences();
-    commonPrint.log('clear preferences');
-    await database.close();
-    await File(await appPath.databasePath).safeDelete(recursive: true);
-    final homeDir = Directory(await appPath.profilesPath);
-    await for (final file in homeDir.list(recursive: true)) {
-      await coreController.deleteFile(file.path);
-    }
-    await preferences.clearPreferences();
-    ref.read(systemActionProvider.notifier).handleExit(false);
-  }
-}
-
-@Riverpod(keepAlive: true)
-class ThemeAction extends _$ThemeAction {
-  @override
-  void build() {}
-
-  void updateBrightness() {
-    WidgetsBinding.instance.addPostFrameCallback((_) {
-      ref.read(systemBrightnessProvider.notifier).value =
-          WidgetsBinding.instance.platformDispatcher.platformBrightness;
-    });
-  }
-
-  void updateViewSize(Size size) {
-    WidgetsBinding.instance.addPostFrameCallback((_) {
-      ref.read(viewSizeProvider.notifier).value = size;
-    });
-  }
-}
-
-@Riverpod(keepAlive: true)
-class ProxiesAction extends _$ProxiesAction {
-  @override
-  void build() {}
-
-  void updateGroupsDebounce([Duration? duration]) {
-    debouncer.call(FunctionTag.updateGroups, updateGroups, duration: duration);
-  }
-
-  void changeProxyDebounce(String groupName, String proxyName) {
-    debouncer.call(FunctionTag.changeProxy, (
-      String groupName,
-      String proxyName,
-    ) async {
-      await changeProxy(groupName: groupName, proxyName: proxyName);
-      updateGroupsDebounce();
-    }, args: [groupName, proxyName]);
-  }
-
-  Future<void> updateGroups() async {
-    try {
-      commonPrint.log('updateGroups');
-      ref.read(groupsProvider.notifier).value = await retry(
-        task: () async {
-          final sortType = ref.read(
-            proxiesStyleSettingProvider.select((state) => state.sortType),
-          );
-          final delayMap = ref.read(delayDataSourceProvider);
-          final testUrl = ref.read(
-            appSettingProvider.select((state) => state.testUrl),
-          );
-          final selectedMap = ref.read(
-            currentProfileProvider.select((state) => state?.selectedMap ?? {}),
-          );
-          return coreController.getProxiesGroups(
-            selectedMap: selectedMap,
-            sortType: sortType,
-            delayMap: delayMap,
-            defaultTestUrl: testUrl,
-          );
-        },
-        retryIf: (res) => res.isEmpty,
-      );
-    } catch (e) {
-      commonPrint.log('updateGroups error: $e');
-      ref.read(groupsProvider.notifier).value = [];
-    }
-  }
-
-  void updateCurrentGroupName(String groupName) {
-    final profile = ref.read(currentProfileProvider);
-    if (profile == null || profile.currentGroupName == groupName) return;
-    ref
-        .read(profilesProvider.notifier)
-        .put(profile.copyWith(currentGroupName: groupName));
-  }
-
-  void updateCurrentUnfoldSet(Set<String> value) {
-    final currentProfile = ref.read(currentProfileProvider);
-    if (currentProfile == null) return;
-    ref
-        .read(profilesProvider.notifier)
-        .put(currentProfile.copyWith(unfoldSet: value));
-  }
-
-  void setDelay(Delay delay) {
-    ref.read(delayDataSourceProvider.notifier).setDelay(delay);
-  }
-
-  Future<void> changeProxy({
-    required String groupName,
-    required String proxyName,
-  }) async {
-    await coreController.changeProxy(
-      ChangeProxyParams(groupName: groupName, proxyName: proxyName),
-    );
-    if (ref.read(appSettingProvider).closeConnections) {
-      await coreController.closeConnections();
-    } else {
-      await coreController.resetConnections();
-    }
-    ref.read(checkIpNumProvider.notifier).add();
-  }
-
-  Future<String> updateProvider(
-    ExternalProvider provider, {
-    bool showLoading = false,
-  }) async {
-    try {
-      if (showLoading) {
-        ref.read(isUpdatingProvider(provider.updatingKey).notifier).value =
-            true;
-      }
-      final message = await coreController.updateExternalProvider(
-        providerName: provider.name,
-      );
-      if (message.isNotEmpty) return message;
-      ref
-          .read(providersProvider.notifier)
-          .setProvider(await coreController.getExternalProvider(provider.name));
-      return '';
-    } finally {
-      ref.read(isUpdatingProvider(provider.updatingKey).notifier).value = false;
-    }
-  }
-}
-
-@Riverpod(keepAlive: true)
-class ProfilesAction extends _$ProfilesAction {
-  @override
-  void build() {}
-
-  void updateCurrentSelectedMap(String groupName, String proxyName) {
-    final currentProfile = ref.read(currentProfileProvider);
-    if (currentProfile != null &&
-        currentProfile.selectedMap[groupName] != proxyName) {
-      final selectedMap = Map<String, String>.from(currentProfile.selectedMap)
-        ..[groupName] = proxyName;
-      ref
-          .read(profilesProvider.notifier)
-          .put(currentProfile.copyWith(selectedMap: selectedMap));
-    }
-  }
-
-  Future<void> deleteProfile(int id) async {
-    ref.read(profilesProvider.notifier).del(id);
-    clearEffect(id);
-    final currentProfileId = ref.read(currentProfileIdProvider);
-    if (currentProfileId == id) {
-      final profiles = ref.read(profilesProvider);
-      if (profiles.isNotEmpty) {
-        final updateId = profiles.first.id;
-        ref.read(currentProfileIdProvider.notifier).value = updateId;
-      } else {
-        ref.read(currentProfileIdProvider.notifier).value = null;
-        ref.read(setupActionProvider.notifier).updateStatus(false);
-      }
-    }
-  }
-
-  Future<void> autoUpdateProfiles() async {
-    for (final profile in ref.read(profilesProvider)) {
-      if (!profile.autoUpdate) continue;
-      final isNotNeedUpdate = profile.lastUpdateDate
-          ?.add(profile.autoUpdateDuration)
-          .isBeforeNow;
-      if (isNotNeedUpdate == false || profile.type == ProfileType.file) {
-        continue;
-      }
-      try {
-        await updateProfile(profile);
-      } catch (e) {
-        commonPrint.log(e.toString(), logLevel: LogLevel.warning);
-      }
-    }
-  }
-
-  void putProfile(Profile profile) {
-    ref.read(profilesProvider.notifier).put(profile);
-    if (ref.read(currentProfileIdProvider) != null) return;
-    ref.read(currentProfileIdProvider.notifier).value = profile.id;
-  }
-
-  Future<void> updateProfiles() async {
-    for (final profile in ref.read(profilesProvider)) {
-      if (profile.type == ProfileType.file) continue;
-      await updateProfile(profile);
-    }
-  }
-
-  Future<void> updateProfile(
-    Profile profile, {
-    bool showLoading = false,
-  }) async {
-    try {
-      if (showLoading) {
-        ref.read(isUpdatingProvider(profile.updatingKey).notifier).value = true;
-      }
-      ref.read(profilesProvider.notifier).put(profile);
-      final newProfile = await profile.update();
-      ref.read(profilesProvider.notifier).put(newProfile);
-      if (profile.id == ref.read(currentProfileIdProvider)) {
-        ref
-            .read(setupActionProvider.notifier)
-            .applyProfileDebounce(silence: true);
-      }
-    } finally {
-      ref.read(isUpdatingProvider(profile.updatingKey).notifier).value = false;
-    }
-  }
-
-  Future<void> addProfileFormFile() async {
-    final platformFile = await globalState.safeRun(picker.pickerFile);
-    if (platformFile == null) return;
-    final bytes = await platformFile.readBytes();
-    globalState.navigatorKey.currentState?.popUntil((route) => route.isFirst);
-    ref.read(currentPageLabelProvider.notifier).toProfiles();
-    final profile = await globalState.loadingRun(
-      tag: LoadingTag.profiles,
-      () async {
-        return Profile.normal(label: platformFile.name).saveFile(bytes);
-      },
-      title: currentAppLocalizations.addProfile,
-    );
-    if (profile != null) {
-      putProfile(profile);
-    }
-  }
-
-  Future<void> addProfileFormURL(String url) async {
-    if (globalState.navigatorKey.currentState?.canPop() ?? false) {
-      globalState.navigatorKey.currentState?.popUntil((route) => route.isFirst);
-    }
-    ref.read(currentPageLabelProvider.notifier).value = PageLabel.profiles;
-    final profile = await globalState.loadingRun(
-      tag: LoadingTag.profiles,
-      () async {
-        return Profile.normal(url: url).update();
-      },
-      title: currentAppLocalizations.addProfile,
-    );
-    if (profile != null) {
-      putProfile(profile);
-    }
-  }
-
-  void setProfileAndAutoApply(Profile profile) {
-    ref.read(profilesProvider.notifier).put(profile);
-    if (profile.id == ref.read(currentProfileIdProvider)) {
-      ref.read(setupActionProvider.notifier).applyProfileDebounce();
-    }
-  }
-
-  Future<void> addProfileFormQrCode() async {
-    final url = await globalState.safeRun(picker.pickerConfigQRCode);
-    if (url == null) return;
-    addProfileFormURL(url);
-  }
-
-  void reorder(List<Profile> profiles) {
-    ref.read(profilesProvider.notifier).reorder(profiles);
-  }
-
-  Future<void> clearEffect(int profileId) async {
-    final profilePath = await appPath.getProfilePath(profileId.toString());
-    final providersDirPath = await appPath.getProvidersDirPath(
-      profileId.toString(),
-    );
-    final profileFile = File(profilePath);
-    final isExists = await profileFile.exists();
-    if (isExists) {
-      await profileFile.safeDelete(recursive: true);
-    }
-    await coreController.deleteFile(providersDirPath);
-  }
-}
-
-@Riverpod(keepAlive: true)
-class GeoResourceAction extends _$GeoResourceAction {
-  @override
-  void build() {}
-
-  Future<void> updateGeoResource(GeoResource geoResource) async {
-    await coreController.updateGeoData(geoResource.name);
-  }
-
-  void updateGeoResourceUrl(GeoResource geoResource, String newUrl) {
-    if (!newUrl.isUrl) {
-      throw 'Invalid url';
-    }
-    ref.read(patchClashConfigProvider.notifier).update((state) {
-      return state.copyWith(geoXUrl: {...state.geoXUrl, geoResource: newUrl});
-    });
-  }
-}
diff --git a/lib/providers/actions/backup.dart b/lib/providers/actions/backup.dart
new file mode 100644
index 0000000000..7bab8707ce
--- /dev/null
+++ b/lib/providers/actions/backup.dart
@@ -0,0 +1,62 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class BackupAction extends _$BackupAction {
+  @override
+  void build() {}
+
+  Future<String> backup() async {
+    final res = await Future.wait([
+      database.profilesDao.fileNames().get(),
+      database.scriptsDao.fileNames().get(),
+    ]);
+    final profileFileNames = res[0];
+    final scriptFileNames = res[1];
+    final configMap = ref.read(configProvider).toJson();
+    configMap['version'] = await preferences.getVersion();
+    return backupTask(configMap, [...profileFileNames, ...scriptFileNames]);
+  }
+
+  Future<void> restore(RestoreOption option) async {
+    final restoreDirPath = await appPath.restoreDirPath;
+    final restoreDir = Directory(restoreDirPath);
+    final restoreStrategy = ref.read(
+      appSettingProvider.select((state) => state.restoreStrategy),
+    );
+    final isOverride = restoreStrategy == RestoreStrategy.override;
+    try {
+      final migrationData = await restoreTask();
+      if (!await restoreDir.exists()) {
+        throw currentAppLocalizations.restoreException;
+      }
+      await database.restore(
+        migrationData.profiles,
+        migrationData.scripts,
+        migrationData.rules,
+        migrationData.links,
+        migrationData.proxyGroups,
+        isOverride: isOverride,
+      );
+      final configMap = migrationData.configMap;
+      if (option == RestoreOption.onlyProfiles || configMap == null) return;
+      final config = Config.fromJson(configMap);
+      ref.read(davSettingProvider.notifier).update((_) => config.davProps);
+      ref.read(patchClashConfigProvider.notifier).value =
+          config.patchClashConfig;
+      ref.read(appSettingProvider.notifier).value = config.appSettingProps;
+      ref.read(currentProfileIdProvider.notifier).value =
+          config.currentProfileId;
+      ref.read(themeSettingProvider.notifier).value = config.themeProps;
+      ref.read(windowSettingProvider.notifier).value = config.windowProps;
+      ref.read(vpnSettingProvider.notifier).value = config.vpnProps;
+      ref.read(proxiesStyleSettingProvider.notifier).value =
+          config.proxiesStyleProps;
+      ref.read(overrideDnsProvider.notifier).value = config.overrideDns;
+      ref.read(networkSettingProvider.notifier).value = config.networkProps;
+      ref.read(hotKeyActionsProvider.notifier).value = config.hotKeyActions;
+      return;
+    } finally {
+      await restoreDir.safeDelete(recursive: true);
+    }
+  }
+}
diff --git a/lib/providers/actions/common.dart b/lib/providers/actions/common.dart
new file mode 100644
index 0000000000..ce3ed77b73
--- /dev/null
+++ b/lib/providers/actions/common.dart
@@ -0,0 +1,84 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class CommonAction extends _$CommonAction {
+  @override
+  void build() {}
+
+  void toggleRunning() {
+    final running = !ref.read(isStartProvider);
+    ref
+        .read(setupActionProvider.notifier)
+        .setRunning(running, initialize: running && !ref.read(initProvider));
+  }
+
+  void updateSpeedStatistics() {
+    ref
+        .read(appSettingProvider.notifier)
+        .update((state) => state.copyWith(showTrayTitle: !state.showTrayTitle));
+  }
+
+  void updateMode() {
+    ref.read(patchClashConfigProvider.notifier).update((state) {
+      final index = Mode.values.indexWhere((item) => item == state.mode);
+      if (index == -1) return state;
+      final nextIndex = index + 1 > Mode.values.length - 1 ? 0 : index + 1;
+      return state.copyWith(mode: Mode.values[nextIndex]);
+    });
+  }
+
+  Future<void> updateTraffic() async {
+    final onlyStatisticsProxy = ref.read(
+      appSettingProvider.select((state) => state.onlyStatisticsProxy),
+    );
+    final traffic = await coreController.getTraffic(onlyStatisticsProxy);
+    ref.read(trafficsProvider.notifier).addTraffic(traffic);
+    ref.read(totalTrafficProvider.notifier).value = await coreController
+        .getTotalTraffic(onlyStatisticsProxy);
+  }
+
+  Future<void> autoCheckUpdate() async {
+    if (!ref.read(appSettingProvider).autoCheckUpdate) return;
+    final res = await request.checkForUpdate();
+    checkUpdateResultHandle(data: res);
+  }
+
+  Future<void> checkUpdateResultHandle({
+    Map<String, dynamic>? data,
+    bool isUser = false,
+  }) async {
+    if (data != null) {
+      final tagName = data['tag_name'];
+      final body = data['body'];
+      final submits = utils.parseReleaseBody(body);
+      final context = globalState.navigatorKey.currentContext!;
+      final textTheme = context.textTheme;
+      final res = await globalState.showMessage(
+        title: currentAppLocalizations.discoverNewVersion,
+        message: TextSpan(
+          text: '$tagName \n',
+          style: textTheme.headlineSmall,
+          children: [
+            TextSpan(text: '\n', style: textTheme.bodyMedium),
+            for (final submit in submits)
+              TextSpan(text: '- $submit \n', style: textTheme.bodyMedium),
+          ],
+        ),
+        confirmText: currentAppLocalizations.goDownload,
+        cancelText: isUser ? null : currentAppLocalizations.noLongerRemind,
+      );
+      if (res == true) {
+        launchUrl(Uri.parse('https://github.com/$repository/releases/latest'));
+      } else if (!isUser && res == false) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(autoCheckUpdate: false));
+      }
+    } else if (isUser) {
+      globalState.showMessage(
+        title: currentAppLocalizations.checkUpdate,
+        message: TextSpan(text: currentAppLocalizations.checkUpdateError),
+      );
+    }
+  }
+}
diff --git a/lib/providers/actions/core.dart b/lib/providers/actions/core.dart
new file mode 100644
index 0000000000..b3c4c7a62a
--- /dev/null
+++ b/lib/providers/actions/core.dart
@@ -0,0 +1,83 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class CoreAction extends _$CoreAction {
+  int _requestedRestartRevision = 0;
+  Future<void>? _restartOperation;
+  bool _latestExplicitStart = false;
+
+  @override
+  void build() {}
+
+  Future<void> initCore() async {
+    final isInit = await coreController.isInit;
+
+    final version = ref.read(versionProvider);
+    if (!isInit) {
+      final res = await coreController.init(version);
+      commonPrint.log('init result: $res');
+    } else {
+      await ref.read(proxiesActionProvider.notifier).updateGroups();
+    }
+  }
+
+  Future<void> startCore() async {
+    ref.read(coreStatusProvider.notifier).value = CoreStatus.connecting;
+    try {
+      await coreController.start();
+      ref.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+      await initCore();
+    } catch (error) {
+      ref.read(coreStatusProvider.notifier).value = CoreStatus.disconnected;
+      globalState.showNotifier(error.toString());
+    }
+  }
+
+  @protected
+  Future<CoreLifecycleResult> restartLifecycle() {
+    return coreController.restart();
+  }
+
+  Future<void> restartCore([bool start = false]) {
+    _requestedRestartRevision++;
+    _latestExplicitStart = start;
+    final activeOperation = _restartOperation;
+    if (activeOperation != null) {
+      return activeOperation;
+    }
+
+    final operation = _runRestartWorker();
+    _restartOperation = operation;
+    return operation;
+  }
+
+  Future<void> _runRestartWorker() async {
+    try {
+      ref.read(coreStatusProvider.notifier).value = CoreStatus.connecting;
+      await restartLifecycle();
+      ref.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+      await initCore();
+
+      var appliedRevision = 0;
+      while (appliedRevision < _requestedRestartRevision) {
+        final revision = _requestedRestartRevision;
+        final explicitStart = _latestExplicitStart;
+        if (explicitStart || ref.read(isStartProvider)) {
+          await ref
+              .read(setupActionProvider.notifier)
+              .setRunning(true, initialize: true);
+        } else {
+          await ref
+              .read(setupActionProvider.notifier)
+              .applyProfile(force: true);
+        }
+        appliedRevision = revision;
+      }
+    } catch (_) {
+      ref.read(coreStatusProvider.notifier).value = CoreStatus.disconnected;
+      rethrow;
+    } finally {
+      _restartOperation = null;
+    }
+  }
+}
diff --git a/lib/providers/actions/geo_resource.dart b/lib/providers/actions/geo_resource.dart
new file mode 100644
index 0000000000..13d3d77a96
--- /dev/null
+++ b/lib/providers/actions/geo_resource.dart
@@ -0,0 +1,20 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class GeoResourceAction extends _$GeoResourceAction {
+  @override
+  void build() {}
+
+  Future<void> updateGeoResource(GeoResource geoResource) async {
+    await coreController.updateGeoData(geoResource.name);
+  }
+
+  void updateGeoResourceUrl(GeoResource geoResource, String newUrl) {
+    if (!newUrl.isUrl) {
+      throw 'Invalid url';
+    }
+    ref.read(patchClashConfigProvider.notifier).update((state) {
+      return state.copyWith(geoXUrl: {...state.geoXUrl, geoResource: newUrl});
+    });
+  }
+}
diff --git a/lib/providers/actions/profiles.dart b/lib/providers/actions/profiles.dart
new file mode 100644
index 0000000000..9401a9c25a
--- /dev/null
+++ b/lib/providers/actions/profiles.dart
@@ -0,0 +1,151 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class ProfilesAction extends _$ProfilesAction {
+  @override
+  void build() {}
+
+  void updateCurrentSelectedMap(String groupName, String proxyName) {
+    final currentProfile = ref.read(currentProfileProvider);
+    if (currentProfile != null &&
+        currentProfile.selectedMap[groupName] != proxyName) {
+      final selectedMap = Map<String, String>.from(currentProfile.selectedMap)
+        ..[groupName] = proxyName;
+      ref
+          .read(profilesProvider.notifier)
+          .put(currentProfile.copyWith(selectedMap: selectedMap));
+    }
+  }
+
+  Future<void> deleteProfile(int id) async {
+    await ref.read(profilesProvider.notifier).del(id);
+    await clearEffect(id);
+    final currentProfileId = ref.read(currentProfileIdProvider);
+    if (currentProfileId == id) {
+      final profiles = ref.read(profilesProvider);
+      if (profiles.isNotEmpty) {
+        final updateId = profiles.first.id;
+        ref.read(currentProfileIdProvider.notifier).value = updateId;
+      } else {
+        ref.read(currentProfileIdProvider.notifier).value = null;
+        ref.read(setupActionProvider.notifier).setRunning(false);
+      }
+    }
+  }
+
+  Future<void> autoUpdateProfiles() async {
+    for (final profile in ref.read(profilesProvider)) {
+      if (!profile.autoUpdate) continue;
+      final isNotNeedUpdate = profile.lastUpdateDate
+          ?.add(profile.autoUpdateDuration)
+          .isBeforeNow;
+      if (isNotNeedUpdate == false || profile.type == ProfileType.file) {
+        continue;
+      }
+      try {
+        await updateProfile(profile);
+      } catch (e) {
+        commonPrint.log(e.toString(), logLevel: LogLevel.warning);
+      }
+    }
+  }
+
+  void putProfile(Profile profile) {
+    ref.read(profilesProvider.notifier).put(profile);
+    if (ref.read(currentProfileIdProvider) != null) return;
+    ref.read(currentProfileIdProvider.notifier).value = profile.id;
+  }
+
+  Future<void> updateProfiles() async {
+    for (final profile in ref.read(profilesProvider)) {
+      if (profile.type == ProfileType.file) continue;
+      await updateProfile(profile);
+    }
+  }
+
+  Future<void> updateProfile(
+    Profile profile, {
+    bool showLoading = false,
+  }) async {
+    try {
+      if (showLoading) {
+        ref.read(isUpdatingProvider(profile.updatingKey).notifier).value = true;
+      }
+      ref.read(profilesProvider.notifier).put(profile);
+      final newProfile = await profile.update();
+      ref.read(profilesProvider.notifier).put(newProfile);
+      if (profile.id == ref.read(currentProfileIdProvider)) {
+        ref
+            .read(setupActionProvider.notifier)
+            .applyProfileDebounce(silence: true);
+      }
+    } finally {
+      ref.read(isUpdatingProvider(profile.updatingKey).notifier).value = false;
+    }
+  }
+
+  Future<void> addProfileFormFile() async {
+    final platformFile = await globalState.safeRun(picker.pickerFile);
+    if (platformFile == null) return;
+    final bytes = await platformFile.readBytes();
+    globalState.navigatorKey.currentState?.popUntil((route) => route.isFirst);
+    ref.read(currentPageLabelProvider.notifier).toProfiles();
+    final profile = await globalState.loadingRun(
+      tag: LoadingTag.profiles,
+      () async {
+        return Profile.normal(label: platformFile.name).saveFile(bytes);
+      },
+      title: currentAppLocalizations.addProfile,
+    );
+    if (profile != null) {
+      putProfile(profile);
+    }
+  }
+
+  Future<void> addProfileFormURL(String url) async {
+    if (globalState.navigatorKey.currentState?.canPop() ?? false) {
+      globalState.navigatorKey.currentState?.popUntil((route) => route.isFirst);
+    }
+    ref.read(currentPageLabelProvider.notifier).value = PageLabel.profiles;
+    final profile = await globalState.loadingRun(
+      tag: LoadingTag.profiles,
+      () async {
+        return Profile.normal(url: url).update();
+      },
+      title: currentAppLocalizations.addProfile,
+    );
+    if (profile != null) {
+      putProfile(profile);
+    }
+  }
+
+  void setProfileAndAutoApply(Profile profile) {
+    ref.read(profilesProvider.notifier).put(profile);
+    if (profile.id == ref.read(currentProfileIdProvider)) {
+      ref.read(setupActionProvider.notifier).applyProfileDebounce();
+    }
+  }
+
+  Future<void> addProfileFormQrCode() async {
+    final url = await globalState.safeRun(picker.pickerConfigQRCode);
+    if (url == null) return;
+    addProfileFormURL(url);
+  }
+
+  void reorder(List<Profile> profiles) {
+    ref.read(profilesProvider.notifier).reorder(profiles);
+  }
+
+  Future<void> clearEffect(int profileId) async {
+    final profilePath = await appPath.getProfilePath(profileId.toString());
+    final profileFile = File(profilePath);
+    final isExists = await profileFile.exists();
+    if (isExists) {
+      await profileFile.safeDelete(recursive: true);
+    }
+    final error = await coreController.clearEffect(profileId);
+    if (error.isNotEmpty) {
+      commonPrint.log(error, logLevel: LogLevel.warning);
+    }
+  }
+}
diff --git a/lib/providers/actions/proxies.dart b/lib/providers/actions/proxies.dart
new file mode 100644
index 0000000000..27a937c813
--- /dev/null
+++ b/lib/providers/actions/proxies.dart
@@ -0,0 +1,108 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class ProxiesAction extends _$ProxiesAction {
+  @override
+  void build() {}
+
+  void updateGroupsDebounce([Duration? duration]) {
+    debouncer.call(FunctionTag.updateGroups, updateGroups, duration: duration);
+  }
+
+  void changeProxyDebounce(String groupName, String proxyName) {
+    debouncer.call(FunctionTag.changeProxy, (
+      String groupName,
+      String proxyName,
+    ) async {
+      await changeProxy(groupName: groupName, proxyName: proxyName);
+      updateGroupsDebounce();
+    }, args: [groupName, proxyName]);
+  }
+
+  Future<void> updateGroups() async {
+    try {
+      commonPrint.log('updateGroups');
+      ref.read(groupsProvider.notifier).value = await retry(
+        task: () async {
+          final sortType = ref.read(
+            proxiesStyleSettingProvider.select((state) => state.sortType),
+          );
+          final delayMap = ref.read(delayDataSourceProvider);
+          final testUrl = ref.read(
+            appSettingProvider.select((state) => state.testUrl),
+          );
+          final selectedMap = ref.read(
+            currentProfileProvider.select((state) => state?.selectedMap ?? {}),
+          );
+          return coreController.getProxiesGroups(
+            selectedMap: selectedMap,
+            sortType: sortType,
+            delayMap: delayMap,
+            defaultTestUrl: testUrl,
+          );
+        },
+        retryIf: (res) => res.isEmpty,
+      );
+    } catch (e) {
+      commonPrint.log('updateGroups error: $e');
+      ref.read(groupsProvider.notifier).value = [];
+    }
+  }
+
+  void updateCurrentGroupName(String groupName) {
+    final profile = ref.read(currentProfileProvider);
+    if (profile == null || profile.currentGroupName == groupName) return;
+    ref
+        .read(profilesProvider.notifier)
+        .put(profile.copyWith(currentGroupName: groupName));
+  }
+
+  void updateCurrentUnfoldSet(Set<String> value) {
+    final currentProfile = ref.read(currentProfileProvider);
+    if (currentProfile == null) return;
+    ref
+        .read(profilesProvider.notifier)
+        .put(currentProfile.copyWith(unfoldSet: value));
+  }
+
+  void setDelay(Delay delay) {
+    ref.read(delayDataSourceProvider.notifier).setDelay(delay);
+  }
+
+  Future<void> changeProxy({
+    required String groupName,
+    required String proxyName,
+  }) async {
+    await coreController.changeProxy(
+      ChangeProxyParams(groupName: groupName, proxyName: proxyName),
+    );
+    if (ref.read(appSettingProvider).closeConnections) {
+      await coreController.closeConnections();
+    } else {
+      await coreController.resetConnections();
+    }
+    ref.read(checkIpNumProvider.notifier).add();
+  }
+
+  Future<String> updateProvider(
+    ExternalProvider provider, {
+    bool showLoading = false,
+  }) async {
+    try {
+      if (showLoading) {
+        ref.read(isUpdatingProvider(provider.updatingKey).notifier).value =
+            true;
+      }
+      final message = await coreController.updateExternalProvider(
+        providerName: provider.name,
+      );
+      if (message.isNotEmpty) return message;
+      ref
+          .read(providersProvider.notifier)
+          .setProvider(await coreController.getExternalProvider(provider.name));
+      return '';
+    } finally {
+      ref.read(isUpdatingProvider(provider.updatingKey).notifier).value = false;
+    }
+  }
+}
diff --git a/lib/providers/actions/setup.dart b/lib/providers/actions/setup.dart
new file mode 100644
index 0000000000..5a52f87026
--- /dev/null
+++ b/lib/providers/actions/setup.dart
@@ -0,0 +1,439 @@
+part of '../action.dart';
+
+enum _SetupTaskResult { completed, handoffToCoreRestart }
+
+class _RunRequest {
+  final bool running;
+  final bool initialize;
+
+  const _RunRequest({required this.running, required this.initialize});
+}
+
+@Riverpod(keepAlive: true)
+class SetupAction extends _$SetupAction {
+  Timer? _runtimeTimer;
+  final _setupScheduler = SerialTaskScheduler();
+  final _listenerScheduler = SerialTaskScheduler();
+  _RunRequest? _latestRunRequest;
+  DateTime? _startTime;
+
+  bool get _isRunning => _startTime != null && _startTime!.isBeforeNow;
+
+  @override
+  void build() {}
+
+  SetupParams get _setupParams {
+    final selectedMap = ref.read(selectedMapProvider);
+    final testUrl = ref.read(
+      appSettingProvider.select((state) => state.testUrl),
+    );
+    return SetupParams(selectedMap: selectedMap, testUrl: testUrl);
+  }
+
+  void fullSetup() {
+    if (!ref.read(initProvider)) return;
+    ref.read(delayDataSourceProvider.notifier).value = {};
+    unawaited(_runSetup(force: true));
+    ref.read(logsProvider.notifier).value = FixedList(500);
+    ref.read(requestsProvider.notifier).value = FixedList(500);
+  }
+
+  void _setLocalRunning(bool running) {
+    _runtimeTimer?.cancel();
+    _runtimeTimer = null;
+    if (!running) {
+      _startTime = null;
+      debouncer.cancel(FunctionTag.applyProfile);
+      _updateRunTime();
+      return;
+    }
+
+    _startTime ??= DateTime.now();
+    _refreshRunningState();
+    _runtimeTimer = Timer.periodic(
+      const Duration(seconds: 1),
+      (_) => _refreshRunningState(),
+    );
+  }
+
+  void _refreshRunningState() {
+    _updateRunTime();
+    unawaited(ref.read(commonActionProvider.notifier).updateTraffic());
+  }
+
+  void _updateRunTime() {
+    final startTime = _startTime;
+    ref.read(runTimeProvider.notifier).value = startTime == null
+        ? null
+        : DateTime.now().millisecondsSinceEpoch -
+              startTime.millisecondsSinceEpoch;
+  }
+
+  Future<void> _updateStartTime() async {
+    _startTime = await service?.getRunTime();
+  }
+
+  Future<void> initStatus() async {
+    if (!globalState.needInitStatus) {
+      commonPrint.log('init status cancel');
+      return;
+    }
+    commonPrint.log('init status');
+    if (system.isAndroid) {
+      await _updateStartTime();
+    }
+    final shouldRun = _isRunning || ref.read(appSettingProvider).autoRun;
+    if (shouldRun) {
+      await setRunning(true, initialize: true);
+    } else {
+      await applyProfile(force: true);
+    }
+  }
+
+  Future<void> setRunning(bool running, {bool initialize = false}) {
+    if (running && !initialize && !ref.read(initProvider)) {
+      return Future.value();
+    }
+
+    final request = _RunRequest(
+      running: running,
+      initialize: running && initialize,
+    );
+    _latestRunRequest = request;
+    _setLocalRunning(running);
+    if (request.initialize) {
+      globalState.needInitStatus = false;
+    }
+    return running ? _start(request) : _stop(request);
+  }
+
+  Future<void> _start(_RunRequest request) async {
+    if (request.initialize) {
+      try {
+        await applyProfile(
+          force: true,
+          preloadInvoke: () => _setCoreRunning(request),
+        );
+      } catch (_) {
+        if (_isCurrent(request)) {
+          await setRunning(false);
+        }
+      }
+      return;
+    }
+
+    await _setCoreRunning(request);
+    if (_isCurrent(request)) {
+      applyProfileDebounce(force: true, silence: true);
+    }
+  }
+
+  Future<void> _stop(_RunRequest request) async {
+    await _setCoreRunning(request);
+    if (!_isCurrent(request)) {
+      return;
+    }
+    resetCoreTraffic();
+    ref.read(trafficsProvider.notifier).clear();
+    ref.read(totalTrafficProvider.notifier).value = const Traffic();
+    ref.read(checkIpNumProvider.notifier).add();
+  }
+
+  Future<void> _setCoreRunning(_RunRequest request) {
+    return _listenerScheduler.run(() async {
+      if (!_isCurrent(request)) {
+        return;
+      }
+      if (request.running && ref.read(suspendProvider)) {
+        return;
+      }
+      await setCoreRunning(request.running);
+    });
+  }
+
+  bool _isCurrent(_RunRequest request) => identical(_latestRunRequest, request);
+
+  Future<void> updateConfigDebounce() async {
+    debouncer.call(FunctionTag.updateConfig, updateConfig);
+  }
+
+  @protected
+  Future<bool> setCoreRunning(bool running) {
+    return running
+        ? coreController.startListener()
+        : coreController.stopListener();
+  }
+
+  @protected
+  void resetCoreTraffic() {
+    coreController.resetTraffic();
+  }
+
+  @visibleForTesting
+  Future<void> updateConfig() async {
+    await globalState.safeRun(() async {
+      final updateParams = ref.read(updateParamsProvider);
+      final shouldContinueSetup = await requestAdmin(updateParams.tun.enable);
+      if (!shouldContinueSetup) {
+        await _restartCoreAfterAuthorization();
+        return;
+      }
+      final message = await coreController.updateConfig(
+        updateParams.copyWith.tun(
+          enable: _getEffectiveTunEnable(updateParams.tun.enable),
+        ),
+      );
+      ref.read(checkIpNumProvider.notifier).add();
+      if (message.isNotEmpty) throw message;
+    });
+  }
+
+  void tryCheckIp() {
+    final isTimeout = ref.read(
+      networkDetectionProvider.select(
+        (state) => state.ipInfo == null && state.isLoading == false,
+      ),
+    );
+    if (!isTimeout) return;
+    ref.read(checkIpNumProvider.notifier).add();
+  }
+
+  void applyProfileDebounce({bool silence = false, bool force = false}) {
+    debouncer.call(FunctionTag.applyProfile, (silence, force) {
+      applyProfile(silence: silence, force: force);
+    }, args: [silence, force]);
+  }
+
+  void changeMode(Mode mode) {
+    ref
+        .read(patchClashConfigProvider.notifier)
+        .update((state) => state.copyWith(mode: mode));
+    if (mode == Mode.global) {
+      ref
+          .read(proxiesActionProvider.notifier)
+          .updateCurrentGroupName(GroupName.GLOBAL.name);
+    }
+  }
+
+  void autoApplyProfile() {
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      applyProfile();
+    });
+  }
+
+  Future<void> applyProfile({
+    bool silence = false,
+    bool force = false,
+    Future<void> Function()? preloadInvoke,
+  }) {
+    return _runSetup(
+      force: force,
+      silence: silence,
+      preloadInvoke: preloadInvoke,
+    );
+  }
+
+  Future<void> _runSetup({
+    bool silence = false,
+    bool force = false,
+    Future<void> Function()? preloadInvoke,
+  }) async {
+    final result = await _setupScheduler.run(() {
+      return _setupConfig(
+        force: force,
+        silence: silence,
+        preloadInvoke: preloadInvoke,
+        onUpdated: () async {
+          await ref.read(proxiesActionProvider.notifier).updateGroups();
+          await ref.read(providersProvider.notifier).syncProviders();
+        },
+      );
+    });
+    if (result != _SetupTaskResult.handoffToCoreRestart) {
+      return;
+    }
+    // Release the current serial task before restartCore reapplies the profile.
+    await _restartCoreAfterAuthorization();
+  }
+
+  Future<void> _restartCoreAfterAuthorization() async {
+    try {
+      await ref.read(coreActionProvider.notifier).restartCore();
+    } catch (_) {
+      ref.read(authorizedTunEnableProvider.notifier).value =
+          TunAuthorizationState.unauthorized;
+    }
+  }
+
+  Future<VM2<String, String>> getProfile({
+    required SetupState setupState,
+    required PatchClashConfig patchConfig,
+  }) async {
+    final profileId = setupState.profileId;
+    if (profileId == null) return const VM2('', '');
+    final defaultUA = globalState.packageInfo.ua;
+    final networkVM2 = ref.read(
+      networkSettingProvider.select(
+        (state) => VM2(state.appendSystemDns, state.routeMode),
+      ),
+    );
+    final overrideDns = ref.read(overrideDnsProvider);
+    final appendSystemDns = networkVM2.a;
+    final routeMode = networkVM2.b;
+    final tailscaleProps = ref.read(tailscaleSettingProvider);
+    final tailscaleProxies = tailscaleProps.activeProxies;
+    final tailscaleRules = tailscaleProps.buildInjectedRules();
+    final tailscaleFakeIpFilters = tailscaleProps.buildFakeIpFilters();
+    final configMap = await coreController.getConfig(profileId);
+    String? scriptContent;
+    final List<Rule> addedRules = [];
+    final List<ProxyGroup> proxyGroups = [];
+    final List<Rule> rules = [];
+    if (setupState.overwriteType == OverwriteType.script) {
+      scriptContent = await setupState.script?.content;
+    } else if (setupState.overwriteType == OverwriteType.standard) {
+      addedRules.addAll(setupState.addedRules);
+    } else {
+      proxyGroups.addAll(setupState.proxyGroups);
+      rules.addAll(setupState.rules);
+    }
+    final realPatchConfig = patchConfig.copyWith(
+      tun: patchConfig.tun.getRealTun(routeMode),
+    );
+    Map<String, dynamic> rawConfig = configMap;
+    if (scriptContent?.isNotEmpty == true) {
+      rawConfig = await handleEvaluate(scriptContent!, rawConfig);
+    }
+    final directory = await appPath.profilesPath;
+    final res = makeRealProfileTask(
+      MakeRealProfileState(
+        rules: rules,
+        proxyGroups: proxyGroups,
+        profilesPath: directory,
+        profileId: profileId,
+        rawConfig: rawConfig,
+        realPatchConfig: realPatchConfig,
+        overrideDns: overrideDns,
+        appendSystemDns: appendSystemDns,
+        addedRules: addedRules,
+        defaultUA: defaultUA,
+        tailscaleProxies: tailscaleProxies,
+        tailscaleRules: tailscaleRules,
+        tailscaleFakeIpFilters: tailscaleFakeIpFilters,
+      ),
+    );
+    return res;
+  }
+
+  Future<String> getProfileWithId(int profileId) async {
+    try {
+      final setupState = await ref.read(setupStateProvider(profileId).future);
+      final patchClashConfig = ref.read(patchClashConfigProvider);
+      final res = await getProfile(
+        setupState: setupState,
+        patchConfig: patchClashConfig,
+      );
+      return res.a;
+    } catch (e) {
+      globalState.showNotifier(e.toString());
+    }
+    return '';
+  }
+
+  bool _getEffectiveTunEnable(bool enableTun) {
+    final authorizationState = ref.read(authorizedTunEnableProvider);
+    return enableTun && authorizationState == TunAuthorizationState.authorized;
+  }
+
+  @protected
+  Future<AuthorizeCode> authorizeCore() {
+    return system.authorizeCore();
+  }
+
+  @visibleForTesting
+  Future<bool> requestAdmin(bool enableTun) async {
+    if (!enableTun) {
+      return true;
+    }
+    final authorizationState = ref.read(authorizedTunEnableProvider);
+    if (authorizationState == TunAuthorizationState.authorized) {
+      return true;
+    }
+
+    final authorizationNotifier = ref.read(
+      authorizedTunEnableProvider.notifier,
+    );
+    authorizationNotifier.value = TunAuthorizationState.unauthorized;
+
+    final code = await authorizeCore();
+
+    switch (code) {
+      case AuthorizeCode.success:
+        authorizationNotifier.value = TunAuthorizationState.authorized;
+        return false;
+      case AuthorizeCode.none:
+        authorizationNotifier.value = TunAuthorizationState.authorized;
+        return true;
+      case AuthorizeCode.error:
+        return true;
+    }
+  }
+
+  Future<_SetupTaskResult> _setupConfig({
+    bool force = false,
+    bool silence = false,
+    Future<void> Function()? preloadInvoke,
+    FutureOr Function()? onUpdated,
+  }) async {
+    var profile = ref.read(currentProfileProvider);
+    final nextProfile = await profile?.checkAndUpdateAndCopy();
+    if (nextProfile != null) {
+      profile = nextProfile;
+      ref.read(profilesProvider.notifier).put(nextProfile);
+    }
+    commonPrint.log('setup ===> ${profile?.realLabel}');
+    final patchConfig = ref.read(patchClashConfigProvider);
+    final shouldContinueSetup = await requestAdmin(patchConfig.tun.enable);
+    if (!shouldContinueSetup) {
+      return _SetupTaskResult.handoffToCoreRestart;
+    }
+    final effectiveTunEnable = _getEffectiveTunEnable(patchConfig.tun.enable);
+    final realPatchConfig = patchConfig.copyWith.tun(
+      enable: effectiveTunEnable,
+    );
+    final setupState = await ref.read(setupStateProvider(profile?.id).future);
+    final vm2 = await getProfile(
+      setupState: setupState,
+      patchConfig: realPatchConfig,
+    );
+    final yamlString = vm2.a;
+    final yamlMd5 = vm2.b;
+    if (yamlMd5 == globalState.lastConfigMd5 && force == false) {
+      return _SetupTaskResult.completed;
+    }
+    if (system.isAndroid) {
+      globalState.lastVpnState = ref.read(vpnStateProvider);
+      final sharedState = ref.read(sharedStateProvider);
+      await preferences.saveShareState(sharedState);
+    }
+    await globalState.loadingRun(
+      () async {
+        final configFilePath = await appPath.configFilePath;
+        await File(configFilePath).safeWriteAsString(yamlString);
+        final message = await coreController.setupConfig(
+          params: _setupParams,
+          preloadInvoke: preloadInvoke,
+        );
+        if (message.isNotEmpty && !message.endsWith('is empty')) {
+          throw message;
+        }
+        globalState.lastConfigMd5 = yamlMd5;
+        ref.read(checkIpNumProvider.notifier).add();
+        await onUpdated?.call();
+      },
+      silence: true,
+      tag: !silence ? LoadingTag.proxies : null,
+    );
+    return _SetupTaskResult.completed;
+  }
+}
diff --git a/lib/providers/actions/store.dart b/lib/providers/actions/store.dart
new file mode 100644
index 0000000000..f8993cdde5
--- /dev/null
+++ b/lib/providers/actions/store.dart
@@ -0,0 +1,58 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class StoreAction extends _$StoreAction {
+  @override
+  void build() {}
+
+  Future<void> shakingStore() async {
+    final profileIds = ref.read(
+      profilesProvider.select((state) => state.map((item) => item.id)),
+    );
+    final scriptIds = await ref.read(
+      scriptsProvider.future.select(
+        (state) async => (await state).map((item) => item.id),
+      ),
+    );
+    final pathsToDelete = await shakingProfileTask(VM2(profileIds, scriptIds));
+    await Future.wait(
+      pathsToDelete.map((path) => File(path).safeDelete(recursive: true)),
+    );
+  }
+
+  void savePreferencesDebounce() {
+    debouncer.call(FunctionTag.savePreferences, () async {
+      await preferences.saveConfig(ref.read(configProvider));
+    });
+  }
+
+  Future handleClear() async {
+    final profileIds = ref
+        .read(profilesProvider)
+        .map((item) => item.id)
+        .toSet();
+    final providersDir = Directory(await appPath.getProvidersRootPath());
+    if (await providersDir.exists()) {
+      await for (final entity in providersDir.list(followLinks: false)) {
+        if (entity is! Directory) continue;
+        final profileId = int.tryParse(basename(entity.path));
+        if (profileId != null && profileId > 0) {
+          profileIds.add(profileId);
+        }
+      }
+    }
+    final clearResults = await Future.wait(
+      profileIds.map(coreController.clearEffect),
+    );
+    for (final error in clearResults.where((error) => error.isNotEmpty)) {
+      commonPrint.log(error, logLevel: LogLevel.warning);
+    }
+    await preferences.clearPreferences();
+    commonPrint.log('clear preferences');
+    await database.close();
+    await File(await appPath.databasePath).safeDelete(recursive: true);
+    await Directory(await appPath.profilesPath).safeDelete(recursive: true);
+    await preferences.clearPreferences();
+    ref.read(systemActionProvider.notifier).handleExit(false);
+  }
+}
diff --git a/lib/providers/actions/system.dart b/lib/providers/actions/system.dart
new file mode 100644
index 0000000000..8518c9ab66
--- /dev/null
+++ b/lib/providers/actions/system.dart
@@ -0,0 +1,117 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class SystemAction extends _$SystemAction {
+  SystemExitCoordinator? _exitCoordinator;
+
+  @override
+  void build() {}
+
+  Future<List<Package>> getPackages() async {
+    if (ref.read(isMobileViewProvider)) {
+      await Future.delayed(commonDuration);
+    }
+    if (ref.read(packagesProvider).isEmpty) {
+      ref.read(packagesProvider.notifier).value =
+          await app?.getPackages() ?? [];
+    }
+    return ref.read(packagesProvider);
+  }
+
+  Future<void> handleExit([bool needSave = false]) {
+    final coordinator = _exitCoordinator ??= SystemExitCoordinator(
+      watchdogDuration: exitWatchdogDuration,
+      closeWindow: closeWindow,
+      closeCore: closeCore,
+      exitApplication: exitApplication,
+    );
+    return coordinator.exit(cleanup: () => cleanupExitResources(needSave));
+  }
+
+  @protected
+  Duration get exitWatchdogDuration => const Duration(seconds: 3);
+
+  @protected
+  Future<void> cleanupExitResources(bool needSave) async {
+    await Future.wait([
+      if (needSave) preferences.saveConfig(ref.read(configProvider)),
+      if (macOS != null) macOS!.updateDns(true),
+      if (proxy != null) proxy!.stopProxy(),
+      if (tray != null) tray!.destroy(),
+    ]);
+  }
+
+  @protected
+  Future<void> closeWindow() async {
+    await window?.close();
+  }
+
+  @protected
+  Future<void> closeCore() async {
+    await coreController.close();
+    commonPrint.log('exit');
+  }
+
+  @protected
+  Future<void> exitApplication() {
+    return system.exit();
+  }
+
+  Future<void> handleClose([bool exit = true]) async {
+    if (!system.isDesktop) {
+      if (ref.read(backBlockProvider)) return;
+    }
+    if (ref.read(appSettingProvider).minimizeOnExit || !exit) {
+      if (system.isDesktop) {
+        await preferences.saveConfig(ref.read(configProvider));
+      }
+      await system.back();
+    } else {
+      await handleExit();
+    }
+  }
+
+  Future<void> updateVisible() async {
+    final visible = await window?.isVisible;
+    if (visible != null && !visible) {
+      window?.show();
+    } else {
+      window?.hide();
+    }
+  }
+
+  void updateTun() {
+    ref
+        .read(patchClashConfigProvider.notifier)
+        .update((state) => state.copyWith.tun(enable: !state.tun.enable));
+  }
+
+  void updateSystemProxy() {
+    ref
+        .read(networkSettingProvider.notifier)
+        .update((state) => state.copyWith(systemProxy: !state.systemProxy));
+  }
+
+  void updateAutoLaunch() {
+    ref
+        .read(appSettingProvider.notifier)
+        .update((state) => state.copyWith(autoLaunch: !state.autoLaunch));
+  }
+
+  Future<void> updateTray() async {
+    tray?.update(
+      trayState: ref.read(trayStateProvider),
+      traffic: ref.read(
+        trafficsProvider.select(
+          (state) => state.list.safeLast(const Traffic()),
+        ),
+      ),
+    );
+  }
+
+  Future<void> updateLocalIp() async {
+    ref.read(localIpProvider.notifier).value = null;
+    await Future.delayed(commonDuration);
+    ref.read(localIpProvider.notifier).value = await utils.getLocalIpAddress();
+  }
+}
diff --git a/lib/providers/actions/system_exit.dart b/lib/providers/actions/system_exit.dart
new file mode 100644
index 0000000000..5bb02418a1
--- /dev/null
+++ b/lib/providers/actions/system_exit.dart
@@ -0,0 +1,70 @@
+import 'dart:async';
+
+typedef ExitStep = Future<void> Function();
+
+final class SystemExitCoordinator {
+  final Duration watchdogDuration;
+  final ExitStep closeWindow;
+  final ExitStep closeCore;
+  final ExitStep exitApplication;
+
+  Future<void>? _operation;
+  Future<void>? _applicationExitOperation;
+
+  SystemExitCoordinator({
+    required this.watchdogDuration,
+    required this.closeWindow,
+    required this.closeCore,
+    required this.exitApplication,
+  });
+
+  Future<void> exit({required ExitStep cleanup}) {
+    final activeOperation = _operation;
+    if (activeOperation != null) {
+      return activeOperation;
+    }
+    final operation = _run(cleanup);
+    _operation = operation;
+    return operation;
+  }
+
+  Future<void> _run(ExitStep cleanup) async {
+    Object? firstError;
+    StackTrace? firstStackTrace;
+
+    Future<void> runStep(ExitStep step) async {
+      try {
+        await step();
+      } catch (error, stackTrace) {
+        firstError ??= error;
+        firstStackTrace ??= stackTrace;
+      }
+    }
+
+    final watchdog = Timer(watchdogDuration, () {
+      unawaited(_exitApplicationOnce().catchError((_) {}));
+    });
+    try {
+      await runStep(cleanup);
+      await runStep(closeWindow);
+      await runStep(closeCore);
+    } finally {
+      watchdog.cancel();
+      await runStep(_exitApplicationOnce);
+    }
+    final error = firstError;
+    if (error != null) {
+      Error.throwWithStackTrace(error, firstStackTrace!);
+    }
+  }
+
+  Future<void> _exitApplicationOnce() {
+    final activeOperation = _applicationExitOperation;
+    if (activeOperation != null) {
+      return activeOperation;
+    }
+    final operation = Future<void>.sync(exitApplication);
+    _applicationExitOperation = operation;
+    return operation;
+  }
+}
diff --git a/lib/providers/actions/theme.dart b/lib/providers/actions/theme.dart
new file mode 100644
index 0000000000..6b48260e00
--- /dev/null
+++ b/lib/providers/actions/theme.dart
@@ -0,0 +1,20 @@
+part of '../action.dart';
+
+@Riverpod(keepAlive: true)
+class ThemeAction extends _$ThemeAction {
+  @override
+  void build() {}
+
+  void updateBrightness() {
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      ref.read(systemBrightnessProvider.notifier).value =
+          WidgetsBinding.instance.platformDispatcher.platformBrightness;
+    });
+  }
+
+  void updateViewSize(Size size) {
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      ref.read(viewSizeProvider.notifier).value = size;
+    });
+  }
+}
diff --git a/lib/providers/app.dart b/lib/providers/app.dart
index 725537c05b..fb0b066548 100644
--- a/lib/providers/app.dart
+++ b/lib/providers/app.dart
@@ -13,11 +13,12 @@ import 'package:wifi_ssid/wifi_ssid.dart';
 
 part 'generated/app.g.dart';
 
-@riverpod
-class RealTunEnable extends _$RealTunEnable with AutoDisposeNotifierMixin {
+@Riverpod(keepAlive: true)
+class AuthorizedTunEnable extends _$AuthorizedTunEnable
+    with AutoDisposeNotifierMixin {
   @override
-  bool build() {
-    return false;
+  TunAuthorizationState build() {
+    return TunAuthorizationState.none;
   }
 }
 
@@ -481,7 +482,9 @@ List<Override> buildAppStateOverrides(AppState appState) {
     logsProvider.overrideWithBuild((_, _) => appState.logs),
     trafficsProvider.overrideWithBuild((_, _) => appState.traffics),
     totalTrafficProvider.overrideWithBuild((_, _) => appState.totalTraffic),
-    realTunEnableProvider.overrideWithBuild((_, _) => appState.realTunEnable),
+    authorizedTunEnableProvider.overrideWithBuild(
+      (_, _) => appState.authorizedTunEnable,
+    ),
     systemUiOverlayStyleStateProvider.overrideWithBuild(
       (_, _) => appState.systemUiOverlayStyle,
     ),
diff --git a/lib/providers/config.dart b/lib/providers/config.dart
index 00ad80c4d1..c3ebf9df08 100644
--- a/lib/providers/config.dart
+++ b/lib/providers/config.dart
@@ -105,6 +105,61 @@ class ExcludeSSIDs extends _$ExcludeSSIDs with AutoDisposeNotifierMixin {
   }
 }
 
+@riverpod
+class TailscaleSetting extends _$TailscaleSetting with AutoDisposeNotifierMixin {
+  @override
+  TailscaleProps build() {
+    return const TailscaleProps();
+  }
+
+  void setEnable(bool enable) {
+    update((state) => state.copyWith(enable: enable));
+  }
+
+  void setBypassTraffic(bool bypassTraffic) {
+    update((state) => state.copyWith(bypassTraffic: bypassTraffic));
+    // Keep Config → DNS → Fake IP Filter in sync with the toggle so the user
+    // can see the entries appear/disappear, and so override-DNS mode also
+    // picks them up without a separate hand edit.
+    ref.read(patchClashConfigProvider.notifier).update((state) {
+      final filters = List<String>.from(state.dns.fakeIpFilter);
+      if (bypassTraffic) {
+        for (final filter in tailscaleFakeIpFilters) {
+          if (!filters.contains(filter)) {
+            filters.add(filter);
+          }
+        }
+      } else {
+        filters.removeWhere(tailscaleFakeIpFilters.contains);
+      }
+      return state.copyWith.dns(fakeIpFilter: filters);
+    });
+  }
+
+  void addOrUpdate(TailscaleProxy proxy, {String? previousName}) {
+    update((state) {
+      final next = List<TailscaleProxy>.from(state.proxies);
+      final lookupName = previousName ?? proxy.name;
+      final index = next.indexWhere((item) => item.name == lookupName);
+      if (index == -1) {
+        next.add(proxy);
+      } else {
+        next[index] = proxy;
+      }
+      return state.copyWith(proxies: next);
+    });
+  }
+
+  void remove(String name) {
+    update((state) {
+      return state.copyWith(
+        proxies: state.proxies.where((item) => item.name != name).toList(),
+      );
+    });
+  }
+}
+
+
 @Riverpod(name: 'configProvider')
 Config _config(Ref ref) {
   final appSettingProps = ref.watch(appSettingProvider);
@@ -119,6 +174,7 @@ Config _config(Ref ref) {
   final proxiesStyleProps = ref.watch(proxiesStyleSettingProvider);
   final patchClashConfig = ref.watch(patchClashConfigProvider);
   final excludeSSIDs = ref.watch(excludeSSIDsProvider);
+  final tailscaleProps = ref.watch(tailscaleSettingProvider);
   return Config(
     appSettingProps: appSettingProps,
     windowProps: windowProps,
@@ -132,6 +188,7 @@ Config _config(Ref ref) {
     proxiesStyleProps: proxiesStyleProps,
     patchClashConfig: patchClashConfig,
     excludeSSIDs: excludeSSIDs,
+    tailscaleProps: tailscaleProps,
   );
 }
 
@@ -155,5 +212,8 @@ List<Override> buildConfigOverrides(Config config) {
       (_, _) => config.patchClashConfig,
     ),
     excludeSSIDsProvider.overrideWithBuild((_, _) => config.excludeSSIDs),
+    tailscaleSettingProvider.overrideWithBuild(
+      (_, _) => config.tailscaleProps,
+    ),
   ];
 }
diff --git a/lib/providers/database.dart b/lib/providers/database.dart
index 1d0d512476..e5d1c239f9 100644
--- a/lib/providers/database.dart
+++ b/lib/providers/database.dart
@@ -63,15 +63,13 @@ class Profiles extends _$Profiles {
     );
   }
 
-  void del(int id) {
+  Future<void> del(int id) async {
     final previous = List<Profile>.from(state);
     state = previous.where((e) => e.id != id).toList();
-    unawaited(
-      withRollback(
-        snapshot: previous,
-        action: () => database.profiles.remove((t) => t.id.equals(id)),
-        rollback: (v) => state = v,
-      ),
+    await withRollback(
+      snapshot: previous,
+      action: () => database.profiles.remove((t) => t.id.equals(id)),
+      rollback: (v) => state = v,
     );
   }
 
diff --git a/lib/providers/generated/action.g.dart b/lib/providers/generated/action.g.dart
index eac384e11a..21d602754d 100644
--- a/lib/providers/generated/action.g.dart
+++ b/lib/providers/generated/action.g.dart
@@ -40,13 +40,13 @@ final class CommonActionProvider extends $NotifierProvider<CommonAction, void> {
   }
 }
 
-String _$commonActionHash() => r'e2a7aa2c41c9404133b16a111b2182357dee4d6e';
+String _$commonActionHash() => r'81d01cab066e94793cdaa4ff89806ebff6030f50';
 
 abstract class _$CommonAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -56,7 +56,7 @@ abstract class _$CommonAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -91,13 +91,13 @@ final class SetupActionProvider extends $NotifierProvider<SetupAction, void> {
   }
 }
 
-String _$setupActionHash() => r'c6c7b3b5d90f5070dca9ed02e51dcc06f812a294';
+String _$setupActionHash() => r'0bff03f323d82075b2fb7481e24b10ed08771eee';
 
 abstract class _$SetupAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -107,7 +107,7 @@ abstract class _$SetupAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -142,13 +142,13 @@ final class BackupActionProvider extends $NotifierProvider<BackupAction, void> {
   }
 }
 
-String _$backupActionHash() => r'4953679dac7f99f6e076720a2a6f9750a22fd74f';
+String _$backupActionHash() => r'3c115d169b912577a3bd87796cefafce3695a019';
 
 abstract class _$BackupAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -158,7 +158,7 @@ abstract class _$BackupAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -193,13 +193,13 @@ final class CoreActionProvider extends $NotifierProvider<CoreAction, void> {
   }
 }
 
-String _$coreActionHash() => r'2b8d02ad5d8219e07bf721268639c619a93c39c1';
+String _$coreActionHash() => r'f07e30b5c450b0ed90b5e5fc7faa1113374f6516';
 
 abstract class _$CoreAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -209,7 +209,7 @@ abstract class _$CoreAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -250,7 +250,7 @@ abstract class _$SystemAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -260,7 +260,7 @@ abstract class _$SystemAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -295,13 +295,13 @@ final class StoreActionProvider extends $NotifierProvider<StoreAction, void> {
   }
 }
 
-String _$storeActionHash() => r'45557218752e62f3a53ef7b68de7d0e22a8ecc0f';
+String _$storeActionHash() => r'e95aaafbf5be8d9d57be16ebc44bf3dcc556619d';
 
 abstract class _$StoreAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -311,7 +311,7 @@ abstract class _$StoreAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -352,7 +352,7 @@ abstract class _$ThemeAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -362,7 +362,7 @@ abstract class _$ThemeAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -404,7 +404,7 @@ abstract class _$ProxiesAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -414,7 +414,7 @@ abstract class _$ProxiesAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -450,13 +450,13 @@ final class ProfilesActionProvider
   }
 }
 
-String _$profilesActionHash() => r'b2457dc5b18d51204d17995949a52cffce41df38';
+String _$profilesActionHash() => r'e67a3e4a98c1b3b668275721491a2b0318d27550';
 
 abstract class _$ProfilesAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -466,7 +466,7 @@ abstract class _$ProfilesAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -508,7 +508,7 @@ abstract class _$GeoResourceAction extends $Notifier<void> {
   void build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<void, void>;
     final element =
         ref.element
@@ -518,6 +518,6 @@ abstract class _$GeoResourceAction extends $Notifier<void> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
diff --git a/lib/providers/generated/app.g.dart b/lib/providers/generated/app.g.dart
index 213ea0947a..fb2b2e2e81 100644
--- a/lib/providers/generated/app.g.dart
+++ b/lib/providers/generated/app.g.dart
@@ -9,55 +9,56 @@ part of '../app.dart';
 // GENERATED CODE - DO NOT MODIFY BY HAND
 // ignore_for_file: type=lint, type=warning
 
-@ProviderFor(RealTunEnable)
-final realTunEnableProvider = RealTunEnableProvider._();
+@ProviderFor(AuthorizedTunEnable)
+final authorizedTunEnableProvider = AuthorizedTunEnableProvider._();
 
-final class RealTunEnableProvider
-    extends $NotifierProvider<RealTunEnable, bool> {
-  RealTunEnableProvider._()
+final class AuthorizedTunEnableProvider
+    extends $NotifierProvider<AuthorizedTunEnable, TunAuthorizationState> {
+  AuthorizedTunEnableProvider._()
     : super(
         from: null,
         argument: null,
         retry: null,
-        name: r'realTunEnableProvider',
-        isAutoDispose: true,
+        name: r'authorizedTunEnableProvider',
+        isAutoDispose: false,
         dependencies: null,
         $allTransitiveDependencies: null,
       );
 
   @override
-  String debugGetCreateSourceHash() => _$realTunEnableHash();
+  String debugGetCreateSourceHash() => _$authorizedTunEnableHash();
 
   @$internal
   @override
-  RealTunEnable create() => RealTunEnable();
+  AuthorizedTunEnable create() => AuthorizedTunEnable();
 
   /// {@macro riverpod.override_with_value}
-  Override overrideWithValue(bool value) {
+  Override overrideWithValue(TunAuthorizationState value) {
     return $ProviderOverride(
       origin: this,
-      providerOverride: $SyncValueProvider<bool>(value),
+      providerOverride: $SyncValueProvider<TunAuthorizationState>(value),
     );
   }
 }
 
-String _$realTunEnableHash() => r'f2c88f5031d1f97665c10f70121082c4f6d6c99d';
+String _$authorizedTunEnableHash() =>
+    r'75958aeb341f93a4573209f7bae5057936d9700a';
 
-abstract class _$RealTunEnable extends $Notifier<bool> {
-  bool build();
+abstract class _$AuthorizedTunEnable extends $Notifier<TunAuthorizationState> {
+  TunAuthorizationState build();
   @$mustCallSuper
   @override
-  void runBuild() {
-    final ref = this.ref as $Ref<bool, bool>;
+  WhenComplete runBuild() {
+    final ref = this.ref as $Ref<TunAuthorizationState, TunAuthorizationState>;
     final element =
         ref.element
             as $ClassProviderElement<
-              AnyNotifier<bool, bool>,
-              bool,
+              AnyNotifier<TunAuthorizationState, TunAuthorizationState>,
+              TunAuthorizationState,
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -98,7 +99,7 @@ abstract class _$Logs extends $Notifier<FixedList<Log>> {
   FixedList<Log> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<FixedList<Log>, FixedList<Log>>;
     final element =
         ref.element
@@ -108,7 +109,7 @@ abstract class _$Logs extends $Notifier<FixedList<Log>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -150,7 +151,7 @@ abstract class _$Requests extends $Notifier<FixedList<TrackerInfo>> {
   FixedList<TrackerInfo> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref =
         this.ref as $Ref<FixedList<TrackerInfo>, FixedList<TrackerInfo>>;
     final element =
@@ -161,7 +162,7 @@ abstract class _$Requests extends $Notifier<FixedList<TrackerInfo>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -203,7 +204,7 @@ abstract class _$Providers extends $Notifier<List<ExternalProvider>> {
   List<ExternalProvider> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref =
         this.ref as $Ref<List<ExternalProvider>, List<ExternalProvider>>;
     final element =
@@ -214,7 +215,7 @@ abstract class _$Providers extends $Notifier<List<ExternalProvider>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -256,7 +257,7 @@ abstract class _$Packages extends $Notifier<List<Package>> {
   List<Package> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<List<Package>, List<Package>>;
     final element =
         ref.element
@@ -266,7 +267,7 @@ abstract class _$Packages extends $Notifier<List<Package>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -308,7 +309,7 @@ abstract class _$SystemBrightness extends $Notifier<Brightness> {
   Brightness build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<Brightness, Brightness>;
     final element =
         ref.element
@@ -318,7 +319,7 @@ abstract class _$SystemBrightness extends $Notifier<Brightness> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -360,7 +361,7 @@ abstract class _$Traffics extends $Notifier<FixedList<Traffic>> {
   FixedList<Traffic> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<FixedList<Traffic>, FixedList<Traffic>>;
     final element =
         ref.element
@@ -370,7 +371,7 @@ abstract class _$Traffics extends $Notifier<FixedList<Traffic>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -412,7 +413,7 @@ abstract class _$TotalTraffic extends $Notifier<Traffic> {
   Traffic build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<Traffic, Traffic>;
     final element =
         ref.element
@@ -422,7 +423,7 @@ abstract class _$TotalTraffic extends $Notifier<Traffic> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -463,7 +464,7 @@ abstract class _$LocalIp extends $Notifier<String?> {
   String? build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<String?, String?>;
     final element =
         ref.element
@@ -473,7 +474,7 @@ abstract class _$LocalIp extends $Notifier<String?> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -514,7 +515,7 @@ abstract class _$RunTime extends $Notifier<int?> {
   int? build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<int?, int?>;
     final element =
         ref.element
@@ -524,7 +525,7 @@ abstract class _$RunTime extends $Notifier<int?> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -565,7 +566,7 @@ abstract class _$ViewSize extends $Notifier<Size> {
   Size build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<Size, Size>;
     final element =
         ref.element
@@ -575,7 +576,7 @@ abstract class _$ViewSize extends $Notifier<Size> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -616,7 +617,7 @@ abstract class _$SideWidth extends $Notifier<double> {
   double build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<double, double>;
     final element =
         ref.element
@@ -626,7 +627,7 @@ abstract class _$SideWidth extends $Notifier<double> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -830,7 +831,7 @@ abstract class _$Init extends $Notifier<bool> {
   bool build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<bool, bool>;
     final element =
         ref.element
@@ -840,7 +841,7 @@ abstract class _$Init extends $Notifier<bool> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -882,7 +883,7 @@ abstract class _$CurrentPageLabel extends $Notifier<PageLabel> {
   PageLabel build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<PageLabel, PageLabel>;
     final element =
         ref.element
@@ -892,7 +893,7 @@ abstract class _$CurrentPageLabel extends $Notifier<PageLabel> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -933,7 +934,7 @@ abstract class _$SortNum extends $Notifier<int> {
   int build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<int, int>;
     final element =
         ref.element
@@ -943,7 +944,7 @@ abstract class _$SortNum extends $Notifier<int> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -984,7 +985,7 @@ abstract class _$CheckIpNum extends $Notifier<int> {
   int build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<int, int>;
     final element =
         ref.element
@@ -994,7 +995,7 @@ abstract class _$CheckIpNum extends $Notifier<int> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1035,7 +1036,7 @@ abstract class _$BackBlock extends $Notifier<bool> {
   bool build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<bool, bool>;
     final element =
         ref.element
@@ -1045,7 +1046,7 @@ abstract class _$BackBlock extends $Notifier<bool> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1086,7 +1087,7 @@ abstract class _$Version extends $Notifier<int> {
   int build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<int, int>;
     final element =
         ref.element
@@ -1096,7 +1097,7 @@ abstract class _$Version extends $Notifier<int> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1137,7 +1138,7 @@ abstract class _$Groups extends $Notifier<List<Group>> {
   List<Group> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<List<Group>, List<Group>>;
     final element =
         ref.element
@@ -1147,7 +1148,7 @@ abstract class _$Groups extends $Notifier<List<Group>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1189,7 +1190,7 @@ abstract class _$DelayDataSource extends $Notifier<DelayMap> {
   DelayMap build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<DelayMap, DelayMap>;
     final element =
         ref.element
@@ -1199,7 +1200,7 @@ abstract class _$DelayDataSource extends $Notifier<DelayMap> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1243,7 +1244,7 @@ abstract class _$SystemUiOverlayStyleState
   SystemUiOverlayStyle build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<SystemUiOverlayStyle, SystemUiOverlayStyle>;
     final element =
         ref.element
@@ -1253,7 +1254,7 @@ abstract class _$SystemUiOverlayStyleState
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1295,7 +1296,7 @@ abstract class _$CoreStatus extends $Notifier<CoreStatus> {
   CoreStatus build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<CoreStatus, CoreStatus>;
     final element =
         ref.element
@@ -1305,7 +1306,7 @@ abstract class _$CoreStatus extends $Notifier<CoreStatus> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1384,7 +1385,7 @@ abstract class _$Query extends $Notifier<String> {
   String build(QueryTag tag);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<String, String>;
     final element =
         ref.element
@@ -1394,7 +1395,7 @@ abstract class _$Query extends $Notifier<String> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
 
@@ -1473,7 +1474,7 @@ abstract class _$Loading extends $Notifier<bool> {
   bool build(LoadingTag tag);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<bool, bool>;
     final element =
         ref.element
@@ -1483,7 +1484,7 @@ abstract class _$Loading extends $Notifier<bool> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
 
@@ -1568,7 +1569,7 @@ abstract class _$Items extends $Notifier<Set<dynamic>> {
   Set<dynamic> build(String key);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<Set<dynamic>, Set<dynamic>>;
     final element =
         ref.element
@@ -1578,7 +1579,7 @@ abstract class _$Items extends $Notifier<Set<dynamic>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
 
@@ -1656,7 +1657,7 @@ abstract class _$Item extends $Notifier<dynamic> {
   dynamic build(String key);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<dynamic, dynamic>;
     final element =
         ref.element
@@ -1666,7 +1667,7 @@ abstract class _$Item extends $Notifier<dynamic> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
 
@@ -1745,7 +1746,7 @@ abstract class _$IsUpdating extends $Notifier<bool> {
   bool build(String name);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<bool, bool>;
     final element =
         ref.element
@@ -1755,7 +1756,7 @@ abstract class _$IsUpdating extends $Notifier<bool> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
 
@@ -1797,7 +1798,7 @@ abstract class _$NetworkDetection extends $Notifier<NetworkDetectionState> {
   NetworkDetectionState build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<NetworkDetectionState, NetworkDetectionState>;
     final element =
         ref.element
@@ -1807,7 +1808,7 @@ abstract class _$NetworkDetection extends $Notifier<NetworkDetectionState> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1849,7 +1850,7 @@ abstract class _$CurrentSSID extends $Notifier<String?> {
   String? build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<String?, String?>;
     final element =
         ref.element
@@ -1859,7 +1860,7 @@ abstract class _$CurrentSSID extends $Notifier<String?> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1903,7 +1904,7 @@ abstract class _$BatteryOptimizationDisable extends $Notifier<bool> {
   bool build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<bool, bool>;
     final element =
         ref.element
@@ -1913,7 +1914,7 @@ abstract class _$BatteryOptimizationDisable extends $Notifier<bool> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -1956,7 +1957,7 @@ abstract class _$LocationPermissions extends $Notifier<WifiSsidPermission> {
   WifiSsidPermission build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<WifiSsidPermission, WifiSsidPermission>;
     final element =
         ref.element
@@ -1966,6 +1967,6 @@ abstract class _$LocationPermissions extends $Notifier<WifiSsidPermission> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
diff --git a/lib/providers/generated/config.g.dart b/lib/providers/generated/config.g.dart
index a86297a71e..ee2671cf1b 100644
--- a/lib/providers/generated/config.g.dart
+++ b/lib/providers/generated/config.g.dart
@@ -47,7 +47,7 @@ abstract class _$AppSetting extends $Notifier<AppSettingProps> {
   AppSettingProps build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<AppSettingProps, AppSettingProps>;
     final element =
         ref.element
@@ -57,7 +57,7 @@ abstract class _$AppSetting extends $Notifier<AppSettingProps> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -99,7 +99,7 @@ abstract class _$WindowSetting extends $Notifier<WindowProps> {
   WindowProps build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<WindowProps, WindowProps>;
     final element =
         ref.element
@@ -109,7 +109,7 @@ abstract class _$WindowSetting extends $Notifier<WindowProps> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -150,7 +150,7 @@ abstract class _$VpnSetting extends $Notifier<VpnProps> {
   VpnProps build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<VpnProps, VpnProps>;
     final element =
         ref.element
@@ -160,7 +160,7 @@ abstract class _$VpnSetting extends $Notifier<VpnProps> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -202,7 +202,7 @@ abstract class _$NetworkSetting extends $Notifier<NetworkProps> {
   NetworkProps build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<NetworkProps, NetworkProps>;
     final element =
         ref.element
@@ -212,7 +212,7 @@ abstract class _$NetworkSetting extends $Notifier<NetworkProps> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -254,7 +254,7 @@ abstract class _$ThemeSetting extends $Notifier<ThemeProps> {
   ThemeProps build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<ThemeProps, ThemeProps>;
     final element =
         ref.element
@@ -264,7 +264,7 @@ abstract class _$ThemeSetting extends $Notifier<ThemeProps> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -306,7 +306,7 @@ abstract class _$CurrentProfileId extends $Notifier<int?> {
   int? build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<int?, int?>;
     final element =
         ref.element
@@ -316,7 +316,7 @@ abstract class _$CurrentProfileId extends $Notifier<int?> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -358,7 +358,7 @@ abstract class _$DavSetting extends $Notifier<DAVProps?> {
   DAVProps? build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<DAVProps?, DAVProps?>;
     final element =
         ref.element
@@ -368,7 +368,7 @@ abstract class _$DavSetting extends $Notifier<DAVProps?> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -409,7 +409,7 @@ abstract class _$OverrideDns extends $Notifier<bool> {
   bool build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<bool, bool>;
     final element =
         ref.element
@@ -419,7 +419,7 @@ abstract class _$OverrideDns extends $Notifier<bool> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -461,7 +461,7 @@ abstract class _$HotKeyActions extends $Notifier<List<HotKeyAction>> {
   List<HotKeyAction> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<List<HotKeyAction>, List<HotKeyAction>>;
     final element =
         ref.element
@@ -471,7 +471,7 @@ abstract class _$HotKeyActions extends $Notifier<List<HotKeyAction>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -514,7 +514,7 @@ abstract class _$ProxiesStyleSetting extends $Notifier<ProxiesStyleProps> {
   ProxiesStyleProps build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<ProxiesStyleProps, ProxiesStyleProps>;
     final element =
         ref.element
@@ -524,7 +524,7 @@ abstract class _$ProxiesStyleSetting extends $Notifier<ProxiesStyleProps> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -566,7 +566,7 @@ abstract class _$PatchClashConfig extends $Notifier<PatchClashConfig> {
   PatchClashConfig build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<PatchClashConfig, PatchClashConfig>;
     final element =
         ref.element
@@ -576,7 +576,7 @@ abstract class _$PatchClashConfig extends $Notifier<PatchClashConfig> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -618,7 +618,7 @@ abstract class _$ExcludeSSIDs extends $Notifier<List<String>> {
   List<String> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<List<String>, List<String>>;
     final element =
         ref.element
@@ -628,7 +628,59 @@ abstract class _$ExcludeSSIDs extends $Notifier<List<String>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
+  }
+}
+
+@ProviderFor(TailscaleSetting)
+final tailscaleSettingProvider = TailscaleSettingProvider._();
+
+final class TailscaleSettingProvider
+    extends $NotifierProvider<TailscaleSetting, TailscaleProps> {
+  TailscaleSettingProvider._()
+    : super(
+        from: null,
+        argument: null,
+        retry: null,
+        name: r'tailscaleSettingProvider',
+        isAutoDispose: true,
+        dependencies: null,
+        $allTransitiveDependencies: null,
+      );
+
+  @override
+  String debugGetCreateSourceHash() => _$tailscaleSettingHash();
+
+  @$internal
+  @override
+  TailscaleSetting create() => TailscaleSetting();
+
+  /// {@macro riverpod.override_with_value}
+  Override overrideWithValue(TailscaleProps value) {
+    return $ProviderOverride(
+      origin: this,
+      providerOverride: $SyncValueProvider<TailscaleProps>(value),
+    );
+  }
+}
+
+String _$tailscaleSettingHash() => r'0671fd8714eec5eafdf6f51ffae54abe45b66e69';
+
+abstract class _$TailscaleSetting extends $Notifier<TailscaleProps> {
+  TailscaleProps build();
+  @$mustCallSuper
+  @override
+  WhenComplete runBuild() {
+    final ref = this.ref as $Ref<TailscaleProps, TailscaleProps>;
+    final element =
+        ref.element
+            as $ClassProviderElement<
+              AnyNotifier<TailscaleProps, TailscaleProps>,
+              TailscaleProps,
+              Object?,
+              Object?
+            >;
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -670,4 +722,4 @@ final class _ConfigProvider extends $FunctionalProvider<Config, Config, Config>
   }
 }
 
-String _$_configHash() => r'7f29da1e31a3393fb36ab43c21f0d1b38223afec';
+String _$_configHash() => r'2151b4807c98ef67c0c0d122e0dcd0e9394e65c7';
diff --git a/lib/providers/generated/database.g.dart b/lib/providers/generated/database.g.dart
index a1eea99555..cecb0fd243 100644
--- a/lib/providers/generated/database.g.dart
+++ b/lib/providers/generated/database.g.dart
@@ -292,13 +292,13 @@ final class ProfilesProvider
   }
 }
 
-String _$profilesHash() => r'a977548501ae750bc4fcc0f59dc0a4994ced7c91';
+String _$profilesHash() => r'610b51558ceaf0dc12795756e9bd8e4f73880e22';
 
 abstract class _$Profiles extends $Notifier<List<Profile>> {
   List<Profile> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<List<Profile>, List<Profile>>;
     final element =
         ref.element
@@ -308,7 +308,7 @@ abstract class _$Profiles extends $Notifier<List<Profile>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -342,7 +342,7 @@ abstract class _$Scripts extends $StreamNotifier<List<Script>> {
   Stream<List<Script>> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<AsyncValue<List<Script>>, List<Script>>;
     final element =
         ref.element
@@ -352,7 +352,7 @@ abstract class _$Scripts extends $StreamNotifier<List<Script>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -455,7 +455,7 @@ abstract class _$GlobalRules extends $StreamNotifier<List<Rule>> {
   Stream<List<Rule>> build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<AsyncValue<List<Rule>>, List<Rule>>;
     final element =
         ref.element
@@ -465,7 +465,7 @@ abstract class _$GlobalRules extends $StreamNotifier<List<Rule>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -544,7 +544,7 @@ abstract class _$ProfileAddedRules extends $StreamNotifier<List<Rule>> {
   Stream<List<Rule>> build(int profileId);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<AsyncValue<List<Rule>>, List<Rule>>;
     final element =
         ref.element
@@ -554,7 +554,7 @@ abstract class _$ProfileAddedRules extends $StreamNotifier<List<Rule>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
 
@@ -634,7 +634,7 @@ abstract class _$ProfileCustomRules extends $StreamNotifier<List<Rule>> {
   Stream<List<Rule>> build(int profileId);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<AsyncValue<List<Rule>>, List<Rule>>;
     final element =
         ref.element
@@ -644,7 +644,7 @@ abstract class _$ProfileCustomRules extends $StreamNotifier<List<Rule>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
 
@@ -723,7 +723,7 @@ abstract class _$ProxyGroups extends $StreamNotifier<List<ProxyGroup>> {
   Stream<List<ProxyGroup>> build(int profileId);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref =
         this.ref as $Ref<AsyncValue<List<ProxyGroup>>, List<ProxyGroup>>;
     final element =
@@ -734,7 +734,7 @@ abstract class _$ProxyGroups extends $StreamNotifier<List<ProxyGroup>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
 
@@ -815,7 +815,7 @@ abstract class _$ProfileDisabledRuleIds extends $StreamNotifier<List<int>> {
   Stream<List<int>> build(int profileId);
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<AsyncValue<List<int>>, List<int>>;
     final element =
         ref.element
@@ -825,6 +825,6 @@ abstract class _$ProfileDisabledRuleIds extends $StreamNotifier<List<int>> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, () => build(_$args));
+    return element.handleCreate(ref, () => build(_$args));
   }
 }
diff --git a/lib/providers/generated/state.g.dart b/lib/providers/generated/state.g.dart
index 79c7088df9..28d92505bf 100644
--- a/lib/providers/generated/state.g.dart
+++ b/lib/providers/generated/state.g.dart
@@ -2041,7 +2041,7 @@ final class AutoSetSystemDnsStateProvider
 }
 
 String _$autoSetSystemDnsStateHash() =>
-    r'a8805965efe78241613bfde55f4ea8fa12a6ea32';
+    r'60135ce263c5c31200006f4a9f342f8241a872cc';
 
 @ProviderFor(needUpdateGroups)
 final needUpdateGroupsProvider = NeedUpdateGroupsProvider._();
@@ -3021,7 +3021,7 @@ abstract class _$AccessControlState extends $Notifier<AccessControlProps> {
   AccessControlProps build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<AccessControlProps, AccessControlProps>;
     final element =
         ref.element
@@ -3031,7 +3031,7 @@ abstract class _$AccessControlState extends $Notifier<AccessControlProps> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -3074,7 +3074,7 @@ abstract class _$ProxyGroupProvider extends $Notifier<ProxyGroup> {
   ProxyGroup build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<ProxyGroup, ProxyGroup>;
     final element =
         ref.element
@@ -3084,7 +3084,7 @@ abstract class _$ProxyGroupProvider extends $Notifier<ProxyGroup> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
@@ -3125,7 +3125,7 @@ abstract class _$RuleProvider extends $Notifier<Rule> {
   Rule build();
   @$mustCallSuper
   @override
-  void runBuild() {
+  WhenComplete runBuild() {
     final ref = this.ref as $Ref<Rule, Rule>;
     final element =
         ref.element
@@ -3135,7 +3135,7 @@ abstract class _$RuleProvider extends $Notifier<Rule> {
               Object?,
               Object?
             >;
-    element.handleCreate(ref, build);
+    return element.handleCreate(ref, build);
   }
 }
 
diff --git a/lib/providers/state.dart b/lib/providers/state.dart
index 2f8148994e..c102354c2d 100644
--- a/lib/providers/state.dart
+++ b/lib/providers/state.dart
@@ -570,11 +570,16 @@ Brightness currentBrightness(Ref ref) {
 @riverpod
 VM2<bool, bool> autoSetSystemDnsState(Ref ref) {
   final isStart = ref.watch(runTimeProvider.select((state) => state != null));
-  final realTunEnable = ref.watch(realTunEnableProvider);
+  final tunEnable = ref.watch(
+    patchClashConfigProvider.select((state) => state.tun.enable),
+  );
+  final authorizationState = ref.watch(authorizedTunEnableProvider);
   final autoSetSystemDns = ref.watch(
     networkSettingProvider.select((state) => state.autoSetSystemDns),
   );
-  return VM2(isStart ? realTunEnable : false, autoSetSystemDns);
+  final effectiveTunEnable =
+      tunEnable && authorizationState == TunAuthorizationState.authorized;
+  return VM2(isStart ? effectiveTunEnable : false, autoSetSystemDns);
 }
 
 @riverpod
diff --git a/lib/state.dart b/lib/state.dart
index 1e93f6df6d..86615b34d7 100644
--- a/lib/state.dart
+++ b/lib/state.dart
@@ -6,6 +6,7 @@ import 'package:dynamic_color/dynamic_color.dart';
 import 'package:fl_clash/common/theme.dart';
 import 'package:fl_clash/widgets/dialog.dart';
 import 'package:fl_clash/widgets/list.dart';
+import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
@@ -15,6 +16,7 @@ import 'package:riverpod_annotation/riverpod_annotation.dart';
 import 'package:url_launcher/url_launcher.dart';
 
 import 'common/common.dart';
+import 'common/migration.dart';
 import 'database/database.dart';
 import 'enum/enum.dart';
 import 'l10n/l10n.dart';
@@ -24,15 +26,24 @@ import 'providers/providers.dart';
 class GlobalState {
   static GlobalState? _instance;
   final navigatorKey = GlobalKey<NavigatorState>();
-  bool isPre = true;
-  late final String coreSHA256;
+  late final String appEnv;
   late final PackageInfo packageInfo;
   Function? updateCurrentDelayDebounce;
   late Measure measure;
   late CommonTheme theme;
-  late Color accentColor;
+  Color accentColor = const Color(defaultPrimaryColor);
   late ProviderContainer container;
   bool needInitStatus = true;
+  bool _didCrashOnPreviousExecution = false;
+
+  bool get isPre => appEnv != 'stable';
+
+  bool get canCrashCore => canCrashCoreFor(isDebug: kDebugMode, appEnv: appEnv);
+
+  @visibleForTesting
+  static bool canCrashCoreFor({required bool isDebug, required String appEnv}) {
+    return isDebug || appEnv == 'dev';
+  }
 
   // ignore: deprecated_member_use
   CorePalette? corePalette;
@@ -48,8 +59,7 @@ class GlobalState {
   }
 
   Future<ProviderContainer> init(int version) async {
-    coreSHA256 = const String.fromEnvironment('CORE_SHA256');
-    isPre = const String.fromEnvironment('APP_ENV') != 'stable';
+    appEnv = const String.fromEnvironment('APP_ENV', defaultValue: 'pre');
     await _initDynamicColor();
     return _initData(version);
   }
@@ -57,10 +67,13 @@ class GlobalState {
   Future<void> _initDynamicColor() async {
     try {
       corePalette = await DynamicColorPlugin.getCorePalette();
-      accentColor =
-          await DynamicColorPlugin.getAccentColor() ??
-          const Color(defaultPrimaryColor);
-    } catch (_) {}
+      accentColor = await DynamicColorPlugin.getAccentColor() ?? accentColor;
+    } catch (error) {
+      commonPrint.log(
+        'Failed to initialize dynamic color: $error',
+        logLevel: LogLevel.warning,
+      );
+    }
   }
 
   String get ua => container
@@ -70,6 +83,13 @@ class GlobalState {
   BuildContext get _context => navigatorKey.currentContext!;
 
   Future<ProviderContainer> _initData(int version) async {
+    packageInfo = await PackageInfo.fromPlatform();
+    var config = await migration.run();
+    _didCrashOnPreviousExecution = await system.didCrashOnPreviousExecution();
+    if (_didCrashOnPreviousExecution) {
+      config = config.copyWith(currentProfileId: null);
+      await preferences.saveConfig(config);
+    }
     final appState = AppState(
       brightness: WidgetsBinding.instance.platformDispatcher.platformBrightness,
       version: version,
@@ -81,26 +101,6 @@ class GlobalState {
       systemUiOverlayStyle: const SystemUiOverlayStyle(),
     );
     final appStateOverrides = buildAppStateOverrides(appState);
-    packageInfo = await PackageInfo.fromPlatform();
-    final configMap = await preferences.getConfigMap();
-    final config = await migration.migrationIfNeeded(
-      configMap,
-      sync: (data) async {
-        final newConfigMap = data.configMap;
-        final config = Config.realFromJson(newConfigMap);
-        await Future.wait([
-          database.restore(
-            data.profiles,
-            data.scripts,
-            data.rules,
-            data.links,
-            data.proxyGroups,
-          ),
-          preferences.saveConfig(config),
-        ]);
-        return config;
-      },
-    );
     final configOverrides = buildConfigOverrides(config);
     container = ProviderContainer(
       overrides: [...appStateOverrides, ...configOverrides],
@@ -323,14 +323,26 @@ class GlobalState {
     }
     await _handleFailedPreference();
     await _handlerDisclaimer();
+    await _showCrashRecoveryTip();
     await _showCrashlyticsTip();
-    await container.read(coreActionProvider.notifier).connectCore();
-    await container.read(coreActionProvider.notifier).initCore();
-    await container.read(setupActionProvider.notifier).initStatus();
+    await container.read(coreActionProvider.notifier).startCore();
+    if (!_didCrashOnPreviousExecution) {
+      await container.read(setupActionProvider.notifier).initStatus();
+    }
     container.read(initProvider.notifier).value = true;
     permissions.check();
   }
 
+  Future<void> _showCrashRecoveryTip() async {
+    if (!_didCrashOnPreviousExecution) return;
+    await showMessage(
+      title: currentAppLocalizations.crashDetected,
+      cancelable: false,
+      dismissible: false,
+      message: TextSpan(text: currentAppLocalizations.crashDetectedTip),
+    );
+  }
+
   Future<void> _handleFailedPreference() async {
     if (await preferences.isInit) return;
     final res = await showMessage(
diff --git a/lib/views/access.dart b/lib/views/access.dart
index 5daaad074c..8851eaac45 100644
--- a/lib/views/access.dart
+++ b/lib/views/access.dart
@@ -313,7 +313,7 @@ class _AccessViewState extends ConsumerState<AccessView> {
       builder: (context, snapshot) {
         final appLocalizations = context.appLocalizations;
         if (snapshot.connectionState != ConnectionState.done) {
-          return const Center(child: CircularProgressIndicator());
+          return const Center(child: CommonCircleLoading());
         }
         return packages.isEmpty
             ? NullStatus(label: appLocalizations.noData)
@@ -483,7 +483,8 @@ class PackageListItem extends StatelessWidget {
         style: const TextStyle(overflow: TextOverflow.ellipsis),
         maxLines: 1,
       ),
-      delegate: CheckboxDelegate(value: value, onChanged: onChanged),
+      value: value,
+      onChanged: onChanged,
     );
   }
 }
diff --git a/lib/views/application_setting.dart b/lib/views/application_setting.dart
index ea835a228c..2b30302baf 100644
--- a/lib/views/application_setting.dart
+++ b/lib/views/application_setting.dart
@@ -13,17 +13,15 @@ class CloseConnectionsItem extends ConsumerWidget {
     final closeConnections = ref.watch(
       appSettingProvider.select((state) => state.closeConnections),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.autoCloseConnections),
       subtitle: Text(appLocalizations.autoCloseConnectionsDesc),
-      delegate: SwitchDelegate(
-        value: closeConnections,
-        onChanged: (value) async {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(closeConnections: value));
-        },
-      ),
+      value: closeConnections,
+      onChanged: (value) async {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(closeConnections: value));
+      },
     );
   }
 }
@@ -37,17 +35,15 @@ class UsageItem extends ConsumerWidget {
     final onlyStatisticsProxy = ref.watch(
       appSettingProvider.select((state) => state.onlyStatisticsProxy),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.onlyStatisticsProxy),
       subtitle: Text(appLocalizations.onlyStatisticsProxyDesc),
-      delegate: SwitchDelegate(
-        value: onlyStatisticsProxy,
-        onChanged: (bool value) async {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(onlyStatisticsProxy: value));
-        },
-      ),
+      value: onlyStatisticsProxy,
+      onChanged: (bool value) async {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(onlyStatisticsProxy: value));
+      },
     );
   }
 }
@@ -61,17 +57,15 @@ class MinimizeItem extends ConsumerWidget {
     final minimizeOnExit = ref.watch(
       appSettingProvider.select((state) => state.minimizeOnExit),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.minimizeOnExit),
       subtitle: Text(appLocalizations.minimizeOnExitDesc),
-      delegate: SwitchDelegate(
-        value: minimizeOnExit,
-        onChanged: (bool value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(minimizeOnExit: value));
-        },
-      ),
+      value: minimizeOnExit,
+      onChanged: (bool value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(minimizeOnExit: value));
+      },
     );
   }
 }
@@ -85,17 +79,15 @@ class AutoLaunchItem extends ConsumerWidget {
     final autoLaunch = ref.watch(
       appSettingProvider.select((state) => state.autoLaunch),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.autoLaunch),
       subtitle: Text(appLocalizations.autoLaunchDesc),
-      delegate: SwitchDelegate(
-        value: autoLaunch,
-        onChanged: (bool value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(autoLaunch: value));
-        },
-      ),
+      value: autoLaunch,
+      onChanged: (bool value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(autoLaunch: value));
+      },
     );
   }
 }
@@ -109,17 +101,15 @@ class SilentLaunchItem extends ConsumerWidget {
     final silentLaunch = ref.watch(
       appSettingProvider.select((state) => state.silentLaunch),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.silentLaunch),
       subtitle: Text(appLocalizations.silentLaunchDesc),
-      delegate: SwitchDelegate(
-        value: silentLaunch,
-        onChanged: (bool value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(silentLaunch: value));
-        },
-      ),
+      value: silentLaunch,
+      onChanged: (bool value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(silentLaunch: value));
+      },
     );
   }
 }
@@ -133,17 +123,15 @@ class AutoRunItem extends ConsumerWidget {
     final autoRun = ref.watch(
       appSettingProvider.select((state) => state.autoRun),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.autoRun),
       subtitle: Text(appLocalizations.autoRunDesc),
-      delegate: SwitchDelegate(
-        value: autoRun,
-        onChanged: (bool value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(autoRun: value));
-        },
-      ),
+      value: autoRun,
+      onChanged: (bool value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(autoRun: value));
+      },
     );
   }
 }
@@ -157,17 +145,15 @@ class HiddenItem extends ConsumerWidget {
     final hidden = ref.watch(
       appSettingProvider.select((state) => state.hidden),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.exclude),
       subtitle: Text(appLocalizations.excludeDesc),
-      delegate: SwitchDelegate(
-        value: hidden,
-        onChanged: (value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(hidden: value));
-        },
-      ),
+      value: hidden,
+      onChanged: (value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(hidden: value));
+      },
     );
   }
 }
@@ -181,17 +167,15 @@ class AnimateTabItem extends ConsumerWidget {
     final isAnimateToPage = ref.watch(
       appSettingProvider.select((state) => state.isAnimateToPage),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.tabAnimation),
       subtitle: Text(appLocalizations.tabAnimationDesc),
-      delegate: SwitchDelegate(
-        value: isAnimateToPage,
-        onChanged: (value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(isAnimateToPage: value));
-        },
-      ),
+      value: isAnimateToPage,
+      onChanged: (value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(isAnimateToPage: value));
+      },
     );
   }
 }
@@ -205,17 +189,15 @@ class OpenLogsItem extends ConsumerWidget {
     final openLogs = ref.watch(
       appSettingProvider.select((state) => state.openLogs),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.logcat),
       subtitle: Text(appLocalizations.logcatDesc),
-      delegate: SwitchDelegate(
-        value: openLogs,
-        onChanged: (bool value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(openLogs: value));
-        },
-      ),
+      value: openLogs,
+      onChanged: (bool value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(openLogs: value));
+      },
     );
   }
 }
@@ -229,17 +211,15 @@ class CrashlyticsItem extends ConsumerWidget {
     final crashlytics = ref.watch(
       appSettingProvider.select((state) => state.crashlytics),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.crashlytics),
       subtitle: Text(appLocalizations.crashlyticsTip),
-      delegate: SwitchDelegate(
-        value: crashlytics,
-        onChanged: (bool value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(crashlytics: value));
-        },
-      ),
+      value: crashlytics,
+      onChanged: (bool value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(crashlytics: value));
+      },
     );
   }
 }
@@ -253,17 +233,15 @@ class AutoCheckUpdateItem extends ConsumerWidget {
     final autoCheckUpdate = ref.watch(
       appSettingProvider.select((state) => state.autoCheckUpdate),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.autoCheckUpdate),
       subtitle: Text(appLocalizations.autoCheckUpdateDesc),
-      delegate: SwitchDelegate(
-        value: autoCheckUpdate,
-        onChanged: (bool value) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(autoCheckUpdate: value));
-        },
-      ),
+      value: autoCheckUpdate,
+      onChanged: (bool value) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(autoCheckUpdate: value));
+      },
     );
   }
 }
diff --git a/lib/views/backup_and_restore.dart b/lib/views/backup_and_restore.dart
index c2183a171b..623e8fef20 100644
--- a/lib/views/backup_and_restore.dart
+++ b/lib/views/backup_and_restore.dart
@@ -1,3 +1,4 @@
+import 'dart:async';
 import 'dart:io';
 
 import 'package:dynamic_color/dynamic_color.dart';
@@ -13,6 +14,7 @@ import 'package:fl_clash/widgets/dialog.dart';
 import 'package:fl_clash/widgets/fade_box.dart';
 import 'package:fl_clash/widgets/input.dart';
 import 'package:fl_clash/widgets/list.dart';
+import 'package:fl_clash/widgets/loading.dart';
 import 'package:fl_clash/widgets/scaffold.dart';
 import 'package:fl_clash/widgets/text.dart';
 import 'package:flutter/material.dart';
@@ -28,29 +30,24 @@ class BackupAndRestore extends ConsumerStatefulWidget {
 
 class _BackupAndRestoreState extends ConsumerState<BackupAndRestore>
     with UniqueKeyStateMixin {
-  final _isCompleter = ValueNotifier<bool?>(null);
-  DAVProps? _lastProps;
-  DAVClient? _client;
-
-  Future<void> _updateDAVClient(DAVProps? props) async {
-    _client = props == null ? null : DAVClient(props);
-    final rawProps = props?.copyWith(fileName: '');
-    final rawLastProps = _lastProps?.copyWith(fileName: '');
-    _lastProps = props;
-    if (rawProps == rawLastProps) {
-      return;
-    } else {
-      _isCompleter.value == null;
-      final res = await _client?.ping() ?? false;
-      if (mounted) {
-        _isCompleter.value = res;
-      }
-    }
-  }
+  final _davConnection = DAVConnectionController();
 
   @override
   void initState() {
     super.initState();
+    ref.listenManual(davSettingProvider, (_, _) {
+      _updateDAVClient();
+    }, fireImmediately: true);
+  }
+
+  void _updateDAVClient() {
+    unawaited(_davConnection.update(ref.read(davSettingProvider)));
+  }
+
+  @override
+  void dispose() {
+    _davConnection.dispose();
+    super.dispose();
   }
 
   Future<void> _showAddWebDAV(DAVProps? dav) async {
@@ -63,13 +60,17 @@ class _BackupAndRestoreState extends ConsumerState<BackupAndRestore>
     final appLocalizations = context.appLocalizations;
     final res = await globalState.loadingRun<bool>(
       () async {
+        final client = _davConnection.client;
+        if (client == null) {
+          return false;
+        }
         final path = await globalState.container
             .read(backupActionProvider.notifier)
             .backup();
         if (path.isEmpty) {
           return false;
         }
-        return _client!.backup(path);
+        return client.backup(path);
       },
       tag: LoadingTag.backup_restore,
       title: appLocalizations.backup,
@@ -85,7 +86,11 @@ class _BackupAndRestoreState extends ConsumerState<BackupAndRestore>
     final appLocalizations = context.appLocalizations;
     final res = await globalState.loadingRun<bool>(
       () async {
-        await _client?.restore();
+        final client = _davConnection.client;
+        if (client == null) {
+          return false;
+        }
+        await client.restore();
         await globalState.container
             .read(backupActionProvider.notifier)
             .restore(option);
@@ -201,7 +206,6 @@ class _BackupAndRestoreState extends ConsumerState<BackupAndRestore>
     final appLocalizations = context.appLocalizations;
     final dav = ref.watch(davSettingProvider);
     final isLoading = ref.watch(loadingProvider(LoadingTag.backup_restore));
-    _updateDAVClient(dav);
     return CommonScaffold(
       isLoading: isLoading,
       title: appLocalizations.backupAndRestore,
@@ -237,7 +241,7 @@ class _BackupAndRestoreState extends ConsumerState<BackupAndRestore>
                   children: [
                     Text(appLocalizations.connectivity),
                     ValueListenableBuilder(
-                      valueListenable: _isCompleter,
+                      valueListenable: _davConnection,
                       builder: (_, isCompleter, _) {
                         return Center(
                           child: FadeThroughBox(
@@ -245,9 +249,7 @@ class _BackupAndRestoreState extends ConsumerState<BackupAndRestore>
                                 ? const SizedBox(
                                     width: 12,
                                     height: 12,
-                                    child: CircularProgressIndicator(
-                                      strokeWidth: 1,
-                                    ),
+                                    child: CommonCircleLoading(),
                                   )
                                 : Container(
                                     decoration: BoxDecoration(
@@ -279,15 +281,13 @@ class _BackupAndRestoreState extends ConsumerState<BackupAndRestore>
             ListItem.input(
               title: Text(appLocalizations.file),
               subtitle: Text(dav.fileName),
-              delegate: InputDelegate(
-                title: appLocalizations.file,
-                value: dav.fileName,
-                resetValue: defaultDavFileName,
-                maxLength: TextInputLimits.fileName,
-                onChanged: (value) {
-                  _handleChange(value, ref);
-                },
-              ),
+              dialogTitle: appLocalizations.file,
+              value: dav.fileName,
+              resetValue: defaultDavFileName,
+              maxLength: TextInputLimits.fileName,
+              onChanged: (value) {
+                _handleChange(value, ref);
+              },
             ),
             ListItem(
               onTap: () {
@@ -412,16 +412,21 @@ class _WebDAVFormDialogState extends ConsumerState<WebDAVFormDialog> {
 
   void _submit() {
     if (!_formKey.currentState!.validate()) return;
-    ref.read(davSettingProvider.notifier).value = DAVProps(
-      uri: _uriController.text,
-      user: _userController.text,
-      password: _passwordController.text,
-    );
+    ref
+        .read(davSettingProvider.notifier)
+        .update(
+          (_) => DAVProps(
+            uri: _uriController.text,
+            user: _userController.text,
+            password: _passwordController.text,
+            fileName: widget.dav?.fileName ?? defaultDavFileName,
+          ),
+        );
     Navigator.pop(context);
   }
 
   void _delete() {
-    ref.read(davSettingProvider.notifier).value = null;
+    ref.read(davSettingProvider.notifier).update((_) => null);
     Navigator.pop(context);
   }
 
diff --git a/lib/views/config/advanced.dart b/lib/views/config/advanced.dart
index 673132b7e0..436efe674f 100644
--- a/lib/views/config/advanced.dart
+++ b/lib/views/config/advanced.dart
@@ -24,65 +24,64 @@ class AdvancedConfigView extends StatelessWidget {
         title: Text(appLocalizations.network),
         subtitle: Text(appLocalizations.networkDesc),
         leading: const Icon(Icons.vpn_key),
-        delegate: OpenDelegate(
-          blur: false,
-          widget: BaseScaffold(
-            title: appLocalizations.network,
-            body: const NetworkListView(),
-          ),
+        blur: false,
+        widget: BaseScaffold(
+          title: appLocalizations.network,
+          body: const NetworkListView(),
         ),
       ),
       ListItem.open(
         title: Text(appLocalizations.onDemand),
         subtitle: Text(appLocalizations.onDemandDesc),
         leading: const Icon(Icons.ssid_chart, fontWeight: FontWeight.w900),
-        delegate: const OpenDelegate(widget: OnDemandView(), blur: false),
+        widget: const OnDemandView(),
+        blur: false,
       ),
       ListItem.open(
         title: const Text('DNS'),
         subtitle: Text(appLocalizations.dnsDesc),
         leading: const Icon(Icons.dns),
-        delegate: OpenDelegate(
-          widget: BaseScaffold(
-            title: 'DNS',
-            actions: [
-              Consumer(
-                builder: (_, ref, _) {
-                  return IconButton(
-                    onPressed: () async {
-                      final res = await globalState.showMessage(
-                        title: appLocalizations.reset,
-                        message: TextSpan(text: appLocalizations.resetTip),
-                      );
-                      if (res != true) {
-                        return;
-                      }
-                      ref
-                          .read(patchClashConfigProvider.notifier)
-                          .update((state) => state.copyWith(dns: defaultDns));
-                    },
-                    tooltip: appLocalizations.reset,
-                    icon: const Icon(Icons.replay),
-                  );
-                },
-              ),
-            ],
-            body: const DnsListView(),
-          ),
-          blur: false,
+        widget: BaseScaffold(
+          title: 'DNS',
+          actions: [
+            Consumer(
+              builder: (_, ref, _) {
+                return IconButton(
+                  onPressed: () async {
+                    final res = await globalState.showMessage(
+                      title: appLocalizations.reset,
+                      message: TextSpan(text: appLocalizations.resetTip),
+                    );
+                    if (res != true) {
+                      return;
+                    }
+                    ref
+                        .read(patchClashConfigProvider.notifier)
+                        .update((state) => state.copyWith(dns: defaultDns));
+                  },
+                  tooltip: appLocalizations.reset,
+                  icon: const Icon(Icons.replay),
+                );
+              },
+            ),
+          ],
+          body: const DnsListView(),
         ),
+        blur: false,
       ),
       ListItem.open(
         title: Text(appLocalizations.addedRules),
         subtitle: Text(appLocalizations.controlGlobalAddedRules),
         leading: const Icon(Icons.library_books),
-        delegate: const OpenDelegate(widget: AddedRulesView(), blur: false),
+        widget: const AddedRulesView(),
+        blur: false,
       ),
       ListItem.open(
         title: Text(appLocalizations.script),
         subtitle: Text(appLocalizations.overrideScript),
         leading: const Icon(Icons.rocket, fontWeight: FontWeight.w900),
-        delegate: const OpenDelegate(widget: ScriptsView(), blur: false),
+        widget: const ScriptsView(),
+        blur: false,
       ),
     ];
     return BaseScaffold(
diff --git a/lib/views/config/dns.dart b/lib/views/config/dns.dart
index 7c3a1513db..ce8ceb434a 100644
--- a/lib/views/config/dns.dart
+++ b/lib/views/config/dns.dart
@@ -12,15 +12,13 @@ class OverrideItem extends ConsumerWidget {
   Widget build(BuildContext context, ref) {
     final appLocalizations = context.appLocalizations;
     final override = ref.watch(overrideDnsProvider);
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.overrideDns),
       subtitle: Text(appLocalizations.overrideDnsDesc),
-      delegate: SwitchDelegate(
-        value: override,
-        onChanged: (bool value) async {
-          ref.read(overrideDnsProvider.notifier).value = value;
-        },
-      ),
+      value: override,
+      onChanged: (bool value) async {
+        ref.read(overrideDnsProvider.notifier).value = value;
+      },
     );
   }
 }
@@ -34,17 +32,15 @@ class StatusItem extends ConsumerWidget {
     final enable = ref.watch(
       patchClashConfigProvider.select((state) => state.dns.enable),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.status),
       subtitle: Text(appLocalizations.statusDesc),
-      delegate: SwitchDelegate(
-        value: enable,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(enable: value));
-        },
-      ),
+      value: enable,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(enable: value));
+      },
     );
   }
 }
@@ -61,25 +57,23 @@ class ListenItem extends ConsumerWidget {
     return ListItem.input(
       title: Text(appLocalizations.listen),
       subtitle: Text(listen),
-      delegate: InputDelegate(
-        title: appLocalizations.listen,
-        value: listen,
-        maxLength: TextInputLimits.dnsListen,
-        validator: (value) {
-          if (value == null || value.isEmpty) {
-            return appLocalizations.emptyTip(appLocalizations.listen);
-          }
-          return null;
-        },
-        onChanged: (String? value) {
-          if (value == null) {
-            return;
-          }
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(listen: value));
-        },
-      ),
+      dialogTitle: appLocalizations.listen,
+      value: listen,
+      maxLength: TextInputLimits.dnsListen,
+      validator: (value) {
+        if (value == null || value.isEmpty) {
+          return appLocalizations.emptyTip(appLocalizations.listen);
+        }
+        return null;
+      },
+      onChanged: (String? value) {
+        if (value == null) {
+          return;
+        }
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(listen: value));
+      },
     );
   }
 }
@@ -93,17 +87,15 @@ class PreferH3Item extends ConsumerWidget {
     final preferH3 = ref.watch(
       patchClashConfigProvider.select((state) => state.dns.preferH3),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: const Text('PreferH3'),
       subtitle: Text(appLocalizations.preferH3Desc),
-      delegate: SwitchDelegate(
-        value: preferH3,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(preferH3: value));
-        },
-      ),
+      value: preferH3,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(preferH3: value));
+      },
     );
   }
 }
@@ -116,16 +108,14 @@ class IPv6Item extends ConsumerWidget {
     final ipv6 = ref.watch(
       patchClashConfigProvider.select((state) => state.dns.ipv6),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: const Text('IPv6'),
-      delegate: SwitchDelegate(
-        value: ipv6,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(ipv6: value));
-        },
-      ),
+      value: ipv6,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(ipv6: value));
+      },
     );
   }
 }
@@ -139,17 +129,15 @@ class RespectRulesItem extends ConsumerWidget {
     final respectRules = ref.watch(
       patchClashConfigProvider.select((state) => state.dns.respectRules),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.respectRules),
       subtitle: Text(appLocalizations.respectRulesDesc),
-      delegate: SwitchDelegate(
-        value: respectRules,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(respectRules: value));
-        },
-      ),
+      value: respectRules,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(respectRules: value));
+      },
     );
   }
 }
@@ -166,20 +154,18 @@ class DnsModeItem extends ConsumerWidget {
     return ListItem<DnsMode>.options(
       title: Text(appLocalizations.dnsMode),
       subtitle: Text(enhancedMode.name),
-      delegate: OptionsDelegate(
-        title: appLocalizations.dnsMode,
-        options: DnsMode.values,
-        onChanged: (value) {
-          if (value == null) {
-            return;
-          }
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(enhancedMode: value));
-        },
-        textBuilder: (dnsMode) => dnsMode.name,
-        value: enhancedMode,
-      ),
+      dialogTitle: appLocalizations.dnsMode,
+      options: DnsMode.values,
+      onChanged: (value) {
+        if (value == null) {
+          return;
+        }
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(enhancedMode: value));
+      },
+      textBuilder: (dnsMode) => dnsMode.name,
+      value: enhancedMode,
     );
   }
 }
@@ -196,25 +182,23 @@ class FakeIpRangeItem extends ConsumerWidget {
     return ListItem.input(
       title: Text(appLocalizations.fakeipRange),
       subtitle: Text(fakeIpRange),
-      delegate: InputDelegate(
-        title: appLocalizations.fakeipRange,
-        value: fakeIpRange,
-        maxLength: TextInputLimits.cidr,
-        validator: (value) {
-          if (value == null || value.isEmpty) {
-            return appLocalizations.emptyTip(appLocalizations.fakeipRange);
-          }
-          return null;
-        },
-        onChanged: (String? value) {
-          if (value == null) {
-            return;
-          }
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(fakeIpRange: value));
-        },
-      ),
+      dialogTitle: appLocalizations.fakeipRange,
+      value: fakeIpRange,
+      maxLength: TextInputLimits.cidr,
+      validator: (value) {
+        if (value == null || value.isEmpty) {
+          return appLocalizations.emptyTip(appLocalizations.fakeipRange);
+        }
+        return null;
+      },
+      onChanged: (String? value) {
+        if (value == null) {
+          return;
+        }
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(fakeIpRange: value));
+      },
     );
   }
 }
@@ -230,22 +214,20 @@ class FakeIpFilterItem extends ConsumerWidget {
     );
     return ListItem.open(
       title: Text(appLocalizations.fakeipFilter),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: appLocalizations.fakeipFilter,
-          items: fakeIpFilter,
-          itemMaxLength: TextInputLimits.domain,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith.dns(fakeIpFilter: List.from(items)),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: appLocalizations.fakeipFilter,
+        items: fakeIpFilter,
+        itemMaxLength: TextInputLimits.domain,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) => state.copyWith.dns(fakeIpFilter: List.from(items)),
+            );
+      },
     );
   }
 }
@@ -262,23 +244,21 @@ class DefaultNameserverItem extends ConsumerWidget {
     return ListItem.open(
       title: Text(appLocalizations.defaultNameserver),
       subtitle: Text(appLocalizations.defaultNameserverDesc),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: appLocalizations.defaultNameserver,
-          items: defaultNameserver,
-          itemMaxLength: TextInputLimits.dnsServer,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) =>
-                    state.copyWith.dns(defaultNameserver: List.from(items)),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: appLocalizations.defaultNameserver,
+        items: defaultNameserver,
+        itemMaxLength: TextInputLimits.dnsServer,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) =>
+                  state.copyWith.dns(defaultNameserver: List.from(items)),
+            );
+      },
     );
   }
 }
@@ -295,22 +275,20 @@ class NameserverItem extends ConsumerWidget {
     return ListItem.open(
       title: Text(appLocalizations.nameserver),
       subtitle: Text(appLocalizations.nameserverDesc),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: appLocalizations.nameserver,
-          items: nameserver,
-          itemMaxLength: TextInputLimits.dnsServer,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith.dns(nameserver: List.from(items)),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: appLocalizations.nameserver,
+        items: nameserver,
+        itemMaxLength: TextInputLimits.dnsServer,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) => state.copyWith.dns(nameserver: List.from(items)),
+            );
+      },
     );
   }
 }
@@ -324,16 +302,14 @@ class UseHostsItem extends ConsumerWidget {
     final useHosts = ref.watch(
       patchClashConfigProvider.select((state) => state.dns.useHosts),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.useHosts),
-      delegate: SwitchDelegate(
-        value: useHosts,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(useHosts: value));
-        },
-      ),
+      value: useHosts,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(useHosts: value));
+      },
     );
   }
 }
@@ -347,16 +323,14 @@ class UseSystemHostsItem extends ConsumerWidget {
     final useSystemHosts = ref.watch(
       patchClashConfigProvider.select((state) => state.dns.useSystemHosts),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.useSystemHosts),
-      delegate: SwitchDelegate(
-        value: useSystemHosts,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(useSystemHosts: value));
-        },
-      ),
+      value: useSystemHosts,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(useSystemHosts: value));
+      },
     );
   }
 }
@@ -373,22 +347,20 @@ class NameserverPolicyItem extends ConsumerWidget {
     return ListItem.open(
       title: Text(appLocalizations.nameserverPolicy),
       subtitle: Text(appLocalizations.nameserverPolicyDesc),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: MapInputPage(
-          title: appLocalizations.nameserverPolicy,
-          map: nameserverPolicy,
-          keyMaxLength: TextInputLimits.domain,
-          valueMaxLength: TextInputLimits.dnsServer,
-          titleBuilder: (item) => Text(item.key),
-          subtitleBuilder: (item) => Text(item.value),
-        ),
-        onChanged: (value) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.dns(nameserverPolicy: value));
-        },
+      blur: false,
+      widget: MapInputPage(
+        title: appLocalizations.nameserverPolicy,
+        map: nameserverPolicy,
+        keyMaxLength: TextInputLimits.domain,
+        valueMaxLength: TextInputLimits.dnsServer,
+        titleBuilder: (item) => Text(item.key),
+        subtitleBuilder: (item) => Text(item.value),
       ),
+      onChanged: (value) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(nameserverPolicy: value));
+      },
     );
   }
 }
@@ -407,23 +379,21 @@ class ProxyServerNameserverItem extends ConsumerWidget {
     return ListItem.open(
       title: Text(appLocalizations.proxyNameserver),
       subtitle: Text(appLocalizations.proxyNameserverDesc),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: appLocalizations.proxyNameserver,
-          items: proxyServerNameserver,
-          itemMaxLength: TextInputLimits.dnsServer,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) =>
-                    state.copyWith.dns(proxyServerNameserver: List.from(items)),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: appLocalizations.proxyNameserver,
+        items: proxyServerNameserver,
+        itemMaxLength: TextInputLimits.dnsServer,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) =>
+                  state.copyWith.dns(proxyServerNameserver: List.from(items)),
+            );
+      },
     );
   }
 }
@@ -440,22 +410,18 @@ class FallbackItem extends ConsumerWidget {
     return ListItem.open(
       title: Text(appLocalizations.fallback),
       subtitle: Text(appLocalizations.fallbackDesc),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: appLocalizations.fallback,
-          items: fallback,
-          itemMaxLength: TextInputLimits.dnsServer,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith.dns(fallback: List.from(items)),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: appLocalizations.fallback,
+        items: fallback,
+        itemMaxLength: TextInputLimits.dnsServer,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns(fallback: List.from(items)));
+      },
     );
   }
 }
@@ -470,18 +436,14 @@ class GeoipItem extends ConsumerWidget {
         (state) => state.dns.fallbackFilter.geoip,
       ),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: const Text('Geoip'),
-      delegate: SwitchDelegate(
-        value: geoip,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith.dns.fallbackFilter(geoip: value),
-              );
-        },
-      ),
+      value: geoip,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.dns.fallbackFilter(geoip: value));
+      },
     );
   }
 }
@@ -500,27 +462,25 @@ class GeoipCodeItem extends ConsumerWidget {
     return ListItem.input(
       title: Text(appLocalizations.geoipCode),
       subtitle: Text(geoipCode),
-      delegate: InputDelegate(
-        title: appLocalizations.geoipCode,
-        value: geoipCode,
-        maxLength: TextInputLimits.geoIpCode,
-        validator: (value) {
-          if (value == null || value.isEmpty) {
-            return appLocalizations.emptyTip(appLocalizations.geoipCode);
-          }
-          return null;
-        },
-        onChanged: (String? value) {
-          if (value == null) {
-            return;
-          }
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith.dns.fallbackFilter(geoipCode: value),
-              );
-        },
-      ),
+      dialogTitle: appLocalizations.geoipCode,
+      value: geoipCode,
+      maxLength: TextInputLimits.geoIpCode,
+      validator: (value) {
+        if (value == null || value.isEmpty) {
+          return appLocalizations.emptyTip(appLocalizations.geoipCode);
+        }
+        return null;
+      },
+      onChanged: (String? value) {
+        if (value == null) {
+          return;
+        }
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) => state.copyWith.dns.fallbackFilter(geoipCode: value),
+            );
+      },
     );
   }
 }
@@ -537,24 +497,21 @@ class GeositeItem extends ConsumerWidget {
     );
     return ListItem.open(
       title: const Text('Geosite'),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: 'Geosite',
-          items: geosite,
-          itemMaxLength: TextInputLimits.geoSite,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith.dns.fallbackFilter(
-                  geosite: List.from(items),
-                ),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: 'Geosite',
+        items: geosite,
+        itemMaxLength: TextInputLimits.geoSite,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) =>
+                  state.copyWith.dns.fallbackFilter(geosite: List.from(items)),
+            );
+      },
     );
   }
 }
@@ -572,23 +529,21 @@ class IpcidrItem extends ConsumerWidget {
     );
     return ListItem.open(
       title: Text(appLocalizations.ipcidr),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: appLocalizations.ipcidr,
-          items: ipcidr,
-          itemMaxLength: TextInputLimits.cidr,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) =>
-                    state.copyWith.dns.fallbackFilter(ipcidr: List.from(items)),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: appLocalizations.ipcidr,
+        items: ipcidr,
+        itemMaxLength: TextInputLimits.cidr,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) =>
+                  state.copyWith.dns.fallbackFilter(ipcidr: List.from(items)),
+            );
+      },
     );
   }
 }
@@ -606,23 +561,21 @@ class DomainItem extends ConsumerWidget {
     );
     return ListItem.open(
       title: Text(appLocalizations.domain),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: appLocalizations.domain,
-          items: domain,
-          itemMaxLength: TextInputLimits.domain,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) =>
-                    state.copyWith.dns.fallbackFilter(domain: List.from(items)),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: appLocalizations.domain,
+        items: domain,
+        itemMaxLength: TextInputLimits.domain,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) =>
+                  state.copyWith.dns.fallbackFilter(domain: List.from(items)),
+            );
+      },
     );
   }
 }
diff --git a/lib/views/config/general.dart b/lib/views/config/general.dart
index 784d98695c..44f61e1a72 100644
--- a/lib/views/config/general.dart
+++ b/lib/views/config/general.dart
@@ -24,20 +24,18 @@ class LogLevelItem extends ConsumerWidget {
       leading: const Icon(Icons.info_outline),
       title: Text(appLocalizations.logLevel),
       subtitle: Text(logLevel.name),
-      delegate: OptionsDelegate<LogLevel>(
-        title: appLocalizations.logLevel,
-        options: LogLevel.values,
-        onChanged: (LogLevel? value) {
-          if (value == null) {
-            return;
-          }
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith(logLevel: value));
-        },
-        textBuilder: (logLevel) => logLevel.name,
-        value: logLevel,
-      ),
+      dialogTitle: appLocalizations.logLevel,
+      options: LogLevel.values,
+      onChanged: (LogLevel? value) {
+        if (value == null) {
+          return;
+        }
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith(logLevel: value));
+      },
+      textBuilder: (logLevel) => logLevel.name,
+      value: logLevel,
     );
   }
 }
@@ -181,40 +179,34 @@ class _UaDialogState extends State<_UaDialog> {
             runSpacing: 8,
             children: [
               ListItem.radio(
-                delegate: RadioDelegate(
-                  value: _defaultUaValue,
-                  onTab: () {
-                    Navigator.of(context).pop(
-                      const _UaDialogResult(
-                        value: _defaultUaValue,
-                        isCustom: false,
-                      ),
-                    );
-                  },
-                ),
+                value: _defaultUaValue,
+                onTap: () {
+                  Navigator.of(context).pop(
+                    const _UaDialogResult(
+                      value: _defaultUaValue,
+                      isCustom: false,
+                    ),
+                  );
+                },
                 title: Text(appLocalizations.defaultText),
               ),
               for (final ua in _presetUas)
                 ListItem.radio(
-                  delegate: RadioDelegate(
-                    value: ua,
-                    onTab: () {
-                      Navigator.of(
-                        context,
-                      ).pop(_UaDialogResult(value: ua, isCustom: false));
-                    },
-                  ),
+                  value: ua,
+                  onTap: () {
+                    Navigator.of(
+                      context,
+                    ).pop(_UaDialogResult(value: ua, isCustom: false));
+                  },
                   title: Text(ua),
                 ),
               ListItem.radio(
-                delegate: RadioDelegate(
-                  value: _customUaValue,
-                  onTab: () {
-                    setState(() {
-                      _groupValue = _customUaValue;
-                    });
-                  },
-                ),
+                value: _customUaValue,
+                onTap: () {
+                  setState(() {
+                    _groupValue = _customUaValue;
+                  });
+                },
                 title: Builder(
                   builder: (context) {
                     final titleStyle = DefaultTextStyle.of(context).style;
@@ -278,32 +270,30 @@ class KeepAliveIntervalItem extends ConsumerWidget {
       leading: const Icon(Icons.timer_outlined),
       title: Text(appLocalizations.keepAliveIntervalDesc),
       subtitle: Text(appLocalizations.secondsCount(keepAliveInterval)),
-      delegate: InputDelegate(
-        title: appLocalizations.keepAliveIntervalDesc,
-        suffixText: appLocalizations.seconds,
-        resetValue: '$defaultKeepAliveInterval',
-        value: '$keepAliveInterval',
-        maxLength: TextInputLimits.interval,
-        validator: (String? value) {
-          if (value == null || value.isEmpty) {
-            return appLocalizations.emptyTip(appLocalizations.interval);
-          }
-          final intValue = int.tryParse(value);
-          if (intValue == null) {
-            return appLocalizations.numberTip(appLocalizations.interval);
-          }
-          return null;
-        },
-        onChanged: (String? value) {
-          if (value == null) {
-            return;
-          }
-          final intValue = int.parse(value);
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith(keepAliveInterval: intValue));
-        },
-      ),
+      dialogTitle: appLocalizations.keepAliveIntervalDesc,
+      suffixText: appLocalizations.seconds,
+      resetValue: '$defaultKeepAliveInterval',
+      value: '$keepAliveInterval',
+      maxLength: TextInputLimits.interval,
+      validator: (String? value) {
+        if (value == null || value.isEmpty) {
+          return appLocalizations.emptyTip(appLocalizations.interval);
+        }
+        final intValue = int.tryParse(value);
+        if (intValue == null) {
+          return appLocalizations.numberTip(appLocalizations.interval);
+        }
+        return null;
+      },
+      onChanged: (String? value) {
+        if (value == null) {
+          return;
+        }
+        final intValue = int.parse(value);
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith(keepAliveInterval: intValue));
+      },
     );
   }
 }
@@ -321,29 +311,27 @@ class TestUrlItem extends ConsumerWidget {
       leading: const Icon(Icons.timeline),
       title: Text(appLocalizations.testUrl),
       subtitle: Text(testUrl),
-      delegate: InputDelegate(
-        resetValue: defaultTestUrl,
-        title: appLocalizations.testUrl,
-        value: testUrl,
-        maxLength: TextInputLimits.url,
-        validator: (String? value) {
-          if (value == null || value.isEmpty) {
-            return appLocalizations.emptyTip(appLocalizations.testUrl);
-          }
-          if (!value.isUrl) {
-            return appLocalizations.urlTip(appLocalizations.testUrl);
-          }
-          return null;
-        },
-        onChanged: (String? value) {
-          if (value == null) {
-            return;
-          }
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(testUrl: value));
-        },
-      ),
+      resetValue: defaultTestUrl,
+      dialogTitle: appLocalizations.testUrl,
+      value: testUrl,
+      maxLength: TextInputLimits.url,
+      validator: (String? value) {
+        if (value == null || value.isEmpty) {
+          return appLocalizations.emptyTip(appLocalizations.testUrl);
+        }
+        if (!value.isUrl) {
+          return appLocalizations.urlTip(appLocalizations.testUrl);
+        }
+        return null;
+      },
+      onChanged: (String? value) {
+        if (value == null) {
+          return;
+        }
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(testUrl: value));
+      },
     );
   }
 }
@@ -353,7 +341,6 @@ class PortItem extends ConsumerWidget {
 
   Future<void> handleShowPortDialog() async {
     await globalState.showCommonDialog(child: const _PortDialog());
-    // inputDelegate.onChanged(value);
   }
 
   @override
@@ -369,35 +356,6 @@ class PortItem extends ConsumerWidget {
       onTap: () {
         handleShowPortDialog();
       },
-      // delegate: InputDelegate(
-      //   title: appLocalizations.port,
-      //   value: "$mixedPort",
-      //   validator: (String? value) {
-      //     if (value == null || value.isEmpty) {
-      //       return appLocalizations.emptyTip(appLocalizations.proxyPort);
-      //     }
-      //     final mixedPort = int.tryParse(value);
-      //     if (mixedPort == null) {
-      //       return appLocalizations.numberTip(appLocalizations.proxyPort);
-      //     }
-      //     if (mixedPort < 1024 || mixedPort > 49151) {
-      //       return appLocalizations.proxyPortTip;
-      //     }
-      //     return null;
-      //   },
-      //   onChanged: (String? value) {
-      //     if (value == null) {
-      //       return;
-      //     }
-      //     final mixedPort = int.parse(value);
-      //     ref.read(patchClashConfigProvider.notifier).update(
-      //           (state) => state.copyWith(
-      //             mixedPort: mixedPort,
-      //           ),
-      //         );
-      //   },
-      //   resetValue: "$defaultMixedPort",
-      // ),
     );
   }
 }
@@ -415,22 +373,20 @@ class HostsItem extends ConsumerWidget {
       leading: const Icon(Icons.view_list_outlined),
       title: const Text('Hosts'),
       subtitle: Text(appLocalizations.hostsDesc),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: MapInputPage(
-          title: 'Hosts',
-          map: hosts,
-          keyMaxLength: TextInputLimits.domain,
-          valueMaxLength: TextInputLimits.hostValue,
-          titleBuilder: (item) => Text(item.key),
-          subtitleBuilder: (item) => Text(item.value),
-        ),
-        onChanged: (value) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith(hosts: value));
-        },
+      blur: false,
+      widget: MapInputPage(
+        title: 'Hosts',
+        map: hosts,
+        keyMaxLength: TextInputLimits.domain,
+        valueMaxLength: TextInputLimits.hostValue,
+        titleBuilder: (item) => Text(item.key),
+        subtitleBuilder: (item) => Text(item.value),
       ),
+      onChanged: (value) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith(hosts: value));
+      },
     );
   }
 }
@@ -444,18 +400,16 @@ class Ipv6Item extends ConsumerWidget {
     final ipv6 = ref.watch(
       patchClashConfigProvider.select((state) => state.ipv6),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       leading: const Icon(Icons.water_outlined),
       title: const Text('IPv6'),
       subtitle: Text(appLocalizations.ipv6Desc),
-      delegate: SwitchDelegate(
-        value: ipv6,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith(ipv6: value));
-        },
-      ),
+      value: ipv6,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith(ipv6: value));
+      },
     );
   }
 }
@@ -469,18 +423,16 @@ class AppendSystemDNSItem extends ConsumerWidget {
     final appendSystemDNS = ref.watch(
       networkSettingProvider.select((state) => state.appendSystemDns),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       leading: const Icon(Icons.dns_outlined),
       title: Text(appLocalizations.appendSystemDns),
       subtitle: Text(appLocalizations.appendSystemDnsTip),
-      delegate: SwitchDelegate(
-        value: appendSystemDNS,
-        onChanged: (bool value) async {
-          ref
-              .read(networkSettingProvider.notifier)
-              .update((state) => state.copyWith(appendSystemDns: value));
-        },
-      ),
+      value: appendSystemDNS,
+      onChanged: (bool value) async {
+        ref
+            .read(networkSettingProvider.notifier)
+            .update((state) => state.copyWith(appendSystemDns: value));
+      },
     );
   }
 }
@@ -494,18 +446,16 @@ class AllowLanItem extends ConsumerWidget {
     final allowLan = ref.watch(
       patchClashConfigProvider.select((state) => state.allowLan),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       leading: const Icon(Icons.device_hub),
       title: Text(appLocalizations.allowLan),
       subtitle: Text(appLocalizations.allowLanDesc),
-      delegate: SwitchDelegate(
-        value: allowLan,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith(allowLan: value));
-        },
-      ),
+      value: allowLan,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith(allowLan: value));
+      },
     );
   }
 }
@@ -520,18 +470,16 @@ class UnifiedDelayItem extends ConsumerWidget {
       patchClashConfigProvider.select((state) => state.unifiedDelay),
     );
 
-    return ListItem.switchItem(
+    return ListItem.toggle(
       leading: const Icon(Icons.compress_outlined),
       title: Text(appLocalizations.unifiedDelay),
       subtitle: Text(appLocalizations.unifiedDelayDesc),
-      delegate: SwitchDelegate(
-        value: unifiedDelay,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith(unifiedDelay: value));
-        },
-      ),
+      value: unifiedDelay,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith(unifiedDelay: value));
+      },
     );
   }
 }
@@ -548,24 +496,22 @@ class FindProcessItem extends ConsumerWidget {
       ),
     );
 
-    return ListItem.switchItem(
+    return ListItem.toggle(
       leading: const Icon(Icons.polymer_outlined),
       title: Text(appLocalizations.findProcessMode),
       subtitle: Text(appLocalizations.findProcessModeDesc),
-      delegate: SwitchDelegate(
-        value: findProcess,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith(
-                  findProcessMode: value
-                      ? FindProcessMode.always
-                      : FindProcessMode.off,
-                ),
-              );
-        },
-      ),
+      value: findProcess,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) => state.copyWith(
+                findProcessMode: value
+                    ? FindProcessMode.always
+                    : FindProcessMode.off,
+              ),
+            );
+      },
     );
   }
 }
@@ -579,18 +525,16 @@ class TcpConcurrentItem extends ConsumerWidget {
     final tcpConcurrent = ref.watch(
       patchClashConfigProvider.select((state) => state.tcpConcurrent),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       leading: const Icon(Icons.double_arrow_outlined),
       title: Text(appLocalizations.tcpConcurrent),
       subtitle: Text(appLocalizations.tcpConcurrentDesc),
-      delegate: SwitchDelegate(
-        value: tcpConcurrent,
-        onChanged: (value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith(tcpConcurrent: value));
-        },
-      ),
+      value: tcpConcurrent,
+      onChanged: (value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith(tcpConcurrent: value));
+      },
     );
   }
 }
@@ -606,24 +550,22 @@ class GeodataLoaderItem extends ConsumerWidget {
         (state) => state.geodataLoader == GeodataLoader.memconservative,
       ),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       leading: const Icon(Icons.memory),
       title: Text(appLocalizations.geodataLoader),
       subtitle: Text(appLocalizations.geodataLoaderDesc),
-      delegate: SwitchDelegate(
-        value: isMemconservative,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith(
-                  geodataLoader: value
-                      ? GeodataLoader.memconservative
-                      : GeodataLoader.standard,
-                ),
-              );
-        },
-      ),
+      value: isMemconservative,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) => state.copyWith(
+                geodataLoader: value
+                    ? GeodataLoader.memconservative
+                    : GeodataLoader.standard,
+              ),
+            );
+      },
     );
   }
 }
@@ -639,24 +581,22 @@ class ExternalControllerItem extends ConsumerWidget {
         (state) => state.externalController == ExternalControllerStatus.open,
       ),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       leading: const Icon(Icons.api_outlined),
       title: Text(appLocalizations.externalController),
       subtitle: Text(appLocalizations.externalControllerDesc),
-      delegate: SwitchDelegate(
-        value: hasExternalController,
-        onChanged: (bool value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith(
-                  externalController: value
-                      ? ExternalControllerStatus.open
-                      : ExternalControllerStatus.close,
-                ),
-              );
-        },
-      ),
+      value: hasExternalController,
+      onChanged: (bool value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) => state.copyWith(
+                externalController: value
+                    ? ExternalControllerStatus.open
+                    : ExternalControllerStatus.close,
+              ),
+            );
+      },
     );
   }
 }
diff --git a/lib/views/config/network.dart b/lib/views/config/network.dart
index b9001088b7..aec43289c8 100644
--- a/lib/views/config/network.dart
+++ b/lib/views/config/network.dart
@@ -15,17 +15,15 @@ class VPNItem extends ConsumerWidget {
     final enable = ref.watch(
       vpnSettingProvider.select((state) => state.enable),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: const Text('VPN'),
       subtitle: Text(appLocalizations.vpnEnableDesc),
-      delegate: SwitchDelegate(
-        value: enable,
-        onChanged: (value) async {
-          ref
-              .read(vpnSettingProvider.notifier)
-              .update((state) => state.copyWith(enable: value));
-        },
-      ),
+      value: enable,
+      onChanged: (value) async {
+        ref
+            .read(vpnSettingProvider.notifier)
+            .update((state) => state.copyWith(enable: value));
+      },
     );
   }
 }
@@ -40,17 +38,15 @@ class TUNItem extends ConsumerWidget {
       patchClashConfigProvider.select((state) => state.tun.enable),
     );
 
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.tun),
       subtitle: Text(appLocalizations.tunDesc),
-      delegate: SwitchDelegate(
-        value: enable,
-        onChanged: (value) async {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.tun(enable: value));
-        },
-      ),
+      value: enable,
+      onChanged: (value) async {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.tun(enable: value));
+      },
     );
   }
 }
@@ -64,17 +60,15 @@ class AllowBypassItem extends ConsumerWidget {
     final allowBypass = ref.watch(
       vpnSettingProvider.select((state) => state.allowBypass),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.allowBypass),
       subtitle: Text(appLocalizations.allowBypassDesc),
-      delegate: SwitchDelegate(
-        value: allowBypass,
-        onChanged: (bool value) async {
-          ref
-              .read(vpnSettingProvider.notifier)
-              .update((state) => state.copyWith(allowBypass: value));
-        },
-      ),
+      value: allowBypass,
+      onChanged: (bool value) async {
+        ref
+            .read(vpnSettingProvider.notifier)
+            .update((state) => state.copyWith(allowBypass: value));
+      },
     );
   }
 }
@@ -88,17 +82,15 @@ class VpnSystemProxyItem extends ConsumerWidget {
     final systemProxy = ref.watch(
       vpnSettingProvider.select((state) => state.systemProxy),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.systemProxy),
       subtitle: Text(appLocalizations.systemProxyDesc),
-      delegate: SwitchDelegate(
-        value: systemProxy,
-        onChanged: (bool value) async {
-          ref
-              .read(vpnSettingProvider.notifier)
-              .update((state) => state.copyWith(systemProxy: value));
-        },
-      ),
+      value: systemProxy,
+      onChanged: (bool value) async {
+        ref
+            .read(vpnSettingProvider.notifier)
+            .update((state) => state.copyWith(systemProxy: value));
+      },
     );
   }
 }
@@ -113,17 +105,15 @@ class SystemProxyItem extends ConsumerWidget {
       networkSettingProvider.select((state) => state.systemProxy),
     );
 
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.systemProxy),
       subtitle: Text(appLocalizations.systemProxyDesc),
-      delegate: SwitchDelegate(
-        value: systemProxy,
-        onChanged: (bool value) async {
-          ref
-              .read(networkSettingProvider.notifier)
-              .update((state) => state.copyWith(systemProxy: value));
-        },
-      ),
+      value: systemProxy,
+      onChanged: (bool value) async {
+        ref
+            .read(networkSettingProvider.notifier)
+            .update((state) => state.copyWith(systemProxy: value));
+      },
     );
   }
 }
@@ -135,17 +125,15 @@ class Ipv6Item extends ConsumerWidget {
   Widget build(BuildContext context, ref) {
     final appLocalizations = context.appLocalizations;
     final ipv6 = ref.watch(vpnSettingProvider.select((state) => state.ipv6));
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: const Text('IPv6'),
       subtitle: Text(appLocalizations.ipv6InboundDesc),
-      delegate: SwitchDelegate(
-        value: ipv6,
-        onChanged: (bool value) async {
-          ref
-              .read(vpnSettingProvider.notifier)
-              .update((state) => state.copyWith(ipv6: value));
-        },
-      ),
+      value: ipv6,
+      onChanged: (bool value) async {
+        ref
+            .read(vpnSettingProvider.notifier)
+            .update((state) => state.copyWith(ipv6: value));
+      },
     );
   }
 }
@@ -159,16 +147,14 @@ class AutoSetSystemDnsItem extends ConsumerWidget {
     final autoSetSystemDns = ref.watch(
       networkSettingProvider.select((state) => state.autoSetSystemDns),
     );
-    return ListItem.switchItem(
+    return ListItem.toggle(
       title: Text(appLocalizations.autoSetSystemDns),
-      delegate: SwitchDelegate(
-        value: autoSetSystemDns,
-        onChanged: (bool value) async {
-          ref
-              .read(networkSettingProvider.notifier)
-              .update((state) => state.copyWith(autoSetSystemDns: value));
-        },
-      ),
+      value: autoSetSystemDns,
+      onChanged: (bool value) async {
+        ref
+            .read(networkSettingProvider.notifier)
+            .update((state) => state.copyWith(autoSetSystemDns: value));
+      },
     );
   }
 }
@@ -186,20 +172,18 @@ class TunStackItem extends ConsumerWidget {
     return ListItem.options(
       title: Text(appLocalizations.stackMode),
       subtitle: Text(stack.name),
-      delegate: OptionsDelegate<TunStack>(
-        value: stack,
-        options: TunStack.values,
-        textBuilder: (value) => value.name,
-        onChanged: (value) {
-          if (value == null) {
-            return;
-          }
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update((state) => state.copyWith.tun(stack: value));
-        },
-        title: appLocalizations.stackMode,
-      ),
+      value: stack,
+      options: TunStack.values,
+      textBuilder: (value) => value.name,
+      onChanged: (value) {
+        if (value == null) {
+          return;
+        }
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.tun(stack: value));
+      },
+      dialogTitle: appLocalizations.stackMode,
     );
   }
 }
@@ -216,22 +200,18 @@ class BypassDomainItem extends ConsumerWidget {
     return ListItem.open(
       title: Text(appLocalizations.bypassDomain),
       subtitle: Text(appLocalizations.bypassDomainDesc),
-      delegate: OpenDelegate(
-        blur: false,
-        widget: ListInputPage(
-          title: appLocalizations.bypassDomain,
-          items: bypassDomain,
-          itemMaxLength: TextInputLimits.domain,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(networkSettingProvider.notifier)
-              .update(
-                (state) => state.copyWith(bypassDomain: List.from(items)),
-              );
-        },
+      blur: false,
+      widget: ListInputPage(
+        title: appLocalizations.bypassDomain,
+        items: bypassDomain,
+        itemMaxLength: TextInputLimits.domain,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(networkSettingProvider.notifier)
+            .update((state) => state.copyWith(bypassDomain: List.from(items)));
+      },
     );
   }
 }
@@ -245,16 +225,14 @@ class DNSHijackingItem extends ConsumerWidget {
     final dnsHijacking = ref.watch(
       vpnSettingProvider.select((state) => state.dnsHijacking),
     );
-    return ListItem<RouteMode>.switchItem(
+    return ListItem<RouteMode>.toggle(
       title: Text(appLocalizations.dnsHijacking),
-      delegate: SwitchDelegate(
-        value: dnsHijacking,
-        onChanged: (value) async {
-          ref
-              .read(vpnSettingProvider.notifier)
-              .update((state) => state.copyWith(dnsHijacking: value));
-        },
-      ),
+      value: dnsHijacking,
+      onChanged: (value) async {
+        ref
+            .read(vpnSettingProvider.notifier)
+            .update((state) => state.copyWith(dnsHijacking: value));
+      },
     );
   }
 }
@@ -271,20 +249,18 @@ class RouteModeItem extends ConsumerWidget {
     return ListItem<RouteMode>.options(
       title: Text(appLocalizations.routeMode),
       subtitle: Text(Intl.message('routeMode_${routeMode.name}')),
-      delegate: OptionsDelegate<RouteMode>(
-        title: appLocalizations.routeMode,
-        options: RouteMode.values,
-        onChanged: (RouteMode? value) {
-          if (value == null) {
-            return;
-          }
-          ref
-              .read(networkSettingProvider.notifier)
-              .update((state) => state.copyWith(routeMode: value));
-        },
-        textBuilder: (routeMode) => Intl.message('routeMode_${routeMode.name}'),
-        value: routeMode,
-      ),
+      dialogTitle: appLocalizations.routeMode,
+      options: RouteMode.values,
+      onChanged: (RouteMode? value) {
+        if (value == null) {
+          return;
+        }
+        ref
+            .read(networkSettingProvider.notifier)
+            .update((state) => state.copyWith(routeMode: value));
+      },
+      textBuilder: (routeMode) => Intl.message('routeMode_${routeMode.name}'),
+      value: routeMode,
     );
   }
 }
@@ -309,23 +285,21 @@ class RouteAddressItem extends ConsumerWidget {
     return ListItem.open(
       title: Text(appLocalizations.routeAddress),
       subtitle: Text(appLocalizations.routeAddressDesc),
-      delegate: OpenDelegate(
-        blur: false,
-        maxWidth: 360,
-        widget: ListInputPage(
-          title: appLocalizations.routeAddress,
-          items: routeAddress,
-          itemMaxLength: TextInputLimits.cidr,
-          titleBuilder: (item) => Text(item),
-        ),
-        onChanged: (items) {
-          ref
-              .read(patchClashConfigProvider.notifier)
-              .update(
-                (state) => state.copyWith.tun(routeAddress: List.from(items)),
-              );
-        },
+      blur: false,
+      maxWidth: 360,
+      widget: ListInputPage(
+        title: appLocalizations.routeAddress,
+        items: routeAddress,
+        itemMaxLength: TextInputLimits.cidr,
+        titleBuilder: (item) => Text(item),
       ),
+      onChanged: (items) {
+        ref
+            .read(patchClashConfigProvider.notifier)
+            .update(
+              (state) => state.copyWith.tun(routeAddress: List.from(items)),
+            );
+      },
     );
   }
 }
diff --git a/lib/views/config/on_demand.dart b/lib/views/config/on_demand.dart
index f89e2770f5..43f3ba3261 100644
--- a/lib/views/config/on_demand.dart
+++ b/lib/views/config/on_demand.dart
@@ -48,9 +48,18 @@ class _OnDemandViewState extends ConsumerState<OnDemandView>
     final res = await wifiSsidManager.requestPermission();
     globalState.container.read(locationPermissionsProvider.notifier).value =
         res;
-    if (!mounted && res != WifiSsidPermission.permanentlyDenied) {
+    if (!mounted) {
       return;
     }
+    switch (getLocationPermissionFollowUp(res)) {
+      case LocationPermissionFollowUp.none:
+        return;
+      case LocationPermissionFollowUp.openSettings:
+        _handlePermanentlyDeniedLocationPermission();
+        return;
+      case LocationPermissionFollowUp.showDeniedMessage:
+        break;
+    }
     final needGo = await globalState.showMessage(
       title: appLocalizations.locationPermissionRequired,
       message: TextSpan(text: appLocalizations.locationPermissionDeniedMessage),
diff --git a/lib/views/dashboard/dashboard.dart b/lib/views/dashboard/dashboard.dart
index 6a793132a7..d2d564b257 100644
--- a/lib/views/dashboard/dashboard.dart
+++ b/lib/views/dashboard/dashboard.dart
@@ -1,19 +1,22 @@
 import 'dart:math';
 
 import 'package:defer_pointer/defer_pointer.dart';
-import 'package:dynamic_color/dynamic_color.dart';
 import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/core/core.dart';
 import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/providers/providers.dart';
-import 'package:fl_clash/state.dart';
 import 'package:fl_clash/widgets/widgets.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
+import 'widgets/core_status_button.dart';
 import 'widgets/start_button.dart';
 
 typedef _IsEditWidgetBuilder = Widget Function(bool isEdit);
 
+const _maxCrossAxisCount = 12;
+const _maxGridWidth = 280.0 * _maxCrossAxisCount / 4;
+
 class DashboardView extends ConsumerStatefulWidget {
   const DashboardView({super.key});
 
@@ -42,114 +45,9 @@ class _DashboardViewState extends ConsumerState<DashboardView> {
     );
   }
 
-  Future<void> _handleConnection() async {
-    final coreStatus = ref.read(coreStatusProvider);
-    if (coreStatus == CoreStatus.connecting) {
-      return;
-    }
-    final tip = coreStatus == CoreStatus.connected
-        ? context.appLocalizations.forceRestartCoreTip
-        : context.appLocalizations.restartCoreTip;
-    final res = await globalState.showMessage(message: TextSpan(text: tip));
-    if (res != true) {
-      return;
-    }
-    globalState.container.read(coreActionProvider.notifier).restartCore();
-  }
-
   List<Widget> _buildActions(bool isEdit) {
-    final appLocalizations = context.appLocalizations;
     return [
-      if (!isEdit)
-        Consumer(
-          builder: (_, ref, _) {
-            final coreStatus = ref.watch(coreStatusProvider);
-            return Tooltip(
-              message: appLocalizations.coreStatus,
-              child: FadeScaleBox(
-                alignment: Alignment.centerRight,
-                child: coreStatus == CoreStatus.connected
-                    ? IconButton.filled(
-                        visualDensity: VisualDensity.compact,
-                        iconSize: 20,
-                        padding: EdgeInsets.zero,
-                        style: IconButton.styleFrom(
-                          backgroundColor: Colors.green.harmonizeWith(
-                            context.colorScheme.primary,
-                          ),
-                          foregroundColor: switch (Theme.brightnessOf(
-                            context,
-                          )) {
-                            Brightness.light =>
-                              context.colorScheme.onSurfaceVariant,
-                            Brightness.dark =>
-                              context.colorScheme.onPrimaryFixedVariant,
-                          },
-                        ),
-                        onPressed: _handleConnection,
-                        icon: const Icon(
-                          Icons.check,
-                          fontWeight: FontWeight.w900,
-                        ),
-                      )
-                    : FilledButton.icon(
-                        key: ValueKey(coreStatus),
-                        onPressed: _handleConnection,
-                        style: FilledButton.styleFrom(
-                          visualDensity: VisualDensity.compact,
-                          padding: const EdgeInsets.symmetric(horizontal: 12),
-                          backgroundColor: switch (coreStatus) {
-                            CoreStatus.connecting => null,
-                            CoreStatus.connected => Colors.greenAccent,
-                            CoreStatus.disconnected =>
-                              context.colorScheme.error,
-                          },
-                          foregroundColor: switch (coreStatus) {
-                            CoreStatus.connecting => null,
-                            CoreStatus.connected => switch (Theme.brightnessOf(
-                              context,
-                            )) {
-                              Brightness.light =>
-                                context.colorScheme.onSurfaceVariant,
-                              Brightness.dark => null,
-                            },
-                            CoreStatus.disconnected =>
-                              context.colorScheme.onError,
-                          },
-                        ),
-                        icon: SizedBox(
-                          height: globalState.measure.bodyMediumHeight,
-                          width: globalState.measure.bodyMediumHeight,
-                          child: switch (coreStatus) {
-                            CoreStatus.connecting => Padding(
-                              padding: const EdgeInsets.all(2),
-                              child: CircularProgressIndicator(
-                                strokeWidth: 3,
-                                color: context.colorScheme.onPrimary,
-                                backgroundColor: Colors.transparent,
-                              ),
-                            ),
-                            CoreStatus.connected => const Icon(
-                              Icons.check_sharp,
-                              fontWeight: FontWeight.w900,
-                            ),
-                            CoreStatus.disconnected => const Icon(
-                              Icons.restart_alt_sharp,
-                              fontWeight: FontWeight.w900,
-                            ),
-                          },
-                        ),
-                        label: Text(switch (coreStatus) {
-                          CoreStatus.connecting => appLocalizations.connecting,
-                          CoreStatus.connected => appLocalizations.connected,
-                          CoreStatus.disconnected =>
-                            appLocalizations.disconnected,
-                        }),
-                      ),
-              ),
-            );
-          },
-        ),
+      if (!isEdit && coreLib == null) const CoreStatusButton(),
       if (isEdit)
         ValueListenableBuilder(
           valueListenable: _addedWidgetsNotifier,
@@ -216,23 +114,31 @@ class _DashboardViewState extends ConsumerState<DashboardView> {
     if (currentState == null) {
       return;
     }
-    if (mounted && currentState.children.isNotEmpty) {
-      await currentState.isTransformCompleter;
-      final dashboardWidgets = currentState.children
-          .map((item) => DashboardWidget.getDashboardWidget(item))
-          .toList();
-      ref
-          .read(appSettingProvider.notifier)
-          .update(
-            (state) => state.copyWith(dashboardWidgets: dashboardWidgets),
-          );
+    if (!mounted || currentState.children.isEmpty) {
+      return;
+    }
+    final transformCompleted = await currentState.isTransformCompleter;
+    if (!transformCompleted ||
+        !mounted ||
+        !currentState.mounted ||
+        !identical(key.currentState, currentState)) {
+      return;
     }
+    final dashboardWidgets = currentState.children
+        .map((item) => DashboardWidget.getDashboardWidget(item))
+        .toList();
+    ref
+        .read(appSettingProvider.notifier)
+        .update((state) => state.copyWith(dashboardWidgets: dashboardWidgets));
   }
 
   @override
   Widget build(BuildContext context) {
     final dashboardState = ref.watch(dashboardStateProvider);
-    final columns = max(4 * ((dashboardState.contentWidth / 280).ceil()), 8);
+    final columns = min(
+      max(4 * ((dashboardState.contentWidth / 280).ceil()), 8),
+      _maxCrossAxisCount,
+    );
     final spacing = 14.mAp;
     final children = [
       ...dashboardState.dashboardWidgets
@@ -260,31 +166,37 @@ class _DashboardViewState extends ConsumerState<DashboardView> {
           alignment: Alignment.topCenter,
           child: SingleChildScrollView(
             padding: const EdgeInsets.all(16).copyWith(bottom: 88),
-            child: isEdit
-                ? SystemBackBlock(
-                    child: CommonPopScope(
-                      child: SuperGrid(
-                        key: key,
+            child: Align(
+              alignment: Alignment.topCenter,
+              child: ConstrainedBox(
+                constraints: const BoxConstraints(maxWidth: _maxGridWidth),
+                child: isEdit
+                    ? SystemBackBlock(
+                        child: CommonPopScope(
+                          child: SuperGrid(
+                            key: key,
+                            crossAxisCount: columns,
+                            crossAxisSpacing: spacing,
+                            mainAxisSpacing: spacing,
+                            children: children,
+                            onUpdate: () {
+                              _handleSave();
+                            },
+                          ),
+                          onPop: (context) {
+                            _handleUpdateIsEdit();
+                            return false;
+                          },
+                        ),
+                      )
+                    : Grid(
                         crossAxisCount: columns,
                         crossAxisSpacing: spacing,
                         mainAxisSpacing: spacing,
                         children: children,
-                        onUpdate: () {
-                          _handleSave();
-                        },
                       ),
-                      onPop: (context) {
-                        _handleUpdateIsEdit();
-                        return false;
-                      },
-                    ),
-                  )
-                : Grid(
-                    crossAxisCount: columns,
-                    crossAxisSpacing: spacing,
-                    mainAxisSpacing: spacing,
-                    children: children,
-                  ),
+              ),
+            ),
           ),
         ),
       ),
diff --git a/lib/views/dashboard/widgets/core_status_button.dart b/lib/views/dashboard/widgets/core_status_button.dart
new file mode 100644
index 0000000000..9d8c615d67
--- /dev/null
+++ b/lib/views/dashboard/widgets/core_status_button.dart
@@ -0,0 +1,159 @@
+import 'dart:async';
+
+import 'package:dynamic_color/dynamic_color.dart';
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/providers/providers.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/widgets/widgets.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+class CoreStatusButton extends ConsumerStatefulWidget {
+  const CoreStatusButton({super.key});
+
+  @override
+  ConsumerState<CoreStatusButton> createState() => _CoreStatusButtonState();
+}
+
+class _CoreStatusButtonState extends ConsumerState<CoreStatusButton> {
+  static const _holdDuration = Duration(milliseconds: 600);
+
+  Timer? _holdTimer;
+  CoreStatus _status = CoreStatus.disconnected;
+
+  @override
+  void initState() {
+    super.initState();
+    _status = ref.read(coreStatusProvider);
+    // The hold arms only on a connecting transition, not on initial mount.
+    ref.listenManual(coreStatusProvider, (_, next) {
+      _onStatusChanged(next);
+    });
+  }
+
+  @override
+  void dispose() {
+    _holdTimer?.cancel();
+    super.dispose();
+  }
+
+  void _onStatusChanged(CoreStatus next) {
+    setState(() {
+      _status = next;
+      switch (next) {
+        case CoreStatus.connecting:
+          _holdTimer ??= Timer(_holdDuration, () {
+            if (mounted) {
+              setState(() {
+                _holdTimer = null;
+              });
+            }
+          });
+          break;
+        case CoreStatus.disconnected:
+          _holdTimer?.cancel();
+          _holdTimer = null;
+          break;
+        case CoreStatus.connected:
+          break;
+      }
+    });
+  }
+
+  Future<void> _handleConnection() async {
+    if (_holdTimer != null) {
+      return;
+    }
+    final coreStatus = ref.read(coreStatusProvider);
+    if (coreStatus == CoreStatus.connecting) {
+      return;
+    }
+    final tip = coreStatus == CoreStatus.connected
+        ? context.appLocalizations.forceRestartCoreTip
+        : context.appLocalizations.restartCoreTip;
+    final res = await globalState.showMessage(message: TextSpan(text: tip));
+    if (res != true) {
+      return;
+    }
+    globalState.container.read(coreActionProvider.notifier).restartCore();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final coreStatus = _holdTimer != null ? CoreStatus.connecting : _status;
+    final appLocalizations = context.appLocalizations;
+    return Tooltip(
+      message: appLocalizations.coreStatus,
+      child: FadeScaleBox(
+        alignment: Alignment.centerRight,
+        child: coreStatus == CoreStatus.connected
+            ? IconButton.filled(
+                visualDensity: VisualDensity.compact,
+                iconSize: 20,
+                padding: EdgeInsets.zero,
+                style: IconButton.styleFrom(
+                  backgroundColor: Colors.green.harmonizeWith(
+                    context.colorScheme.primary,
+                  ),
+                  foregroundColor: switch (Theme.brightnessOf(context)) {
+                    Brightness.light => context.colorScheme.onSurfaceVariant,
+                    Brightness.dark =>
+                      context.colorScheme.onPrimaryFixedVariant,
+                  },
+                ),
+                onPressed: _handleConnection,
+                icon: const Icon(Icons.check, fontWeight: FontWeight.w900),
+              )
+            : FilledButton.icon(
+                key: ValueKey(coreStatus),
+                onPressed: _handleConnection,
+                style: FilledButton.styleFrom(
+                  visualDensity: VisualDensity.compact,
+                  padding: const EdgeInsets.symmetric(horizontal: 12),
+                  backgroundColor: switch (coreStatus) {
+                    CoreStatus.connecting => null,
+                    CoreStatus.connected => Colors.greenAccent,
+                    CoreStatus.disconnected => context.colorScheme.error,
+                  },
+                  foregroundColor: switch (coreStatus) {
+                    CoreStatus.connecting => null,
+                    CoreStatus.connected => switch (Theme.brightnessOf(
+                      context,
+                    )) {
+                      Brightness.light => context.colorScheme.onSurfaceVariant,
+                      Brightness.dark => null,
+                    },
+                    CoreStatus.disconnected => context.colorScheme.onError,
+                  },
+                ),
+                icon: SizedBox(
+                  height: globalState.measure.bodyMediumHeight,
+                  width: globalState.measure.bodyMediumHeight,
+                  child: switch (coreStatus) {
+                    CoreStatus.connecting => Padding(
+                      padding: const EdgeInsets.all(2),
+                      child: CommonCircleLoading(
+                        color: context.colorScheme.onPrimary,
+                      ),
+                    ),
+                    CoreStatus.connected => const Icon(
+                      Icons.check_sharp,
+                      fontWeight: FontWeight.w900,
+                    ),
+                    CoreStatus.disconnected => const Icon(
+                      Icons.restart_alt_sharp,
+                      fontWeight: FontWeight.w900,
+                    ),
+                  },
+                ),
+                label: Text(switch (coreStatus) {
+                  CoreStatus.connecting => appLocalizations.connecting,
+                  CoreStatus.connected => appLocalizations.connected,
+                  CoreStatus.disconnected => appLocalizations.disconnected,
+                }),
+              ),
+      ),
+    );
+  }
+}
diff --git a/lib/views/dashboard/widgets/memory_info.dart b/lib/views/dashboard/widgets/memory_info.dart
index 5893c9bd01..070bf36163 100644
--- a/lib/views/dashboard/widgets/memory_info.dart
+++ b/lib/views/dashboard/widgets/memory_info.dart
@@ -3,6 +3,8 @@ import 'dart:io';
 
 import 'package:fl_clash/common/common.dart';
 import 'package:fl_clash/core/controller.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/providers/app.dart';
 import 'package:fl_clash/state.dart';
 import 'package:fl_clash/widgets/widgets.dart';
 import 'package:flutter/material.dart';
@@ -10,38 +12,92 @@ import 'package:flutter/material.dart';
 final _memoryStateNotifier = ValueNotifier<num>(0);
 
 class MemoryInfo extends StatefulWidget {
-  const MemoryInfo({super.key});
+  final Future<num> Function()? memoryReader;
+
+  const MemoryInfo({super.key, @visibleForTesting this.memoryReader});
 
   @override
   State<MemoryInfo> createState() => _MemoryInfoState();
 }
 
-class _MemoryInfoState extends State<MemoryInfo> {
-  Timer? timer;
+class _MemoryInfoState extends State<MemoryInfo> with WidgetsBindingObserver {
+  Timer? _timer;
+  bool _isForeground = false;
+  bool _isUpdating = false;
+  int _updateGeneration = 0;
 
   @override
   void initState() {
     super.initState();
-    _updateMemory();
+    WidgetsBinding.instance.addObserver(this);
+    _isForeground =
+        WidgetsBinding.instance.lifecycleState == AppLifecycleState.resumed;
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      if (mounted && _isForeground) {
+        _startUpdating();
+      }
+    });
   }
 
   @override
   void dispose() {
-    timer?.cancel();
+    WidgetsBinding.instance.removeObserver(this);
+    _isForeground = false;
+    _stopUpdating();
     super.dispose();
   }
 
-  Future<void> _updateMemory() async {
-    WidgetsBinding.instance.addPostFrameCallback((_) async {
-      final rss = ProcessInfo.currentRss;
-      if (coreController.isCompleted) {
-        _memoryStateNotifier.value = await coreController.getMemory() + rss;
-      } else {
-        _memoryStateNotifier.value = rss;
+  @override
+  void didChangeAppLifecycleState(AppLifecycleState state) {
+    super.didChangeAppLifecycleState(state);
+    final isForeground = state == AppLifecycleState.resumed;
+    if (_isForeground == isForeground) {
+      return;
+    }
+    _isForeground = isForeground;
+    if (isForeground) {
+      _startUpdating();
+    } else {
+      _stopUpdating();
+    }
+  }
+
+  void _startUpdating() {
+    if (!mounted || !_isForeground || _isUpdating) {
+      return;
+    }
+    _isUpdating = true;
+    final generation = ++_updateGeneration;
+    unawaited(_updateMemory(generation));
+  }
+
+  void _stopUpdating() {
+    _isUpdating = false;
+    _updateGeneration++;
+    _timer?.cancel();
+    _timer = null;
+  }
+
+  Future<void> _updateMemory(int generation) async {
+    final memoryReader = widget.memoryReader;
+    final memory = memoryReader != null
+        ? await memoryReader()
+        : await _readMemory();
+    if (!mounted ||
+        !_isForeground ||
+        !_isUpdating ||
+        generation != _updateGeneration) {
+      return;
+    }
+    _memoryStateNotifier.value = memory;
+    _timer = Timer(const Duration(seconds: 2), () {
+      _timer = null;
+      if (mounted &&
+          _isForeground &&
+          _isUpdating &&
+          generation == _updateGeneration) {
+        unawaited(_updateMemory(generation));
       }
-      timer = Timer(const Duration(seconds: 2), () async {
-        _updateMemory();
-      });
     });
   }
 
@@ -99,3 +155,13 @@ class _MemoryInfoState extends State<MemoryInfo> {
     );
   }
 }
+
+Future<num> _readMemory() async {
+  final rss = ProcessInfo.currentRss;
+  final coreConnected =
+      globalState.container.read(coreStatusProvider) == CoreStatus.connected;
+  if (system.isDesktop && coreConnected) {
+    return await coreController.getMemory() + rss;
+  }
+  return rss;
+}
diff --git a/lib/views/dashboard/widgets/outbound_mode.dart b/lib/views/dashboard/widgets/outbound_mode.dart
index c708fbc88f..6a68b248fc 100644
--- a/lib/views/dashboard/widgets/outbound_mode.dart
+++ b/lib/views/dashboard/widgets/outbound_mode.dart
@@ -70,12 +70,10 @@ class OutboundMode extends StatelessWidget {
                                 left: 12.ap,
                                 right: 16.ap,
                               ),
-                              delegate: RadioDelegate(
-                                onTab: () {
-                                  _handleChangeMode(item);
-                                },
-                                value: item,
-                              ),
+                              onTap: () {
+                                _handleChangeMode(item);
+                              },
+                              value: item,
                               title: Text(
                                 Intl.message(item.name),
                                 style: Theme.of(
diff --git a/lib/views/dashboard/widgets/start_button.dart b/lib/views/dashboard/widgets/start_button.dart
index d6885dbb9c..8df9e3071a 100644
--- a/lib/views/dashboard/widgets/start_button.dart
+++ b/lib/views/dashboard/widgets/start_button.dart
@@ -1,10 +1,67 @@
 import 'package:fl_clash/common/common.dart';
-import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/providers/providers.dart';
 import 'package:fl_clash/state.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
+const _threeDigitHourThreshold = 100 * 60 * 60 * 1000;
+const _widthAnimationDuration = Duration(milliseconds: 200);
+const _buttonHeight = 56.0;
+
+TextStyle? _runTimeTextStyle(BuildContext context) {
+  return context.textTheme.titleMedium?.toSoftBold.copyWith(
+    color: context.colorScheme.onPrimaryContainer,
+  );
+}
+
+TextStyle? _hundredsTextStyle(BuildContext context) {
+  return context.textTheme.titleMedium?.toSoftBold.copyWith(
+    color: context.colorScheme.primary,
+    fontWeight: FontWeight.w600,
+  );
+}
+
+double _computeRunTimeTextWidth(
+  BuildContext context, {
+  required bool hasThreeDigitHours,
+}) {
+  final regularWidth = globalState.measure
+      .computeTextSize(Text('99:99:99', style: _runTimeTextStyle(context)))
+      .width;
+  if (!hasThreeDigitHours) {
+    return regularWidth + 16;
+  }
+  final hundredsWidth = globalState.measure
+      .computeTextSize(Text('9', style: _hundredsTextStyle(context)))
+      .width;
+  return hundredsWidth + regularWidth + 16;
+}
+
+class RunTimeText extends StatelessWidget {
+  final int? timeStamp;
+
+  const RunTimeText({super.key, required this.timeStamp});
+
+  @override
+  Widget build(BuildContext context) {
+    final text = utils.getTimeText(timeStamp);
+    final style = _runTimeTextStyle(context);
+    final textWidget = text.length < 9
+        ? Text(text, maxLines: 1, overflow: TextOverflow.visible, style: style)
+        : Text.rich(
+            TextSpan(
+              text: text.substring(0, 1),
+              style: _hundredsTextStyle(context),
+              children: [TextSpan(text: text.substring(1), style: style)],
+            ),
+            maxLines: 1,
+            overflow: TextOverflow.visible,
+            style: style,
+          );
+    return textWidget;
+  }
+}
+
 class StartButton extends ConsumerStatefulWidget {
   const StartButton({super.key});
 
@@ -16,12 +73,16 @@ class _StartButtonState extends ConsumerState<StartButton>
     with SingleTickerProviderStateMixin {
   AnimationController? _controller;
   late Animation<double> _animation;
-  bool isStart = false;
+  double? _twoDigitTextWidth;
+  double? _threeDigitTextWidth;
+  double? _suspendedTextWidth;
+  int? _displayRunTime;
 
   @override
   void initState() {
     super.initState();
-    isStart = ref.read(isStartProvider);
+    final isStart = ref.read(isStartProvider);
+    _displayRunTime = ref.read(runTimeProvider);
     _controller = AnimationController(
       vsync: this,
       value: isStart ? 1 : 0,
@@ -31,14 +92,22 @@ class _StartButtonState extends ConsumerState<StartButton>
       parent: _controller!,
       curve: Curves.easeOutBack,
     );
+    ref.listenManual(runTimeProvider, (_, next) {
+      _updateDisplayRunTime(next);
+    });
     ref.listenManual(isStartProvider, (prev, next) {
-      if (next != isStart) {
-        isStart = next;
-        updateController();
-      }
+      updateController(next);
     }, fireImmediately: true);
   }
 
+  @override
+  void didChangeDependencies() {
+    super.didChangeDependencies();
+    _twoDigitTextWidth = null;
+    _threeDigitTextWidth = null;
+    _suspendedTextWidth = null;
+  }
+
   @override
   void dispose() {
     _controller?.dispose();
@@ -47,25 +116,67 @@ class _StartButtonState extends ConsumerState<StartButton>
   }
 
   void handleSwitchStart() {
-    isStart = !isStart;
-    updateController();
-    debouncer.call(FunctionTag.updateStatus, () {
-      globalState.container
-          .read(setupActionProvider.notifier)
-          .updateStatus(isStart, isInit: !ref.read(initProvider));
-    }, duration: commonDuration);
+    ref.read(commonActionProvider.notifier).toggleRunning();
+  }
+
+  void _updateDisplayRunTime(int? runTime) {
+    if (!mounted ||
+        _displayRunTime == runTime ||
+        (runTime == null && !(_controller?.isDismissed ?? true))) {
+      return;
+    }
+    setState(() {
+      _displayRunTime = runTime;
+    });
   }
 
-  void updateController() {
+  void updateController(bool isStart) {
     WidgetsBinding.instance.addPostFrameCallback((_) {
-      if (isStart && mounted) {
-        _controller?.forward();
-      } else {
-        _controller?.reverse();
+      if (!mounted) {
+        return;
       }
+      final controller = _controller;
+      if (controller == null) {
+        return;
+      }
+      if (isStart) {
+        controller.forward();
+        return;
+      }
+      controller.reverse().whenCompleteOrCancel(() {
+        if (mounted && controller.isDismissed) {
+          _updateDisplayRunTime(ref.read(runTimeProvider));
+        }
+      });
     });
   }
 
+  double _getRunTimeTextWidth(
+    BuildContext context, {
+    required bool hasThreeDigitHours,
+  }) {
+    if (hasThreeDigitHours) {
+      return _threeDigitTextWidth ??= _computeRunTimeTextWidth(
+        context,
+        hasThreeDigitHours: true,
+      );
+    }
+    return _twoDigitTextWidth ??= _computeRunTimeTextWidth(
+      context,
+      hasThreeDigitHours: false,
+    );
+  }
+
+  double _getSuspendedTextWidth(BuildContext context, String suspendedText) {
+    return _suspendedTextWidth ??=
+        globalState.measure
+            .computeTextSize(
+              Text(suspendedText, style: context.textTheme.titleMedium),
+            )
+            .width +
+        24;
+  }
+
   @override
   Widget build(BuildContext context) {
     final hasProfile = ref.watch(
@@ -75,88 +186,76 @@ class _StartButtonState extends ConsumerState<StartButton>
       return Container();
     }
     final suspend = ref.watch(suspendProvider);
+    final hasThreeDigitHours =
+        (_displayRunTime ?? 0) >= _threeDigitHourThreshold;
     final theme = Theme.of(context);
     final appLocalizations = context.appLocalizations;
+    final textWidth = suspend
+        ? _getSuspendedTextWidth(context, appLocalizations.suspended)
+        : _getRunTimeTextWidth(context, hasThreeDigitHours: hasThreeDigitHours);
     return RepaintBoundary(
       child: Theme(
         data: theme.copyWith(
           floatingActionButtonTheme: theme.floatingActionButtonTheme.copyWith(
-            sizeConstraints: const BoxConstraints(minWidth: 56, maxWidth: 200),
+            sizeConstraints: const BoxConstraints(
+              minWidth: 56,
+              maxWidth: 220,
+              minHeight: _buttonHeight,
+              maxHeight: _buttonHeight,
+            ),
           ),
         ),
-        child: AnimatedBuilder(
-          animation: _controller!.view,
-          builder: (_, child) {
-            final textWidth = suspend
-                ? globalState.measure
-                          .computeTextSize(
-                            Text(
-                              appLocalizations.suspended,
-                              style: context.textTheme.titleMedium,
-                            ),
-                          )
-                          .width +
-                      24
-                : globalState.measure
-                          .computeTextSize(
-                            Text(
-                              utils.getTimeDifference(DateTime.now()),
-                              style: context.textTheme.titleMedium?.toSoftBold,
-                            ),
-                          )
-                          .width +
-                      16;
-            return FloatingActionButton(
-              clipBehavior: Clip.antiAlias,
-              materialTapTargetSize: MaterialTapTargetSize.padded,
-              heroTag: null,
-              onPressed: () {
-                handleSwitchStart();
-              },
-              child: Row(
-                mainAxisSize: MainAxisSize.min,
-                children: [
-                  Container(
-                    height: 56,
+        child: FloatingActionButton(
+          clipBehavior: Clip.antiAlias,
+          materialTapTargetSize: MaterialTapTargetSize.padded,
+          heroTag: null,
+          onPressed: () {
+            handleSwitchStart();
+          },
+          child: Row(
+            mainAxisSize: MainAxisSize.min,
+            children: [
+              AnimatedBuilder(
+                animation: _animation,
+                builder: (_, child) {
+                  return Container(
+                    height: _buttonHeight,
                     padding: EdgeInsets.only(
                       left: 16,
                       right: 16 - 8 * _animation.value,
                     ),
                     alignment: Alignment.centerLeft,
-                    child: AnimatedIcon(
-                      icon: AnimatedIcons.play_pause,
-                      progress: _animation,
-                    ),
-                  ),
-                  SizedBox(width: textWidth * _animation.value, child: child!),
-                ],
+                    child: child,
+                  );
+                },
+                child: AnimatedIcon(
+                  icon: AnimatedIcons.play_pause,
+                  progress: _animation,
+                ),
               ),
-            );
-          },
-          child: suspend
-              ? Text(
-                  appLocalizations.suspended,
-                  maxLines: 1,
-                  overflow: TextOverflow.visible,
-                  style: Theme.of(context).textTheme.titleMedium?.copyWith(
-                    color: context.colorScheme.onPrimaryContainer,
-                  ),
-                )
-              : Consumer(
-                  builder: (_, ref, _) {
-                    final runTime = ref.watch(runTimeProvider);
-                    final text = utils.getTimeText(runTime);
-                    return Text(
-                      text,
-                      maxLines: 1,
-                      overflow: TextOverflow.visible,
-                      style: Theme.of(context).textTheme.titleMedium?.toSoftBold
-                          .copyWith(
-                            color: context.colorScheme.onPrimaryContainer,
-                          ),
-                    );
-                  },
+              SizeTransition(
+                axis: Axis.horizontal,
+                alignment: Alignment.centerLeft,
+                sizeFactor: _animation,
+                child: AnimatedContainer(
+                  width: textWidth,
+                  duration: _widthAnimationDuration,
+                  curve: Curves.easeOut,
+                  child: suspend
+                      ? Text(
+                          appLocalizations.suspended,
+                          maxLines: 1,
+                          overflow: TextOverflow.visible,
+                          style: Theme.of(context).textTheme.titleMedium
+                              ?.copyWith(
+                                color: context.colorScheme.onPrimaryContainer,
+                              ),
+                        )
+                      : RunTimeText(timeStamp: _displayRunTime),
                 ),
+              ),
+            ],
+          ),
         ),
       ),
     );
diff --git a/lib/views/developer.dart b/lib/views/developer.dart
index a8b43a92db..236b207f91 100644
--- a/lib/views/developer.dart
+++ b/lib/views/developer.dart
@@ -40,7 +40,7 @@ class DeveloperView extends ConsumerWidget {
             }
           },
         ),
-        if (globalState.isPre)
+        if (globalState.canCrashCore)
           ListItem(
             title: Text(appLocalizations.crashTest),
             minVerticalPadding: 12,
@@ -106,19 +106,15 @@ class DeveloperView extends ConsumerWidget {
             CommonCard(
               type: CommonCardType.filled,
               radius: 18,
-              child: ListItem.switchItem(
+              child: ListItem.toggle(
                 padding: const EdgeInsets.only(left: 16, right: 16),
                 title: Text(appLocalizations.developerMode),
-                delegate: SwitchDelegate(
-                  value: enable,
-                  onChanged: (value) {
-                    ref
-                        .read(appSettingProvider.notifier)
-                        .update(
-                          (state) => state.copyWith(developerMode: value),
-                        );
-                  },
-                ),
+                value: enable,
+                onChanged: (value) {
+                  ref
+                      .read(appSettingProvider.notifier)
+                      .update((state) => state.copyWith(developerMode: value));
+                },
               ),
             ),
             const SizedBox(height: 16),
diff --git a/lib/views/profiles/edit.dart b/lib/views/profiles/edit.dart
index af64e09bb4..4445e3a682 100644
--- a/lib/views/profiles/edit.dart
+++ b/lib/views/profiles/edit.dart
@@ -50,15 +50,11 @@ class _EditProfileViewState extends State<EditProfileView> {
 
   Future<void> _updateFileInfo() async {
     final file = await widget.profile.file;
-    if (!await file.exists()) {
-      return;
-    }
-    final lastModified = await file.lastModified();
-    final size = await file.length();
+    final fileInfo = await file.getFileInfo();
     if (!mounted) {
       return;
     }
-    _fileInfoNotifier.value = FileInfo(size: size, lastModified: lastModified);
+    _fileInfoNotifier.value = fileInfo;
   }
 
   Future<void> _handleConfirm() async {
@@ -257,12 +253,10 @@ class _EditProfileViewState extends State<EditProfileView> {
             },
           ),
         ),
-        ListItem.switchItem(
+        ListItem.toggle(
           title: Text(appLocalizations.autoUpdate),
-          delegate: SwitchDelegate<bool>(
-            value: _autoUpdate,
-            onChanged: _setAutoUpdate,
-          ),
+          value: _autoUpdate,
+          onChanged: _setAutoUpdate,
         ),
         if (_autoUpdate)
           ListItem(
diff --git a/lib/views/profiles/overwrite/custom/proxies.dart b/lib/views/profiles/overwrite/custom/proxies.dart
index 8c3dab4835..f186089b05 100644
--- a/lib/views/profiles/overwrite/custom/proxies.dart
+++ b/lib/views/profiles/overwrite/custom/proxies.dart
@@ -197,7 +197,7 @@ class _EditProxiesViewState extends ConsumerState<EditProxiesView>
                 child: CommonCard(
                   radius: 20,
                   type: CommonCardType.filled,
-                  child: ListItem.switchItem(
+                  child: ListItem.toggle(
                     minTileHeight: 54,
                     title: Row(
                       mainAxisSize: MainAxisSize.min,
@@ -224,12 +224,10 @@ class _EditProxiesViewState extends ConsumerState<EditProxiesView>
                         ),
                       ],
                     ),
-                    delegate: SwitchDelegate(
-                      value: includeAllProxies,
-                      onChanged: (_) {
-                        _handleChangeIncludeAllProxies();
-                      },
-                    ),
+                    value: includeAllProxies,
+                    onChanged: (_) {
+                      _handleChangeIncludeAllProxies();
+                    },
                   ),
                 ),
               ),
diff --git a/lib/views/profiles/overwrite/custom/proxy_providers.dart b/lib/views/profiles/overwrite/custom/proxy_providers.dart
index 412b96bdf6..d238f0f5a8 100644
--- a/lib/views/profiles/overwrite/custom/proxy_providers.dart
+++ b/lib/views/profiles/overwrite/custom/proxy_providers.dart
@@ -186,7 +186,7 @@ class _EditProxyProvidersViewState extends ConsumerState<EditProxyProvidersView>
                 child: CommonCard(
                   radius: 20,
                   type: CommonCardType.filled,
-                  child: ListItem.switchItem(
+                  child: ListItem.toggle(
                     minTileHeight: 54,
                     title: Row(
                       mainAxisSize: MainAxisSize.min,
@@ -214,12 +214,10 @@ class _EditProxyProvidersViewState extends ConsumerState<EditProxyProvidersView>
                         ),
                       ],
                     ),
-                    delegate: SwitchDelegate(
-                      value: includeAllProxyProviders,
-                      onChanged: (_) {
-                        _handleChangeIncludeAllProxyProviders();
-                      },
-                    ),
+                    value: includeAllProxyProviders,
+                    onChanged: (_) {
+                      _handleChangeIncludeAllProxyProviders();
+                    },
                   ),
                 ),
               ),
diff --git a/lib/views/profiles/profiles.dart b/lib/views/profiles/profiles.dart
index 369c417b1c..70eb6db698 100644
--- a/lib/views/profiles/profiles.dart
+++ b/lib/views/profiles/profiles.dart
@@ -298,7 +298,7 @@ class ProfileItem extends StatelessWidget {
                     ? const Padding(
                         key: ValueKey('loading'),
                         padding: EdgeInsets.all(8),
-                        child: CircularProgressIndicator(),
+                        child: CommonCircleLoading(),
                       )
                     : CommonPopupBox(
                         key: const ValueKey('menu'),
diff --git a/lib/views/proxies/card.dart b/lib/views/proxies/card.dart
index 096992a68c..168f4d8e1d 100644
--- a/lib/views/proxies/card.dart
+++ b/lib/views/proxies/card.dart
@@ -47,7 +47,7 @@ class ProxyCard extends StatelessWidget {
                     height: measure.labelSmallHeight,
                     width: measure.labelSmallHeight,
                     child: delay == 0
-                        ? const CircularProgressIndicator(strokeWidth: 2)
+                        ? const CommonCircleLoading()
                         : IconButton(
                             icon: const Icon(Icons.bolt),
                             iconSize: globalState.measure.labelSmallHeight,
diff --git a/lib/views/proxies/common.dart b/lib/views/proxies/common.dart
index 2344b83247..73abf29b93 100644
--- a/lib/views/proxies/common.dart
+++ b/lib/views/proxies/common.dart
@@ -30,12 +30,6 @@ List<Group> getGroups() {
   return globalState.container.read(groupsProvider);
 }
 
-String? getCurrentGroupName() {
-  return globalState.container.read(
-    currentProfileProvider.select((state) => state?.currentGroupName),
-  );
-}
-
 void updateCurrentGroupName(String groupName) {
   globalState.container
       .read(proxiesActionProvider.notifier)
@@ -68,19 +62,31 @@ Future<void> proxyDelayTest(Proxy proxy, [String? testUrl]) async {
   ref
       .read(proxiesActionProvider.notifier)
       .setDelay(Delay(url: currentTestUrl, name: state.proxyName, value: 0));
-  ref
-      .read(proxiesActionProvider.notifier)
-      .setDelay(await coreController.getDelay(currentTestUrl, state.proxyName));
+  try {
+    final delay = await coreController.getDelay(
+      currentTestUrl,
+      state.proxyName,
+    );
+    ref.read(proxiesActionProvider.notifier).setDelay(delay);
+  } catch (error) {
+    commonPrint.log(
+      'Delay test failed for ${state.proxyName}: $error',
+      logLevel: LogLevel.error,
+    );
+    ref
+        .read(proxiesActionProvider.notifier)
+        .setDelay(Delay(url: currentTestUrl, name: state.proxyName, value: -1));
+  }
 }
 
 Future<void> delayTest(List<Proxy> proxies, [String? testUrl]) async {
-  final delayProxies = proxies.map<Future>((proxy) async {
-    await proxyDelayTest(proxy, testUrl);
-  }).toList();
-
-  final batchesDelayProxies = delayProxies.batch(100);
-  for (final batchDelayProxies in batchesDelayProxies) {
-    await Future.wait(batchDelayProxies);
+  final batches = proxies.batch(100);
+  for (final batch in batches) {
+    await Future.wait(
+      batch.map((proxy) async {
+        await proxyDelayTest(proxy, testUrl);
+      }),
+    );
   }
   globalState.container.read(sortNumProvider.notifier).add();
 }
diff --git a/lib/views/proxies/providers.dart b/lib/views/proxies/providers.dart
index aeb1897da1..ccada68183 100644
--- a/lib/views/proxies/providers.dart
+++ b/lib/views/proxies/providers.dart
@@ -133,6 +133,7 @@ class ProviderItem extends StatelessWidget {
             runSpacing: 6,
             spacing: 12,
             runAlignment: WrapAlignment.center,
+            crossAxisAlignment: WrapCrossAlignment.center,
             children: [
               CommonChip(
                 avatar: const Icon(Icons.upload),
@@ -151,7 +152,7 @@ class ProviderItem extends StatelessWidget {
                             width: 30,
                             child: Padding(
                               padding: EdgeInsets.all(2),
-                              child: CircularProgressIndicator(),
+                              child: CommonCircleLoading(),
                             ),
                           )
                         : CommonChip(
diff --git a/lib/views/proxies/tab.dart b/lib/views/proxies/tab.dart
index d1eae78b32..fce13ed4a0 100644
--- a/lib/views/proxies/tab.dart
+++ b/lib/views/proxies/tab.dart
@@ -2,7 +2,6 @@ import 'dart:math';
 
 import 'package:fl_clash/common/common.dart';
 import 'package:fl_clash/enum/enum.dart';
-import 'package:fl_clash/models/clash_config.dart';
 import 'package:fl_clash/models/common.dart';
 import 'package:fl_clash/providers/providers.dart';
 import 'package:fl_clash/state.dart';
@@ -55,14 +54,31 @@ class ProxiesTabViewState extends ConsumerState<ProxiesTabView>
   }
 
   void scrollToGroupSelected() {
-    final currentGroupName = getCurrentGroupName();
-    _keyMap[currentGroupName]?.currentState?.scrollToSelected();
+    final group = currentGroup;
+    if (group == null) {
+      return;
+    }
+    _keyMap[group.name]?.currentState?.scrollToSelected();
   }
 
   Future<void> delayTestCurrentGroup() async {
-    final currentGroupName = getCurrentGroupName();
-    final currentState = _keyMap[currentGroupName]?.currentState;
-    await delayTest(currentState?.currentProxies ?? [], currentState?.testUrl);
+    final group = currentGroup;
+    if (group == null) {
+      return;
+    }
+    await delayTest(group.all, group.testUrl);
+  }
+
+  Group? get currentGroup {
+    return _getGroup(_tabController?.index);
+  }
+
+  Group? _getGroup(int? index) {
+    final groups = ref.read(proxiesTabStateProvider).groups;
+    if (index == null || index < 0 || index >= groups.length) {
+      return null;
+    }
+    return groups[index];
   }
 
   Widget _buildMoreButton() {
@@ -126,21 +142,15 @@ class ProxiesTabViewState extends ConsumerState<ProxiesTabView>
   }
 
   void _tabControllerListener([int? index]) {
+    final group = _getGroup(index ?? _tabController?.index);
+    if (group == null) {
+      return;
+    }
     WidgetsBinding.instance.addPostFrameCallback((_) {
-      int? groupIndex = index;
-      if (groupIndex == -1) {
-        return;
-      }
-      if (groupIndex == null) {
-        final currentIndex = _tabController?.index;
-        groupIndex = currentIndex;
-      }
-      final currentGroups = getCurrentGroups();
-      if (groupIndex == null || groupIndex > currentGroups.length) {
+      if (!mounted) {
         return;
       }
-      final currentGroup = currentGroups[groupIndex];
-      updateCurrentGroupName(currentGroup.name);
+      updateCurrentGroupName(group.name);
     });
   }
 
@@ -281,9 +291,6 @@ class ProxyGroupView extends ConsumerStatefulWidget {
 class _ProxyGroupViewState extends ConsumerState<ProxyGroupView> {
   late final ScrollController _controller;
 
-  List<Proxy> currentProxies = [];
-  String? testUrl;
-
   @override
   void initState() {
     super.initState();
@@ -315,7 +322,7 @@ class _ProxyGroupViewState extends ConsumerState<ProxyGroupView> {
         16 +
             getScrollToSelectedOffset(
               groupName: widget.group.name,
-              proxies: currentProxies,
+              proxies: widget.group.all,
             ),
         _controller.position.maxScrollExtent,
       ),
@@ -328,8 +335,6 @@ class _ProxyGroupViewState extends ConsumerState<ProxyGroupView> {
   Widget build(BuildContext context) {
     final group = widget.group;
     final proxies = group.all;
-    testUrl = group.testUrl;
-    currentProxies = proxies;
     return CommonScrollBar(
       controller: _controller,
       child: GridView.builder(
@@ -347,9 +352,9 @@ class _ProxyGroupViewState extends ConsumerState<ProxyGroupView> {
           crossAxisSpacing: 8,
           mainAxisExtent: getItemHeight(widget.cardType),
         ),
-        itemCount: currentProxies.length,
+        itemCount: proxies.length,
         itemBuilder: (_, index) {
-          final proxy = currentProxies[index];
+          final proxy = proxies[index];
           return ProxyCard(
             testUrl: group.testUrl,
             groupType: group.type,
@@ -382,9 +387,12 @@ class _DelayTestButtonState extends State<DelayTestButton>
       return;
     }
     _controller.forward();
-    await widget.onClick();
-    if (mounted) {
-      _controller.reverse();
+    try {
+      await widget.onClick();
+    } finally {
+      if (mounted) {
+        _controller.reverse();
+      }
     }
   }
 
diff --git a/lib/views/resources.dart b/lib/views/resources.dart
index 45ac6a13b4..66ddb582fb 100644
--- a/lib/views/resources.dart
+++ b/lib/views/resources.dart
@@ -32,18 +32,16 @@ class ResourcesView extends StatelessWidget {
             ...generateSection(
               title: appLocalizations.geoOptions,
               items: [
-                ListItem.switchItem(
+                ListItem.toggle(
                   title: Text(appLocalizations.geoAutoUpdate),
-                  delegate: SwitchDelegate(
-                    value: vm2.a,
-                    onChanged: (value) {
-                      ref
-                          .read(patchClashConfigProvider.notifier)
-                          .update(
-                            (state) => state.copyWith(geoAutoUpdate: value),
-                          );
-                    },
-                  ),
+                  value: vm2.a,
+                  onChanged: (value) {
+                    ref
+                        .read(patchClashConfigProvider.notifier)
+                        .update(
+                          (state) => state.copyWith(geoAutoUpdate: value),
+                        );
+                  },
                 ),
                 ListItem.input(
                   title: Text(appLocalizations.geoAutoUpdateInterval),
@@ -51,41 +49,39 @@ class ResourcesView extends StatelessWidget {
                     appLocalizations.hoursCount(vm2.b),
                     style: context.textTheme.bodyMedium?.toSoftBold,
                   ),
-                  delegate: InputDelegate(
-                    suffixText: appLocalizations.hours,
-                    title: appLocalizations.geoAutoUpdateInterval,
-                    keyboardType: TextInputType.number,
-                    validator: (value) {
-                      if (value == null || value.isEmpty) {
-                        return appLocalizations.emptyTip(
-                          appLocalizations.geoAutoUpdateInterval,
-                        );
-                      }
-                      final interval = int.tryParse(value);
-                      if (interval == null) {
-                        return appLocalizations.numberTip(
-                          appLocalizations.geoAutoUpdateInterval,
+                  suffixText: appLocalizations.hours,
+                  dialogTitle: appLocalizations.geoAutoUpdateInterval,
+                  keyboardType: TextInputType.number,
+                  validator: (value) {
+                    if (value == null || value.isEmpty) {
+                      return appLocalizations.emptyTip(
+                        appLocalizations.geoAutoUpdateInterval,
+                      );
+                    }
+                    final interval = int.tryParse(value);
+                    if (interval == null) {
+                      return appLocalizations.numberTip(
+                        appLocalizations.geoAutoUpdateInterval,
+                      );
+                    }
+                    if (interval <= 0) {
+                      return appLocalizations.geoAutoUpdateIntervalTip;
+                    }
+                    return null;
+                  },
+                  value: vm2.b.toString(),
+                  onChanged: (value) {
+                    final intValue = int.tryParse(value ?? '') ?? 0;
+                    if (intValue <= 0) {
+                      return;
+                    }
+                    ref
+                        .read(patchClashConfigProvider.notifier)
+                        .update(
+                          (state) =>
+                              state.copyWith(geoUpdateInterval: intValue),
                         );
-                      }
-                      if (interval <= 0) {
-                        return appLocalizations.geoAutoUpdateIntervalTip;
-                      }
-                      return null;
-                    },
-                    value: vm2.b.toString(),
-                    onChanged: (value) {
-                      final intValue = int.tryParse(value ?? '') ?? 0;
-                      if (intValue <= 0) {
-                        return;
-                      }
-                      ref
-                          .read(patchClashConfigProvider.notifier)
-                          .update(
-                            (state) =>
-                                state.copyWith(geoUpdateInterval: intValue),
-                          );
-                    },
-                  ),
+                  },
                 ),
               ],
             ),
@@ -145,12 +141,10 @@ class _GeoResourceListItemState extends ConsumerState<_GeoResourceListItem> {
     }
   }
 
-  Future<FileInfo> _getGeoFileLastModified(String fileName) async {
+  Future<FileInfo?> _getGeoFileInfo(String fileName) async {
     final homePath = await appPath.homeDirPath;
     final file = File(join(homePath, fileName));
-    final lastModified = await file.lastModified();
-    final size = await file.length();
-    return FileInfo(size: size, lastModified: lastModified);
+    return file.getFileInfo();
   }
 
   Future<void> _handleUpdateGeoDataItem() async {
@@ -177,8 +171,8 @@ class _GeoResourceListItemState extends ConsumerState<_GeoResourceListItem> {
               crossAxisAlignment: CrossAxisAlignment.start,
               children: [
                 const SizedBox(height: 6),
-                FutureBuilder<FileInfo>(
-                  future: _getGeoFileLastModified(fileName),
+                FutureBuilder<FileInfo?>(
+                  future: _getGeoFileInfo(fileName),
                   builder: (_, snapshot) {
                     final height = globalState.measure.bodyMediumHeight;
                     return SizedBox(
@@ -199,6 +193,7 @@ class _GeoResourceListItemState extends ConsumerState<_GeoResourceListItem> {
                   runSpacing: 6,
                   spacing: 12,
                   runAlignment: WrapAlignment.center,
+                  crossAxisAlignment: WrapCrossAlignment.center,
                   children: [
                     CommonChip(
                       avatar: const Icon(Icons.edit),
@@ -209,6 +204,7 @@ class _GeoResourceListItemState extends ConsumerState<_GeoResourceListItem> {
                     ),
                     Row(
                       mainAxisSize: MainAxisSize.min,
+                      crossAxisAlignment: CrossAxisAlignment.center,
                       children: [
                         SizedBox(
                           child: isUpdating
@@ -217,7 +213,7 @@ class _GeoResourceListItemState extends ConsumerState<_GeoResourceListItem> {
                                   width: 30,
                                   child: Padding(
                                     padding: EdgeInsets.all(2),
-                                    child: CircularProgressIndicator(),
+                                    child: CommonCircleLoading(),
                                   ),
                                 )
                               : CommonChip(
diff --git a/lib/views/tailscale.dart b/lib/views/tailscale.dart
new file mode 100644
index 0000000000..1ce24d902c
--- /dev/null
+++ b/lib/views/tailscale.dart
@@ -0,0 +1,820 @@
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:fl_clash/providers/providers.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/views/proxies/common.dart';
+import 'package:fl_clash/widgets/widgets.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+class TailscaleView extends ConsumerWidget {
+  const TailscaleView({super.key});
+
+  Future<void> _applyTailscaleConfig(WidgetRef ref) async {
+    // Await apply so ping / status do not race the debounced profile merge.
+    await ref.read(setupActionProvider.notifier).applyProfile(silence: true);
+  }
+
+  Future<void> _handleAddOrEdit(
+    BuildContext context,
+    WidgetRef ref, [
+    TailscaleProxy? proxy,
+  ]) async {
+    final existingNames = ref
+        .read(tailscaleSettingProvider)
+        .proxies
+        .map((item) => item.name)
+        .toList();
+    final res = await globalState.showCommonDialog<TailscaleProxy>(
+      child: TailscaleNodeDialog(proxy: proxy, existingNames: existingNames),
+    );
+    if (res == null) {
+      return;
+    }
+    ref
+        .read(tailscaleSettingProvider.notifier)
+        .addOrUpdate(res, previousName: proxy?.name);
+    await _applyTailscaleConfig(ref);
+  }
+
+  Future<void> _handleDelete(
+    BuildContext context,
+    WidgetRef ref,
+    TailscaleProxy proxy,
+  ) async {
+    final appLocalizations = context.appLocalizations;
+    final res = await globalState.showMessage(
+      title: appLocalizations.tip,
+      message: TextSpan(
+        text: appLocalizations.deleteTip(appLocalizations.tailscale),
+      ),
+    );
+    if (res != true) {
+      return;
+    }
+    ref.read(tailscaleSettingProvider.notifier).remove(proxy.name);
+    await _applyTailscaleConfig(ref);
+  }
+
+  Future<void> _handleTest(
+    BuildContext context,
+    WidgetRef ref,
+    TailscaleProxy proxy,
+  ) async {
+    final appLocalizations = context.appLocalizations;
+    if (!ref.read(tailscaleSettingProvider).enable) {
+      context.showNotifier(appLocalizations.tailscaleTestNeedEnable);
+      return;
+    }
+    if (!ref.read(isStartProvider)) {
+      context.showNotifier(appLocalizations.tailscaleTestNeedStart);
+      return;
+    }
+    await _applyTailscaleConfig(ref);
+    await proxyDelayTest(Proxy(name: proxy.name, type: tailscaleProxyType));
+  }
+
+  Widget _buildScenarioCard(BuildContext context) {
+    final appLocalizations = context.appLocalizations;
+    final isAndroid = system.isAndroid;
+    return Padding(
+      padding: const EdgeInsets.fromLTRB(16, 12, 16, 4),
+      child: Container(
+        padding: const EdgeInsets.all(16),
+        decoration: BoxDecoration(
+          color: context.colorScheme.primaryContainer.opacity38,
+          borderRadius: BorderRadius.circular(12),
+        ),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Row(
+              children: [
+                Icon(
+                  isAndroid ? Icons.phone_android : Icons.computer,
+                  size: 20,
+                  color: context.colorScheme.primary,
+                ),
+                const SizedBox(width: 8),
+                Expanded(
+                  child: Text(
+                    isAndroid
+                        ? appLocalizations.tailscaleScenarioAndroidTitle
+                        : appLocalizations.tailscaleScenarioDesktopTitle,
+                    style: context.textTheme.titleSmall?.copyWith(
+                      fontWeight: FontWeight.bold,
+                    ),
+                  ),
+                ),
+              ],
+            ),
+            const SizedBox(height: 8),
+            Text(
+              isAndroid
+                  ? appLocalizations.tailscaleScenarioAndroidBody
+                  : appLocalizations.tailscaleScenarioDesktopBody,
+              style: context.textTheme.bodySmall?.copyWith(
+                color: context.colorScheme.onSurfaceVariant,
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildGuideStep(BuildContext context, int number, String text) {
+    return Padding(
+      padding: const EdgeInsets.only(bottom: 10),
+      child: Row(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Container(
+            width: 22,
+            height: 22,
+            alignment: Alignment.center,
+            decoration: BoxDecoration(
+              color: context.colorScheme.primary,
+              shape: BoxShape.circle,
+            ),
+            child: Text(
+              '$number',
+              style: context.textTheme.labelSmall?.copyWith(
+                color: context.colorScheme.onPrimary,
+                fontWeight: FontWeight.bold,
+              ),
+            ),
+          ),
+          const SizedBox(width: 12),
+          Expanded(
+            child: Padding(
+              padding: const EdgeInsets.only(top: 2),
+              child: Text(text, style: context.textTheme.bodyMedium),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+
+  Widget _buildGuide(BuildContext context) {
+    final appLocalizations = context.appLocalizations;
+    final isAndroid = system.isAndroid;
+    return Padding(
+      padding: const EdgeInsets.fromLTRB(16, 12, 16, 8),
+      child: Container(
+        padding: const EdgeInsets.all(16),
+        decoration: BoxDecoration(
+          color: context.colorScheme.surfaceContainerHighest.opacity38,
+          borderRadius: BorderRadius.circular(12),
+        ),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Row(
+              children: [
+                Icon(
+                  Icons.checklist_outlined,
+                  size: 20,
+                  color: context.colorScheme.primary,
+                ),
+                const SizedBox(width: 8),
+                Text(
+                  appLocalizations.tailscaleGuideTitle,
+                  style: context.textTheme.titleSmall?.copyWith(
+                    fontWeight: FontWeight.bold,
+                  ),
+                ),
+              ],
+            ),
+            const SizedBox(height: 12),
+            if (isAndroid) ...[
+              _buildGuideStep(
+                context,
+                1,
+                appLocalizations.tailscaleAndroidStep1,
+              ),
+              _buildGuideStep(
+                context,
+                2,
+                appLocalizations.tailscaleAndroidStep2,
+              ),
+              _buildGuideStep(
+                context,
+                3,
+                appLocalizations.tailscaleAndroidStep3,
+              ),
+              _buildGuideStep(
+                context,
+                4,
+                appLocalizations.tailscaleAndroidStep4,
+              ),
+            ] else ...[
+              _buildGuideStep(
+                context,
+                1,
+                appLocalizations.tailscaleDesktopStep1,
+              ),
+              _buildGuideStep(
+                context,
+                2,
+                appLocalizations.tailscaleDesktopStep2,
+              ),
+              _buildGuideStep(
+                context,
+                3,
+                appLocalizations.tailscaleDesktopStep3,
+              ),
+              _buildGuideStep(
+                context,
+                4,
+                appLocalizations.tailscaleDesktopStep4,
+              ),
+            ],
+            const SizedBox(height: 4),
+            Text(
+              appLocalizations.tailscaleTestTip,
+              style: context.textTheme.bodySmall?.copyWith(
+                color: context.colorScheme.onSurfaceVariant,
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildStatusBanner(
+    BuildContext context,
+    WidgetRef ref, {
+    required bool enable,
+    required int nodeCount,
+    required int routeCount,
+  }) {
+    final appLocalizations = context.appLocalizations;
+    final isStart = ref.watch(isStartProvider);
+    final String message;
+    final Color? color;
+    final IconData icon;
+    if (!enable) {
+      message = appLocalizations.tailscaleStatusDisabled;
+      color = context.colorScheme.onSurfaceVariant;
+      icon = Icons.pause_circle_outline;
+    } else if (nodeCount == 0) {
+      message = appLocalizations.tailscaleStatusNoNodes;
+      color = context.colorScheme.tertiary;
+      icon = Icons.info_outline;
+    } else if (routeCount == 0) {
+      message = appLocalizations.tailscaleStatusNeedRoutes;
+      color = context.colorScheme.tertiary;
+      icon = Icons.alt_route_outlined;
+    } else if (!isStart) {
+      message = appLocalizations.tailscaleStatusNeedStart;
+      color = context.colorScheme.tertiary;
+      icon = Icons.play_circle_outline;
+    } else {
+      message = appLocalizations.tailscaleStatusReady(nodeCount);
+      color = context.colorScheme.primary;
+      icon = Icons.check_circle_outline;
+    }
+    return Padding(
+      padding: const EdgeInsets.fromLTRB(16, 8, 16, 0),
+      child: Row(
+        children: [
+          Icon(icon, size: 18, color: color),
+          const SizedBox(width: 8),
+          Expanded(
+            child: Text(
+              message,
+              style: context.textTheme.bodySmall?.copyWith(color: color),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+
+  Widget _buildNodeDelay(BuildContext context, WidgetRef ref, String name) {
+    final appLocalizations = context.appLocalizations;
+    final delay = ref.watch(delayProvider(proxyName: name));
+    if (delay == null) {
+      return Text(
+        appLocalizations.tailscaleNotTested,
+        style: context.textTheme.labelSmall?.copyWith(
+          color: context.colorScheme.onSurfaceVariant,
+        ),
+      );
+    }
+    if (delay == 0) {
+      return SizedBox(
+        width: 14,
+        height: 14,
+        child: CircularProgressIndicator(
+          strokeWidth: 2,
+          color: context.colorScheme.primary,
+        ),
+      );
+    }
+    return Text(
+      delay > 0 ? '$delay ms' : appLocalizations.timeout,
+      style: context.textTheme.labelSmall?.copyWith(
+        color: utils.getDelayColor(delay),
+        fontWeight: FontWeight.w600,
+      ),
+    );
+  }
+
+  String _buildSubtitle(BuildContext context, TailscaleProxy proxy) {
+    final appLocalizations = context.appLocalizations;
+    final parts = <String>[];
+    if (proxy.routes.isNotEmpty) {
+      parts.add(
+        appLocalizations.tailscaleRoutesCount(proxy.routes.length),
+      );
+    } else {
+      parts.add(appLocalizations.tailscaleNoRoutes);
+    }
+    if (proxy.exitNode.trim().isNotEmpty) {
+      parts.add('${appLocalizations.tailscaleExitNode}: ${proxy.exitNode}');
+    }
+    return parts.join(' · ');
+  }
+
+  Widget _buildNodeTile(
+    BuildContext context,
+    WidgetRef ref, {
+    required TailscaleProxy proxy,
+  }) {
+    final appLocalizations = context.appLocalizations;
+    return ListItem(
+      leading: const Icon(Icons.device_hub),
+      title: Text(
+        proxy.name,
+        maxLines: 1,
+        overflow: TextOverflow.ellipsis,
+      ),
+      subtitle: Text(
+        _buildSubtitle(context, proxy),
+        maxLines: 2,
+        overflow: TextOverflow.ellipsis,
+      ),
+      trailing: Row(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          _buildNodeDelay(context, ref, proxy.name),
+          const SizedBox(width: 4),
+          IconButton(
+            tooltip: appLocalizations.tailscaleTestNode,
+            onPressed: () {
+              _handleTest(context, ref, proxy);
+            },
+            icon: const Icon(Icons.network_ping),
+          ),
+          IconButton(
+            tooltip: appLocalizations.delete,
+            onPressed: () {
+              _handleDelete(context, ref, proxy);
+            },
+            icon: const Icon(Icons.delete_outline),
+          ),
+        ],
+      ),
+      onTap: () {
+        _handleAddOrEdit(context, ref, proxy);
+      },
+    );
+  }
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final appLocalizations = context.appLocalizations;
+    final props = ref.watch(tailscaleSettingProvider);
+    final enable = props.enable;
+    final proxies = props.proxies;
+    final routeCount = proxies.fold<int>(
+      0,
+      (sum, proxy) => sum + proxy.routes.length,
+    );
+    final bypassRecommended = system.isDesktop;
+    // Header block is always index 0; nodes follow.
+    final itemCount = proxies.isEmpty ? 1 : proxies.length + 1;
+    return CommonScaffold(
+      title: appLocalizations.tailscale,
+      actions: [
+        IconButton(
+          tooltip: appLocalizations.addTailscaleNode,
+          onPressed: () {
+            _handleAddOrEdit(context, ref);
+          },
+          icon: const Icon(Icons.add),
+        ),
+        const SizedBox(width: 8),
+      ],
+      body: ListView.builder(
+        padding: const EdgeInsets.only(bottom: 20),
+        itemCount: itemCount,
+        itemBuilder: (_, index) {
+          if (index == 0) {
+            return Column(
+              crossAxisAlignment: CrossAxisAlignment.start,
+              children: [
+                _buildScenarioCard(context),
+                ListItem.toggle(
+                  leading: const Icon(Icons.vpn_key_outlined),
+                  title: Text(appLocalizations.tailscaleEnable),
+                  subtitle: Text(appLocalizations.tailscaleEnableDesc),
+                  value: enable,
+                  onChanged: (value) async {
+                    ref
+                        .read(tailscaleSettingProvider.notifier)
+                        .setEnable(value);
+                    if (value &&
+                        bypassRecommended &&
+                        !ref.read(tailscaleSettingProvider).bypassTraffic) {
+                      context.showNotifier(
+                        appLocalizations.tailscaleBypassNudge,
+                        actionState: MessageActionState(
+                          actionText:
+                              appLocalizations.tailscaleEnableBypassAction,
+                          action: () async {
+                            ref
+                                .read(tailscaleSettingProvider.notifier)
+                                .setBypassTraffic(true);
+                            await _applyTailscaleConfig(ref);
+                          },
+                        ),
+                      );
+                    }
+                    await _applyTailscaleConfig(ref);
+                  },
+                ),
+                ListItem.toggle(
+                  leading: const Icon(Icons.alt_route_outlined),
+                  title: Text(appLocalizations.tailscaleBypass),
+                  subtitle: Text(
+                    bypassRecommended
+                        ? appLocalizations.tailscaleBypassRecommended
+                        : appLocalizations.tailscaleBypassAndroidHint,
+                  ),
+                  value: props.bypassTraffic,
+                  onChanged: (value) async {
+                    ref
+                        .read(tailscaleSettingProvider.notifier)
+                        .setBypassTraffic(value);
+                    await _applyTailscaleConfig(ref);
+                  },
+                ),
+                _buildStatusBanner(
+                  context,
+                  ref,
+                  enable: enable,
+                  nodeCount: proxies.length,
+                  routeCount: routeCount,
+                ),
+                const Divider(height: 16),
+                if (proxies.isEmpty)
+                  _buildGuide(context)
+                else
+                  ExpansionTile(
+                    tilePadding: const EdgeInsets.symmetric(horizontal: 16),
+                    title: Text(appLocalizations.tailscaleShowSetupGuide),
+                    children: [_buildGuide(context)],
+                  ),
+                if (proxies.isEmpty)
+                  Padding(
+                    padding: const EdgeInsets.fromLTRB(16, 24, 16, 16),
+                    child: Column(
+                      children: [
+                        NullStatus(label: appLocalizations.tailscaleEmptyTip),
+                        const SizedBox(height: 24),
+                        FilledButton.icon(
+                          onPressed: () {
+                            _handleAddOrEdit(context, ref);
+                          },
+                          icon: const Icon(Icons.add),
+                          label: Text(appLocalizations.addTailscaleNode),
+                        ),
+                      ],
+                    ),
+                  )
+                else
+                  Padding(
+                    padding: const EdgeInsets.fromLTRB(16, 8, 16, 0),
+                    child: Text(
+                      appLocalizations.tailscaleNodesTitle,
+                      style: context.textTheme.titleSmall?.copyWith(
+                        fontWeight: FontWeight.bold,
+                      ),
+                    ),
+                  ),
+              ],
+            );
+          }
+          return _buildNodeTile(
+            context,
+            ref,
+            proxy: proxies[index - 1],
+          );
+        },
+      ),
+    );
+  }
+}
+
+class TailscaleNodeDialog extends StatefulWidget {
+  final TailscaleProxy? proxy;
+  final List<String> existingNames;
+
+  const TailscaleNodeDialog({
+    super.key,
+    this.proxy,
+    this.existingNames = const [],
+  });
+
+  @override
+  State<TailscaleNodeDialog> createState() => _TailscaleNodeDialogState();
+}
+
+class _TailscaleNodeDialogState extends State<TailscaleNodeDialog> {
+  final _formKey = GlobalKey<FormState>();
+  late final TextEditingController _nameController;
+  late final TextEditingController _authKeyController;
+  late final TextEditingController _hostnameController;
+  late final TextEditingController _controlUrlController;
+  late final TextEditingController _stateDirController;
+  late final TextEditingController _exitNodeController;
+  late final TextEditingController _routesController;
+  late bool _ephemeral;
+  late bool _udp;
+  late bool _acceptRoutes;
+  late bool _exitNodeAllowLanAccess;
+  late bool _showAdvanced;
+  late bool _obscureAuthKey;
+
+  @override
+  void initState() {
+    super.initState();
+    final proxy = widget.proxy ?? const TailscaleProxy(name: '');
+    _nameController = TextEditingController(text: proxy.name);
+    _authKeyController = TextEditingController(text: proxy.authKey);
+    _hostnameController = TextEditingController(text: proxy.hostname);
+    _controlUrlController = TextEditingController(text: proxy.controlUrl);
+    _stateDirController = TextEditingController(text: proxy.stateDir);
+    _exitNodeController = TextEditingController(text: proxy.exitNode);
+    _routesController = TextEditingController(text: proxy.routes.join('\n'));
+    _ephemeral = proxy.ephemeral;
+    _udp = proxy.udp;
+    _acceptRoutes = proxy.acceptRoutes;
+    _exitNodeAllowLanAccess = proxy.exitNodeAllowLanAccess;
+    _obscureAuthKey = true;
+    _showAdvanced =
+        proxy.hostname.isNotEmpty ||
+        proxy.controlUrl.isNotEmpty ||
+        proxy.stateDir.isNotEmpty ||
+        proxy.exitNode.isNotEmpty ||
+        proxy.ephemeral ||
+        !proxy.udp ||
+        proxy.acceptRoutes ||
+        proxy.exitNodeAllowLanAccess;
+  }
+
+  @override
+  void dispose() {
+    _nameController.dispose();
+    _authKeyController.dispose();
+    _hostnameController.dispose();
+    _controlUrlController.dispose();
+    _stateDirController.dispose();
+    _exitNodeController.dispose();
+    _routesController.dispose();
+    super.dispose();
+  }
+
+  void _handleSubmit() {
+    if (_formKey.currentState?.validate() != true) {
+      return;
+    }
+    final routes = _routesController.text
+        .split(RegExp(r'[\n,]'))
+        .map((item) => item.trim())
+        .where((item) => item.isNotEmpty)
+        .toList();
+    final proxy = TailscaleProxy(
+      name: _nameController.text.trim(),
+      authKey: _authKeyController.text.trim(),
+      hostname: _hostnameController.text.trim(),
+      controlUrl: _controlUrlController.text.trim(),
+      stateDir: _stateDirController.text.trim(),
+      exitNode: _exitNodeController.text.trim(),
+      ephemeral: _ephemeral,
+      udp: _udp,
+      acceptRoutes: _acceptRoutes,
+      exitNodeAllowLanAccess: _exitNodeAllowLanAccess,
+      routes: routes,
+    );
+    Navigator.of(context).pop(proxy);
+  }
+
+  Widget _buildTextField({
+    required TextEditingController controller,
+    required String label,
+    String? helperText,
+    int maxLines = 1,
+    bool obscureText = false,
+    Widget? suffixIcon,
+    String? Function(String?)? validator,
+  }) {
+    return Padding(
+      padding: const EdgeInsets.only(bottom: 16),
+      child: TextFormField(
+        controller: controller,
+        validator: validator,
+        maxLines: obscureText ? 1 : maxLines,
+        obscureText: obscureText,
+        decoration: InputDecoration(
+          border: const OutlineInputBorder(),
+          labelText: label,
+          helperText: helperText,
+          helperMaxLines: 3,
+          alignLabelWithHint: maxLines > 1,
+          suffixIcon: suffixIcon,
+        ),
+      ),
+    );
+  }
+
+  Widget _buildSwitch({
+    required String label,
+    required bool value,
+    required ValueChanged<bool> onChanged,
+  }) {
+    return SwitchListTile(
+      contentPadding: EdgeInsets.zero,
+      title: Text(label, style: context.textTheme.bodyLarge),
+      value: value,
+      onChanged: onChanged,
+    );
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final appLocalizations = context.appLocalizations;
+    return CommonDialog(
+      title: widget.proxy != null
+          ? appLocalizations.editTailscaleNode
+          : appLocalizations.addTailscaleNode,
+      actions: [
+        TextButton(
+          onPressed: () {
+            Navigator.of(context).pop();
+          },
+          child: Text(appLocalizations.cancel),
+        ),
+        const SizedBox(width: 8),
+        TextButton(
+          onPressed: _handleSubmit,
+          child: Text(appLocalizations.confirm),
+        ),
+      ],
+      child: SizedBox(
+        width: 360,
+        child: Form(
+          key: _formKey,
+          child: SingleChildScrollView(
+            child: Column(
+              mainAxisSize: MainAxisSize.min,
+              crossAxisAlignment: CrossAxisAlignment.start,
+              children: [
+                const SizedBox(height: 8),
+                _buildTextField(
+                  controller: _nameController,
+                  label: appLocalizations.name,
+                  helperText: appLocalizations.tailscaleNameHelper,
+                  validator: (value) {
+                    final name = value?.trim() ?? '';
+                    if (name.isEmpty) {
+                      return appLocalizations.emptyTip(appLocalizations.name);
+                    }
+                    final isEditingSame = widget.proxy?.name == name;
+                    if (!isEditingSame &&
+                        widget.existingNames.contains(name)) {
+                      return appLocalizations.tailscaleNameExistsTip;
+                    }
+                    return null;
+                  },
+                ),
+                _buildTextField(
+                  controller: _authKeyController,
+                  label: appLocalizations.tailscaleAuthKey,
+                  helperText: appLocalizations.tailscaleAuthKeyHint,
+                  obscureText: _obscureAuthKey,
+                  suffixIcon: IconButton(
+                    onPressed: () {
+                      setState(() => _obscureAuthKey = !_obscureAuthKey);
+                    },
+                    icon: Icon(
+                      _obscureAuthKey
+                          ? Icons.visibility_outlined
+                          : Icons.visibility_off_outlined,
+                    ),
+                  ),
+                  validator: (value) {
+                    final key = value?.trim() ?? '';
+                    if (key.isEmpty) {
+                      return appLocalizations.emptyTip(
+                        appLocalizations.tailscaleAuthKey,
+                      );
+                    }
+                    return null;
+                  },
+                ),
+                _buildTextField(
+                  controller: _routesController,
+                  label: appLocalizations.tailscaleRoutes,
+                  helperText: appLocalizations.tailscaleRoutesHint,
+                  maxLines: 3,
+                ),
+                Align(
+                  alignment: Alignment.centerLeft,
+                  child: TextButton.icon(
+                    onPressed: () {
+                      setState(() => _showAdvanced = !_showAdvanced);
+                    },
+                    icon: Icon(
+                      _showAdvanced
+                          ? Icons.expand_less
+                          : Icons.expand_more,
+                    ),
+                    label: Text(
+                      _showAdvanced
+                          ? appLocalizations.hideAdvanced
+                          : appLocalizations.showAdvanced,
+                    ),
+                  ),
+                ),
+                if (_showAdvanced) ...[
+                  _buildTextField(
+                    controller: _hostnameController,
+                    label: appLocalizations.tailscaleHostname,
+                    helperText: appLocalizations.tailscaleHostnameHint,
+                  ),
+                  _buildTextField(
+                    controller: _controlUrlController,
+                    label: appLocalizations.tailscaleControlUrl,
+                    helperText: appLocalizations.tailscaleControlUrlHint,
+                  ),
+                  _buildTextField(
+                    controller: _stateDirController,
+                    label: appLocalizations.tailscaleStateDir,
+                    helperText: appLocalizations.tailscaleStateDirHint,
+                  ),
+                  _buildTextField(
+                    controller: _exitNodeController,
+                    label: appLocalizations.tailscaleExitNode,
+                    helperText: appLocalizations.tailscaleExitNodeHint,
+                  ),
+                  _buildSwitch(
+                    label: appLocalizations.tailscaleEphemeral,
+                    value: _ephemeral,
+                    onChanged: (value) {
+                      setState(() {
+                        _ephemeral = value;
+                      });
+                    },
+                  ),
+                  _buildSwitch(
+                    label: appLocalizations.tailscaleUdp,
+                    value: _udp,
+                    onChanged: (value) {
+                      setState(() {
+                        _udp = value;
+                      });
+                    },
+                  ),
+                  _buildSwitch(
+                    label: appLocalizations.tailscaleAcceptRoutes,
+                    value: _acceptRoutes,
+                    onChanged: (value) {
+                      setState(() {
+                        _acceptRoutes = value;
+                      });
+                    },
+                  ),
+                  _buildSwitch(
+                    label: appLocalizations.tailscaleExitNodeAllowLanAccess,
+                    value: _exitNodeAllowLanAccess,
+                    onChanged: (value) {
+                      setState(() {
+                        _exitNodeAllowLanAccess = value;
+                      });
+                    },
+                  ),
+                ],
+              ],
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/lib/views/theme.dart b/lib/views/theme.dart
index 5b4d845ea1..ba424246fc 100644
--- a/lib/views/theme.dart
+++ b/lib/views/theme.dart
@@ -428,7 +428,7 @@ class _PrueBlackItem extends ConsumerWidget {
       themeSettingProvider.select((state) => state.pureBlack),
     );
     return SliverToBoxAdapter(
-      child: ListItem.switchItem(
+      child: ListItem.toggle(
         leading: const Icon(Icons.contrast),
         horizontalTitleGap: 12,
         title: Text(
@@ -437,14 +437,12 @@ class _PrueBlackItem extends ConsumerWidget {
             color: context.colorScheme.onSurfaceVariant,
           ),
         ),
-        delegate: SwitchDelegate(
-          value: prueBlack,
-          onChanged: (value) {
-            ref
-                .read(themeSettingProvider.notifier)
-                .update((state) => state.copyWith(pureBlack: value));
-          },
-        ),
+        value: prueBlack,
+        onChanged: (value) {
+          ref
+              .read(themeSettingProvider.notifier)
+              .update((state) => state.copyWith(pureBlack: value));
+        },
       ),
     );
   }
@@ -466,7 +464,7 @@ class _TextScaleFactorItem extends ConsumerWidget {
         children: [
           Padding(
             padding: const EdgeInsets.only(bottom: 8),
-            child: ListItem.switchItem(
+            child: ListItem.toggle(
               leading: const Icon(Icons.text_fields),
               horizontalTitleGap: 12,
               title: Text(
@@ -475,16 +473,12 @@ class _TextScaleFactorItem extends ConsumerWidget {
                   color: context.colorScheme.onSurfaceVariant,
                 ),
               ),
-              delegate: SwitchDelegate(
-                value: textScale.enable,
-                onChanged: (value) {
-                  ref
-                      .read(themeSettingProvider.notifier)
-                      .update(
-                        (state) => state.copyWith.textScale(enable: value),
-                      );
-                },
-              ),
+              value: textScale.enable,
+              onChanged: (value) {
+                ref
+                    .read(themeSettingProvider.notifier)
+                    .update((state) => state.copyWith.textScale(enable: value));
+              },
             ),
           ),
           Padding(
diff --git a/lib/views/tools.dart b/lib/views/tools.dart
index 950bdc3631..08add8c1bd 100644
--- a/lib/views/tools.dart
+++ b/lib/views/tools.dart
@@ -11,6 +11,7 @@ import 'package:fl_clash/views/application_setting.dart';
 import 'package:fl_clash/views/backup_and_restore.dart';
 import 'package:fl_clash/views/config/config.dart';
 import 'package:fl_clash/views/hotkey.dart';
+import 'package:fl_clash/views/tailscale.dart';
 import 'package:fl_clash/widgets/widgets.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
@@ -36,11 +37,9 @@ class _ToolViewState extends ConsumerState<ToolsView> {
       subtitle: navigationItem.description != null
           ? Text(Intl.message(navigationItem.description!))
           : null,
-      delegate: OpenDelegate(
-        widget: navigationItem.builder(context),
-        maxWidth: 400,
-        forceFull: false,
-      ),
+      widget: navigationItem.builder(context),
+      maxWidth: 400,
+      forceFull: false,
     );
   }
 
@@ -68,6 +67,16 @@ class _ToolViewState extends ConsumerState<ToolsView> {
     );
   }
 
+
+  List<Widget> _getFeatureList() {
+    return generateSection(
+      title: context.appLocalizations.features,
+      items: [
+        const _TailscaleItem(),
+      ],
+    );
+  }
+
   List<Widget> _getSettingList() {
     return generateSection(
       title: context.appLocalizations.settings,
@@ -107,6 +116,7 @@ class _ToolViewState extends ConsumerState<ToolsView> {
           );
         },
       ),
+      ..._getFeatureList(),
       ..._getSettingList(),
       ..._getOtherList(vm2.b),
     ];
@@ -141,17 +151,15 @@ class _LocaleItem extends ConsumerWidget {
       leading: const Icon(Icons.language_outlined),
       title: Text(context.appLocalizations.language),
       subtitle: Text(Intl.message(subTitle)),
-      delegate: OptionsDelegate(
-        title: context.appLocalizations.language,
-        options: [null, ...AppLocalizations.delegate.supportedLocales],
-        onChanged: (Locale? locale) {
-          ref
-              .read(appSettingProvider.notifier)
-              .update((state) => state.copyWith(locale: locale?.toString()));
-        },
-        textBuilder: (locale) => _getLocaleString(context, locale),
-        value: currentLocale,
-      ),
+      dialogTitle: context.appLocalizations.language,
+      options: [null, ...AppLocalizations.delegate.supportedLocales],
+      onChanged: (Locale? locale) {
+        ref
+            .read(appSettingProvider.notifier)
+            .update((state) => state.copyWith(locale: locale?.toString()));
+      },
+      textBuilder: (locale) => _getLocaleString(context, locale),
+      value: currentLocale,
     );
   }
 }
@@ -165,7 +173,7 @@ class _ThemeItem extends StatelessWidget {
       leading: const Icon(Icons.style),
       title: Text(context.appLocalizations.theme),
       subtitle: Text(context.appLocalizations.themeDesc),
-      delegate: const OpenDelegate(widget: ThemeView()),
+      widget: const ThemeView(),
     );
   }
 }
@@ -179,7 +187,7 @@ class _BackupItem extends StatelessWidget {
       leading: const Icon(Icons.cloud_sync),
       title: Text(context.appLocalizations.backupAndRestore),
       subtitle: Text(context.appLocalizations.backupAndRestoreDesc),
-      delegate: const OpenDelegate(widget: BackupAndRestore()),
+      widget: const BackupAndRestore(),
     );
   }
 }
@@ -193,7 +201,7 @@ class _HotkeyItem extends StatelessWidget {
       leading: const Icon(Icons.keyboard),
       title: Text(context.appLocalizations.hotkeyManagement),
       subtitle: Text(context.appLocalizations.hotkeyManagementDesc),
-      delegate: const OpenDelegate(widget: HotKeyView()),
+      widget: const HotKeyView(),
     );
   }
 }
@@ -226,7 +234,7 @@ class _AccessItem extends StatelessWidget {
       leading: const Icon(Icons.view_list),
       title: Text(context.appLocalizations.accessControl),
       subtitle: Text(context.appLocalizations.accessControlDesc),
-      delegate: const OpenDelegate(widget: AccessView()),
+      widget: const AccessView(),
     );
   }
 }
@@ -240,7 +248,7 @@ class _ConfigItem extends StatelessWidget {
       leading: const Icon(Icons.edit),
       title: Text(context.appLocalizations.basicConfig),
       subtitle: Text(context.appLocalizations.basicConfigDesc),
-      delegate: const OpenDelegate(widget: ConfigView()),
+      widget: const ConfigView(),
     );
   }
 }
@@ -254,7 +262,22 @@ class _AdvancedConfigItem extends StatelessWidget {
       leading: const Icon(Icons.build),
       title: Text(context.appLocalizations.advancedConfig),
       subtitle: Text(context.appLocalizations.advancedConfigDesc),
-      delegate: const OpenDelegate(widget: AdvancedConfigView()),
+      widget: const AdvancedConfigView(),
+    );
+  }
+}
+
+
+class _TailscaleItem extends StatelessWidget {
+  const _TailscaleItem();
+
+  @override
+  Widget build(BuildContext context) {
+    return ListItem.open(
+      leading: const Icon(Icons.device_hub),
+      title: Text(context.appLocalizations.tailscale),
+      subtitle: Text(context.appLocalizations.tailscaleDesc),
+      widget: const TailscaleView(),
     );
   }
 }
@@ -268,7 +291,7 @@ class _SettingItem extends StatelessWidget {
       leading: const Icon(Icons.settings),
       title: Text(context.appLocalizations.application),
       subtitle: Text(context.appLocalizations.applicationDesc),
-      delegate: const OpenDelegate(widget: ApplicationSettingView()),
+      widget: const ApplicationSettingView(),
     );
   }
 }
@@ -299,7 +322,7 @@ class _InfoItem extends StatelessWidget {
     return ListItem.open(
       leading: const Icon(Icons.info),
       title: Text(context.appLocalizations.about),
-      delegate: const OpenDelegate(widget: AboutView()),
+      widget: const AboutView(),
     );
   }
 }
@@ -312,7 +335,7 @@ class _DeveloperItem extends StatelessWidget {
     return ListItem.open(
       leading: const Icon(Icons.developer_board),
       title: Text(context.appLocalizations.developerMode),
-      delegate: const OpenDelegate(widget: DeveloperView()),
+      widget: const DeveloperView(),
     );
   }
 }
diff --git a/lib/views/views.dart b/lib/views/views.dart
index f036cb3fae..f6d736e5d8 100644
--- a/lib/views/views.dart
+++ b/lib/views/views.dart
@@ -11,4 +11,5 @@ export 'logs.dart';
 export 'profiles/profiles.dart';
 export 'proxies/proxies.dart';
 export 'resources.dart';
+export 'tailscale.dart';
 export 'tools.dart';
diff --git a/lib/widgets/animated_visibility.dart b/lib/widgets/animated_visibility.dart
new file mode 100644
index 0000000000..afe175573d
--- /dev/null
+++ b/lib/widgets/animated_visibility.dart
@@ -0,0 +1,148 @@
+import 'package:flutter/material.dart';
+
+const _transitionDuration = Duration(milliseconds: 300);
+
+enum _VisibilityMotion {
+  sidebar(
+    axis: Axis.horizontal,
+    alignment: AlignmentDirectional.topStart,
+    hiddenOffset: Offset(-1, 0),
+  ),
+  bottomNavigation(
+    axis: Axis.vertical,
+    alignment: AlignmentDirectional.bottomStart,
+    hiddenOffset: Offset(0, 1),
+  );
+
+  final Axis axis;
+  final AlignmentGeometry alignment;
+  final Offset hiddenOffset;
+
+  const _VisibilityMotion({
+    required this.axis,
+    required this.alignment,
+    required this.hiddenOffset,
+  });
+}
+
+/// Animates navigation visibility together with the surrounding layout.
+class AnimatedVisibility extends StatefulWidget {
+  final bool visible;
+  final _VisibilityMotion _motion;
+  final Widget child;
+
+  /// Creates a sidebar transition that moves to the left when hidden.
+  const AnimatedVisibility.sidebar({
+    super.key,
+    required this.visible,
+    required this.child,
+  }) : _motion = _VisibilityMotion.sidebar;
+
+  /// Creates a bottom-navigation transition that moves through the bottom.
+  const AnimatedVisibility.bottomNavigation({
+    super.key,
+    required this.visible,
+    required this.child,
+  }) : _motion = _VisibilityMotion.bottomNavigation;
+
+  @override
+  State<AnimatedVisibility> createState() => _AnimatedVisibilityState();
+}
+
+class _AnimatedVisibilityState extends State<AnimatedVisibility>
+    with SingleTickerProviderStateMixin {
+  late final AnimationController _controller;
+  late final CurvedAnimation _animation;
+  late Widget _presentedChild;
+  late bool _includeChild;
+
+  @override
+  void initState() {
+    super.initState();
+    _presentedChild = widget.child;
+    _includeChild = widget.visible;
+    _controller = AnimationController(
+      value: widget.visible ? 1 : 0,
+      duration: _transitionDuration,
+      reverseDuration: _transitionDuration,
+      vsync: this,
+    )..addStatusListener(_handleAnimationStatus);
+    _animation = CurvedAnimation(
+      parent: _controller,
+      curve: Easing.standardDecelerate,
+      reverseCurve: const FlippedCurve(Easing.standardAccelerate),
+    );
+  }
+
+  @override
+  void didUpdateWidget(covariant AnimatedVisibility oldWidget) {
+    super.didUpdateWidget(oldWidget);
+    if (widget.visible == oldWidget.visible) {
+      if (widget.visible) {
+        _presentedChild = widget.child;
+      }
+      return;
+    }
+    if (widget.visible) {
+      _presentedChild = widget.child;
+      _includeChild = true;
+      _controller.forward();
+      return;
+    }
+    if (_controller.isDismissed) {
+      _includeChild = false;
+      return;
+    }
+    _controller.reverse();
+  }
+
+  void _handleAnimationStatus(AnimationStatus status) {
+    if (status != AnimationStatus.dismissed ||
+        widget.visible ||
+        !_includeChild) {
+      return;
+    }
+    setState(() {
+      _includeChild = false;
+    });
+  }
+
+  @override
+  void dispose() {
+    _controller.removeStatusListener(_handleAnimationStatus);
+    _animation.dispose();
+    _controller.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final motion = widget._motion;
+    final content = _includeChild
+        ? SizeTransition(
+            sizeFactor: _animation,
+            axis: motion.axis,
+            alignment: motion.alignment,
+            child: FadeTransition(
+              opacity: _animation,
+              child: SlideTransition(
+                position: _animation.drive(
+                  Tween(begin: motion.hiddenOffset, end: Offset.zero),
+                ),
+                child: _presentedChild,
+              ),
+            ),
+          )
+        : const SizedBox.shrink();
+    return ExcludeSemantics(
+      excluding: !widget.visible,
+      child: ExcludeFocus(
+        excluding: !widget.visible,
+        child: IgnorePointer(
+          ignoring: !widget.visible,
+          child: ClipRect(child: content),
+        ),
+      ),
+    );
+  }
+}
diff --git a/lib/widgets/input.dart b/lib/widgets/input.dart
index 39fc876e48..a79919f31f 100644
--- a/lib/widgets/input.dart
+++ b/lib/widgets/input.dart
@@ -51,12 +51,10 @@ class OptionsDialog<T> extends StatelessWidget {
                     });
                   }
                   return ListItem.radio(
-                    delegate: RadioDelegate(
-                      value: option,
-                      onTab: () {
-                        Navigator.of(context).pop(option);
-                      },
-                    ),
+                    value: option,
+                    onTap: () {
+                      Navigator.of(context).pop(option);
+                    },
                     title: Text(textBuilder(option)),
                   );
                 },
diff --git a/lib/widgets/list.dart b/lib/widgets/list.dart
index c71bd53752..4096b561d3 100644
--- a/lib/widgets/list.dart
+++ b/lib/widgets/list.dart
@@ -1,4 +1,3 @@
-import 'package:animations/animations.dart';
 import 'package:collection/collection.dart';
 import 'package:fl_clash/common/common.dart';
 import 'package:fl_clash/enum/enum.dart';
@@ -10,66 +9,71 @@ import 'package:flutter/material.dart';
 
 import 'card.dart';
 import 'input.dart';
+import 'open_container.dart';
 import 'scaffold.dart';
 import 'sheet.dart';
 
-class Delegate {
-  const Delegate();
+sealed class _ListItemAction {
+  const _ListItemAction();
 }
 
-class RadioDelegate<T> extends Delegate {
+final class _DefaultAction extends _ListItemAction {
+  const _DefaultAction();
+}
+
+final class _RadioAction<T> extends _ListItemAction {
   final T value;
-  final void Function()? onTab;
+  final VoidCallback? onTap;
 
-  const RadioDelegate({required this.value, this.onTab});
+  const _RadioAction({required this.value, this.onTap});
 }
 
-class SwitchDelegate<T> extends Delegate {
+final class _ToggleAction extends _ListItemAction {
   final bool value;
   final ValueChanged<bool>? onChanged;
 
-  const SwitchDelegate({required this.value, this.onChanged});
+  const _ToggleAction({required this.value, this.onChanged});
 }
 
-class CheckboxDelegate<T> extends Delegate {
+final class _CheckboxAction extends _ListItemAction {
   final bool value;
   final ValueChanged<bool?>? onChanged;
 
-  const CheckboxDelegate({this.value = false, this.onChanged});
+  const _CheckboxAction({required this.value, this.onChanged});
 }
 
-class OpenDelegate<T> extends Delegate {
+final class _OpenAction extends _ListItemAction {
   final Widget widget;
   final double? maxWidth;
   final bool blur;
   final bool forceFull;
-  final ValueChanged<T?>? onChanged;
+  final ValueChanged<dynamic>? onChanged;
 
-  const OpenDelegate({
+  const _OpenAction({
     required this.widget,
     this.maxWidth,
-    this.blur = true,
-    this.forceFull = true,
+    required this.blur,
+    required this.forceFull,
     this.onChanged,
   });
 }
 
-class NextDelegate extends Delegate {
+final class _NextAction extends _ListItemAction {
   final Widget widget;
   final double? maxWidth;
   final bool blur;
 
-  const NextDelegate({required this.widget, this.maxWidth, this.blur = true});
+  const _NextAction({required this.widget, this.maxWidth, required this.blur});
 }
 
-class OptionsDelegate<T> extends Delegate {
+final class _OptionsAction<T> extends _ListItemAction {
   final List<T> options;
   final String title;
   final T value;
   final String Function(T value) textBuilder;
-  final Function(T? value) onChanged;
+  final ValueChanged<T?> onChanged;
 
-  const OptionsDelegate({
+  const _OptionsAction({
     required this.title,
     required this.options,
     required this.textBuilder,
@@ -78,18 +82,17 @@ class OptionsDelegate<T> extends Delegate {
   });
 }
 
-class InputDelegate extends Delegate {
+final class _InputAction extends _ListItemAction {
   final String title;
   final String value;
   final String? suffixText;
-  final Function(String? value) onChanged;
+  final ValueChanged<String?> onChanged;
   final FormFieldValidator<String>? validator;
   final int? maxLength;
   final TextInputType? keyboardType;
-
   final String? resetValue;
 
-  const InputDelegate({
+  const _InputAction({
     required this.title,
     required this.value,
     this.suffixText,
@@ -109,7 +112,7 @@ class ListItem<T> extends StatelessWidget {
   final ListTileTitleAlignment tileTitleAlignment;
   final bool? dense;
   final Widget? trailing;
-  final Delegate delegate;
+  final _ListItemAction _action;
   final double? horizontalTitleGap;
   final TextStyle? titleTextStyle;
   final TextStyle? subtitleTextStyle;
@@ -136,16 +139,20 @@ class ListItem<T> extends StatelessWidget {
     this.visualDensity,
     this.minVerticalPadding = 12,
     this.tileTitleAlignment = ListTileTitleAlignment.center,
-  }) : delegate = const Delegate();
+  }) : _action = const _DefaultAction();
 
-  const ListItem.open({
+  ListItem.open({
     super.key,
     required this.title,
     this.subtitle,
     this.leading,
     this.padding = const EdgeInsets.symmetric(horizontal: 16),
     this.trailing,
-    required OpenDelegate this.delegate,
+    required Widget widget,
+    double? maxWidth,
+    bool blur = true,
+    bool forceFull = true,
+    ValueChanged<dynamic>? onChanged,
     this.horizontalTitleGap,
     this.dense,
     this.titleTextStyle,
@@ -155,16 +162,25 @@ class ListItem<T> extends StatelessWidget {
     this.visualDensity,
     this.minVerticalPadding = 12,
     this.tileTitleAlignment = ListTileTitleAlignment.center,
-  }) : onTap = null;
+  }) : _action = _OpenAction(
+         widget: widget,
+         maxWidth: maxWidth,
+         blur: blur,
+         forceFull: forceFull,
+         onChanged: onChanged,
+       ),
+       onTap = null;
 
-  const ListItem.next({
+  ListItem.next({
     super.key,
     required this.title,
     this.subtitle,
     this.leading,
     this.padding = const EdgeInsets.symmetric(horizontal: 16),
     this.trailing,
-    required NextDelegate this.delegate,
+    required Widget widget,
+    double? maxWidth,
+    bool blur = true,
     this.horizontalTitleGap,
     this.dense,
     this.titleTextStyle,
@@ -174,16 +190,21 @@ class ListItem<T> extends StatelessWidget {
     this.visualDensity,
     this.minVerticalPadding = 12,
     this.tileTitleAlignment = ListTileTitleAlignment.center,
-  }) : onTap = null;
+  }) : _action = _NextAction(widget: widget, maxWidth: maxWidth, blur: blur),
+       onTap = null;
 
-  const ListItem.options({
+  ListItem.options({
     super.key,
     required this.title,
     this.subtitle,
     this.leading,
     this.padding = const EdgeInsets.symmetric(horizontal: 16),
     this.trailing,
-    required OptionsDelegate<T> this.delegate,
+    required String dialogTitle,
+    required List<T> options,
+    required T value,
+    required String Function(T value) textBuilder,
+    required ValueChanged<T?> onChanged,
     this.horizontalTitleGap,
     this.dense,
     this.titleTextStyle,
@@ -193,16 +214,30 @@ class ListItem<T> extends StatelessWidget {
     this.visualDensity,
     this.minVerticalPadding = 12,
     this.tileTitleAlignment = ListTileTitleAlignment.center,
-  }) : onTap = null;
+  }) : _action = _OptionsAction<T>(
+         title: dialogTitle,
+         options: options,
+         value: value,
+         textBuilder: textBuilder,
+         onChanged: onChanged,
+       ),
+       onTap = null;
 
-  const ListItem.input({
+  ListItem.input({
     super.key,
     required this.title,
     this.subtitle,
     this.leading,
     this.padding = const EdgeInsets.symmetric(horizontal: 16),
     this.trailing,
-    required InputDelegate this.delegate,
+    required String dialogTitle,
+    required String value,
+    String? suffixText,
+    required ValueChanged<String?> onChanged,
+    FormFieldValidator<String>? validator,
+    int? maxLength,
+    TextInputType? keyboardType,
+    String? resetValue,
     this.horizontalTitleGap,
     this.dense,
     this.titleTextStyle,
@@ -212,15 +247,26 @@ class ListItem<T> extends StatelessWidget {
     this.visualDensity,
     this.minVerticalPadding = 12,
     this.tileTitleAlignment = ListTileTitleAlignment.center,
-  }) : onTap = null;
+  }) : _action = _InputAction(
+         title: dialogTitle,
+         value: value,
+         suffixText: suffixText,
+         onChanged: onChanged,
+         validator: validator,
+         maxLength: maxLength,
+         keyboardType: keyboardType,
+         resetValue: resetValue,
+       ),
+       onTap = null;
 
-  const ListItem.checkbox({
+  ListItem.checkbox({
     super.key,
     required this.title,
     this.subtitle,
     this.leading,
     this.padding = const EdgeInsets.only(left: 16, right: 8),
-    required CheckboxDelegate<T> this.delegate,
+    bool value = false,
+    ValueChanged<bool?>? onChanged,
     this.horizontalTitleGap,
     this.dense,
     this.titleTextStyle,
@@ -230,16 +276,18 @@ class ListItem<T> extends StatelessWidget {
     this.visualDensity,
     this.minVerticalPadding = 12,
     this.tileTitleAlignment = ListTileTitleAlignment.center,
-  }) : trailing = null,
+  }) : _action = _CheckboxAction(value: value, onChanged: onChanged),
+       trailing = null,
        onTap = null;
 
-  const ListItem.switchItem({
+  ListItem.toggle({
     super.key,
     required this.title,
     this.subtitle,
     this.leading,
     this.padding = const EdgeInsets.only(left: 16, right: 8),
-    required SwitchDelegate<T> this.delegate,
+    required bool value,
+    ValueChanged<bool>? onChanged,
     this.horizontalTitleGap,
     this.dense,
     this.titleTextStyle,
@@ -249,16 +297,18 @@ class ListItem<T> extends StatelessWidget {
     this.visualDensity,
     this.minVerticalPadding = 12,
     this.tileTitleAlignment = ListTileTitleAlignment.center,
-  }) : trailing = null,
+  }) : _action = _ToggleAction(value: value, onChanged: onChanged),
+       trailing = null,
        onTap = null;
 
-  const ListItem.radio({
+  ListItem.radio({
     super.key,
     required this.title,
     this.subtitle,
     this.trailing,
     this.padding = const EdgeInsets.only(left: 12, right: 16),
-    required RadioDelegate<T> this.delegate,
+    required T value,
+    VoidCallback? onTap,
     this.horizontalTitleGap = 8,
     this.dense,
     this.titleTextStyle,
@@ -268,7 +318,8 @@ class ListItem<T> extends StatelessWidget {
     this.visualDensity,
     this.minVerticalPadding = 12,
     this.tileTitleAlignment = ListTileTitleAlignment.center,
-  }) : leading = null,
+  }) : _action = _RadioAction<T>(value: value, onTap: onTap),
+       leading = null,
        onTap = null;
 
   Widget _buildListTile({
@@ -298,151 +349,131 @@ class ListItem<T> extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    if (delegate is OpenDelegate) {
-      final openDelegate = delegate as OpenDelegate;
-      final child = openDelegate.widget;
-      final onChanged = openDelegate.onChanged;
-      return OpenContainer<T>(
-        closedColor: context.colorScheme.surface,
-        openColor: context.colorScheme.surface,
-        closedElevation: 0,
-        openElevation: 0,
-        openShape: const RoundedSuperellipseBorder(
-          borderRadius: BorderRadius.zero,
-        ),
-        closedShape: const RoundedSuperellipseBorder(
-          borderRadius: BorderRadius.zero,
-        ),
-        closedBuilder: (context, action) {
-          Future<void> openAction() async {
-            final isMobile = globalState.container.read(isMobileViewProvider);
-            if (!isMobile || kDebugMode) {
-              final res = await showExtend(
-                context,
-                props: ExtendProps(
-                  blur: openDelegate.blur,
-                  maxWidth: openDelegate.maxWidth,
-                  forceFull: openDelegate.forceFull,
-                ),
-                builder: (_) {
-                  return child;
-                },
-              );
-              if (onChanged != null) {
-                onChanged(res);
+    switch (_action) {
+      case final _OpenAction openDelegate:
+        final child = openDelegate.widget;
+        final onChanged = openDelegate.onChanged;
+        return OpenContainer<dynamic>(
+          closedBuilder: (context, action) {
+            Future<void> openAction() async {
+              final isMobile = globalState.container.read(isMobileViewProvider);
+              if (!isMobile || kDebugMode) {
+                final res = await showExtend(
+                  context,
+                  props: ExtendProps(
+                    blur: openDelegate.blur,
+                    maxWidth: openDelegate.maxWidth,
+                    forceFull: openDelegate.forceFull,
+                  ),
+                  builder: (_) {
+                    return child;
+                  },
+                );
+                if (onChanged != null) {
+                  onChanged(res);
+                }
+                return;
               }
-              return;
+              action();
             }
-            action();
-          }
 
-          return _buildListTile(onTap: openAction);
-        },
-        onClosed: onChanged,
-        openBuilder: (_, action) {
-          return child;
-        },
-      );
-    }
-    if (delegate is NextDelegate) {
-      final nextDelegate = delegate as NextDelegate;
-      final child = nextDelegate.widget;
-
-      return _buildListTile(
-        onTap: () {
-          showExtend(
-            context,
-            props: ExtendProps(
-              blur: nextDelegate.blur,
-              maxWidth: nextDelegate.maxWidth,
-            ),
-            builder: (_) {
-              return child;
-            },
-          );
-        },
-      );
-    }
-    if (delegate is OptionsDelegate) {
-      final optionsDelegate = delegate as OptionsDelegate<T>;
-      return _buildListTile(
-        onTap: () async {
-          final value = await globalState.showCommonDialog<T>(
-            child: OptionsDialog<T>(
-              title: optionsDelegate.title,
-              options: optionsDelegate.options,
-              textBuilder: optionsDelegate.textBuilder,
-              value: optionsDelegate.value,
-            ),
-          );
-          optionsDelegate.onChanged(value);
-        },
-      );
-    }
-    if (delegate is InputDelegate) {
-      final inputDelegate = delegate as InputDelegate;
-      return _buildListTile(
-        onTap: () async {
-          final value = await globalState.showCommonDialog<String>(
-            child: InputDialog(
-              title: inputDelegate.title,
-              value: inputDelegate.value,
-              suffixText: inputDelegate.suffixText,
-              resetValue: inputDelegate.resetValue,
-              inputFormatters: inputDelegate.maxLength == null
-                  ? null
-                  : TextInputLimits.limit(inputDelegate.maxLength!),
-              keyboardType: inputDelegate.keyboardType,
-              validator: inputDelegate.validator,
-            ),
-          );
-          inputDelegate.onChanged(value);
-        },
-      );
-    }
-    if (delegate is CheckboxDelegate) {
-      final checkboxDelegate = delegate as CheckboxDelegate;
-      return _buildListTile(
-        onTap: () {
-          if (checkboxDelegate.onChanged != null) {
-            checkboxDelegate.onChanged!(!checkboxDelegate.value);
-          }
-        },
-        trailing: CommonCheckBox(
-          value: checkboxDelegate.value,
-          onChanged: checkboxDelegate.onChanged,
-        ),
-      );
-    }
-    if (delegate is SwitchDelegate) {
-      final switchDelegate = delegate as SwitchDelegate;
-      return _buildListTile(
-        onTap: () {
-          if (switchDelegate.onChanged != null) {
-            switchDelegate.onChanged!(!switchDelegate.value);
-          }
-        },
-        trailing: Switch(
-          value: switchDelegate.value,
-          onChanged: switchDelegate.onChanged,
-        ),
-      );
-    }
-    if (delegate is RadioDelegate) {
-      final radioDelegate = delegate as RadioDelegate<T>;
-      return _buildListTile(
-        onTap: radioDelegate.onTab,
-        leading: Radio<T>(
-          visualDensity: VisualDensity.compact,
-          materialTapTargetSize: MaterialTapTargetSize.shrinkWrap,
-          value: radioDelegate.value,
-          toggleable: true,
-        ),
-        trailing: trailing,
-      );
+            return _buildListTile(onTap: openAction);
+          },
+          onClosed: onChanged,
+          openBuilder: (_, action) {
+            return child;
+          },
+        );
+      case final _NextAction nextDelegate:
+        final child = nextDelegate.widget;
+
+        return _buildListTile(
+          onTap: () {
+            showExtend(
+              context,
+              props: ExtendProps(
+                blur: nextDelegate.blur,
+                maxWidth: nextDelegate.maxWidth,
+              ),
+              builder: (_) {
+                return child;
+              },
+            );
+          },
+        );
+      case final _OptionsAction options:
+        final optionsDelegate = options as _OptionsAction<T>;
+        return _buildListTile(
+          onTap: () async {
+            final value = await globalState.showCommonDialog<T>(
+              child: OptionsDialog<T>(
+                title: optionsDelegate.title,
+                options: optionsDelegate.options,
+                textBuilder: optionsDelegate.textBuilder,
+                value: optionsDelegate.value,
+              ),
+            );
+            optionsDelegate.onChanged(value);
+          },
+        );
+      case final _InputAction inputDelegate:
+        return _buildListTile(
+          onTap: () async {
+            final value = await globalState.showCommonDialog<String>(
+              child: InputDialog(
+                title: inputDelegate.title,
+                value: inputDelegate.value,
+                suffixText: inputDelegate.suffixText,
+                resetValue: inputDelegate.resetValue,
+                inputFormatters: inputDelegate.maxLength == null
+                    ? null
+                    : TextInputLimits.limit(inputDelegate.maxLength!),
+                keyboardType: inputDelegate.keyboardType,
+                validator: inputDelegate.validator,
+              ),
+            );
+            inputDelegate.onChanged(value);
+          },
+        );
+      case final _CheckboxAction checkboxDelegate:
+        return _buildListTile(
+          onTap: checkboxDelegate.onChanged == null
+              ? null
+              : () {
+                  checkboxDelegate.onChanged!(!checkboxDelegate.value);
+                },
+          trailing: CommonCheckBox(
+            value: checkboxDelegate.value,
+            onChanged: checkboxDelegate.onChanged,
+          ),
+        );
+      case final _ToggleAction toggleAction:
+        return _buildListTile(
+          onTap: toggleAction.onChanged == null
+              ? null
+              : () {
+                  toggleAction.onChanged!(!toggleAction.value);
+                },
+          trailing: Switch(
+            value: toggleAction.value,
+            onChanged: toggleAction.onChanged,
+          ),
+        );
+      case final _RadioAction radio:
+        final radioDelegate = radio as _RadioAction<T>;
+        return _buildListTile(
+          onTap: radioDelegate.onTap,
+          leading: Radio<T>(
+            visualDensity: VisualDensity.compact,
+            materialTapTargetSize: MaterialTapTargetSize.shrinkWrap,
+            value: radioDelegate.value,
+            toggleable: true,
+          ),
+          trailing: trailing,
+        );
+      case _DefaultAction():
+        return _buildListTile(onTap: onTap);
     }
-
-    return _buildListTile(onTap: onTap);
   }
 }
 
diff --git a/lib/widgets/loading.dart b/lib/widgets/loading.dart
index 6a676f14f2..36aac2734d 100644
--- a/lib/widgets/loading.dart
+++ b/lib/widgets/loading.dart
@@ -1,11 +1,34 @@
+import 'dart:async';
+import 'dart:math' as math;
+
 import 'package:flutter/material.dart';
+import 'package:flutter/physics.dart';
+
+enum LoadingIndicatorM3EVariant { defaultStyle, contained }
 
 class CommonCircleLoading extends StatefulWidget {
-  static const double defaultDimension = 32;
+  static const double defaultDimension = 48;
 
+  final LoadingIndicatorM3EVariant variant;
   final Color? color;
+  final Color? containerColor;
+  final List<StarBorder>? polygons;
+  final BoxConstraints? constraints;
+  final EdgeInsetsGeometry? padding;
+  final String? semanticLabel;
+  final String? semanticValue;
 
-  const CommonCircleLoading({super.key, this.color});
+  const CommonCircleLoading({
+    super.key,
+    this.variant = LoadingIndicatorM3EVariant.defaultStyle,
+    this.color,
+    this.containerColor,
+    this.polygons,
+    this.constraints,
+    this.padding,
+    this.semanticLabel,
+    this.semanticValue,
+  }) : assert(polygons == null || polygons.length > 1);
 
   @override
   State<CommonCircleLoading> createState() => _CommonCircleLoadingState();
@@ -13,53 +36,195 @@ class CommonCircleLoading extends StatefulWidget {
 
 class _CommonCircleLoadingState extends State<CommonCircleLoading>
     with TickerProviderStateMixin {
-  late AnimationController _rotateController;
-  late AnimationController _pointsController;
-  late Animation<double> _pointsAnimation;
+  static const _globalRotationDuration = Duration(milliseconds: 4666);
+  static const _morphInterval = Duration(milliseconds: 650);
+  static const _fullRotation = 360.0;
+  static const _quarterRotation = _fullRotation / 4;
+  static const _activeIndicatorScale = 38 / 48;
+  static const _defaultConstraints = BoxConstraints.tightFor(
+    width: CommonCircleLoading.defaultDimension,
+    height: CommonCircleLoading.defaultDimension,
+  );
+
+  static const List<_ShapeSpec> _defaultShapeSequence = [
+    // Soft burst.
+    _ShapeSpec(
+      points: 10,
+      innerRadiusRatio: 0.78,
+      pointRounding: 0.55,
+      valleyRounding: 0.35,
+    ),
+    // Nine-sided cookie.
+    _ShapeSpec(
+      points: 9,
+      innerRadiusRatio: 0.86,
+      pointRounding: 0.62,
+      valleyRounding: 0.28,
+    ),
+    // Pentagon.
+    _ShapeSpec(points: 5, innerRadiusRatio: 0.81, pointRounding: 0.25),
+    // Horizontal pill.
+    _ShapeSpec(
+      points: 2,
+      innerRadiusRatio: 1,
+      pointRounding: 0.5,
+      valleyRounding: 0.5,
+      widthScale: 0.95,
+      heightScale: 0.52,
+      squash: 1,
+    ),
+    // Sunny.
+    _ShapeSpec(
+      points: 8,
+      innerRadiusRatio: 0.58,
+      pointRounding: 0.52,
+      valleyRounding: 0.18,
+    ),
+    // Four-sided cookie.
+    _ShapeSpec(
+      points: 4,
+      innerRadiusRatio: 0.78,
+      pointRounding: 0.62,
+      valleyRounding: 0.28,
+    ),
+    // Vertical oval.
+    _ShapeSpec(
+      points: 2,
+      innerRadiusRatio: 1,
+      pointRounding: 0.5,
+      valleyRounding: 0.5,
+      widthScale: 0.62,
+      heightScale: 0.95,
+      squash: 1,
+    ),
+  ];
+
+  final SpringSimulation _morphAnimation = SpringSimulation(
+    SpringDescription.withDampingRatio(mass: 1, stiffness: 200, ratio: 0.6),
+    0,
+    1,
+    5,
+    snapToEnd: true,
+  );
+
+  late final AnimationController _morphController;
+  late final AnimationController _globalRotationController;
+  late final Listenable _animation;
+
+  var _currentMorphIndex = 0;
+  var _morphRotationTargetAngle = _quarterRotation;
 
   @override
   void initState() {
     super.initState();
-    _rotateController = AnimationController(
-      duration: const Duration(seconds: 3),
+    _morphController = AnimationController.unbounded(vsync: this);
+    _globalRotationController = AnimationController(
+      duration: _globalRotationDuration,
       vsync: this,
     )..repeat();
-
-    _pointsController = AnimationController(
-      duration: const Duration(seconds: 1),
-      vsync: this,
-    )..repeat(reverse: true);
-
-    _pointsAnimation = Tween<double>(begin: 3.0, end: 9.0).animate(
-      CurvedAnimation(parent: _pointsController, curve: Curves.easeInOut),
-    );
+    _animation = Listenable.merge([
+      _morphController,
+      _globalRotationController,
+    ]);
+    unawaited(_runMorphLoop());
   }
 
   @override
   void dispose() {
-    _rotateController.dispose();
-    _pointsController.dispose();
+    _morphController.dispose();
+    _globalRotationController.dispose();
     super.dispose();
   }
 
+  @override
+  void didUpdateWidget(covariant CommonCircleLoading oldWidget) {
+    super.didUpdateWidget(oldWidget);
+    if (widget.polygons != oldWidget.polygons &&
+        _currentMorphIndex >= _shapeCount) {
+      _currentMorphIndex = 0;
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
-    final color = widget.color ?? Theme.of(context).colorScheme.primary;
+    final colorScheme = Theme.of(context).colorScheme;
+    final activeColor = switch (widget.variant) {
+      LoadingIndicatorM3EVariant.defaultStyle =>
+        widget.color ?? colorScheme.primary,
+      LoadingIndicatorM3EVariant.contained =>
+        widget.color ?? colorScheme.onPrimaryContainer,
+    };
+    final backgroundColor = switch (widget.variant) {
+      LoadingIndicatorM3EVariant.defaultStyle =>
+        widget.containerColor ?? Colors.transparent,
+      LoadingIndicatorM3EVariant.contained =>
+        widget.containerColor ?? colorScheme.primaryContainer,
+    };
+    final shapeSequence =
+        widget.polygons
+            ?.map(_ShapeSpec.fromStarBorder)
+            .toList(growable: false) ??
+        _defaultShapeSequence;
+    final padding = (widget.padding ?? EdgeInsets.zero).resolve(
+      Directionality.of(context),
+    );
 
     return LayoutBuilder(
       builder: (context, constraints) {
-        final dimension = _resolveDimension(constraints);
+        final indicatorConstraints = constraints.deflate(padding);
+        final dimension = _resolveDimension(
+          indicatorConstraints,
+          widget.constraints ?? _defaultConstraints,
+        );
+        final currentMorphIndex = _currentMorphIndex % shapeSequence.length;
         return Align(
           widthFactor: 1,
           heightFactor: 1,
-          child: RepaintBoundary(
-            child: RotationTransition(
-              turns: _rotateController,
-              child: CustomPaint(
-                size: Size.square(dimension),
-                painter: _StarPainter(
-                  points: _pointsAnimation.value,
-                  color: color,
+          child: Semantics(
+            label: widget.semanticLabel,
+            value: widget.semanticValue,
+            child: DecoratedBox(
+              decoration: BoxDecoration(
+                color: backgroundColor,
+                borderRadius: BorderRadius.circular(999),
+              ),
+              child: Padding(
+                padding: padding,
+                child: RepaintBoundary(
+                  child: SizedBox.square(
+                    dimension: dimension,
+                    child: AnimatedBuilder(
+                      animation: _animation,
+                      builder: (context, child) {
+                        final morphProgress = _morphController.value.clamp(
+                          0.0,
+                          1.0,
+                        );
+                        final rotationDegrees =
+                            morphProgress * _quarterRotation +
+                            _morphRotationTargetAngle +
+                            _globalRotationController.value * _fullRotation;
+                        final shape = _ShapeSpec.lerp(
+                          shapeSequence[currentMorphIndex],
+                          shapeSequence[(currentMorphIndex + 1) %
+                              shapeSequence.length],
+                          morphProgress,
+                        );
+                        return Transform.rotate(
+                          angle: rotationDegrees * math.pi / 180,
+                          child: CustomPaint(
+                            painter: _ShapePainter(
+                              shape: shape,
+                              color: activeColor,
+                              scaleFactor: _activeIndicatorScale,
+                            ),
+                            child: child,
+                          ),
+                        );
+                      },
+                      child: const SizedBox.expand(),
+                    ),
+                  ),
                 ),
               ),
             ),
@@ -69,9 +234,21 @@ class _CommonCircleLoadingState extends State<CommonCircleLoading>
     );
   }
 
-  double _resolveDimension(BoxConstraints constraints) {
-    final maxWidth = constraints.maxWidth;
-    final maxHeight = constraints.maxHeight;
+  int get _shapeCount =>
+      widget.polygons?.length ?? _defaultShapeSequence.length;
+
+  double _resolveDimension(
+    BoxConstraints parentConstraints,
+    BoxConstraints preferredConstraints,
+  ) {
+    final effectiveConstraints = preferredConstraints.enforce(
+      BoxConstraints(
+        maxWidth: parentConstraints.maxWidth,
+        maxHeight: parentConstraints.maxHeight,
+      ),
+    );
+    final maxWidth = effectiveConstraints.maxWidth;
+    final maxHeight = effectiveConstraints.maxHeight;
 
     if (maxWidth.isFinite && maxHeight.isFinite) {
       return maxWidth < maxHeight ? maxWidth : maxHeight;
@@ -87,33 +264,143 @@ class _CommonCircleLoadingState extends State<CommonCircleLoading>
 
     return CommonCircleLoading.defaultDimension;
   }
+
+  Future<void> _runMorphLoop() async {
+    while (mounted) {
+      final startedAt = DateTime.now();
+      try {
+        await _morphController.animateWith(_morphAnimation).orCancel;
+      } on TickerCanceled {
+        return;
+      }
+
+      final elapsed = DateTime.now().difference(startedAt);
+      if (elapsed < _morphInterval) {
+        await Future<void>.delayed(_morphInterval - elapsed);
+      }
+      if (!mounted) {
+        return;
+      }
+
+      setState(() {
+        _currentMorphIndex = (_currentMorphIndex + 1) % _shapeCount;
+        _morphRotationTargetAngle =
+            (_morphRotationTargetAngle + _quarterRotation) % _fullRotation;
+        _morphController.value = 0;
+      });
+    }
+  }
 }
 
-class _StarPainter extends CustomPainter {
+class _ShapeSpec {
   final double points;
+  final double innerRadiusRatio;
+  final double pointRounding;
+  final double valleyRounding;
+  final double widthScale;
+  final double heightScale;
+  final double squash;
+
+  const _ShapeSpec({
+    required this.points,
+    required this.innerRadiusRatio,
+    required this.pointRounding,
+    this.valleyRounding = 0,
+    this.widthScale = 1,
+    this.heightScale = 1,
+    this.squash = 0,
+  });
+
+  static _ShapeSpec lerp(_ShapeSpec begin, _ShapeSpec end, double progress) {
+    return _ShapeSpec(
+      points: _lerp(begin.points, end.points, progress),
+      innerRadiusRatio: _lerp(
+        begin.innerRadiusRatio,
+        end.innerRadiusRatio,
+        progress,
+      ),
+      pointRounding: _lerp(begin.pointRounding, end.pointRounding, progress),
+      valleyRounding: _lerp(begin.valleyRounding, end.valleyRounding, progress),
+      widthScale: _lerp(begin.widthScale, end.widthScale, progress),
+      heightScale: _lerp(begin.heightScale, end.heightScale, progress),
+      squash: _lerp(begin.squash, end.squash, progress),
+    );
+  }
+
+  static _ShapeSpec fromStarBorder(StarBorder border) {
+    return _ShapeSpec(
+      points: border.points,
+      innerRadiusRatio: border.innerRadiusRatio,
+      pointRounding: border.pointRounding,
+      valleyRounding: border.valleyRounding,
+      squash: border.squash,
+    );
+  }
+
+  static double _lerp(double begin, double end, double progress) {
+    return begin + (end - begin) * progress;
+  }
+
+  @override
+  bool operator ==(Object other) {
+    return other is _ShapeSpec &&
+        other.points == points &&
+        other.innerRadiusRatio == innerRadiusRatio &&
+        other.pointRounding == pointRounding &&
+        other.valleyRounding == valleyRounding &&
+        other.widthScale == widthScale &&
+        other.heightScale == heightScale &&
+        other.squash == squash;
+  }
+
+  @override
+  int get hashCode => Object.hash(
+    points,
+    innerRadiusRatio,
+    pointRounding,
+    valleyRounding,
+    widthScale,
+    heightScale,
+    squash,
+  );
+}
+
+class _ShapePainter extends CustomPainter {
+  final _ShapeSpec shape;
   final Color color;
+  final double scaleFactor;
   final Paint _paint;
 
-  _StarPainter({required this.points, required this.color})
-    : _paint = Paint()..color = color;
+  _ShapePainter({
+    required this.shape,
+    required this.color,
+    required this.scaleFactor,
+  }) : _paint = Paint()
+         ..style = PaintingStyle.fill
+         ..isAntiAlias = true
+         ..color = color;
 
   @override
   void paint(Canvas canvas, Size size) {
-    final rect = Offset.zero & size;
-    final starBorder = StarBorder(
-      points: points,
-      innerRadiusRatio: 0.8,
-      pointRounding: 0.5,
-      valleyRounding: 0.1,
-      squash: 0.5,
+    final rect = Rect.fromCenter(
+      center: size.center(Offset.zero),
+      width: size.width * scaleFactor * shape.widthScale,
+      height: size.height * scaleFactor * shape.heightScale,
     );
-
-    final path = starBorder.getOuterPath(rect);
-    canvas.drawPath(path, _paint);
+    final border = StarBorder(
+      points: shape.points,
+      innerRadiusRatio: shape.innerRadiusRatio,
+      pointRounding: shape.pointRounding,
+      valleyRounding: shape.valleyRounding,
+      squash: shape.squash,
+    );
+    canvas.drawPath(border.getOuterPath(rect), _paint);
   }
 
   @override
-  bool shouldRepaint(covariant _StarPainter oldDelegate) {
-    return oldDelegate.points != points || oldDelegate.color != color;
+  bool shouldRepaint(covariant _ShapePainter oldDelegate) {
+    return oldDelegate.shape != shape ||
+        oldDelegate.color != color ||
+        oldDelegate.scaleFactor != scaleFactor;
   }
 }
diff --git a/lib/widgets/open_container.dart b/lib/widgets/open_container.dart
index 47b7f27792..a424c634c8 100644
--- a/lib/widgets/open_container.dart
+++ b/lib/widgets/open_container.dart
@@ -269,6 +269,10 @@ class _OpenContainerRoute<T> extends ModalRoute<T> {
 
   final _FlippableTweenSequence<double> _closedOpacityTween;
   final _FlippableTweenSequence<double> _openOpacityTween;
+  final Animatable<Color?> _scrimTween = ColorTween(
+    begin: Colors.transparent,
+    end: Colors.transparent,
+  );
   late _FlippableTweenSequence<Color?> _colorTween;
   final GlobalKey _openBuilderKey = GlobalKey();
   final RectTween _rectTween = RectTween();
@@ -475,60 +479,64 @@ class _OpenContainerRoute<T> extends ModalRoute<T> {
 
           final Rect rect = _rectTween.evaluate(curvedAnimation)!;
           return SizedBox.expand(
-            child: Align(
-              alignment: Alignment.topLeft,
-              child: Transform.translate(
-                offset: Offset(rect.left, rect.top),
-                child: SizedBox(
-                  width: rect.width,
-                  height: rect.height,
-                  child: Material(
-                    clipBehavior: Clip.antiAlias,
-                    animationDuration: Duration.zero,
-                    color: colorTween!.evaluate(animation),
-                    child: Stack(
-                      fit: StackFit.passthrough,
-                      children: <Widget>[
-                        // Closed child fading out.
-                        FittedBox(
-                          fit: BoxFit.fitWidth,
-                          alignment: Alignment.topLeft,
-                          child: SizedBox(
-                            width: _rectTween.begin!.width,
-                            height: _rectTween.begin!.height,
-                            child: (hideableKey.currentState?.isInTree ?? false)
-                                ? null
-                                : FadeTransition(
-                                    opacity: closedOpacityTween!.animate(
-                                      animation,
+            child: Container(
+              color: _scrimTween.evaluate(curvedAnimation),
+              child: Align(
+                alignment: Alignment.topLeft,
+                child: Transform.translate(
+                  offset: Offset(rect.left, rect.top),
+                  child: SizedBox(
+                    width: rect.width,
+                    height: rect.height,
+                    child: Material(
+                      clipBehavior: Clip.antiAlias,
+                      animationDuration: Duration.zero,
+                      color: colorTween!.evaluate(animation),
+                      child: Stack(
+                        fit: StackFit.passthrough,
+                        children: <Widget>[
+                          // Closed child fading out.
+                          FittedBox(
+                            fit: BoxFit.fitWidth,
+                            alignment: Alignment.topLeft,
+                            child: SizedBox(
+                              width: _rectTween.begin!.width,
+                              height: _rectTween.begin!.height,
+                              child:
+                                  (hideableKey.currentState?.isInTree ?? false)
+                                  ? null
+                                  : FadeTransition(
+                                      opacity: closedOpacityTween!.animate(
+                                        animation,
+                                      ),
+                                      child: Builder(
+                                        key: closedBuilderKey,
+                                        builder: (BuildContext context) {
+                                          // Use dummy "open container" callback
+                                          // since we are in the process of opening.
+                                          return closedBuilder(context, () {});
+                                        },
+                                      ),
                                     ),
-                                    child: Builder(
-                                      key: closedBuilderKey,
-                                      builder: (BuildContext context) {
-                                        // Use dummy "open container" callback
-                                        // since we are in the process of opening.
-                                        return closedBuilder(context, () {});
-                                      },
-                                    ),
-                                  ),
+                            ),
                           ),
-                        ),
-                        // Open child fading in.
-                        OverflowBox(
-                          maxWidth: _rectTween.end!.width,
-                          maxHeight: _rectTween.end!.height,
-                          alignment: Alignment.topLeft,
-                          child: FadeTransition(
-                            opacity: openOpacityTween!.animate(animation),
-                            child: Builder(
-                              key: _openBuilderKey,
-                              builder: (BuildContext context) {
-                                return openBuilder(context, closeContainer);
-                              },
+                          // Open child fading in.
+                          OverflowBox(
+                            maxWidth: _rectTween.end!.width,
+                            maxHeight: _rectTween.end!.height,
+                            alignment: Alignment.topLeft,
+                            child: FadeTransition(
+                              opacity: openOpacityTween!.animate(animation),
+                              child: Builder(
+                                key: _openBuilderKey,
+                                builder: (BuildContext context) {
+                                  return openBuilder(context, closeContainer);
+                                },
+                              ),
                             ),
                           ),
-                        ),
-                      ],
+                        ],
+                      ),
                     ),
                   ),
                 ),
diff --git a/lib/widgets/super_grid.dart b/lib/widgets/super_grid.dart
index 7c94199913..517db63794 100644
--- a/lib/widgets/super_grid.dart
+++ b/lib/widgets/super_grid.dart
@@ -10,8 +10,6 @@ import 'package:fl_clash/widgets/grid.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/physics.dart';
 
-typedef VoidCallback = void Function();
-
 class SuperGrid extends StatefulWidget {
   final List<GridItem> children;
   final double mainAxisSpacing;
@@ -33,7 +31,11 @@ class SuperGrid extends StatefulWidget {
 }
 
 class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
-  final ValueNotifier<List<GridItem>> _childrenNotifier = ValueNotifier([]);
+  static const _reorderDuration = Duration(milliseconds: 420);
+  static const _shakeDuration = Duration(milliseconds: 480);
+  static const _reorderCurve = Cubic(0.22, 0.72, 0.24, 1.08);
+
+  late final ValueNotifier<List<GridItem>> _childrenNotifier;
   List<GridItem> children = [];
 
   int get length => _childrenNotifier.value.length;
@@ -46,7 +48,6 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
   List<Offset> _offsets = [];
   Offset _parentOffset = Offset.zero;
   EdgeDraggingAutoScroller? _edgeDraggingAutoScroller;
-  Map<int, Tween<Offset>> _transformTweenMap = {};
 
   final ValueNotifier<bool> _animating = ValueNotifier(false);
 
@@ -57,7 +58,7 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
   late AnimationController _transformController;
 
   Future<bool> get isTransformCompleter =>
-      _transformCompleter?.future ?? Future(() => true);
+      _transformCompleter?.future ?? Future<bool>.value(true);
 
   Completer<bool>? _transformCompleter;
 
@@ -67,15 +68,21 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
   Animation<Offset>? _fakeDragWidgetAnimation;
 
   late AnimationController _shakeController;
-  late Animation<double> _shakeAnimation;
   Rect _dragRect = Rect.zero;
   Scrollable? _scrollable;
+  bool _isDragging = false;
 
   int get crossCount => widget.crossAxisCount;
 
-  void _onChildrenChange() {
+  void _stopAutoScroll() {
+    _edgeDraggingAutoScroller?.stopAutoScroll();
+  }
+
+  void _handleChildrenChanged() {
+    children = List<GridItem>.of(_childrenNotifier.value);
     _tempIndexList = List.generate(length, (index) => index);
     _itemContexts = List.filled(length, null);
+    widget.onUpdate?.call();
   }
 
   void _preTransformState() {
@@ -99,7 +106,6 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
     _transformController.value = 0;
     _sizes = List.generate(length, (index) => Size.zero);
     _offsets = [];
-    _transformTweenMap.clear();
     _transformAnimationMap.clear();
     _containerSize = Size.zero;
     _dragIndexNotifier.value = -1;
@@ -113,36 +119,28 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
   @override
   void initState() {
     super.initState();
-    children = widget.children;
-    _childrenNotifier.addListener(() {
-      children = _childrenNotifier.value;
-      if (widget.onUpdate != null) {
-        widget.onUpdate!();
-      }
-    });
-
-    _childrenNotifier.value = widget.children;
+    children = List<GridItem>.of(widget.children);
+    _childrenNotifier = ValueNotifier(children)
+      ..addListener(_handleChildrenChanged);
+    _tempIndexList = List.generate(length, (index) => index);
+    _itemContexts = List.filled(length, null);
 
     _fakeDragWidgetController = AnimationController.unbounded(vsync: this);
 
     _shakeController = AnimationController(
       vsync: this,
-      duration: const Duration(milliseconds: 120),
-    );
-
-    _shakeAnimation = Tween<double>(begin: -0.012, end: 0.012).animate(
-      CurvedAnimation(parent: _shakeController, curve: Curves.easeInOut),
-    );
+      duration: _shakeDuration,
+    )..repeat();
 
     _transformController = AnimationController(
       vsync: this,
-      duration: commonDuration,
+      duration: _reorderDuration,
     );
     _initState();
   }
 
   void handleAdd(GridItem gridItem) {
-    _childrenNotifier.value = List.from(_childrenNotifier.value)..add(gridItem);
+    _childrenNotifier.value = [..._childrenNotifier.value, gridItem];
   }
 
   @override
@@ -151,20 +149,33 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
 
     final scrollable = context.findAncestorWidgetOfExactType<Scrollable>();
     if (scrollable == null) {
+      _stopAutoScroll();
+      _scrollable = null;
+      _edgeDraggingAutoScroller = null;
       return;
     }
-    if (_scrollable != scrollable) {
-      _edgeDraggingAutoScroller = EdgeDraggingAutoScroller(
-        Scrollable.of(context),
-        onScrollViewScrolled: () {
-          _edgeDraggingAutoScroller?.startAutoScrollIfNecessary(_dragRect);
-        },
-        velocityScalar: 40,
-      );
+    if (_scrollable == scrollable) {
+      return;
     }
+    _stopAutoScroll();
+    _scrollable = scrollable;
+    late final EdgeDraggingAutoScroller autoScroller;
+    autoScroller = EdgeDraggingAutoScroller(
+      Scrollable.of(context),
+      onScrollViewScrolled: () {
+        if (!mounted ||
+            !_isDragging ||
+            !identical(_edgeDraggingAutoScroller, autoScroller)) {
+          return;
+        }
+        autoScroller.startAutoScrollIfNecessary(_dragRect);
+      },
+      velocityScalar: 40,
+    );
+    _edgeDraggingAutoScroller = autoScroller;
   }
 
-  Future _transform() async {
+  Future<bool> _transform() async {
     final List<Offset> layoutOffsets = [Offset(_containerSize.width, 0)];
     final List<Offset> nextOffsets = [];
 
@@ -210,42 +221,35 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
       layoutOffsets.removeRange(min(startIndex + 1, endIndex), endIndex);
     }
 
-    final Map<int, Tween<Offset>> transformTweenMap = {};
-
-    for (final index in _tempIndexList) {
-      final nextIndex = _tempIndexList.indexWhere((i) => i == index);
-      transformTweenMap[index] = Tween(
-        begin: _transformTweenMap[index]?.begin ?? Offset.zero,
+    final transformAnimationMap = <int, Animation<Offset>>{};
+    final transformCurve = CurvedAnimation(
+      parent: _transformController,
+      curve: _reorderCurve,
+    );
+    for (var nextIndex = 0; nextIndex < _tempIndexList.length; nextIndex++) {
+      final index = _tempIndexList[nextIndex];
+      transformAnimationMap[index] = Tween<Offset>(
+        begin: _transformAnimationMap[index]?.value ?? Offset.zero,
         end: nextOffsets[nextIndex] - _offsets[index],
-      );
+      ).animate(transformCurve);
     }
-
-    _transformTweenMap = transformTweenMap;
-
-    _transformAnimationMap = transformTweenMap.map((key, value) {
-      final preAnimationValue = _transformAnimationMap[key]?.value;
-      return MapEntry(
-        key,
-        Tween(begin: preAnimationValue ?? Offset.zero, end: value.end).animate(
-          _transformController.drive(
-            Tween<double>(
-              begin: 0.0,
-              end: 1,
-            ).chain(CurveTween(curve: Curves.fastOutSlowIn)),
-          ),
-        ),
-      );
-    });
+    _transformAnimationMap = transformAnimationMap;
 
     if (_targetIndex != -1) {
       _targetOffset = nextOffsets[_targetIndex];
     }
-    return _transformController.forward(from: 0);
+    try {
+      await _transformController.forward(from: 0).orCancel;
+      return true;
+    } on TickerCanceled {
+      return false;
+    }
   }
 
   void _handleDragStarted(int index) {
     _initState();
     _preTransformState();
+    _isDragging = true;
     _dragIndexNotifier.value = index;
     _dragWidgetSizeNotifier.value = _sizes[index];
     _targetIndex = index;
@@ -259,41 +263,71 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
   }
 
   Future<void> _handleDragEnd(DraggableDetails details) async {
-    final children = List<GridItem>.from(_childrenNotifier.value);
-    children.insert(_targetIndex, children.removeAt(_dragIndexNotifier.value));
-    this.children = children;
+    _isDragging = false;
+    _stopAutoScroll();
     debouncer.cancel(FunctionTag.handleWill);
-    if (_targetIndex == -1) {
+    final dragIndex = _dragIndexNotifier.value;
+    if (_targetIndex < 0 ||
+        _targetIndex >= length ||
+        dragIndex < 0 ||
+        dragIndex >= length) {
+      _initState();
       return;
     }
-    const tolerance = Tolerance(distance: 0.5, velocity: 0.01);
-    const spring = SpringDescription(mass: 1, stiffness: 100, damping: 10);
+
+    final nextChildren = List<GridItem>.of(_childrenNotifier.value);
+    nextChildren.insert(_targetIndex, nextChildren.removeAt(dragIndex));
+    children = nextChildren;
+
+    const tolerance = Tolerance(distance: 0.001, velocity: 0.01);
+    const spring = SpringDescription(mass: 1, stiffness: 180, damping: 18);
     final simulation = SpringSimulation(spring, 0, 1, 0, tolerance: tolerance);
-    _fakeDragWidgetAnimation = Tween(
+    _fakeDragWidgetAnimation = Tween<Offset>(
       begin: details.offset - _parentOffset,
       end: _targetOffset,
     ).animate(_fakeDragWidgetController);
     _animating.value = true;
 
-    _transformCompleter = Completer<bool>();
-    await _fakeDragWidgetController.animateWith(simulation);
-    _transformCompleter?.complete(true);
-    _animating.value = false;
-    _fakeDragWidgetAnimation = null;
-    _transformTweenMap.clear();
-    _transformAnimationMap.clear();
-    _childrenNotifier.value = children;
-    _initState();
+    final completer = Completer<bool>();
+    _transformCompleter = completer;
+    try {
+      await _fakeDragWidgetController.animateWith(simulation).orCancel;
+      if (!mounted) {
+        return;
+      }
+      _animating.value = false;
+      _fakeDragWidgetAnimation = null;
+      _transformAnimationMap.clear();
+      _childrenNotifier.value = nextChildren;
+      _initState();
+      completer.complete(true);
+    } on TickerCanceled {
+      if (mounted) {
+        _animating.value = false;
+        _fakeDragWidgetAnimation = null;
+        _initState();
+      }
+    } finally {
+      if (!completer.isCompleted) {
+        completer.complete(false);
+      }
+      if (identical(_transformCompleter, completer)) {
+        _transformCompleter = null;
+      }
+    }
   }
 
   void _handleDragUpdate(DragUpdateDetails details) {
+    if (!_isDragging) {
+      return;
+    }
     _dragRect = _dragRect.translate(0, details.delta.dy);
     _edgeDraggingAutoScroller?.startAutoScrollIfNecessary(_dragRect);
   }
 
   Future<void> _handleWill(int index) async {
     final dragIndex = _dragIndexNotifier.value;
-    if (dragIndex < 0 || dragIndex > _offsets.length - 1) {
+    if (dragIndex < 0 || dragIndex >= _offsets.length) {
       return;
     }
     final targetIndex = _tempIndexList.indexWhere((i) => i == index);
@@ -321,7 +355,10 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
     _preTransformState();
     final indexWhere = _tempIndexList.indexWhere((i) => i == index);
     _tempIndexList.removeAt(indexWhere);
-    await _transform();
+    final completed = await _transform();
+    if (!completed || !mounted) {
+      return;
+    }
     final children = List<GridItem>.from(_childrenNotifier.value);
     children.removeAt(index);
     _childrenNotifier.value = children;
@@ -333,7 +370,7 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
       valueListenable: _animating,
       builder: (_, animating, child) {
         if (animating && _dragIndexNotifier.value == index) {
-          return _buildSizeBox(Container(), index);
+          return _buildSizeBox(const SizedBox.shrink());
         }
         return child!;
       },
@@ -382,7 +419,7 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
     return nextOffset;
   }
 
-  Widget _buildSizeBox(Widget child, int index) {
+  Widget _buildSizeBox(Widget child) {
     return ValueListenableBuilder(
       valueListenable: _dragWidgetSizeNotifier,
       builder: (_, size, child) {
@@ -396,27 +433,19 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
     return ValueListenableBuilder(
       valueListenable: _animating,
       builder: (_, animating, child) {
-        if (animating) {
-          return ActivateBox(child: child!);
-        } else {
-          return child!;
-        }
+        return animating ? ActivateBox(child: child!) : child!;
       },
       child: child,
     );
   }
 
-  Widget _buildShake(Widget child) {
-    final random = 0.7 + Random().nextDouble() * 0.3;
-    _shakeController.stop();
-    _shakeController.repeat(reverse: true);
+  Widget _buildShake(Widget child, int index) {
     return AnimatedBuilder(
-      animation: _shakeAnimation,
+      animation: _shakeController,
       builder: (_, child) {
-        return Transform.rotate(
-          angle: _shakeAnimation.value * random,
-          child: child!,
-        );
+        final phase = index * pi / 2;
+        final angle = sin(_shakeController.value * 2 * pi + phase) * 0.01;
+        return Transform.rotate(angle: angle, child: child!);
       },
       child: child,
     );
@@ -464,64 +493,64 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
               },
               child: child!,
             ),
+            index,
           );
         },
         child: target,
       ),
     );
+    void onDragStarted() {
+      _handleDragStarted(index);
+    }
+
+    void onDragUpdate(DragUpdateDetails details) {
+      _handleDragUpdate(details);
+    }
+
+    void onDragEnd(DraggableDetails details) {
+      _handleDragEnd(details);
+    }
+
     final draggableChild = system.isDesktop
         ? Draggable(
             childWhenDragging: childWhenDragging,
             data: index,
             feedback: feedback,
-            onDragStarted: () {
-              _handleDragStarted(index);
-            },
-            onDragUpdate: (details) {
-              _handleDragUpdate(details);
-            },
-            onDragEnd: (details) {
-              _handleDragEnd(details);
-            },
+            onDragStarted: onDragStarted,
+            onDragUpdate: onDragUpdate,
+            onDragEnd: onDragEnd,
             child: shakeTarget,
           )
         : LongPressDraggable(
             childWhenDragging: childWhenDragging,
             data: index,
             feedback: feedback,
-            onDragStarted: () {
-              _handleDragStarted(index);
-            },
-            onDragUpdate: (details) {
-              _handleDragUpdate(details);
-            },
-            onDragEnd: (details) {
-              _handleDragEnd(details);
-            },
+            onDragStarted: onDragStarted,
+            onDragUpdate: onDragUpdate,
+            onDragEnd: onDragEnd,
             child: shakeTarget,
           );
     return draggableChild;
   }
 
   Widget _builderItem(int index) {
-    final girdItem = _childrenNotifier.value[index];
-    final child = girdItem.child;
+    final gridItem = _childrenNotifier.value[index];
+    final child = gridItem.child;
     return GridItem(
-      mainAxisCellCount: girdItem.mainAxisCellCount,
-      crossAxisCellCount: girdItem.crossAxisCellCount,
+      mainAxisCellCount: gridItem.mainAxisCellCount,
+      crossAxisCellCount: gridItem.crossAxisCellCount,
       child: Builder(
         builder: (context) {
           _itemContexts[index] = context;
           final childWhenDragging = ActivateBox(
             child: Opacity(
               opacity: 0.6,
-              child: _buildSizeBox(CommonCard(child: child), index),
+              child: _buildSizeBox(CommonCard(child: child)),
             ),
           );
           final feedback = ActivateBox(
             child: _buildSizeBox(
               CommonCard(child: Material(elevation: 6, child: child)),
-              index,
             ),
           );
           return _buildTransform(
@@ -544,7 +573,7 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
       builder: (_, animating, _) {
         final index = _dragIndexNotifier.value;
         if (!animating || _fakeDragWidgetAnimation == null || index == -1) {
-          return Container();
+          return const SizedBox.shrink();
         }
         return _buildSizeBox(
           AnimatedBuilder(
@@ -557,7 +586,6 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
             },
             child: ActivateBox(child: _childrenNotifier.value[index].child),
           ),
-          index,
         );
       },
     );
@@ -565,10 +593,28 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
 
   @override
   void dispose() {
+    _isDragging = false;
+    _stopAutoScroll();
+    _edgeDraggingAutoScroller = null;
     _scrollable = null;
+    debouncer.cancel(FunctionTag.handleWill);
+    final completer = _transformCompleter;
+    if (completer != null && !completer.isCompleted) {
+      completer.complete(false);
+    }
+    _transformCompleter = null;
+    _childrenNotifier.removeListener(_handleChildrenChanged);
+    _childrenNotifier.value = const [];
+    children = const [];
+    _itemContexts = [];
+    _sizes = [];
+    _offsets = [];
+    _transformAnimationMap.clear();
+    _fakeDragWidgetAnimation = null;
     _fakeDragWidgetController.dispose();
     _shakeController.dispose();
     _transformController.dispose();
+    _dragWidgetSizeNotifier.dispose();
     _dragIndexNotifier.dispose();
     _animating.dispose();
     _childrenNotifier.dispose();
@@ -584,7 +630,6 @@ class SuperGridState extends State<SuperGrid> with TickerProviderStateMixin {
             ValueListenableBuilder(
               valueListenable: _childrenNotifier,
               builder: (_, children, _) {
-                _onChildrenChange();
                 return Grid(
                   axisDirection: AxisDirection.down,
                   crossAxisCount: crossCount,
diff --git a/lib/widgets/theme.dart b/lib/widgets/theme.dart
index fba78ae91a..4025250d6c 100644
--- a/lib/widgets/theme.dart
+++ b/lib/widgets/theme.dart
@@ -55,24 +55,23 @@ class SliderDefaultsM3 extends SliderThemeData {
   Color? get inactiveTrackColor => _colors.secondaryContainer;
 
   @override
-  Color? get secondaryActiveTrackColor => _colors.primary.withOpacity(0.54);
+  Color? get secondaryActiveTrackColor =>
+      _colors.primary.withValues(alpha: 0.54);
 
   @override
-  Color? get disabledActiveTrackColor => _colors.onSurface.withOpacity(0.38);
+  Color? get disabledActiveTrackColor => _colors.onSurface.opacity38;
 
   @override
-  Color? get disabledInactiveTrackColor => _colors.onSurface.withOpacity(0.12);
+  Color? get disabledInactiveTrackColor => _colors.onSurface.opacity12;
 
   @override
-  Color? get disabledSecondaryActiveTrackColor =>
-      _colors.onSurface.withOpacity(0.38);
+  Color? get disabledSecondaryActiveTrackColor => _colors.onSurface.opacity38;
 
   @override
-  Color? get activeTickMarkColor => _colors.onPrimary.withOpacity(1.0);
+  Color? get activeTickMarkColor => _colors.onPrimary;
 
   @override
-  Color? get inactiveTickMarkColor =>
-      _colors.onSecondaryContainer.withOpacity(1.0);
+  Color? get inactiveTickMarkColor => _colors.onSecondaryContainer;
 
   @override
   Color? get disabledActiveTickMarkColor => _colors.onInverseSurface;
@@ -84,19 +83,19 @@ class SliderDefaultsM3 extends SliderThemeData {
   Color? get thumbColor => _colors.primary;
 
   @override
-  Color? get disabledThumbColor => _colors.onSurface.withOpacity(0.38);
+  Color? get disabledThumbColor => _colors.onSurface.opacity38;
 
   @override
   Color? get overlayColor =>
       WidgetStateColor.resolveWith((Set<WidgetState> states) {
         if (states.contains(WidgetState.dragged)) {
-          return _colors.primary.withOpacity(0.1);
+          return _colors.primary.opacity10;
         }
         if (states.contains(WidgetState.hovered)) {
-          return _colors.primary.withOpacity(0.08);
+          return _colors.primary.withValues(alpha: 0.08);
         }
         if (states.contains(WidgetState.focused)) {
-          return _colors.primary.withOpacity(0.1);
+          return _colors.primary.opacity10;
         }
 
         return Colors.transparent;
diff --git a/lib/widgets/widgets.dart b/lib/widgets/widgets.dart
index 72eb54f48f..0d5a7b6ce7 100644
--- a/lib/widgets/widgets.dart
+++ b/lib/widgets/widgets.dart
@@ -1,5 +1,6 @@
 export 'activate_box.dart';
 export 'animate_grid.dart';
+export 'animated_visibility.dart';
 export 'builder.dart';
 export 'button.dart';
 export 'card.dart';
diff --git a/linux/flutter/generated_plugin_registrant.cc b/linux/flutter/generated_plugin_registrant.cc
index fe5849361a..f0d1e42ae2 100644
--- a/linux/flutter/generated_plugin_registrant.cc
+++ b/linux/flutter/generated_plugin_registrant.cc
@@ -12,7 +12,6 @@
 #include <gtk/gtk_plugin.h>
 #include <hotkey_manager_linux/hotkey_manager_linux_plugin.h>
 #include <screen_retriever_linux/screen_retriever_linux_plugin.h>
-#include <sqlite3_flutter_libs/sqlite3_flutter_libs_plugin.h>
 #include <tray_manager/tray_manager_plugin.h>
 #include <url_launcher_linux/url_launcher_plugin.h>
 #include <wifi_ssid/wifi_ssid_plugin.h>
@@ -37,9 +36,6 @@ void fl_register_plugins(FlPluginRegistry* registry) {
   g_autoptr(FlPluginRegistrar) screen_retriever_linux_registrar =
       fl_plugin_registry_get_registrar_for_plugin(registry, "ScreenRetrieverLinuxPlugin");
   screen_retriever_linux_plugin_register_with_registrar(screen_retriever_linux_registrar);
-  g_autoptr(FlPluginRegistrar) sqlite3_flutter_libs_registrar =
-      fl_plugin_registry_get_registrar_for_plugin(registry, "Sqlite3FlutterLibsPlugin");
-  sqlite3_flutter_libs_plugin_register_with_registrar(sqlite3_flutter_libs_registrar);
   g_autoptr(FlPluginRegistrar) tray_manager_registrar =
       fl_plugin_registry_get_registrar_for_plugin(registry, "TrayManagerPlugin");
   tray_manager_plugin_register_with_registrar(tray_manager_registrar);
diff --git a/linux/flutter/generated_plugins.cmake b/linux/flutter/generated_plugins.cmake
index 4eded7fe6b..7072325117 100644
--- a/linux/flutter/generated_plugins.cmake
+++ b/linux/flutter/generated_plugins.cmake
@@ -9,7 +9,6 @@ list(APPEND FLUTTER_PLUGIN_LIST
   gtk
   hotkey_manager_linux
   screen_retriever_linux
-  sqlite3_flutter_libs
   tray_manager
   url_launcher_linux
   wifi_ssid
diff --git a/linux/packaging/deb/make_config.yaml b/linux/packaging/deb/make_config.yaml
index 535ae3742e..14d56e7830 100644
--- a/linux/packaging/deb/make_config.yaml
+++ b/linux/packaging/deb/make_config.yaml
@@ -13,6 +13,7 @@ icon: ./assets/images/icon.png
 dependencies:
   - libayatana-appindicator3-dev
   - libkeybinder-3.0-dev
+  - libsecret-1-0
 
 keywords:
   - FlClash
@@ -25,4 +26,4 @@ generic_name: FlClash
 categories:
   - Network
 
-startup_notify: true
\ No newline at end of file
+startup_notify: true
diff --git a/linux/packaging/rpm/make_config.yaml b/linux/packaging/rpm/make_config.yaml
index 50a7ddabef..4fed9892cd 100644
--- a/linux/packaging/rpm/make_config.yaml
+++ b/linux/packaging/rpm/make_config.yaml
@@ -10,6 +10,9 @@ installed_size: 6604
 essential: false
 icon: ./assets/images/icon.png
 
+requires:
+  - libsecret
+
 keywords:
   - FlClash
   - Clash
@@ -20,4 +23,4 @@ generic_name: FlClash
 
 group: Applications/Internet
 
-startup_notify: true
\ No newline at end of file
+startup_notify: true
diff --git a/macos/Flutter/GeneratedPluginRegistrant.swift b/macos/Flutter/GeneratedPluginRegistrant.swift
index a50d2e9dee..e81cac9f40 100644
--- a/macos/Flutter/GeneratedPluginRegistrant.swift
+++ b/macos/Flutter/GeneratedPluginRegistrant.swift
@@ -18,7 +18,6 @@ import package_info_plus
 import screen_retriever_macos
 import shared_preferences_foundation
 import sqflite_darwin
-import sqlite3_flutter_libs
 import tray_manager
 import url_launcher_macos
 import wifi_ssid
@@ -39,7 +38,6 @@ func RegisterGeneratedPlugins(registry: FlutterPluginRegistry) {
   ScreenRetrieverMacosPlugin.register(with: registry.registrar(forPlugin: "ScreenRetrieverMacosPlugin"))
   SharedPreferencesPlugin.register(with: registry.registrar(forPlugin: "SharedPreferencesPlugin"))
   SqflitePlugin.register(with: registry.registrar(forPlugin: "SqflitePlugin"))
-  Sqlite3FlutterLibsPlugin.register(with: registry.registrar(forPlugin: "Sqlite3FlutterLibsPlugin"))
   TrayManagerPlugin.register(with: registry.registrar(forPlugin: "TrayManagerPlugin"))
   UrlLauncherPlugin.register(with: registry.registrar(forPlugin: "UrlLauncherPlugin"))
   WifiSsidPlugin.register(with: registry.registrar(forPlugin: "WifiSsidPlugin"))
diff --git a/macos/Podfile.lock b/macos/Podfile.lock
index 611f162426..95668e0ae5 100644
--- a/macos/Podfile.lock
+++ b/macos/Podfile.lock
@@ -40,7 +40,7 @@ SPEC CHECKSUMS:
   HotKey: 400beb7caa29054ea8d864c96f5ba7e5b4852277
   hotkey_manager_macos: a4317849af96d2430fa89944d3c58977ca089fbe
   rust_api: 112f3cfd993afe61c6662bdb30fd6e3509fb3bf8
-  setup: 8b838da8e99b84b526ac668469e84de76f32fb74
+  setup: fbca4a83aba6efbe6510b5e268c8aea0bf192d00
 
 PODFILE CHECKSUM: b9facb167d6b7e90fef40306c3fe521e010924ac
 
diff --git a/plugins/proxy/CHANGELOG.md b/plugins/proxy/CHANGELOG.md
index 41cc7d8192..926536faa3 100644
--- a/plugins/proxy/CHANGELOG.md
+++ b/plugins/proxy/CHANGELOG.md
@@ -1,3 +1,10 @@
+## Unreleased
+
+- Split Linux and macOS proxy handling into focused backends.
+- Validate proxy ports and Windows method-channel arguments.
+- Report unavailable backends and empty command sets as failures.
+- Expand Dart and Windows contract tests.
+
 ## 0.0.1
 
-* TODO: Describe initial release.
+- Initial FlClash system proxy integration.
diff --git a/plugins/proxy/README.md b/plugins/proxy/README.md
index 2475e88708..02281d23f3 100644
--- a/plugins/proxy/README.md
+++ b/plugins/proxy/README.md
@@ -1,15 +1,12 @@
 # proxy
 
-A new Flutter plugin project.
+FlClash's desktop system-proxy integration.
 
-## Getting Started
-
-This project is a starting point for a Flutter
-[plug-in package](https://flutter.dev/developing-packages/),
-a specialized package that includes platform-specific implementation code for
-Android and/or iOS.
-
-For help getting started with Flutter development, view the
-[online documentation](https://flutter.dev/docs), which offers tutorials,
-samples, guidance on mobile development, and a full API reference.
+- Windows uses a Flutter method channel and WinINet settings.
+- macOS uses `/usr/sbin/networksetup` for each active network service.
+- Linux uses GNOME/MATE `gsettings` or KDE `kwriteconfig` based on the active
+  desktop environment.
 
+The public `Proxy` API validates the port, applies HTTP, HTTPS, and SOCKS
+settings to `127.0.0.1`, and returns `false` when the selected platform backend
+is unavailable or a command fails.
diff --git a/plugins/proxy/lib/proxy.dart b/plugins/proxy/lib/proxy.dart
index 5f4f7da519..bc8a83f9c9 100644
--- a/plugins/proxy/lib/proxy.dart
+++ b/plugins/proxy/lib/proxy.dart
@@ -1,611 +1,60 @@
 import 'dart:io';
 
-import 'package:flutter/foundation.dart';
-import 'package:path/path.dart';
-
 import 'proxy_platform_interface.dart';
+import 'src/linux_proxy.dart';
+import 'src/macos_proxy.dart';
+import 'src/proxy_command.dart';
 
-enum ProxyTypes { http, https, socks }
-
-typedef ProxyProcessRunner = Future<ProcessResult> Function(
-  String executable,
-  List<String> arguments, {
-  bool runInShell,
-});
-
-typedef ProxyExecutableChecker = Future<bool> Function(String executable);
-
-@immutable
-class ProxyCommand {
-  final String executable;
-  final List<String> args;
-  final bool runInShell;
-
-  const ProxyCommand(
-    this.executable,
-    this.args, {
-    this.runInShell = false,
-  });
-}
-
-enum LinuxProxyBackend {
-  gnome,
-  mate,
-  kde,
-}
+export 'src/proxy_command.dart' show ProxyExecutableChecker, ProxyProcessRunner;
 
-class Proxy extends ProxyPlatform {
-  static String url = '127.0.0.1';
+class Proxy {
+  static const int _minPort = 1;
+  static const int _maxPort = 65535;
 
-  final ProxyProcessRunner _processRunner;
-  final ProxyExecutableChecker _executableChecker;
+  late final LinuxProxy _linuxProxy;
+  late final MacosProxy _macosProxy;
 
   Proxy({
     ProxyProcessRunner? processRunner,
     ProxyExecutableChecker? executableChecker,
-  })  : _processRunner = processRunner ?? Process.run,
-        _executableChecker = executableChecker ?? _hasExecutable;
+  }) {
+    final commandRunner = ProxyCommandRunner(processRunner ?? Process.run);
+    _linuxProxy = LinuxProxy(
+      commandRunner: commandRunner,
+      executableChecker: executableChecker,
+    );
+    _macosProxy = MacosProxy(commandRunner: commandRunner);
+  }
 
-  @override
-  Future<bool?> startProxy(
+  Future<bool> startProxy(
     int port, [
     List<String> bypassDomain = const [],
   ]) async {
+    if (port < _minPort || port > _maxPort) {
+      return false;
+    }
     return switch (Platform.operatingSystem) {
-      'macos' => await _startProxyWithMacos(port, bypassDomain),
-      'linux' => await _startProxyWithLinux(port, bypassDomain),
+      'macos' => await _macosProxy.start(port, bypassDomain),
+      'linux' => await _linuxProxy.start(
+        port,
+        bypassDomain,
+        desktop: Platform.environment['XDG_CURRENT_DESKTOP'],
+        homeDir: Platform.environment['HOME'],
+      ),
       'windows' => await ProxyPlatform.instance.startProxy(port, bypassDomain),
       String() => false,
     };
   }
 
-  @override
-  Future<bool?> stopProxy() async {
+  Future<bool> stopProxy() async {
     return switch (Platform.operatingSystem) {
-      'macos' => await _stopProxyWithMacos(),
-      'linux' => await _stopProxyWithLinux(),
+      'macos' => await _macosProxy.stop(),
+      'linux' => await _linuxProxy.stop(
+        desktop: Platform.environment['XDG_CURRENT_DESKTOP'],
+        homeDir: Platform.environment['HOME'],
+      ),
       'windows' => await ProxyPlatform.instance.stopProxy(),
       String() => false,
     };
   }
-
-  Future<bool> _startProxyWithLinux(int port, List<String> bypassDomain) async {
-    final homeDir = Platform.environment['HOME'];
-    if (homeDir == null || homeDir.isEmpty) {
-      return false;
-    }
-    final commands = await _resolveLinuxStartCommands(
-      port,
-      bypassDomain,
-      desktop: Platform.environment['XDG_CURRENT_DESKTOP'],
-      homeDir: homeDir,
-    );
-    if (commands.isEmpty) {
-      return false;
-    }
-    return _runCommands(commands);
-  }
-
-  Future<bool> _stopProxyWithLinux() async {
-    final homeDir = Platform.environment['HOME'];
-    if (homeDir == null || homeDir.isEmpty) {
-      return false;
-    }
-    final commands = await _resolveLinuxStopCommands(
-      desktop: Platform.environment['XDG_CURRENT_DESKTOP'],
-      homeDir: homeDir,
-    );
-    if (commands.isEmpty) {
-      return false;
-    }
-    return _runCommands(commands);
-  }
-
-  Future<bool> _startProxyWithMacos(int port, List<String> bypassDomain) async {
-    final devices = await _getNetworkDeviceListWithMacos();
-    final commands = devices.expand(
-      (dev) => _buildMacosStartCommands(
-        dev,
-        port,
-        bypassDomain,
-      ),
-    );
-    return _runCommands(commands);
-  }
-
-  Future<bool> _stopProxyWithMacos() async {
-    final devices = await _getNetworkDeviceListWithMacos();
-    final commands = devices.expand(_buildMacosStopCommands);
-    return _runCommands(commands);
-  }
-
-  Future<List<String>> _getNetworkDeviceListWithMacos() async {
-    final res = await _processRunner(
-      '/usr/sbin/networksetup',
-      ['-listallnetworkservices'],
-    );
-    if (res.exitCode != 0) {
-      return [];
-    }
-    return _parseMacosNetworkServices(res.stdout.toString());
-  }
-
-  Future<bool> _runCommands(Iterable<ProxyCommand> commands) async {
-    try {
-      for (final command in commands) {
-        final result = await _processRunner(
-          command.executable,
-          command.args,
-          runInShell: command.runInShell,
-        );
-        if (result.exitCode != 0) {
-          return false;
-        }
-      }
-      return true;
-    } catch (_) {
-      return false;
-    }
-  }
-
-  Future<List<ProxyCommand>> _resolveLinuxStartCommands(
-    int port,
-    List<String> bypassDomain, {
-    required String? desktop,
-    required String homeDir,
-  }) async {
-    final backend = await _resolveLinuxBackend(desktop);
-    if (backend == null) {
-      return [];
-    }
-    return _buildLinuxStartCommands(
-      port: port,
-      bypassDomain: bypassDomain,
-      desktop: desktop,
-      homeDir: homeDir,
-      backend: backend,
-      kdeConfigWriter: await _resolveKdeConfigWriter(),
-    );
-  }
-
-  Future<List<ProxyCommand>> _resolveLinuxStopCommands({
-    required String? desktop,
-    required String homeDir,
-  }) async {
-    final backend = await _resolveLinuxBackend(desktop);
-    if (backend == null) {
-      return [];
-    }
-    return _buildLinuxStopCommands(
-      desktop: desktop,
-      homeDir: homeDir,
-      backend: backend,
-      kdeConfigWriter: await _resolveKdeConfigWriter(),
-    );
-  }
-
-  Future<LinuxProxyBackend?> _resolveLinuxBackend(String? desktop) async {
-    final preferredBackend = _preferredLinuxBackend(desktop);
-    if (preferredBackend != null) {
-      return preferredBackend;
-    }
-    for (final backend in LinuxProxyBackend.values) {
-      if (await _isLinuxBackendAvailable(backend)) {
-        return backend;
-      }
-    }
-    return null;
-  }
-
-  Future<bool> _isLinuxBackendAvailable(LinuxProxyBackend backend) async {
-    return switch (backend) {
-      LinuxProxyBackend.gnome => await _executableChecker('gsettings'),
-      LinuxProxyBackend.mate => await _executableChecker('gsettings'),
-      LinuxProxyBackend.kde => await _executableChecker('kwriteconfig6') ||
-          await _executableChecker('kwriteconfig5'),
-    };
-  }
-
-  Future<String> _resolveKdeConfigWriter() async {
-    if (await _executableChecker('kwriteconfig6')) {
-      return 'kwriteconfig6';
-    }
-    return 'kwriteconfig5';
-  }
-
-  static Future<bool> _hasExecutable(String executable) async {
-    final result = await Process.run('which', [executable]);
-    return result.exitCode == 0;
-  }
-
-  static LinuxProxyBackend? _preferredLinuxBackend(String? desktop) {
-    final desktops = _linuxDesktops(desktop);
-    if (desktops.contains('KDE')) {
-      return LinuxProxyBackend.kde;
-    }
-    if (desktops.contains('MATE')) {
-      return LinuxProxyBackend.mate;
-    }
-    if (desktops.any(
-      (desktop) =>
-          const {'GNOME', 'CINNAMON', 'BUDGIE', 'UNITY'}.contains(desktop),
-    )) {
-      return LinuxProxyBackend.gnome;
-    }
-    return null;
-  }
-
-  static Set<String> _linuxDesktops(String? desktop) {
-    if (desktop == null || desktop.isEmpty) {
-      return {};
-    }
-    return desktop
-        .split(':')
-        .map((value) => value.trim().toUpperCase())
-        .where((value) => value.isNotEmpty)
-        .toSet();
-  }
-
-  static List<ProxyCommand> _buildLinuxStartCommands({
-    required int port,
-    required List<String> bypassDomain,
-    required String? desktop,
-    required String homeDir,
-    LinuxProxyBackend? backend,
-    String kdeConfigWriter = 'kwriteconfig5',
-    Set<String>? availableExecutables,
-  }) {
-    final resolvedBackend = backend ??
-        _resolveLinuxBackendForBuild(
-          desktop: desktop,
-          availableExecutables: availableExecutables,
-        );
-    if (resolvedBackend == null) {
-      return [];
-    }
-    return switch (resolvedBackend) {
-      LinuxProxyBackend.gnome => _buildGSettingsStartCommands(
-          port: port,
-          bypassDomain: bypassDomain,
-          schemaPrefix: 'org.gnome.system.proxy',
-        ),
-      LinuxProxyBackend.mate => _buildGSettingsStartCommands(
-          port: port,
-          bypassDomain: bypassDomain,
-          schemaPrefix: 'org.mate.system.proxy',
-        ),
-      LinuxProxyBackend.kde => _buildKdeStartCommands(
-          port: port,
-          bypassDomain: bypassDomain,
-          homeDir: homeDir,
-          executable: _resolveKdeConfigWriterForBuild(
-            availableExecutables,
-            fallback: kdeConfigWriter,
-          ),
-        ),
-    };
-  }
-
-  static List<ProxyCommand> _buildLinuxStopCommands({
-    required String? desktop,
-    required String homeDir,
-    LinuxProxyBackend? backend,
-    String kdeConfigWriter = 'kwriteconfig5',
-    Set<String>? availableExecutables,
-  }) {
-    final resolvedBackend = backend ??
-        _resolveLinuxBackendForBuild(
-          desktop: desktop,
-          availableExecutables: availableExecutables,
-        );
-    if (resolvedBackend == null) {
-      return [];
-    }
-    return switch (resolvedBackend) {
-      LinuxProxyBackend.gnome => _buildGSettingsStopCommands(
-          schemaPrefix: 'org.gnome.system.proxy',
-        ),
-      LinuxProxyBackend.mate => _buildGSettingsStopCommands(
-          schemaPrefix: 'org.mate.system.proxy',
-        ),
-      LinuxProxyBackend.kde => _buildKdeStopCommands(
-          homeDir: homeDir,
-          executable: _resolveKdeConfigWriterForBuild(
-            availableExecutables,
-            fallback: kdeConfigWriter,
-          ),
-        ),
-    };
-  }
-
-  static LinuxProxyBackend? _resolveLinuxBackendForBuild({
-    required String? desktop,
-    required Set<String>? availableExecutables,
-  }) {
-    final preferredBackend = _preferredLinuxBackend(desktop);
-    if (preferredBackend != null) {
-      return preferredBackend;
-    }
-    if (availableExecutables == null) {
-      return LinuxProxyBackend.gnome;
-    }
-    for (final backend in LinuxProxyBackend.values) {
-      if (_isLinuxBackendAvailableForBuild(backend, availableExecutables)) {
-        return backend;
-      }
-    }
-    return null;
-  }
-
-  static bool _isLinuxBackendAvailableForBuild(
-    LinuxProxyBackend backend,
-    Set<String> availableExecutables,
-  ) {
-    return switch (backend) {
-      LinuxProxyBackend.gnome => availableExecutables.contains('gsettings'),
-      LinuxProxyBackend.mate => availableExecutables.contains('gsettings'),
-      LinuxProxyBackend.kde => availableExecutables.contains('kwriteconfig6') ||
-          availableExecutables.contains('kwriteconfig5'),
-    };
-  }
-
-  static String _resolveKdeConfigWriterForBuild(
-    Set<String>? availableExecutables, {
-    required String fallback,
-  }) {
-    if (availableExecutables?.contains('kwriteconfig6') ?? false) {
-      return 'kwriteconfig6';
-    }
-    if (availableExecutables?.contains('kwriteconfig5') ?? false) {
-      return 'kwriteconfig5';
-    }
-    return fallback;
-  }
-
-  static List<ProxyCommand> _buildGSettingsStartCommands({
-    required int port,
-    required List<String> bypassDomain,
-    required String schemaPrefix,
-  }) {
-    final commands = <ProxyCommand>[
-      ProxyCommand(
-        'gsettings',
-        ['set', schemaPrefix, 'mode', 'manual'],
-      ),
-      ProxyCommand(
-        'gsettings',
-        [
-          'set',
-          schemaPrefix,
-          'ignore-hosts',
-          _formatGSettingsStringList(bypassDomain),
-        ],
-      ),
-    ];
-    for (final type in ProxyTypes.values) {
-      commands.addAll([
-        ProxyCommand(
-          'gsettings',
-          [
-            'set',
-            '$schemaPrefix.${type.name}',
-            'host',
-            url,
-          ],
-        ),
-        ProxyCommand(
-          'gsettings',
-          [
-            'set',
-            '$schemaPrefix.${type.name}',
-            'port',
-            '$port',
-          ],
-        ),
-      ]);
-    }
-    return commands;
-  }
-
-  static List<ProxyCommand> _buildGSettingsStopCommands({
-    required String schemaPrefix,
-  }) {
-    return [
-      ProxyCommand(
-        'gsettings',
-        ['set', schemaPrefix, 'mode', 'none'],
-      ),
-    ];
-  }
-
-  static List<ProxyCommand> _buildKdeStartCommands({
-    required int port,
-    required List<String> bypassDomain,
-    required String homeDir,
-    required String executable,
-  }) {
-    final configDir = join(homeDir, '.config');
-    final commands = <ProxyCommand>[];
-    commands.addAll([
-      ProxyCommand(
-        executable,
-        [
-          '--file',
-          join(configDir, 'kioslaverc'),
-          '--group',
-          'Proxy Settings',
-          '--key',
-          'ProxyType',
-          '1',
-        ],
-      ),
-      ProxyCommand(
-        executable,
-        [
-          '--file',
-          join(configDir, 'kioslaverc'),
-          '--group',
-          'Proxy Settings',
-          '--key',
-          'NoProxyFor',
-          bypassDomain.join(','),
-        ],
-      ),
-    ]);
-    for (final type in ProxyTypes.values) {
-      commands.add(
-        ProxyCommand(
-          executable,
-          [
-            '--file',
-            join(configDir, 'kioslaverc'),
-            '--group',
-            'Proxy Settings',
-            '--key',
-            '${type.name}Proxy',
-            '${type.name}://$url:$port',
-          ],
-        ),
-      );
-    }
-    return commands;
-  }
-
-  static List<ProxyCommand> _buildKdeStopCommands({
-    required String homeDir,
-    required String executable,
-  }) {
-    return [
-      ProxyCommand(
-        executable,
-        [
-          '--file',
-          join(homeDir, '.config', 'kioslaverc'),
-          '--group',
-          'Proxy Settings',
-          '--key',
-          'ProxyType',
-          '0',
-        ],
-      ),
-    ];
-  }
-
-  static String _formatGSettingsStringList(List<String> values) {
-    if (values.isEmpty) {
-      return '[]';
-    }
-    final escaped = values.map((value) => "'${value.replaceAll("'", "\\'")}'");
-    return '[${escaped.join(', ')}]';
-  }
-
-  static List<ProxyCommand> _buildMacosStartCommands(
-    String dev,
-    int port,
-    List<String> bypassDomain,
-  ) {
-    return [
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setwebproxy', dev, url, '$port'],
-      ),
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setwebproxystate', dev, 'on'],
-      ),
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setsecurewebproxy', dev, url, '$port'],
-      ),
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setsecurewebproxystate', dev, 'on'],
-      ),
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setsocksfirewallproxy', dev, url, '$port'],
-      ),
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setsocksfirewallproxystate', dev, 'on'],
-      ),
-      _buildMacosProxyBypassCommand(dev, bypassDomain),
-    ];
-  }
-
-  static List<ProxyCommand> _buildMacosStopCommands(String dev) {
-    return [
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setautoproxystate', dev, 'off'],
-      ),
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setwebproxystate', dev, 'off'],
-      ),
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setsecurewebproxystate', dev, 'off'],
-      ),
-      ProxyCommand(
-        '/usr/sbin/networksetup',
-        ['-setsocksfirewallproxystate', dev, 'off'],
-      ),
-      _buildMacosProxyBypassCommand(dev, const []),
-    ];
-  }
-
-  static ProxyCommand _buildMacosProxyBypassCommand(
-    String dev,
-    List<String> bypassDomain,
-  ) {
-    return ProxyCommand(
-      '/usr/sbin/networksetup',
-      [
-        '-setproxybypassdomains',
-        dev,
-        if (bypassDomain.isEmpty) 'Empty' else ...bypassDomain,
-      ],
-    );
-  }
-
-  static List<String> _parseMacosNetworkServices(String stdout) {
-    return stdout
-        .split('\n')
-        .map((line) => line.trim())
-        .where((line) => line.isNotEmpty)
-        .where((line) => !line.startsWith('*'))
-        .where((line) => !line.startsWith('An asterisk '))
-        .toList();
-  }
-
-  @visibleForTesting
-  static List<ProxyCommand> buildLinuxStartCommandsForTest({
-    required int port,
-    required List<String> bypassDomain,
-    required String? desktop,
-    required String homeDir,
-    Set<String>? availableExecutables,
-  }) {
-    return _buildLinuxStartCommands(
-      port: port,
-      bypassDomain: bypassDomain,
-      desktop: desktop,
-      homeDir: homeDir,
-      availableExecutables: availableExecutables,
-    );
-  }
-
-  @visibleForTesting
-  static List<String> parseMacosNetworkServicesForTest(String stdout) {
-    return _parseMacosNetworkServices(stdout);
-  }
-
-  @visibleForTesting
-  static ProxyCommand buildMacosProxyBypassCommandForTest(
-    String dev,
-    List<String> bypassDomain,
-  ) {
-    return _buildMacosProxyBypassCommand(dev, bypassDomain);
-  }
 }
diff --git a/plugins/proxy/lib/proxy_method_channel.dart b/plugins/proxy/lib/proxy_method_channel.dart
index a4ac5fd168..decf7ea9fa 100644
--- a/plugins/proxy/lib/proxy_method_channel.dart
+++ b/plugins/proxy/lib/proxy_method_channel.dart
@@ -5,22 +5,24 @@ import 'proxy_platform_interface.dart';
 
 /// An implementation of [ProxyPlatform] that uses method channels.
 class MethodChannelProxy extends ProxyPlatform {
+  static const _startProxyMethod = 'StartProxy';
+  static const _stopProxyMethod = 'StopProxy';
+
   /// The method channel used to interact with the native platform.
   @visibleForTesting
   final methodChannel = const MethodChannel('proxy');
 
-  MethodChannelProxy();
-
   @override
-  Future<bool?> startProxy(int port, List<String> bypassDomain) async {
-    return await methodChannel.invokeMethod<bool>("StartProxy", {
-      'port': port,
-      'bypassDomain': bypassDomain,
-    });
+  Future<bool> startProxy(int port, List<String> bypassDomain) async {
+    return await methodChannel.invokeMethod<bool>(_startProxyMethod, {
+          'port': port,
+          'bypassDomain': bypassDomain,
+        }) ??
+        false;
   }
 
   @override
-  Future<bool?> stopProxy() async {
-    return await methodChannel.invokeMethod<bool>("StopProxy");
+  Future<bool> stopProxy() async {
+    return await methodChannel.invokeMethod<bool>(_stopProxyMethod) ?? false;
   }
 }
diff --git a/plugins/proxy/lib/proxy_platform_interface.dart b/plugins/proxy/lib/proxy_platform_interface.dart
index 7e21d95697..dbcb181cf4 100644
--- a/plugins/proxy/lib/proxy_platform_interface.dart
+++ b/plugins/proxy/lib/proxy_platform_interface.dart
@@ -20,11 +20,11 @@ abstract class ProxyPlatform extends PlatformInterface {
     _instance = instance;
   }
 
-  Future<bool?> startProxy(int port, List<String> bypassDomain) {
+  Future<bool> startProxy(int port, List<String> bypassDomain) {
     throw UnimplementedError('startProxy() has not been implemented.');
   }
 
-  Future<bool?> stopProxy() {
+  Future<bool> stopProxy() {
     throw UnimplementedError('stopProxy() has not been implemented.');
   }
 }
diff --git a/plugins/proxy/lib/src/linux_proxy.dart b/plugins/proxy/lib/src/linux_proxy.dart
new file mode 100644
index 0000000000..0b053171f5
--- /dev/null
+++ b/plugins/proxy/lib/src/linux_proxy.dart
@@ -0,0 +1,383 @@
+import 'dart:io';
+
+import 'package:path/path.dart' as path;
+
+import 'proxy_command.dart';
+
+enum LinuxProxyBackend { gnome, mate, kde }
+
+enum _ProxyType { http, https, socks }
+
+const _fallbackBackends = [LinuxProxyBackend.gnome, LinuxProxyBackend.kde];
+
+class LinuxProxy {
+  final ProxyCommandRunner _commandRunner;
+  final ProxyExecutableChecker _executableChecker;
+
+  LinuxProxy({
+    required ProxyCommandRunner commandRunner,
+    ProxyExecutableChecker? executableChecker,
+  }) : _commandRunner = commandRunner,
+       _executableChecker = executableChecker ?? _hasExecutable;
+
+  Future<bool> start(
+    int port,
+    List<String> bypassDomain, {
+    required String? desktop,
+    required String? homeDir,
+  }) async {
+    if (homeDir == null || homeDir.isEmpty) {
+      return false;
+    }
+    final selection = await _resolveBackend(desktop);
+    if (selection == null) {
+      return false;
+    }
+    return _commandRunner.run(
+      LinuxProxyCommands.buildStartForBackend(
+        port: port,
+        bypassDomain: bypassDomain,
+        homeDir: homeDir,
+        backend: selection.backend,
+        kdeConfigWriter: selection.executable,
+      ),
+    );
+  }
+
+  Future<bool> stop({
+    required String? desktop,
+    required String? homeDir,
+  }) async {
+    if (homeDir == null || homeDir.isEmpty) {
+      return false;
+    }
+    final selection = await _resolveBackend(desktop);
+    if (selection == null) {
+      return false;
+    }
+    return _commandRunner.run(
+      LinuxProxyCommands.buildStopForBackend(
+        homeDir: homeDir,
+        backend: selection.backend,
+        kdeConfigWriter: selection.executable,
+      ),
+    );
+  }
+
+  Future<_LinuxBackendSelection?> _resolveBackend(String? desktop) async {
+    final preferredBackend = LinuxProxyCommands.preferredBackend(desktop);
+    if (preferredBackend != null) {
+      return _resolveSelection(preferredBackend);
+    }
+    for (final backend in _fallbackBackends) {
+      final selection = await _resolveSelection(backend);
+      if (selection != null) {
+        return selection;
+      }
+    }
+    return null;
+  }
+
+  Future<_LinuxBackendSelection?> _resolveSelection(
+    LinuxProxyBackend backend,
+  ) async {
+    switch (backend) {
+      case LinuxProxyBackend.gnome:
+      case LinuxProxyBackend.mate:
+        if (await _executableChecker('gsettings')) {
+          return _LinuxBackendSelection(backend, 'gsettings');
+        }
+        return null;
+      case LinuxProxyBackend.kde:
+        for (final executable in const ['kwriteconfig6', 'kwriteconfig5']) {
+          if (await _executableChecker(executable)) {
+            return _LinuxBackendSelection(backend, executable);
+          }
+        }
+    }
+    return null;
+  }
+
+  static Future<bool> _hasExecutable(String executable) async {
+    try {
+      final result = await Process.run('which', [executable]);
+      return result.exitCode == 0;
+    } on ProcessException {
+      return false;
+    }
+  }
+}
+
+class LinuxProxyCommands {
+  static LinuxProxyBackend? preferredBackend(String? desktop) {
+    final desktops = _desktops(desktop);
+    if (desktops.contains('KDE')) {
+      return LinuxProxyBackend.kde;
+    }
+    if (desktops.contains('MATE')) {
+      return LinuxProxyBackend.mate;
+    }
+    if (desktops.any(
+      (desktop) =>
+          const {'GNOME', 'CINNAMON', 'BUDGIE', 'UNITY'}.contains(desktop),
+    )) {
+      return LinuxProxyBackend.gnome;
+    }
+    return null;
+  }
+
+  static List<ProxyCommand> buildStart({
+    required int port,
+    required List<String> bypassDomain,
+    required String? desktop,
+    required String homeDir,
+    Set<String>? availableExecutables,
+  }) {
+    final backend = _resolveBackend(
+      desktop: desktop,
+      availableExecutables: availableExecutables,
+    );
+    if (backend == null) {
+      return [];
+    }
+    return buildStartForBackend(
+      port: port,
+      bypassDomain: bypassDomain,
+      homeDir: homeDir,
+      backend: backend,
+      kdeConfigWriter: _resolveKdeConfigWriter(availableExecutables),
+    );
+  }
+
+  static List<ProxyCommand> buildStop({
+    required String? desktop,
+    required String homeDir,
+    Set<String>? availableExecutables,
+  }) {
+    final backend = _resolveBackend(
+      desktop: desktop,
+      availableExecutables: availableExecutables,
+    );
+    if (backend == null) {
+      return [];
+    }
+    return buildStopForBackend(
+      homeDir: homeDir,
+      backend: backend,
+      kdeConfigWriter: _resolveKdeConfigWriter(availableExecutables),
+    );
+  }
+
+  static List<ProxyCommand> buildStartForBackend({
+    required int port,
+    required List<String> bypassDomain,
+    required String homeDir,
+    required LinuxProxyBackend backend,
+    required String kdeConfigWriter,
+  }) {
+    return switch (backend) {
+      LinuxProxyBackend.gnome => _buildGSettingsStart(
+        port: port,
+        bypassDomain: bypassDomain,
+        schemaPrefix: 'org.gnome.system.proxy',
+      ),
+      LinuxProxyBackend.mate => _buildGSettingsStart(
+        port: port,
+        bypassDomain: bypassDomain,
+        schemaPrefix: 'org.mate.system.proxy',
+      ),
+      LinuxProxyBackend.kde => _buildKdeStart(
+        port: port,
+        bypassDomain: bypassDomain,
+        homeDir: homeDir,
+        executable: kdeConfigWriter,
+      ),
+    };
+  }
+
+  static List<ProxyCommand> buildStopForBackend({
+    required String homeDir,
+    required LinuxProxyBackend backend,
+    required String kdeConfigWriter,
+  }) {
+    return switch (backend) {
+      LinuxProxyBackend.gnome => _buildGSettingsStop(
+        schemaPrefix: 'org.gnome.system.proxy',
+      ),
+      LinuxProxyBackend.mate => _buildGSettingsStop(
+        schemaPrefix: 'org.mate.system.proxy',
+      ),
+      LinuxProxyBackend.kde => _buildKdeStop(
+        homeDir: homeDir,
+        executable: kdeConfigWriter,
+      ),
+    };
+  }
+
+  static LinuxProxyBackend? _resolveBackend({
+    required String? desktop,
+    required Set<String>? availableExecutables,
+  }) {
+    final preferred = preferredBackend(desktop);
+    if (preferred != null) {
+      if (availableExecutables == null ||
+          _isBackendAvailable(preferred, availableExecutables)) {
+        return preferred;
+      }
+      return null;
+    }
+    if (availableExecutables == null) {
+      return LinuxProxyBackend.gnome;
+    }
+    for (final backend in _fallbackBackends) {
+      if (_isBackendAvailable(backend, availableExecutables)) {
+        return backend;
+      }
+    }
+    return null;
+  }
+
+  static bool _isBackendAvailable(
+    LinuxProxyBackend backend,
+    Set<String> availableExecutables,
+  ) {
+    return switch (backend) {
+      LinuxProxyBackend.gnome ||
+      LinuxProxyBackend.mate => availableExecutables.contains('gsettings'),
+      LinuxProxyBackend.kde =>
+        availableExecutables.contains('kwriteconfig6') ||
+            availableExecutables.contains('kwriteconfig5'),
+    };
+  }
+
+  static String _resolveKdeConfigWriter(Set<String>? availableExecutables) {
+    if (availableExecutables?.contains('kwriteconfig6') ?? false) {
+      return 'kwriteconfig6';
+    }
+    return 'kwriteconfig5';
+  }
+
+  static List<ProxyCommand> _buildGSettingsStart({
+    required int port,
+    required List<String> bypassDomain,
+    required String schemaPrefix,
+  }) {
+    final commands = <ProxyCommand>[
+      ProxyCommand('gsettings', [
+        'set',
+        schemaPrefix,
+        'ignore-hosts',
+        _formatGSettingsStringList(bypassDomain),
+      ]),
+    ];
+    for (final type in _ProxyType.values) {
+      commands.addAll([
+        ProxyCommand('gsettings', [
+          'set',
+          '$schemaPrefix.${type.name}',
+          'host',
+          proxyHost,
+        ]),
+        ProxyCommand('gsettings', [
+          'set',
+          '$schemaPrefix.${type.name}',
+          'port',
+          '$port',
+        ]),
+      ]);
+    }
+    commands.add(
+      ProxyCommand('gsettings', ['set', schemaPrefix, 'mode', 'manual']),
+    );
+    return commands;
+  }
+
+  static List<ProxyCommand> _buildGSettingsStop({
+    required String schemaPrefix,
+  }) {
+    return [
+      ProxyCommand('gsettings', ['set', schemaPrefix, 'mode', 'none']),
+    ];
+  }
+
+  static List<ProxyCommand> _buildKdeStart({
+    required int port,
+    required List<String> bypassDomain,
+    required String homeDir,
+    required String executable,
+  }) {
+    final configFile = path.join(homeDir, '.config', 'kioslaverc');
+    return [
+      ProxyCommand(executable, [
+        '--file',
+        configFile,
+        '--group',
+        'Proxy Settings',
+        '--key',
+        'NoProxyFor',
+        bypassDomain.join(','),
+      ]),
+      for (final type in _ProxyType.values)
+        ProxyCommand(executable, [
+          '--file',
+          configFile,
+          '--group',
+          'Proxy Settings',
+          '--key',
+          '${type.name}Proxy',
+          '${type.name}://$proxyHost:$port',
+        ]),
+      ProxyCommand(executable, [
+        '--file',
+        configFile,
+        '--group',
+        'Proxy Settings',
+        '--key',
+        'ProxyType',
+        '1',
+      ]),
+    ];
+  }
+
+  static List<ProxyCommand> _buildKdeStop({
+    required String homeDir,
+    required String executable,
+  }) {
+    return [
+      ProxyCommand(executable, [
+        '--file',
+        path.join(homeDir, '.config', 'kioslaverc'),
+        '--group',
+        'Proxy Settings',
+        '--key',
+        'ProxyType',
+        '0',
+      ]),
+    ];
+  }
+
+  static String _formatGSettingsStringList(List<String> values) {
+    final escaped = values.map((value) {
+      return value.replaceAll(r'\', r'\\').replaceAll("'", r"\'");
+    });
+    return "[${escaped.map((value) => "'$value'").join(', ')}]";
+  }
+
+  static Set<String> _desktops(String? desktop) {
+    if (desktop == null || desktop.isEmpty) {
+      return {};
+    }
+    return desktop
+        .split(':')
+        .map((value) => value.trim().toUpperCase())
+        .where((value) => value.isNotEmpty)
+        .toSet();
+  }
+}
+
+class _LinuxBackendSelection {
+  final LinuxProxyBackend backend;
+  final String executable;
+
+  const _LinuxBackendSelection(this.backend, this.executable);
+}
diff --git a/plugins/proxy/lib/src/macos_proxy.dart b/plugins/proxy/lib/src/macos_proxy.dart
new file mode 100644
index 0000000000..cb3dd058bc
--- /dev/null
+++ b/plugins/proxy/lib/src/macos_proxy.dart
@@ -0,0 +1,130 @@
+import 'dart:io';
+
+import 'proxy_command.dart';
+
+class MacosProxy {
+  final ProxyCommandRunner _commandRunner;
+
+  MacosProxy({required ProxyCommandRunner commandRunner})
+    : _commandRunner = commandRunner;
+
+  Future<bool> start(int port, List<String> bypassDomain) async {
+    final services = await _networkServices();
+    return _commandRunner.run(
+      services.expand(
+        (service) => MacosProxyCommands.buildStart(service, port, bypassDomain),
+      ),
+    );
+  }
+
+  Future<bool> stop() async {
+    final services = await _networkServices();
+    return _commandRunner.run(services.expand(MacosProxyCommands.buildStop));
+  }
+
+  Future<List<String>> _networkServices() async {
+    try {
+      final result = await _commandRunner.process('/usr/sbin/networksetup', [
+        '-listallnetworkservices',
+      ]);
+      if (result.exitCode != 0) {
+        return [];
+      }
+      return MacosProxyCommands.parseNetworkServices(result.stdout.toString());
+    } on ProcessException {
+      return [];
+    }
+  }
+}
+
+class MacosProxyCommands {
+  static List<ProxyCommand> buildStart(
+    String service,
+    int port,
+    List<String> bypassDomain,
+  ) {
+    return [
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setwebproxy',
+        service,
+        proxyHost,
+        '$port',
+      ]),
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setsecurewebproxy',
+        service,
+        proxyHost,
+        '$port',
+      ]),
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setsocksfirewallproxy',
+        service,
+        proxyHost,
+        '$port',
+      ]),
+      buildProxyBypass(service, bypassDomain),
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setwebproxystate',
+        service,
+        'on',
+      ]),
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setsecurewebproxystate',
+        service,
+        'on',
+      ]),
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setsocksfirewallproxystate',
+        service,
+        'on',
+      ]),
+    ];
+  }
+
+  static List<ProxyCommand> buildStop(String service) {
+    return [
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setautoproxystate',
+        service,
+        'off',
+      ]),
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setwebproxystate',
+        service,
+        'off',
+      ]),
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setsecurewebproxystate',
+        service,
+        'off',
+      ]),
+      ProxyCommand('/usr/sbin/networksetup', [
+        '-setsocksfirewallproxystate',
+        service,
+        'off',
+      ]),
+      buildProxyBypass(service, const []),
+    ];
+  }
+
+  static ProxyCommand buildProxyBypass(
+    String service,
+    List<String> bypassDomain,
+  ) {
+    return ProxyCommand('/usr/sbin/networksetup', [
+      '-setproxybypassdomains',
+      service,
+      if (bypassDomain.isEmpty) 'Empty' else ...bypassDomain,
+    ]);
+  }
+
+  static List<String> parseNetworkServices(String stdout) {
+    return stdout
+        .split('\n')
+        .map((line) => line.trim())
+        .where((line) => line.isNotEmpty)
+        .where((line) => !line.startsWith('*'))
+        .where((line) => !line.startsWith('An asterisk '))
+        .toList();
+  }
+}
diff --git a/plugins/proxy/lib/src/proxy_command.dart b/plugins/proxy/lib/src/proxy_command.dart
new file mode 100644
index 0000000000..7f305e3569
--- /dev/null
+++ b/plugins/proxy/lib/src/proxy_command.dart
@@ -0,0 +1,58 @@
+import 'dart:io';
+
+import 'package:flutter/foundation.dart';
+
+const proxyHost = '127.0.0.1';
+
+typedef ProxyProcessRunner =
+    Future<ProcessResult> Function(
+      String executable,
+      List<String> arguments, {
+      bool runInShell,
+    });
+
+typedef ProxyExecutableChecker = Future<bool> Function(String executable);
+
+@immutable
+class ProxyCommand {
+  final String executable;
+  final List<String> args;
+  final bool runInShell;
+
+  ProxyCommand(this.executable, List<String> args, {this.runInShell = false})
+    : args = List.unmodifiable(args);
+}
+
+class ProxyCommandRunner {
+  final ProxyProcessRunner _processRunner;
+
+  ProxyCommandRunner(this._processRunner);
+
+  Future<ProcessResult> process(
+    String executable,
+    List<String> arguments, {
+    bool runInShell = false,
+  }) {
+    return _processRunner(executable, arguments, runInShell: runInShell);
+  }
+
+  Future<bool> run(Iterable<ProxyCommand> commands) async {
+    var executed = false;
+    try {
+      for (final command in commands) {
+        executed = true;
+        final result = await process(
+          command.executable,
+          command.args,
+          runInShell: command.runInShell,
+        );
+        if (result.exitCode != 0) {
+          return false;
+        }
+      }
+    } on ProcessException {
+      return false;
+    }
+    return executed;
+  }
+}
diff --git a/plugins/proxy/pubspec.yaml b/plugins/proxy/pubspec.yaml
index 9236ca481e..14e5d4ca4f 100644
--- a/plugins/proxy/pubspec.yaml
+++ b/plugins/proxy/pubspec.yaml
@@ -1,70 +1,25 @@
 name: proxy
-description: A new Flutter plugin project.
+description: FlClash system proxy integration for Windows, macOS, and Linux.
 version: 0.0.1
-homepage:
+publish_to: none
 
 environment:
-  sdk: '>=3.1.0 <4.0.0'
-  flutter: '>=3.3.0'
+  sdk: '>=3.8.0 <4.0.0'
+  flutter: '>=3.35.0'
 
 dependencies:
   flutter:
     sdk: flutter
-  plugin_platform_interface: ^2.0.2
-  path: ^1.8.3
+  path: ^1.9.0
+  plugin_platform_interface: ^2.1.8
 
 dev_dependencies:
+  flutter_lints: ^6.0.0
   flutter_test:
     sdk: flutter
-  flutter_lints: ^2.0.0
 
-# For information on the generic Dart part of this file, see the
-# following page: https://dart.dev/tools/pub/pubspec
-
-# The following section is specific to Flutter packages.
 flutter:
-  # This section identifies this Flutter project as a plugin project.
-  # The 'pluginClass' specifies the class (in Java, Kotlin, Swift, Objective-C, etc.)
-  # which should be registered in the plugin registry. This is required for
-  # using method channels.
-  # The Android 'package' specifies package in which the registered class is.
-  # This is required for using method channels on Android.
-  # The 'ffiPlugin' specifies that native code should be built and bundled.
-  # This is required for using `dart:ffi`.
-  # All these are used by the tooling to maintain consistency when
-  # adding or updating assets for this project.
   plugin:
     platforms:
       windows:
         pluginClass: ProxyPluginCApi
-
-  # To add assets to your plugin package, add an assets section, like this:
-  # assets:
-  #   - images/a_dot_burr.jpeg
-  #   - images/a_dot_ham.jpeg
-  #
-  # For details regarding assets in packages, see
-  # https://flutter.dev/assets-and-images/#from-packages
-  #
-  # An image asset can refer to one or more resolution-specific "variants", see
-  # https://flutter.dev/assets-and-images/#resolution-aware
-
-  # To add custom fonts to your plugin package, add a fonts section here,
-  # in this "flutter" section. Each entry in this list should have a
-  # "family" key with the font family name, and a "fonts" key with a
-  # list giving the asset and other descriptors for the font. For
-  # example:
-  # fonts:
-  #   - family: Schyler
-  #     fonts:
-  #       - asset: fonts/Schyler-Regular.ttf
-  #       - asset: fonts/Schyler-Italic.ttf
-  #         style: italic
-  #   - family: Trajan Pro
-  #     fonts:
-  #       - asset: fonts/TrajanPro.ttf
-  #       - asset: fonts/TrajanPro_Bold.ttf
-  #         weight: 700
-  #
-  # For details regarding fonts in packages, see
-  # https://flutter.dev/custom-fonts/#from-packages
diff --git a/plugins/proxy/test/proxy_test.dart b/plugins/proxy/test/proxy_test.dart
index 2b86c324b1..31265f3951 100644
--- a/plugins/proxy/test/proxy_test.dart
+++ b/plugins/proxy/test/proxy_test.dart
@@ -1,10 +1,115 @@
+import 'dart:io';
+
+import 'package:flutter/services.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:proxy/proxy.dart';
+import 'package:proxy/proxy_method_channel.dart';
+import 'package:proxy/src/linux_proxy.dart';
+import 'package:proxy/src/macos_proxy.dart';
+import 'package:proxy/src/proxy_command.dart';
 
 void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  group('Proxy', () {
+    test('rejects ports outside the TCP port range', () async {
+      final proxy = Proxy(
+        processRunner: (executable, arguments, {runInShell = false}) async {
+          fail('invalid ports must not execute platform commands');
+        },
+      );
+
+      expect(await proxy.startProxy(0), isFalse);
+      expect(await proxy.startProxy(65536), isFalse);
+    });
+  });
+
+  group('ProxyCommandRunner', () {
+    test('treats an empty command set as failure', () async {
+      final runner = ProxyCommandRunner((
+        executable,
+        arguments, {
+        runInShell = false,
+      }) async {
+        fail('empty command sets must not start a process');
+      });
+
+      expect(await runner.run(const []), isFalse);
+    });
+
+    test('stops after the first failed command', () async {
+      var callCount = 0;
+      final runner = ProxyCommandRunner((
+        executable,
+        arguments, {
+        runInShell = false,
+      }) async {
+        callCount++;
+        return ProcessResult(callCount, callCount == 1 ? 1 : 0, '', '');
+      });
+
+      final result = await runner.run([
+        ProxyCommand('first', const []),
+        ProxyCommand('second', const []),
+      ]);
+
+      expect(result, isFalse);
+      expect(callCount, 1);
+    });
+
+    test('converts process launch failures to false', () async {
+      final runner = ProxyCommandRunner((
+        executable,
+        arguments, {
+        runInShell = false,
+      }) async {
+        throw ProcessException(executable, arguments);
+      });
+
+      expect(await runner.run([ProxyCommand('missing', const [])]), isFalse);
+    });
+  });
+
   group('Linux proxy command builders', () {
+    test(
+      'checks each fallback command only once for unknown desktops',
+      () async {
+        final checkedExecutables = <String>[];
+        final executedCommands = <String>[];
+        final proxy = LinuxProxy(
+          commandRunner: ProxyCommandRunner((
+            executable,
+            arguments, {
+            runInShell = false,
+          }) async {
+            executedCommands.add(executable);
+            return ProcessResult(1, 0, '', '');
+          }),
+          executableChecker: (executable) async {
+            checkedExecutables.add(executable);
+            return executable == 'kwriteconfig5';
+          },
+        );
+
+        final result = await proxy.start(
+          7890,
+          const ['localhost'],
+          desktop: 'UNKNOWN',
+          homeDir: '/home/user',
+        );
+
+        expect(result, isTrue);
+        expect(checkedExecutables, [
+          'gsettings',
+          'kwriteconfig6',
+          'kwriteconfig5',
+        ]);
+        expect(executedCommands, everyElement('kwriteconfig5'));
+      },
+    );
+
     test('builds GNOME commands without duplicate port writes', () {
-      final commands = Proxy.buildLinuxStartCommandsForTest(
+      final commands = LinuxProxyCommands.buildStart(
         port: 7890,
         bypassDomain: ['localhost', '127.0.0.1'],
         desktop: 'GNOME',
@@ -20,6 +125,12 @@ void main() {
 
       expect(portCommands, hasLength(3));
       expect(hostCommands, hasLength(3));
+      expect(commands.last.args, [
+        'set',
+        'org.gnome.system.proxy',
+        'mode',
+        'manual',
+      ]);
       expect(
         commands
             .singleWhere(
@@ -34,7 +145,7 @@ void main() {
     });
 
     test('builds empty GNOME ignore-hosts as an empty list', () {
-      final commands = Proxy.buildLinuxStartCommandsForTest(
+      final commands = LinuxProxyCommands.buildStart(
         port: 7890,
         bypassDomain: const [],
         desktop: 'GNOME',
@@ -54,8 +165,25 @@ void main() {
       );
     });
 
+    test('escapes backslashes and quotes in GNOME ignore-hosts', () {
+      final commands = LinuxProxyCommands.buildStart(
+        port: 7890,
+        bypassDomain: [r'local\host', "it's"],
+        desktop: 'GNOME',
+        homeDir: '/home/user',
+      );
+
+      expect(
+        commands
+            .singleWhere((command) => command.args.contains('ignore-hosts'))
+            .args
+            .last,
+        r"['local\\host', 'it\'s']",
+      );
+    });
+
     test('builds MATE commands with MATE proxy schema', () {
-      final commands = Proxy.buildLinuxStartCommandsForTest(
+      final commands = LinuxProxyCommands.buildStart(
         port: 7890,
         bypassDomain: ['localhost'],
         desktop: 'MATE',
@@ -77,7 +205,7 @@ void main() {
     });
 
     test('falls back to GNOME gsettings commands for XFCE when available', () {
-      final commands = Proxy.buildLinuxStartCommandsForTest(
+      final commands = LinuxProxyCommands.buildStart(
         port: 7890,
         bypassDomain: ['localhost'],
         desktop: 'XFCE',
@@ -99,7 +227,7 @@ void main() {
     });
 
     test('prefers kwriteconfig6 for KDE when available', () {
-      final commands = Proxy.buildLinuxStartCommandsForTest(
+      final commands = LinuxProxyCommands.buildStart(
         port: 7890,
         bypassDomain: ['localhost'],
         desktop: 'KDE',
@@ -112,12 +240,28 @@ void main() {
       });
     });
 
-    test('falls back to kwriteconfig5 for KDE when kwriteconfig6 is missing',
-        () {
-      final commands = Proxy.buildLinuxStartCommandsForTest(
+    test(
+      'falls back to kwriteconfig5 for KDE when kwriteconfig6 is missing',
+      () {
+        final commands = LinuxProxyCommands.buildStart(
+          port: 7890,
+          bypassDomain: ['localhost'],
+          desktop: 'KDE',
+          homeDir: '/home/user',
+          availableExecutables: {'kwriteconfig5'},
+        );
+
+        expect(commands.map((command) => command.executable).toSet(), {
+          'kwriteconfig5',
+        });
+      },
+    );
+
+    test('uses available backend for unknown desktops', () {
+      final commands = LinuxProxyCommands.buildStart(
         port: 7890,
         bypassDomain: ['localhost'],
-        desktop: 'KDE',
+        desktop: 'UNKNOWN',
         homeDir: '/home/user',
         availableExecutables: {'kwriteconfig5'},
       );
@@ -127,26 +271,24 @@ void main() {
       });
     });
 
-    test('uses available backend for unknown desktops', () {
-      final commands = Proxy.buildLinuxStartCommandsForTest(
+    test('does not use an unrelated backend for a known desktop', () {
+      final commands = LinuxProxyCommands.buildStart(
         port: 7890,
         bypassDomain: ['localhost'],
-        desktop: 'UNKNOWN',
+        desktop: 'KDE',
         homeDir: '/home/user',
-        availableExecutables: {'kwriteconfig5'},
+        availableExecutables: {'gsettings'},
       );
 
-      expect(commands.map((command) => command.executable).toSet(), {
-        'kwriteconfig5',
-      });
+      expect(commands, isEmpty);
     });
   });
 
   group('macOS proxy command builders', () {
     test(
-        'filters networksetup service list headers, disabled services, and blanks',
-        () {
-      final services = Proxy.parseMacosNetworkServicesForTest('''
+      'filters networksetup service list headers, disabled services, and blanks',
+      () {
+        final services = MacosProxyCommands.parseNetworkServices('''
 An asterisk (*) denotes that a network service is disabled.
 Wi-Fi
 *Thunderbolt Bridge
@@ -154,14 +296,15 @@ USB 10/100/1000 LAN
 
 ''');
 
-      expect(services, ['Wi-Fi', 'USB 10/100/1000 LAN']);
-    });
+        expect(services, ['Wi-Fi', 'USB 10/100/1000 LAN']);
+      },
+    );
 
     test('passes bypass domains as separate networksetup arguments', () {
-      final command = Proxy.buildMacosProxyBypassCommandForTest(
-        'Wi-Fi',
-        ['localhost', '127.0.0.1'],
-      );
+      final command = MacosProxyCommands.buildProxyBypass('Wi-Fi', [
+        'localhost',
+        '127.0.0.1',
+      ]);
 
       expect(command.executable, '/usr/sbin/networksetup');
       expect(command.args, [
@@ -173,12 +316,78 @@ USB 10/100/1000 LAN
     });
 
     test('uses Empty when clearing bypass domains', () {
-      final command = Proxy.buildMacosProxyBypassCommandForTest(
-        'Wi-Fi',
-        const [],
-      );
+      final command = MacosProxyCommands.buildProxyBypass('Wi-Fi', const []);
 
       expect(command.args, ['-setproxybypassdomains', 'Wi-Fi', 'Empty']);
     });
+
+    test('configures values before enabling proxy states', () {
+      final commands = MacosProxyCommands.buildStart('Wi-Fi', 7890, const [
+        'localhost',
+      ]);
+
+      final firstStateCommand = commands.indexWhere(
+        (command) => command.args.first.endsWith('proxystate'),
+      );
+
+      expect(firstStateCommand, 4);
+      expect(commands[3].args.first, '-setproxybypassdomains');
+    });
+
+    test('reports failure when no active network service is found', () async {
+      var callCount = 0;
+      final proxy = MacosProxy(
+        commandRunner: ProxyCommandRunner((
+          executable,
+          arguments, {
+          runInShell = false,
+        }) async {
+          callCount++;
+          return ProcessResult(
+            callCount,
+            0,
+            'An asterisk (*) denotes that a network service is disabled.\n',
+            '',
+          );
+        }),
+      );
+
+      expect(await proxy.start(7890, const []), isFalse);
+      expect(callCount, 1);
+    });
+  });
+
+  group('MethodChannelProxy', () {
+    final proxy = MethodChannelProxy();
+
+    tearDown(() {
+      TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+          .setMockMethodCallHandler(proxy.methodChannel, null);
+    });
+
+    test('sends the Windows start contract', () async {
+      MethodCall? capturedCall;
+      TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+          .setMockMethodCallHandler(proxy.methodChannel, (call) async {
+            capturedCall = call;
+            return true;
+          });
+
+      final result = await proxy.startProxy(7890, const ['localhost']);
+
+      expect(result, isTrue);
+      expect(capturedCall?.method, 'StartProxy');
+      expect(capturedCall?.arguments, {
+        'port': 7890,
+        'bypassDomain': ['localhost'],
+      });
+    });
+
+    test('maps a null native response to false', () async {
+      TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+          .setMockMethodCallHandler(proxy.methodChannel, (_) async => null);
+
+      expect(await proxy.stopProxy(), isFalse);
+    });
   });
 }
diff --git a/plugins/proxy/windows/proxy_plugin.cpp b/plugins/proxy/windows/proxy_plugin.cpp
index cd0ad7a97a..f37d3ce3e2 100644
--- a/plugins/proxy/windows/proxy_plugin.cpp
+++ b/plugins/proxy/windows/proxy_plugin.cpp
@@ -6,6 +6,7 @@
 #include <WinInet.h>
 #include <Ras.h>
 #include <RasError.h>
+#include <algorithm>
 #include <string>
 #include <vector>
 
@@ -21,6 +22,9 @@
 namespace
 {
 
+constexpr int kMinProxyPort = 1;
+constexpr int kMaxProxyPort = 65535;
+
 std::wstring Utf8ToWide(const std::string& value)
 {
   if (value.empty())
@@ -43,20 +47,27 @@ std::wstring Utf8ToWide(const std::string& value)
 std::wstring BuildBypassList(const flutter::EncodableList& bypassDomain)
 {
   std::wstring bypassList;
-  for (const auto& domain : bypassDomain) {
-    const auto* value = std::get_if<std::string>(&domain);
-    if (value == nullptr)
+  for (const auto& domain : bypassDomain)
+  {
+    const auto& value = std::get<std::string>(domain);
+    if (!bypassList.empty())
     {
-      continue;
+      bypassList += L";";
     }
-    if (!bypassList.empty()) {
-       bypassList += L";";
-    }
-    bypassList += Utf8ToWide(*value);
+    bypassList += Utf8ToWide(value);
   }
   return bypassList;
 }
 
+bool IsStringList(const flutter::EncodableList& values)
+{
+  return std::all_of(
+      values.begin(), values.end(), [](const auto& value)
+      {
+        return std::holds_alternative<std::string>(value);
+      });
+}
+
 bool SetOptionsForConnection(
     INTERNET_PER_CONN_OPTION_LIST& list,
     LPTSTR connection)
@@ -133,7 +144,9 @@ bool startProxy(const int port, const flutter::EncodableList& bypassDomain)
   options[2].dwOption = INTERNET_PER_CONN_PROXY_BYPASS;
   options[2].Value.pszValue = bypassList.data();
 
-  return ApplyOptionsToConnections(list) && NotifySettingsChanged();
+  const bool optionsApplied = ApplyOptionsToConnections(list);
+  const bool settingsNotified = NotifySettingsChanged();
+  return optionsApplied && settingsNotified;
 }
 
 bool stopProxy()
@@ -148,7 +161,9 @@ bool stopProxy()
   options[0].dwOption = INTERNET_PER_CONN_FLAGS;
   options[0].Value.dwValue = PROXY_TYPE_DIRECT;
 
-  return ApplyOptionsToConnections(list) && NotifySettingsChanged();
+  const bool optionsApplied = ApplyOptionsToConnections(list);
+  const bool settingsNotified = NotifySettingsChanged();
+  return optionsApplied && settingsNotified;
 }
 
 }  // namespace
@@ -176,19 +191,15 @@ namespace proxy
     registrar->AddPlugin(std::move(plugin));
   }
 
-  ProxyPlugin::ProxyPlugin() {}
-
-  ProxyPlugin::~ProxyPlugin() {}
-
   void ProxyPlugin::HandleMethodCall(
       const flutter::MethodCall<flutter::EncodableValue> &method_call,
       std::unique_ptr<flutter::MethodResult<flutter::EncodableValue>> result)
   {
-    if (method_call.method_name().compare("StopProxy") == 0)
+    if (method_call.method_name() == "StopProxy")
     {
       result->Success(stopProxy());
     }
-    else if (method_call.method_name().compare("StartProxy") == 0)
+    else if (method_call.method_name() == "StartProxy")
     {
       auto *arguments = std::get_if<flutter::EncodableMap>(method_call.arguments());
       if (arguments == nullptr)
@@ -210,6 +221,17 @@ namespace proxy
         result->Error("bad_args", "StartProxy argument types are invalid");
         return;
       }
+      if (*port < kMinProxyPort || *port > kMaxProxyPort)
+      {
+        result->Error("bad_args", "StartProxy port must be between 1 and 65535");
+        return;
+      }
+      if (!IsStringList(*bypassDomain))
+      {
+        result->Error(
+            "bad_args", "StartProxy bypassDomain must contain only strings");
+        return;
+      }
       result->Success(startProxy(*port, *bypassDomain));
     }
     else
diff --git a/plugins/proxy/windows/proxy_plugin.h b/plugins/proxy/windows/proxy_plugin.h
index ae3ff1a9e4..5a6a881f69 100644
--- a/plugins/proxy/windows/proxy_plugin.h
+++ b/plugins/proxy/windows/proxy_plugin.h
@@ -12,9 +12,9 @@ class ProxyPlugin : public flutter::Plugin {
  public:
   static void RegisterWithRegistrar(flutter::PluginRegistrarWindows *registrar);
 
-  ProxyPlugin();
+  ProxyPlugin() = default;
 
-  virtual ~ProxyPlugin();
+  ~ProxyPlugin() override = default;
 
   // Disallow copy and assign.
   ProxyPlugin(const ProxyPlugin&) = delete;
diff --git a/plugins/proxy/windows/test/proxy_plugin_test.cpp b/plugins/proxy/windows/test/proxy_plugin_test.cpp
index 5a05314796..c03a086f71 100644
--- a/plugins/proxy/windows/test/proxy_plugin_test.cpp
+++ b/plugins/proxy/windows/test/proxy_plugin_test.cpp
@@ -49,5 +49,53 @@ TEST(ProxyPlugin, StartProxyRejectsMissingArguments) {
   EXPECT_EQ(error_code, "bad_args");
 }
 
+TEST(ProxyPlugin, StartProxyRejectsInvalidPort) {
+  ProxyPlugin plugin;
+  std::string error_code;
+  EncodableMap arguments = {
+      {EncodableValue("port"), EncodableValue(70000)},
+      {EncodableValue("bypassDomain"), EncodableValue(EncodableList())}};
+
+  plugin.HandleMethodCall(
+      MethodCall(
+          "StartProxy",
+          std::make_unique<EncodableValue>(std::move(arguments))),
+      std::make_unique<MethodResultFunctions<>>(
+          nullptr,
+          [&error_code](
+              const std::string& code,
+              const std::string& message,
+              const EncodableValue* details) { error_code = code; },
+          nullptr));
+
+  EXPECT_EQ(error_code, "bad_args");
+}
+
+TEST(ProxyPlugin, StartProxyRejectsNonStringBypassDomain) {
+  ProxyPlugin plugin;
+  std::string error_code;
+  EncodableList bypass_domain = {
+      EncodableValue("localhost"),
+      EncodableValue(1)};
+  EncodableMap arguments = {
+      {EncodableValue("port"), EncodableValue(7890)},
+      {EncodableValue("bypassDomain"),
+       EncodableValue(std::move(bypass_domain))}};
+
+  plugin.HandleMethodCall(
+      MethodCall(
+          "StartProxy",
+          std::make_unique<EncodableValue>(std::move(arguments))),
+      std::make_unique<MethodResultFunctions<>>(
+          nullptr,
+          [&error_code](
+              const std::string& code,
+              const std::string& message,
+              const EncodableValue* details) { error_code = code; },
+          nullptr));
+
+  EXPECT_EQ(error_code, "bad_args");
+}
+
 }  // namespace test
 }  // namespace proxy
diff --git a/plugins/rust_api/android/src/main/AndroidManifest.xml b/plugins/rust_api/android/src/main/AndroidManifest.xml
index 06714550c8..cc947c5679 100644
--- a/plugins/rust_api/android/src/main/AndroidManifest.xml
+++ b/plugins/rust_api/android/src/main/AndroidManifest.xml
@@ -1,3 +1 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-        package="com.flutter_rust_bridge.rust_api">
-</manifest>
+<manifest />
diff --git a/plugins/rust_api/cargokit/build_pod.sh b/plugins/rust_api/cargokit/build_pod.sh
index ed0e0d987d..3714ee190d 100755
--- a/plugins/rust_api/cargokit/build_pod.sh
+++ b/plugins/rust_api/cargokit/build_pod.sh
@@ -11,8 +11,6 @@ NEW_PATH=`echo $PATH | tr ":" "\n" | grep -v "Contents/Developer/" | tr "\n" ":"
 
 export PATH=${NEW_PATH%?} # remove trailing :
 
-env
-
 # Platform name (macosx, iphoneos, iphonesimulator)
 export CARGOKIT_DARWIN_PLATFORM_NAME=$PLATFORM_NAME
 
diff --git a/plugins/rust_api/lib/src/rust/api/ipc.dart b/plugins/rust_api/lib/src/rust/api/ipc.dart
index 95768f3dd8..5a99b6d1c0 100644
--- a/plugins/rust_api/lib/src/rust/api/ipc.dart
+++ b/plugins/rust_api/lib/src/rust/api/ipc.dart
@@ -6,19 +6,14 @@
 import '../frb_generated.dart';
 import 'package:flutter_rust_bridge/flutter_rust_bridge_for_generated.dart';
 
-// These functions are ignored because they are not marked as `pub`: `cleanup_socket`, `io_loop`, `is_current_gen`, `make_frame`, `read_frame`, `write_frame`
-// These types are ignored because they are neither used by any `pub` functions nor (for structs and enums) marked `#[frb(unignore)]`: `ServerState`
+// These functions are ignored because they are not marked as `pub`: `cleanup_socket`, `finish_server`, `io_loop`, `make_frame`, `poll`, `report_error`, `reset`, `server_active`, `stop_server_thread`, `validate_frame_len`, `write_all_interruptible`, `write_frame`
+// These types are ignored because they are neither used by any `pub` functions nor (for structs and enums) marked `#[frb(unignore)]`: `FrameReader`, `ServerState`
+// These functions are ignored (category: IgnoreBecauseOwnerTyShouldIgnore): `default`
 
 Stream<Uint8List> restartIpcServer({required String name}) =>
     RustLib.instance.api.crateApiIpcRestartIpcServer(name: name);
 
 Future<void> stopIpcServer() => RustLib.instance.api.crateApiIpcStopIpcServer();
 
-Future<bool> ipcServerStatus() =>
-    RustLib.instance.api.crateApiIpcIpcServerStatus();
-
-Future<bool> isIpcConnected() =>
-    RustLib.instance.api.crateApiIpcIsIpcConnected();
-
 Future<void> sendIpcMessage({required List<int> data}) =>
     RustLib.instance.api.crateApiIpcSendIpcMessage(data: data);
diff --git a/plugins/rust_api/lib/src/rust/frb_generated.dart b/plugins/rust_api/lib/src/rust/frb_generated.dart
index dfac7f5bc6..5c9e38de35 100644
--- a/plugins/rust_api/lib/src/rust/frb_generated.dart
+++ b/plugins/rust_api/lib/src/rust/frb_generated.dart
@@ -66,7 +66,7 @@ class RustLib extends BaseEntrypoint<RustLibApi, RustLibApiImpl, RustLibWire> {
   String get codegenVersion => '2.12.0';
 
   @override
-  int get rustContentHash => -514549545;
+  int get rustContentHash => -1590120092;
 
   static const kDefaultExternalLibraryLoaderConfig =
       ExternalLibraryLoaderConfig(
@@ -80,10 +80,6 @@ class RustLib extends BaseEntrypoint<RustLibApi, RustLibApiImpl, RustLibWire> {
 abstract class RustLibApi extends BaseApi {
   Future<void> crateApiInitInitApp();
 
-  Future<bool> crateApiIpcIpcServerStatus();
-
-  Future<bool> crateApiIpcIsIpcConnected();
-
   Stream<Uint8List> crateApiIpcRestartIpcServer({required String name});
 
   Future<void> crateApiIpcSendIpcMessage({required List<int> data});
@@ -126,60 +122,6 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
   TaskConstMeta get kCrateApiInitInitAppConstMeta =>
       const TaskConstMeta(debugName: "init_app", argNames: []);
 
-  @override
-  Future<bool> crateApiIpcIpcServerStatus() {
-    return handler.executeNormal(
-      NormalTask(
-        callFfi: (port_) {
-          final serializer = SseSerializer(generalizedFrbRustBinding);
-          pdeCallFfi(
-            generalizedFrbRustBinding,
-            serializer,
-            funcId: 2,
-            port: port_,
-          );
-        },
-        codec: SseCodec(
-          decodeSuccessData: sse_decode_bool,
-          decodeErrorData: null,
-        ),
-        constMeta: kCrateApiIpcIpcServerStatusConstMeta,
-        argValues: [],
-        apiImpl: this,
-      ),
-    );
-  }
-
-  TaskConstMeta get kCrateApiIpcIpcServerStatusConstMeta =>
-      const TaskConstMeta(debugName: "ipc_server_status", argNames: []);
-
-  @override
-  Future<bool> crateApiIpcIsIpcConnected() {
-    return handler.executeNormal(
-      NormalTask(
-        callFfi: (port_) {
-          final serializer = SseSerializer(generalizedFrbRustBinding);
-          pdeCallFfi(
-            generalizedFrbRustBinding,
-            serializer,
-            funcId: 3,
-            port: port_,
-          );
-        },
-        codec: SseCodec(
-          decodeSuccessData: sse_decode_bool,
-          decodeErrorData: null,
-        ),
-        constMeta: kCrateApiIpcIsIpcConnectedConstMeta,
-        argValues: [],
-        apiImpl: this,
-      ),
-    );
-  }
-
-  TaskConstMeta get kCrateApiIpcIsIpcConnectedConstMeta =>
-      const TaskConstMeta(debugName: "is_ipc_connected", argNames: []);
-
   @override
   Stream<Uint8List> crateApiIpcRestartIpcServer({required String name}) {
     final sink = RustStreamSink<Uint8List>();
@@ -193,7 +135,7 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
             pdeCallFfi(
               generalizedFrbRustBinding,
               serializer,
-              funcId: 4,
+              funcId: 2,
               port: port_,
             );
           },
@@ -226,7 +168,7 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
           pdeCallFfi(
             generalizedFrbRustBinding,
             serializer,
-            funcId: 5,
+            funcId: 3,
             port: port_,
           );
         },
@@ -253,7 +195,7 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
           pdeCallFfi(
             generalizedFrbRustBinding,
             serializer,
-            funcId: 6,
+            funcId: 4,
             port: port_,
           );
         },
@@ -291,12 +233,6 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
     return raw as String;
   }
 
-  @protected
-  bool dco_decode_bool(dynamic raw) {
-    // Codec=Dco (DartCObject based), see doc to use other codecs
-    return raw as bool;
-  }
-
   @protected
   List<int> dco_decode_list_prim_u_8_loose(dynamic raw) {
     // Codec=Dco (DartCObject based), see doc to use other codecs
@@ -343,12 +279,6 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
     return utf8.decoder.convert(inner);
   }
 
-  @protected
-  bool sse_decode_bool(SseDeserializer deserializer) {
-    // Codec=Sse (Serialization based), see doc to use other codecs
-    return deserializer.buffer.getUint8() != 0;
-  }
-
   @protected
   List<int> sse_decode_list_prim_u_8_loose(SseDeserializer deserializer) {
     // Codec=Sse (Serialization based), see doc to use other codecs
@@ -380,6 +310,12 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
     return deserializer.buffer.getInt32();
   }
 
+  @protected
+  bool sse_decode_bool(SseDeserializer deserializer) {
+    // Codec=Sse (Serialization based), see doc to use other codecs
+    return deserializer.buffer.getUint8() != 0;
+  }
+
   @protected
   void sse_encode_AnyhowException(
     AnyhowException self,
@@ -412,12 +348,6 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
     sse_encode_list_prim_u_8_strict(utf8.encoder.convert(self), serializer);
   }
 
-  @protected
-  void sse_encode_bool(bool self, SseSerializer serializer) {
-    // Codec=Sse (Serialization based), see doc to use other codecs
-    serializer.buffer.putUint8(self ? 1 : 0);
-  }
-
   @protected
   void sse_encode_list_prim_u_8_loose(
     List<int> self,
@@ -456,4 +386,10 @@ class RustLibApiImpl extends RustLibApiImplPlatform implements RustLibApi {
     // Codec=Sse (Serialization based), see doc to use other codecs
     serializer.buffer.putInt32(self);
   }
+
+  @protected
+  void sse_encode_bool(bool self, SseSerializer serializer) {
+    // Codec=Sse (Serialization based), see doc to use other codecs
+    serializer.buffer.putUint8(self ? 1 : 0);
+  }
 }
diff --git a/plugins/rust_api/lib/src/rust/frb_generated.io.dart b/plugins/rust_api/lib/src/rust/frb_generated.io.dart
index 187f77d7b7..8005fa7142 100644
--- a/plugins/rust_api/lib/src/rust/frb_generated.io.dart
+++ b/plugins/rust_api/lib/src/rust/frb_generated.io.dart
@@ -29,9 +29,6 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
   @protected
   String dco_decode_String(dynamic raw);
 
-  @protected
-  bool dco_decode_bool(dynamic raw);
-
   @protected
   List<int> dco_decode_list_prim_u_8_loose(dynamic raw);
 
@@ -55,9 +52,6 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
   @protected
   String sse_decode_String(SseDeserializer deserializer);
 
-  @protected
-  bool sse_decode_bool(SseDeserializer deserializer);
-
   @protected
   List<int> sse_decode_list_prim_u_8_loose(SseDeserializer deserializer);
 
@@ -73,6 +67,9 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
   @protected
   int sse_decode_i_32(SseDeserializer deserializer);
 
+  @protected
+  bool sse_decode_bool(SseDeserializer deserializer);
+
   @protected
   void sse_encode_AnyhowException(
     AnyhowException self,
@@ -88,9 +85,6 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
   @protected
   void sse_encode_String(String self, SseSerializer serializer);
 
-  @protected
-  void sse_encode_bool(bool self, SseSerializer serializer);
-
   @protected
   void sse_encode_list_prim_u_8_loose(List<int> self, SseSerializer serializer);
 
@@ -108,6 +102,9 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
 
   @protected
   void sse_encode_i_32(int self, SseSerializer serializer);
+
+  @protected
+  void sse_encode_bool(bool self, SseSerializer serializer);
 }
 
 // Section: wire_class
diff --git a/plugins/rust_api/lib/src/rust/frb_generated.web.dart b/plugins/rust_api/lib/src/rust/frb_generated.web.dart
index 5afff9a7ec..4aabf61e82 100644
--- a/plugins/rust_api/lib/src/rust/frb_generated.web.dart
+++ b/plugins/rust_api/lib/src/rust/frb_generated.web.dart
@@ -31,9 +31,6 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
   @protected
   String dco_decode_String(dynamic raw);
 
-  @protected
-  bool dco_decode_bool(dynamic raw);
-
   @protected
   List<int> dco_decode_list_prim_u_8_loose(dynamic raw);
 
@@ -57,9 +54,6 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
   @protected
   String sse_decode_String(SseDeserializer deserializer);
 
-  @protected
-  bool sse_decode_bool(SseDeserializer deserializer);
-
   @protected
   List<int> sse_decode_list_prim_u_8_loose(SseDeserializer deserializer);
 
@@ -75,6 +69,9 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
   @protected
   int sse_decode_i_32(SseDeserializer deserializer);
 
+  @protected
+  bool sse_decode_bool(SseDeserializer deserializer);
+
   @protected
   void sse_encode_AnyhowException(
     AnyhowException self,
@@ -90,9 +87,6 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
   @protected
   void sse_encode_String(String self, SseSerializer serializer);
 
-  @protected
-  void sse_encode_bool(bool self, SseSerializer serializer);
-
   @protected
   void sse_encode_list_prim_u_8_loose(List<int> self, SseSerializer serializer);
 
@@ -110,6 +104,9 @@ abstract class RustLibApiImplPlatform extends BaseApiImpl<RustLibWire> {
 
   @protected
   void sse_encode_i_32(int self, SseSerializer serializer);
+
+  @protected
+  void sse_encode_bool(bool self, SseSerializer serializer);
 }
 
 // Section: wire_class
diff --git a/plugins/rust_api/pubspec.yaml b/plugins/rust_api/pubspec.yaml
index 22bf333550..f182f4ddcf 100644
--- a/plugins/rust_api/pubspec.yaml
+++ b/plugins/rust_api/pubspec.yaml
@@ -4,7 +4,7 @@ version: 0.0.1
 homepage:
 
 environment:
-  sdk: ^3.9.2
+  sdk: '>=3.8.0 <4.0.0'
   flutter: '>=3.3.0'
 
 dependencies:
diff --git a/plugins/rust_api/rust/Cargo.lock b/plugins/rust_api/rust/Cargo.lock
index 25bc010d47..38f953d8c6 100644
--- a/plugins/rust_api/rust/Cargo.lock
+++ b/plugins/rust_api/rust/Cargo.lock
@@ -594,7 +594,7 @@ version = "0.1.0"
 dependencies = [
  "flutter_rust_bridge",
  "interprocess",
- "libc",
+ "windows-sys",
 ]
 
 [[package]]
diff --git a/plugins/rust_api/rust/Cargo.toml b/plugins/rust_api/rust/Cargo.toml
index c0759bd65e..6fdaf27ae6 100644
--- a/plugins/rust_api/rust/Cargo.toml
+++ b/plugins/rust_api/rust/Cargo.toml
@@ -10,8 +10,8 @@ crate-type = ["cdylib", "staticlib"]
 flutter_rust_bridge = "=2.12.0"
 interprocess = "2"
 
-[target.'cfg(unix)'.dependencies]
-libc = "0.2"
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_System_Pipes"] }
 
 [profile.release]
 opt-level = "s"
diff --git a/plugins/rust_api/rust/src/api/ipc.rs b/plugins/rust_api/rust/src/api/ipc.rs
index ef87bf1af1..3a40d02206 100644
--- a/plugins/rust_api/rust/src/api/ipc.rs
+++ b/plugins/rust_api/rust/src/api/ipc.rs
@@ -4,15 +4,21 @@ use flutter_rust_bridge::frb;
 use interprocess::local_socket::prelude::*;
 use interprocess::local_socket::{GenericFilePath, ListenerNonblockingMode, ListenerOptions};
 use std::io::{self, Read, Write};
-use std::path::Path;
-use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
-use std::sync::mpsc::{self, Sender};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{self, SyncSender, TrySendError};
 use std::sync::{Arc, Mutex};
 use std::thread;
 use std::time::Duration;
 
 #[cfg(unix)]
-use std::os::unix::io::RawFd;
+use std::path::Path;
+#[cfg(windows)]
+use std::{
+    os::windows::io::{AsHandle, AsRawHandle},
+    ptr,
+};
+#[cfg(windows)]
+use windows_sys::Win32::System::Pipes::PeekNamedPipe;
 
 macro_rules! ipc_debug {
     ($($arg:tt)*) => {
@@ -22,14 +28,10 @@ macro_rules! ipc_debug {
 }
 
 static RUNNING: AtomicBool = AtomicBool::new(false);
-static CONNECTED: AtomicBool = AtomicBool::new(false);
-static LAST_ERROR: Mutex<Option<String>> = Mutex::new(None);
-static GENERATION: AtomicU64 = AtomicU64::new(0);
-#[cfg(unix)]
-static SHUTDOWN_FD: Mutex<Option<RawFd>> = Mutex::new(None);
+static LIFECYCLE: Mutex<()> = Mutex::new(());
 
 struct ServerState {
-    tx: Option<Sender<Vec<u8>>>,
+    tx: Option<SyncSender<Vec<u8>>>,
     handle: Option<thread::JoinHandle<()>>,
 }
 
@@ -44,363 +46,530 @@ const TYPE_DISCONNECTED: u8 = 0x02;
 const TYPE_DATA: u8 = 0x03;
 const TYPE_ERROR: u8 = 0x04;
 
+const MAX_FRAME_SIZE: usize = 64 * 1024 * 1024;
+const MAX_PENDING_MESSAGES: usize = 8;
+const IO_POLL_INTERVAL: Duration = Duration::from_millis(20);
+const ACCEPT_POLL_INTERVAL: Duration = Duration::from_millis(50);
+
 fn make_frame(ty: u8, payload: &[u8]) -> Vec<u8> {
-    let mut v = Vec::with_capacity(1 + payload.len());
-    v.push(ty);
-    v.extend_from_slice(payload);
-    v
+    let mut frame = Vec::with_capacity(1 + payload.len());
+    frame.push(ty);
+    frame.extend_from_slice(payload);
+    frame
 }
 
-fn cleanup_socket(path: &str) {
+fn cleanup_socket(path: &str) -> io::Result<()> {
     #[cfg(unix)]
     {
         if Path::new(path).exists() {
-            let _ = std::fs::remove_file(path);
+            std::fs::remove_file(path)?;
         }
     }
     #[cfg(windows)]
     {
         let _ = path;
     }
+    Ok(())
 }
 
-#[frb]
-pub fn restart_ipc_server(
-    name: String,
-    sink: StreamSink<Vec<u8>, SseCodec>,
-) -> Result<(), String> {
-    let new_gen = GENERATION.fetch_add(1, Ordering::SeqCst) + 1;
-    ipc_debug!("[IPC] restart_ipc_server: gen={new_gen}, name={name}");
-
-    shutdown_old_fd();
+fn server_active() -> bool {
+    RUNNING.load(Ordering::SeqCst)
+}
 
+fn stop_server_thread() -> Result<(), String> {
     RUNNING.store(false, Ordering::SeqCst);
-    CONNECTED.store(false, Ordering::SeqCst);
+    let handle = {
+        let mut state = STATE.lock().map_err(|e| format!("Lock poisoned: {e}"))?;
+        state.tx = None;
+        state.handle.take()
+    };
+    if let Some(handle) = handle {
+        handle
+            .join()
+            .map_err(|_| "IPC server thread panicked".to_owned())?;
+    }
+    Ok(())
+}
 
-    let old_handle = STATE
+#[frb]
+pub fn restart_ipc_server(name: String, sink: StreamSink<Vec<u8>, SseCodec>) -> Result<(), String> {
+    let _lifecycle = LIFECYCLE
         .lock()
-        .map(|mut guard| {
-            guard.tx = None;
-            guard.handle.take()
-        })
-        .unwrap_or(None);
-    if let Some(handle) = old_handle {
-        ipc_debug!("[IPC] restart_ipc_server: joining old thread...");
-        let _ = handle.join();
-        ipc_debug!("[IPC] restart_ipc_server: old thread joined");
-    }
+        .map_err(|e| format!("Lifecycle lock poisoned: {e}"))?;
 
-    cleanup_socket(&name);
+    stop_server_thread()?;
+    cleanup_socket(&name).map_err(|e| format!("Failed to remove stale socket: {e}"))?;
 
     RUNNING.store(true, Ordering::SeqCst);
-    ipc_debug!("[IPC] restart_ipc_server: RUNNING=true, spawning io_loop");
-
     let handle = thread::Builder::new()
         .name("ipc-server".into())
-        .spawn(move || io_loop(name, sink, new_gen))
+        .spawn(move || io_loop(name, sink))
         .map_err(|e| {
             RUNNING.store(false, Ordering::SeqCst);
-            ipc_debug!("[IPC] restart_ipc_server: spawn failed: {e}");
-            format!("Failed to spawn thread: {e}")
+            format!("Failed to spawn IPC server thread: {e}")
         })?;
 
-    if let Ok(mut guard) = STATE.lock() {
-        guard.handle = Some(handle);
-    }
-    ipc_debug!("[IPC] restart_ipc_server: done, thread spawned");
-
+    let mut state = STATE.lock().map_err(|e| format!("Lock poisoned: {e}"))?;
+    state.handle = Some(handle);
     Ok(())
 }
 
-#[cfg(unix)]
-fn shutdown_old_fd() {
-    if let Ok(mut guard) = SHUTDOWN_FD.lock() {
-        if let Some(fd) = guard.take() {
-            ipc_debug!("[IPC] shutdown_old_fd: shutting down fd={fd}");
-            if unsafe { libc::shutdown(fd, libc::SHUT_RDWR) } != 0 {
-                ipc_debug!(
-                    "[IPC] shutdown_old_fd: shutdown failed: {}",
-                    io::Error::last_os_error()
-                );
-            }
-        }
-    }
+#[frb]
+pub fn stop_ipc_server() -> Result<(), String> {
+    let _lifecycle = LIFECYCLE
+        .lock()
+        .map_err(|e| format!("Lifecycle lock poisoned: {e}"))?;
+    stop_server_thread()
 }
 
-#[cfg(not(unix))]
-fn shutdown_old_fd() {}
-
 #[frb]
-pub fn stop_ipc_server() -> Result<(), String> {
-    ipc_debug!(
-        "[IPC] stop_ipc_server: RUNNING={}",
-        RUNNING.load(Ordering::SeqCst)
-    );
-    if !RUNNING.load(Ordering::SeqCst) {
-        return Err("IPC server is not running".into());
+pub fn send_ipc_message(data: Vec<u8>) -> Result<(), String> {
+    validate_frame_len(data.len()).map_err(|e| e.to_string())?;
+    let tx = STATE
+        .lock()
+        .map_err(|e| format!("Lock poisoned: {e}"))?
+        .tx
+        .clone()
+        .ok_or("IPC client is not connected")?;
+
+    match tx.try_send(data) {
+        Ok(()) => Ok(()),
+        Err(TrySendError::Full(_)) => Err("IPC send queue is full".into()),
+        Err(TrySendError::Disconnected(_)) => Err("IPC client is disconnected".into()),
+    }
+}
+
+fn validate_frame_len(len: usize) -> io::Result<u32> {
+    if len > MAX_FRAME_SIZE {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("IPC frame exceeds {MAX_FRAME_SIZE} bytes"),
+        ));
     }
+    u32::try_from(len)
+        .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "IPC frame is too large"))
+}
 
-    shutdown_old_fd();
+#[cfg(any(windows, test))]
+fn normalize_windows_pipe_write(result: io::Result<usize>) -> io::Result<usize> {
+    match result {
+        Ok(0) => Err(io::ErrorKind::WouldBlock.into()),
+        result => result,
+    }
+}
 
-    RUNNING.store(false, Ordering::SeqCst);
-    CONNECTED.store(false, Ordering::SeqCst);
-    if let Ok(mut guard) = STATE.lock() {
-        guard.tx = None;
-        if let Some(handle) = guard.handle.take() {
-            ipc_debug!("[IPC] stop_ipc_server: joining old thread...");
-            let _ = handle.join();
-            ipc_debug!("[IPC] stop_ipc_server: old thread joined");
+fn write_all_interruptible(
+    writer: &mut impl Write,
+    mut data: &[u8],
+    connection_running: &AtomicBool,
+) -> io::Result<()> {
+    while !data.is_empty() {
+        if !connection_running.load(Ordering::SeqCst) || !server_active() {
+            return Err(io::Error::new(
+                io::ErrorKind::Interrupted,
+                "IPC connection stopped",
+            ));
+        }
+        let result = writer.write(data);
+        #[cfg(windows)]
+        let result = normalize_windows_pipe_write(result);
+        match result {
+            Ok(0) => return Err(io::ErrorKind::WriteZero.into()),
+            Ok(written) => data = &data[written..],
+            Err(e) if e.kind() == io::ErrorKind::Interrupted => continue,
+            Err(e) if e.kind() == io::ErrorKind::WouldBlock => {
+                thread::sleep(IO_POLL_INTERVAL);
+            }
+            Err(e) => return Err(e),
         }
     }
     Ok(())
 }
 
-#[frb]
-pub fn ipc_server_status() -> bool {
-    RUNNING.load(Ordering::SeqCst)
+fn write_frame(
+    writer: &mut impl Write,
+    data: &[u8],
+    connection_running: &AtomicBool,
+) -> io::Result<()> {
+    let len = validate_frame_len(data.len())?;
+    write_all_interruptible(writer, &len.to_le_bytes(), connection_running)?;
+    write_all_interruptible(writer, data, connection_running)
 }
 
-#[frb]
-pub fn is_ipc_connected() -> bool {
-    CONNECTED.load(Ordering::SeqCst)
+#[frb(ignore)]
+#[derive(Default)]
+struct FrameReader {
+    header: [u8; 4],
+    header_read: usize,
+    payload: Vec<u8>,
+    payload_read: usize,
 }
 
-#[frb]
-pub fn send_ipc_message(data: Vec<u8>) -> Result<(), String> {
-    if !CONNECTED.load(Ordering::SeqCst) {
-        return Err("IPC client is not connected".into());
-    }
-    if let Ok(mut guard) = LAST_ERROR.lock() {
-        if let Some(err) = guard.take() {
-            ipc_debug!("[IPC] send_ipc_message: returning cached error: {err}");
-            return Err(err);
+impl FrameReader {
+    fn poll(&mut self, reader: &mut impl Read) -> io::Result<Option<Vec<u8>>> {
+        loop {
+            if self.header_read < self.header.len() {
+                match reader.read(&mut self.header[self.header_read..]) {
+                    Ok(0) => return Err(io::ErrorKind::UnexpectedEof.into()),
+                    Ok(read) => self.header_read += read,
+                    Err(e) if e.kind() == io::ErrorKind::Interrupted => continue,
+                    Err(e) if e.kind() == io::ErrorKind::WouldBlock => return Ok(None),
+                    Err(e) => return Err(e),
+                }
+                if self.header_read < self.header.len() {
+                    continue;
+                }
+
+                let len = u32::from_le_bytes(self.header) as usize;
+                validate_frame_len(len)?;
+                if len == 0 {
+                    self.reset();
+                    return Ok(Some(Vec::new()));
+                }
+                self.payload = vec![0; len];
+            }
+
+            match reader.read(&mut self.payload[self.payload_read..]) {
+                Ok(0) => return Err(io::ErrorKind::UnexpectedEof.into()),
+                Ok(read) => self.payload_read += read,
+                Err(e) if e.kind() == io::ErrorKind::Interrupted => continue,
+                Err(e) if e.kind() == io::ErrorKind::WouldBlock => return Ok(None),
+                Err(e) => return Err(e),
+            }
+            if self.payload_read == self.payload.len() {
+                let payload = std::mem::take(&mut self.payload);
+                self.reset();
+                return Ok(Some(payload));
+            }
         }
     }
-    let guard = STATE.lock().map_err(|e| format!("Lock poisoned: {e}"))?;
-    let tx = guard.tx.as_ref().ok_or("IPC server is not running")?;
-    tx.send(data)
-        .map_err(|e| format!("Failed to send: {e}"))
-}
 
-fn write_frame(mut writer: impl Write, data: &[u8]) -> io::Result<()> {
-    let len = data.len() as u32;
-    writer.write_all(&len.to_le_bytes())?;
-    writer.write_all(data)?;
-    writer.flush()
+    fn reset(&mut self) {
+        self.header = [0; 4];
+        self.header_read = 0;
+        self.payload.clear();
+        self.payload_read = 0;
+    }
 }
 
-fn read_frame(mut reader: impl Read) -> io::Result<Vec<u8>> {
-    let mut len_buf = [0u8; 4];
-    reader.read_exact(&mut len_buf)?;
-    let len = u32::from_le_bytes(len_buf) as usize;
-    let mut payload = vec![0u8; len];
-    reader.read_exact(&mut payload)?;
-    Ok(payload)
+#[cfg(windows)]
+fn windows_pipe_bytes_available(
+    receiver: &interprocess::local_socket::RecvHalf,
+) -> io::Result<u32> {
+    let interprocess::local_socket::RecvHalf::NamedPipe(pipe) = receiver;
+    let mut available = 0_u32;
+    // SAFETY: `pipe` owns a live named-pipe handle for this receive half, and
+    // `available` is a valid output pointer. No input buffer is supplied.
+    let result = unsafe {
+        PeekNamedPipe(
+            pipe.as_handle().as_raw_handle(),
+            ptr::null_mut(),
+            0,
+            ptr::null_mut(),
+            &mut available,
+            ptr::null_mut(),
+        )
+    };
+    if result == 0 {
+        Err(io::Error::last_os_error())
+    } else {
+        Ok(available)
+    }
 }
 
-fn is_current_gen(gen: u64) -> bool {
-    GENERATION.load(Ordering::SeqCst) == gen
+#[cfg(windows)]
+struct WindowsPipeReader<'a> {
+    receiver: &'a mut interprocess::local_socket::RecvHalf,
 }
 
-fn save_shutdown_fd(stream: &LocalSocketStream) {
-    #[cfg(unix)]
-    {
-        use std::os::fd::AsRawFd;
-        use std::os::unix::io::AsFd;
-        let LocalSocketStream::UdSocket(ref s) = stream;
-        if let Ok(mut guard) = SHUTDOWN_FD.lock() {
-            *guard = Some(s.as_fd().as_raw_fd());
+#[cfg(windows)]
+impl Read for WindowsPipeReader<'_> {
+    fn read(&mut self, buffer: &mut [u8]) -> io::Result<usize> {
+        if windows_pipe_bytes_available(self.receiver)? == 0 {
+            return Err(io::ErrorKind::WouldBlock.into());
         }
-    }
-    #[cfg(not(unix))]
-    {
-        let _ = stream;
+        self.receiver.read(buffer)
     }
 }
 
-fn clear_shutdown_fd() {
-    #[cfg(unix)]
-    {
-        if let Ok(mut guard) = SHUTDOWN_FD.lock() {
-            *guard = None;
-        }
-    }
+fn report_error(sink: &StreamSink<Vec<u8>, SseCodec>, message: impl AsRef<str>) {
+    let _ = sink.add(make_frame(TYPE_ERROR, message.as_ref().as_bytes()));
 }
 
-fn io_loop(name: String, sink: StreamSink<Vec<u8>, SseCodec>, gen: u64) {
-    ipc_debug!("[IPC] io_loop[{gen}]: started");
+fn is_expected_disconnect_error(error: &io::Error) -> bool {
+    matches!(
+        error.kind(),
+        io::ErrorKind::UnexpectedEof | io::ErrorKind::ConnectionReset | io::ErrorKind::BrokenPipe
+    )
+}
+
+fn finish_server(name: &str) {
+    RUNNING.store(false, Ordering::SeqCst);
+    if let Ok(mut state) = STATE.lock() {
+        state.tx = None;
+    }
+    if let Err(e) = cleanup_socket(name) {
+        ipc_debug!("[IPC] cleanup socket failed: {e}");
+    }
+}
 
+fn io_loop(name: String, sink: StreamSink<Vec<u8>, SseCodec>) {
     let fs_name = match name.clone().to_fs_name::<GenericFilePath>() {
-        Ok(n) => n,
+        Ok(name) => name,
         Err(e) => {
-            ipc_debug!("[IPC] io_loop[{gen}]: name error: {e}");
-            let _ = sink.add(make_frame(TYPE_ERROR, format!("name error: {e}").as_bytes()));
-            if is_current_gen(gen) {
-                RUNNING.store(false, Ordering::SeqCst);
-            }
+            report_error(&sink, format!("name error: {e}"));
+            finish_server(&name);
             return;
         }
     };
 
     let listener = match ListenerOptions::new().name(fs_name).create_sync() {
-        Ok(l) => l,
+        Ok(listener) => listener,
         Err(e) => {
-            ipc_debug!("[IPC] io_loop[{gen}]: bind error: {e}");
-            let _ = sink.add(make_frame(TYPE_ERROR, format!("bind error: {e}").as_bytes()));
-            if is_current_gen(gen) {
-                RUNNING.store(false, Ordering::SeqCst);
-            }
+            report_error(&sink, format!("bind error: {e}"));
+            finish_server(&name);
             return;
         }
     };
 
     if let Err(e) = listener.set_nonblocking(ListenerNonblockingMode::Accept) {
-        ipc_debug!("[IPC] io_loop[{gen}]: set_nonblocking error: {e}");
-        let _ = sink.add(make_frame(
-            TYPE_ERROR,
-            format!("set_nonblocking error: {e}").as_bytes(),
-        ));
-        if is_current_gen(gen) {
-            RUNNING.store(false, Ordering::SeqCst);
-        }
+        report_error(&sink, format!("listener nonblocking error: {e}"));
+        finish_server(&name);
         return;
     }
 
-    ipc_debug!("[IPC] io_loop[{gen}]: listener bound, sending TYPE_READY");
-    let _ = sink.add(make_frame(TYPE_READY, &[]));
+    if sink.add(make_frame(TYPE_READY, &[])).is_err() {
+        finish_server(&name);
+        return;
+    }
 
-    while RUNNING.load(Ordering::SeqCst) {
+    while server_active() {
         let stream = match listener.accept() {
-            Ok(s) => {
-                ipc_debug!("[IPC] io_loop[{gen}]: client accepted");
-                s
-            }
+            Ok(stream) => stream,
             Err(e) if e.kind() == io::ErrorKind::WouldBlock => {
-                thread::sleep(Duration::from_millis(100));
+                thread::sleep(ACCEPT_POLL_INTERVAL);
                 continue;
             }
             Err(e) => {
-                ipc_debug!("[IPC] io_loop[{gen}]: accept error: {e}");
-                if RUNNING.load(Ordering::SeqCst) {
-                    let _ = sink.add(
-                        make_frame(TYPE_ERROR, format!("accept error: {e}").as_bytes()),
-                    );
+                if server_active() {
+                    report_error(&sink, format!("accept error: {e}"));
                 }
                 break;
             }
         };
 
-        if let Err(e) = stream.set_nonblocking(false) {
-            ipc_debug!("[IPC] io_loop[{gen}]: set_nonblocking(false) error: {e}");
-            let _ = sink.add(
-                make_frame(TYPE_ERROR, format!("stream nonblocking error: {e}").as_bytes()),
-            );
+        if let Err(e) = stream.set_nonblocking(true) {
+            report_error(&sink, format!("stream nonblocking error: {e}"));
             continue;
         }
 
-        save_shutdown_fd(&stream);
+        #[cfg(windows)]
+        let connected_payload = match stream.peer_creds().and_then(|credentials| {
+            credentials.pid().ok_or_else(|| {
+                io::Error::new(
+                    io::ErrorKind::PermissionDenied,
+                    "peer process ID is unavailable",
+                )
+            })
+        }) {
+            Ok(process_id) => process_id.to_le_bytes().to_vec(),
+            Err(e) => {
+                report_error(&sink, format!("peer credentials error: {e}"));
+                continue;
+            }
+        };
+        #[cfg(not(windows))]
+        let connected_payload = Vec::new();
 
-        let (tx, rx) = mpsc::channel::<Vec<u8>>();
-        if let Ok(mut guard) = STATE.lock() {
-            guard.tx = Some(tx);
+        let (tx, rx) = mpsc::sync_channel::<Vec<u8>>(MAX_PENDING_MESSAGES);
+        match STATE.lock() {
+            Ok(mut state) if server_active() => state.tx = Some(tx),
+            Ok(_) => break,
+            Err(e) => {
+                report_error(&sink, format!("state lock error: {e}"));
+                break;
+            }
         }
 
-        ipc_debug!("[IPC] io_loop[{gen}]: client connected, sending TYPE_CONNECTED");
-        CONNECTED.store(true, Ordering::SeqCst);
-        if sink.add(make_frame(TYPE_CONNECTED, &[])).is_err() {
-            ipc_debug!("[IPC] io_loop[{gen}]: sink closed on TYPE_CONNECTED");
-            CONNECTED.store(false, Ordering::SeqCst);
+        if sink
+            .add(make_frame(TYPE_CONNECTED, &connected_payload))
+            .is_err()
+        {
             break;
         }
 
-        let (recv_half, send_half) = stream.split();
-        let running = Arc::new(AtomicBool::new(true));
-        let wr = Arc::clone(&running);
-
-        let (err_tx, err_rx) = mpsc::channel::<String>();
-
+        let (mut receiver, mut sender) = stream.split();
+        let connection_running = Arc::new(AtomicBool::new(true));
+        let writer_running = Arc::clone(&connection_running);
         let writer = thread::spawn(move || {
-            let mut sender = send_half;
-            while wr.load(Ordering::SeqCst) {
-                match rx.recv() {
+            let mut error = None;
+            while writer_running.load(Ordering::SeqCst) && server_active() {
+                match rx.recv_timeout(IO_POLL_INTERVAL) {
                     Ok(data) => {
-                        if let Err(e) = write_frame(&mut sender, &data) {
-                            let _ = err_tx.send(format!("write error: {e}"));
+                        if let Err(e) = write_frame(&mut sender, &data, &writer_running) {
+                            if e.kind() != io::ErrorKind::Interrupted {
+                                error = Some(format!("write error: {e}"));
+                            }
                             break;
                         }
                     }
-                    Err(mpsc::RecvError) => break,
+                    Err(mpsc::RecvTimeoutError::Timeout) => continue,
+                    Err(mpsc::RecvTimeoutError::Disconnected) => break,
                 }
             }
-            wr.store(false, Ordering::SeqCst);
+            writer_running.store(false, Ordering::SeqCst);
+            error
         });
 
-        let mut receiver = recv_half;
-        loop {
-            match read_frame(&mut receiver) {
-                Ok(data) => {
+        let mut frame_reader = FrameReader::default();
+        while connection_running.load(Ordering::SeqCst) && server_active() {
+            #[cfg(windows)]
+            let poll_result = frame_reader.poll(&mut WindowsPipeReader {
+                receiver: &mut receiver,
+            });
+            #[cfg(not(windows))]
+            let poll_result = frame_reader.poll(&mut receiver);
+
+            match poll_result {
+                Ok(Some(data)) => {
                     if sink.add(make_frame(TYPE_DATA, &data)).is_err() {
-                        ipc_debug!("[IPC] io_loop[{gen}]: sink closed on TYPE_DATA");
                         break;
                     }
                 }
+                Ok(None) => thread::sleep(IO_POLL_INTERVAL),
                 Err(e) => {
-                    ipc_debug!("[IPC] io_loop[{gen}]: read error: {e}");
-                    let _ = sink.add(
-                        make_frame(TYPE_ERROR, format!("read error: {e}").as_bytes()),
-                    );
+                    if !is_expected_disconnect_error(&e) && server_active() {
+                        ipc_debug!("[IPC] read error: {e}, raw={:?}", e.raw_os_error());
+                        report_error(&sink, format!("read error: {e}"));
+                    }
                     break;
                 }
             }
         }
 
-        running.store(false, Ordering::SeqCst);
+        connection_running.store(false, Ordering::SeqCst);
+        if let Ok(mut state) = STATE.lock() {
+            state.tx = None;
+        }
+        if let Ok(Some(message)) = writer.join() {
+            report_error(&sink, message);
+        }
+        if server_active() && sink.add(make_frame(TYPE_DISCONNECTED, &[])).is_err() {
+            break;
+        }
+    }
 
-        clear_shutdown_fd();
+    finish_server(&name);
+}
 
-        if is_current_gen(gen) {
-            if let Ok(mut guard) = STATE.lock() {
-                guard.tx = None;
-            }
-        }
-        writer.join().ok();
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::VecDeque;
+    use std::io::Cursor;
+
+    enum ReadStep {
+        Data(Vec<u8>),
+        WouldBlock,
+    }
+
+    struct StepReader {
+        steps: VecDeque<ReadStep>,
+    }
 
-        if let Ok(msg) = err_rx.try_recv() {
-            ipc_debug!("[IPC] io_loop[{gen}]: writer error: {msg}");
-            if is_current_gen(gen) {
-                if let Ok(mut guard) = LAST_ERROR.lock() {
-                    *guard = Some(msg.clone());
+    impl Read for StepReader {
+        fn read(&mut self, buffer: &mut [u8]) -> io::Result<usize> {
+            match self.steps.pop_front() {
+                Some(ReadStep::Data(mut data)) => {
+                    let read = data.len().min(buffer.len());
+                    buffer[..read].copy_from_slice(&data[..read]);
+                    if read < data.len() {
+                        data.drain(..read);
+                        self.steps.push_front(ReadStep::Data(data));
+                    }
+                    Ok(read)
                 }
+                Some(ReadStep::WouldBlock) => Err(io::ErrorKind::WouldBlock.into()),
+                None => Ok(0),
             }
-            let _ = sink.add(make_frame(TYPE_ERROR, msg.as_bytes()));
         }
+    }
 
-        ipc_debug!("[IPC] io_loop[{gen}]: disconnected, sending TYPE_DISCONNECTED");
-        if is_current_gen(gen) {
-            CONNECTED.store(false, Ordering::SeqCst);
-        }
-        if sink.add(make_frame(TYPE_DISCONNECTED, &[])).is_err() {
-            ipc_debug!("[IPC] io_loop[{gen}]: sink closed on TYPE_DISCONNECTED");
-            break;
-        }
+    #[test]
+    fn frame_reader_reads_complete_frame() {
+        let payload = b"hello";
+        let mut bytes = (payload.len() as u32).to_le_bytes().to_vec();
+        bytes.extend_from_slice(payload);
+        let mut reader = Cursor::new(bytes);
+        let mut frame_reader = FrameReader::default();
+
+        assert_eq!(
+            frame_reader.poll(&mut reader).unwrap(),
+            Some(payload.to_vec())
+        );
     }
 
-    ipc_debug!(
-        "[IPC] io_loop[{gen}]: exiting (RUNNING={})",
-        RUNNING.load(Ordering::SeqCst)
-    );
-    if is_current_gen(gen) {
-        ipc_debug!("[IPC] io_loop[{gen}]: is current gen, cleaning up");
-        RUNNING.store(false, Ordering::SeqCst);
-        if let Ok(mut guard) = STATE.lock() {
-            guard.tx = None;
-            guard.handle = None;
-        }
-        cleanup_socket(&name);
-    } else {
-        ipc_debug!(
-            "[IPC] io_loop[{gen}]: stale gen (current={}), skipping cleanup",
-            GENERATION.load(Ordering::SeqCst)
+    #[test]
+    fn frame_reader_preserves_partial_nonblocking_reads() {
+        let mut reader = StepReader {
+            steps: VecDeque::from([
+                ReadStep::Data(vec![5, 0]),
+                ReadStep::WouldBlock,
+                ReadStep::Data(vec![0, 0]),
+                ReadStep::Data(b"he".to_vec()),
+                ReadStep::WouldBlock,
+                ReadStep::Data(b"llo".to_vec()),
+            ]),
+        };
+        let mut frame_reader = FrameReader::default();
+
+        assert_eq!(frame_reader.poll(&mut reader).unwrap(), None);
+        assert_eq!(frame_reader.poll(&mut reader).unwrap(), None);
+        assert_eq!(
+            frame_reader.poll(&mut reader).unwrap(),
+            Some(b"hello".to_vec())
+        );
+    }
+
+    #[test]
+    fn frame_reader_rejects_oversized_frame_before_allocation() {
+        let len = (MAX_FRAME_SIZE as u32 + 1).to_le_bytes();
+        let mut reader = Cursor::new(len);
+        let mut frame_reader = FrameReader::default();
+
+        assert_eq!(
+            frame_reader.poll(&mut reader).unwrap_err().kind(),
+            io::ErrorKind::InvalidData
         );
+        assert!(frame_reader.payload.is_empty());
+    }
+
+    #[test]
+    fn windows_zero_write_is_treated_as_pending() {
+        assert_eq!(
+            normalize_windows_pipe_write(Ok(0)).unwrap_err().kind(),
+            io::ErrorKind::WouldBlock,
+        );
+        assert_eq!(normalize_windows_pipe_write(Ok(2)).unwrap(), 2);
+
+        let error = io::Error::from(io::ErrorKind::BrokenPipe);
+        assert_eq!(
+            normalize_windows_pipe_write(Err(error)).unwrap_err().kind(),
+            io::ErrorKind::BrokenPipe,
+        );
+    }
+
+    #[test]
+    fn expected_disconnect_errors_are_not_reported() {
+        for kind in [
+            io::ErrorKind::UnexpectedEof,
+            io::ErrorKind::ConnectionReset,
+            io::ErrorKind::BrokenPipe,
+        ] {
+            assert!(is_expected_disconnect_error(&io::Error::from(kind)));
+        }
+        assert!(!is_expected_disconnect_error(&io::Error::from(
+            io::ErrorKind::InvalidData,
+        )));
     }
 }
diff --git a/plugins/rust_api/rust/src/api/mod.rs b/plugins/rust_api/rust/src/api/mod.rs
index 4c93b4e883..fa2ac7265c 100644
--- a/plugins/rust_api/rust/src/api/mod.rs
+++ b/plugins/rust_api/rust/src/api/mod.rs
@@ -1,2 +1,2 @@
-pub mod ipc;
 pub mod init;
+pub mod ipc;
diff --git a/plugins/rust_api/rust/src/frb_generated.rs b/plugins/rust_api/rust/src/frb_generated.rs
index caa0faab4d..5aadc4a1dd 100644
--- a/plugins/rust_api/rust/src/frb_generated.rs
+++ b/plugins/rust_api/rust/src/frb_generated.rs
@@ -38,7 +38,7 @@ flutter_rust_bridge::frb_generated_boilerplate!(
     default_rust_auto_opaque = RustAutoOpaqueMoi,
 );
 pub(crate) const FLUTTER_RUST_BRIDGE_CODEGEN_VERSION: &str = "2.12.0";
-pub(crate) const FLUTTER_RUST_BRIDGE_CODEGEN_CONTENT_HASH: i32 = -514549545;
+pub(crate) const FLUTTER_RUST_BRIDGE_CODEGEN_CONTENT_HASH: i32 = -1590120092;
 
 // Section: executor
 
@@ -80,70 +80,6 @@ fn wire__crate__api__init__init_app_impl(
         },
     )
 }
-fn wire__crate__api__ipc__ipc_server_status_impl(
-    port_: flutter_rust_bridge::for_generated::MessagePort,
-    ptr_: flutter_rust_bridge::for_generated::PlatformGeneralizedUint8ListPtr,
-    rust_vec_len_: i32,
-    data_len_: i32,
-) {
-    FLUTTER_RUST_BRIDGE_HANDLER.wrap_normal::<flutter_rust_bridge::for_generated::SseCodec, _, _>(
-        flutter_rust_bridge::for_generated::TaskInfo {
-            debug_name: "ipc_server_status",
-            port: Some(port_),
-            mode: flutter_rust_bridge::for_generated::FfiCallMode::Normal,
-        },
-        move || {
-            let message = unsafe {
-                flutter_rust_bridge::for_generated::Dart2RustMessageSse::from_wire(
-                    ptr_,
-                    rust_vec_len_,
-                    data_len_,
-                )
-            };
-            let mut deserializer =
-                flutter_rust_bridge::for_generated::SseDeserializer::new(message);
-            deserializer.end();
-            move |context| {
-                transform_result_sse::<_, ()>((move || {
-                    let output_ok = Result::<_, ()>::Ok(crate::api::ipc::ipc_server_status())?;
-                    Ok(output_ok)
-                })())
-            }
-        },
-    )
-}
-fn wire__crate__api__ipc__is_ipc_connected_impl(
-    port_: flutter_rust_bridge::for_generated::MessagePort,
-    ptr_: flutter_rust_bridge::for_generated::PlatformGeneralizedUint8ListPtr,
-    rust_vec_len_: i32,
-    data_len_: i32,
-) {
-    FLUTTER_RUST_BRIDGE_HANDLER.wrap_normal::<flutter_rust_bridge::for_generated::SseCodec, _, _>(
-        flutter_rust_bridge::for_generated::TaskInfo {
-            debug_name: "is_ipc_connected",
-            port: Some(port_),
-            mode: flutter_rust_bridge::for_generated::FfiCallMode::Normal,
-        },
-        move || {
-            let message = unsafe {
-                flutter_rust_bridge::for_generated::Dart2RustMessageSse::from_wire(
-                    ptr_,
-                    rust_vec_len_,
-                    data_len_,
-                )
-            };
-            let mut deserializer =
-                flutter_rust_bridge::for_generated::SseDeserializer::new(message);
-            deserializer.end();
-            move |context| {
-                transform_result_sse::<_, ()>((move || {
-                    let output_ok = Result::<_, ()>::Ok(crate::api::ipc::is_ipc_connected())?;
-                    Ok(output_ok)
-                })())
-            }
-        },
-    )
-}
 fn wire__crate__api__ipc__restart_ipc_server_impl(
     port_: flutter_rust_bridge::for_generated::MessagePort,
     ptr_: flutter_rust_bridge::for_generated::PlatformGeneralizedUint8ListPtr,
@@ -273,13 +209,6 @@ impl SseDecode for String {
     }
 }
 
-impl SseDecode for bool {
-    // Codec=Sse (Serialization based), see doc to use other codecs
-    fn sse_decode(deserializer: &mut flutter_rust_bridge::for_generated::SseDeserializer) -> Self {
-        deserializer.cursor.read_u8().unwrap() != 0
-    }
-}
-
 impl SseDecode for Vec<u8> {
     // Codec=Sse (Serialization based), see doc to use other codecs
     fn sse_decode(deserializer: &mut flutter_rust_bridge::for_generated::SseDeserializer) -> Self {
@@ -311,6 +240,13 @@ impl SseDecode for i32 {
     }
 }
 
+impl SseDecode for bool {
+    // Codec=Sse (Serialization based), see doc to use other codecs
+    fn sse_decode(deserializer: &mut flutter_rust_bridge::for_generated::SseDeserializer) -> Self {
+        deserializer.cursor.read_u8().unwrap() != 0
+    }
+}
+
 fn pde_ffi_dispatcher_primary_impl(
     func_id: i32,
     port: flutter_rust_bridge::for_generated::MessagePort,
@@ -321,11 +257,9 @@ fn pde_ffi_dispatcher_primary_impl(
     // Codec=Pde (Serialization + dispatch), see doc to use other codecs
     match func_id {
         1 => wire__crate__api__init__init_app_impl(port, ptr, rust_vec_len, data_len),
-        2 => wire__crate__api__ipc__ipc_server_status_impl(port, ptr, rust_vec_len, data_len),
-        3 => wire__crate__api__ipc__is_ipc_connected_impl(port, ptr, rust_vec_len, data_len),
-        4 => wire__crate__api__ipc__restart_ipc_server_impl(port, ptr, rust_vec_len, data_len),
-        5 => wire__crate__api__ipc__send_ipc_message_impl(port, ptr, rust_vec_len, data_len),
-        6 => wire__crate__api__ipc__stop_ipc_server_impl(port, ptr, rust_vec_len, data_len),
+        2 => wire__crate__api__ipc__restart_ipc_server_impl(port, ptr, rust_vec_len, data_len),
+        3 => wire__crate__api__ipc__send_ipc_message_impl(port, ptr, rust_vec_len, data_len),
+        4 => wire__crate__api__ipc__stop_ipc_server_impl(port, ptr, rust_vec_len, data_len),
         _ => unreachable!(),
     }
 }
@@ -365,13 +299,6 @@ impl SseEncode for String {
     }
 }
 
-impl SseEncode for bool {
-    // Codec=Sse (Serialization based), see doc to use other codecs
-    fn sse_encode(self, serializer: &mut flutter_rust_bridge::for_generated::SseSerializer) {
-        serializer.cursor.write_u8(self as _).unwrap();
-    }
-}
-
 impl SseEncode for Vec<u8> {
     // Codec=Sse (Serialization based), see doc to use other codecs
     fn sse_encode(self, serializer: &mut flutter_rust_bridge::for_generated::SseSerializer) {
@@ -401,6 +328,13 @@ impl SseEncode for i32 {
     }
 }
 
+impl SseEncode for bool {
+    // Codec=Sse (Serialization based), see doc to use other codecs
+    fn sse_encode(self, serializer: &mut flutter_rust_bridge::for_generated::SseSerializer) {
+        serializer.cursor.write_u8(self as _).unwrap();
+    }
+}
+
 #[cfg(not(target_family = "wasm"))]
 mod io {
     // This file is automatically generated, so please do not edit it.
diff --git a/plugins/setup/analysis_options.yaml b/plugins/setup/analysis_options.yaml
new file mode 100644
index 0000000000..45305438b6
--- /dev/null
+++ b/plugins/setup/analysis_options.yaml
@@ -0,0 +1,5 @@
+include: package:flutter_lints/flutter.yaml
+
+analyzer:
+  exclude:
+    - buildkit/build_tool/**
diff --git a/plugins/setup/android/src/main/AndroidManifest.xml b/plugins/setup/android/src/main/AndroidManifest.xml
index e9ca0e6ac5..cc947c5679 100644
--- a/plugins/setup/android/src/main/AndroidManifest.xml
+++ b/plugins/setup/android/src/main/AndroidManifest.xml
@@ -1,3 +1 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-  package="com.follow.clash.setup">
-</manifest>
+<manifest />
diff --git a/plugins/setup/buildkit/build_pod.sh b/plugins/setup/buildkit/build_pod.sh
index 240a5005bc..0340d878e7 100755
--- a/plugins/setup/buildkit/build_pod.sh
+++ b/plugins/setup/buildkit/build_pod.sh
@@ -10,14 +10,33 @@ export PATH="/opt/homebrew/bin:/usr/local/bin:${HOME}/fvm/default/bin:${HOME}/.p
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_DIR="$(cd "${PODS_ROOT:-$PWD}/../.." && pwd)"
 
-# Forward CocoaPods/Xcode environment to variables the build_tool expects
-export CARGOKIT_DARWIN_PLATFORM_NAME="${PLATFORM_NAME:-macosx}"
-export CARGOKIT_DARWIN_ARCHS="${ARCHS:-arm64}"
-export CARGOKIT_CONFIGURATION="${CONFIGURATION:-Release}"
+FLUTTER_EXPORT_BUILD_ENVIRONMENT="${PODS_ROOT}/../Flutter/ephemeral/flutter_export_environment.sh"
+if [ -f "$FLUTTER_EXPORT_BUILD_ENVIRONMENT" ]; then
+  # shellcheck disable=SC1090
+  source "$FLUTTER_EXPORT_BUILD_ENVIRONMENT"
+fi
+
+# Forward CocoaPods/Xcode environment to variables the build_tool expects.
+export BUILDKIT_CONFIGURATION="${CONFIGURATION:-Release}"
 export PROJECT_DIR
 
 if [ -z "${APP_ENV:-}" ]; then
   export APP_ENV="pre"
 fi
 
-exec "$SCRIPT_DIR/run_build_tool.sh" macos
+build_args=(macos)
+case "${ARCHS:-}" in
+  arm64)
+    build_args+=(--arch arm64)
+    ;;
+  x86_64)
+    build_args+=(--arch amd64)
+    ;;
+esac
+
+"$SCRIPT_DIR/run_build_tool.sh" "${build_args[@]}"
+
+# Match Cargokit's phony input strategy so CocoaPods invokes the build tool on
+# every native build and lets setup's fingerprint cache decide what to compile.
+ln -fs "$OBJROOT/XCBuildData/build.db" "${BUILT_PRODUCTS_DIR}/buildkit_phony"
+ln -fs "${BUILT_PRODUCTS_DIR}/${EXECUTABLE_PATH}" "${BUILT_PRODUCTS_DIR}/buildkit_phony_out"
diff --git a/plugins/setup/buildkit/build_tool/lib/src/build_cache.dart b/plugins/setup/buildkit/build_tool/lib/src/build_cache.dart
new file mode 100644
index 0000000000..c6d0f83ac4
--- /dev/null
+++ b/plugins/setup/buildkit/build_tool/lib/src/build_cache.dart
@@ -0,0 +1,254 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:logging/logging.dart';
+import 'package:path/path.dart' as p;
+
+import 'error.dart';
+
+final _log = Logger('build_cache');
+
+class BuildExecution {
+  const BuildExecution({
+    required this.primaryOutput,
+    required this.rebuilt,
+  });
+
+  final String primaryOutput;
+  final bool rebuilt;
+}
+
+class BuildNotice {
+  bool _shown = false;
+
+  void show({required String key, required String reason}) {
+    if (_shown) return;
+    _shown = true;
+    _log.warning('[setup] Rebuilding $key: $reason');
+  }
+}
+
+class BuildCache {
+  BuildCache({required String rootDir})
+      : rootDir = p.normalize(p.absolute(rootDir)),
+        cacheDir = p.join(
+          p.normalize(p.absolute(rootDir)),
+          '.dart_tool',
+          'setup_build_cache',
+          'v1',
+        );
+
+  static const int schemaVersion = 1;
+  static final Map<String, _AsyncLock> _processLocks = {};
+
+  final String rootDir;
+  final String cacheDir;
+
+  Future<BuildExecution> run({
+    required String key,
+    required Future<String> Function() fingerprint,
+    required String primaryOutput,
+    required Future<List<String>> Function() build,
+    required BuildNotice notice,
+    bool force = false,
+  }) {
+    Directory(cacheDir).createSync(recursive: true);
+    final safeKey = key.replaceAll(RegExp(r'[^A-Za-z0-9_.-]'), '_');
+    final processLock = _processLocks.putIfAbsent(
+      p.join(cacheDir, safeKey),
+      _AsyncLock.new,
+    );
+    return processLock.synchronized(
+      () => _runWithFileLock(
+        key: key,
+        safeKey: safeKey,
+        fingerprint: fingerprint,
+        primaryOutput: primaryOutput,
+        build: build,
+        notice: notice,
+        force: force,
+      ),
+    );
+  }
+
+  Future<BuildExecution> _runWithFileLock({
+    required String key,
+    required String safeKey,
+    required Future<String> Function() fingerprint,
+    required String primaryOutput,
+    required Future<List<String>> Function() build,
+    required BuildNotice notice,
+    required bool force,
+  }) async {
+    final lockFile = File(p.join(cacheDir, '$safeKey.lock'));
+    lockFile.createSync(recursive: true);
+    final lock = await lockFile.open(mode: FileMode.append);
+
+    try {
+      await lock.lock(FileLock.exclusive);
+      final currentFingerprint = await fingerprint();
+      final recordFile = File(p.join(cacheDir, '$safeKey.json'));
+      final missReason = force
+          ? 'forced rebuild'
+          : _cacheMissReason(
+              recordFile: recordFile,
+              fingerprint: currentFingerprint,
+              primaryOutput: primaryOutput,
+            );
+      if (missReason == null) {
+        return BuildExecution(
+          primaryOutput: primaryOutput,
+          rebuilt: false,
+        );
+      }
+
+      notice.show(key: key, reason: missReason);
+      final outputs = <String>{primaryOutput, ...await build()}.toList()
+        ..sort();
+      final metadata = outputs.map(_outputMetadata).toList();
+      _writeRecord(
+        recordFile: recordFile,
+        fingerprint: currentFingerprint,
+        outputs: metadata,
+      );
+      return BuildExecution(
+        primaryOutput: primaryOutput,
+        rebuilt: true,
+      );
+    } finally {
+      try {
+        await lock.unlock();
+      } on FileSystemException {
+        // The operating system releases the lock when the file is closed.
+      }
+      await lock.close();
+    }
+  }
+
+  String? _cacheMissReason({
+    required File recordFile,
+    required String fingerprint,
+    required String primaryOutput,
+  }) {
+    if (!recordFile.existsSync()) return 'no cached build';
+
+    try {
+      final record = jsonDecode(recordFile.readAsStringSync());
+      if (record is! Map<String, dynamic>) return 'invalid cache record';
+      if (record['schema'] != schemaVersion) return 'cache schema changed';
+      if (record['fingerprint'] != fingerprint) return 'build inputs changed';
+
+      final rawOutputs = record['outputs'];
+      if (rawOutputs is! List || rawOutputs.isEmpty) {
+        return 'cached output list is missing';
+      }
+      final outputs = rawOutputs
+          .whereType<Map>()
+          .map((entry) => Map<String, dynamic>.from(entry))
+          .toList();
+      final primaryPath = _storedPath(primaryOutput);
+      if (!outputs.any((output) => output['path'] == primaryPath)) {
+        return 'primary output is not cached';
+      }
+
+      for (final output in outputs) {
+        final reason = _validateOutput(output);
+        if (reason != null) return reason;
+      }
+      return null;
+    } on FormatException {
+      return 'invalid cache record';
+    } on FileSystemException {
+      return 'cache record is unreadable';
+    }
+  }
+
+  Map<String, Object> _outputMetadata(String outputPath) {
+    final file = File(outputPath);
+    if (!file.existsSync()) {
+      throw BuildException('Expected build output not found: $outputPath');
+    }
+    final stat = file.statSync();
+    if (stat.type != FileSystemEntityType.file || stat.size <= 0) {
+      throw BuildException('Expected non-empty build output: $outputPath');
+    }
+    return {
+      'path': _storedPath(outputPath),
+      'size': stat.size,
+      'modified': stat.modified.millisecondsSinceEpoch,
+    };
+  }
+
+  String? _validateOutput(Map<String, dynamic> metadata) {
+    final storedPath = metadata['path'];
+    final size = metadata['size'];
+    final modified = metadata['modified'];
+    if (storedPath is! String || size is! int || modified is! int) {
+      return 'invalid output metadata';
+    }
+
+    final file = File(_resolvedPath(storedPath));
+    if (!file.existsSync()) return 'output is missing: $storedPath';
+    final stat = file.statSync();
+    if (stat.type != FileSystemEntityType.file || stat.size <= 0) {
+      return 'output is invalid: $storedPath';
+    }
+    if (stat.size != size || stat.modified.millisecondsSinceEpoch != modified) {
+      return 'output changed: $storedPath';
+    }
+    return null;
+  }
+
+  String _storedPath(String filePath) {
+    final absolutePath = p.normalize(p.absolute(filePath));
+    if (p.isWithin(rootDir, absolutePath) || p.equals(rootDir, absolutePath)) {
+      return p.posix.joinAll(p.split(p.relative(absolutePath, from: rootDir)));
+    }
+    return absolutePath;
+  }
+
+  String _resolvedPath(String storedPath) => p.isAbsolute(storedPath)
+      ? storedPath
+      : p.joinAll([rootDir, ...p.posix.split(storedPath)]);
+
+  void _writeRecord({
+    required File recordFile,
+    required String fingerprint,
+    required List<Map<String, Object>> outputs,
+  }) {
+    final temporaryFile = File(
+      '${recordFile.path}.$pid.${DateTime.now().microsecondsSinceEpoch}.tmp',
+    );
+    temporaryFile.writeAsStringSync(
+      jsonEncode({
+        'schema': schemaVersion,
+        'fingerprint': fingerprint,
+        'outputs': outputs,
+      }),
+      flush: true,
+    );
+    try {
+      temporaryFile.renameSync(recordFile.path);
+    } on FileSystemException {
+      if (recordFile.existsSync()) recordFile.deleteSync();
+      temporaryFile.renameSync(recordFile.path);
+    }
+  }
+}
+
+class _AsyncLock {
+  Future<void> _tail = Future<void>.value();
+
+  Future<T> synchronized<T>(Future<T> Function() action) {
+    final result = Completer<T>();
+    _tail = _tail.then((_) async {
+      try {
+        result.complete(await action());
+      } catch (error, stackTrace) {
+        result.completeError(error, stackTrace);
+      }
+    });
+    return result.future;
+  }
+}
diff --git a/plugins/setup/buildkit/build_tool/lib/src/build_tool.dart b/plugins/setup/buildkit/build_tool/lib/src/build_tool.dart
index 22b9897691..470a616465 100644
--- a/plugins/setup/buildkit/build_tool/lib/src/build_tool.dart
+++ b/plugins/setup/buildkit/build_tool/lib/src/build_tool.dart
@@ -1,4 +1,3 @@
-import 'dart:convert';
 import 'dart:io';
 
 import 'package:args/command_runner.dart';
@@ -7,6 +6,7 @@ import 'package:path/path.dart' as p;
 
 import 'environment.dart';
 import 'error.dart';
+import 'build_cache.dart';
 import 'go_builder.dart';
 import 'logging.dart';
 import 'options.dart';
@@ -45,6 +45,16 @@ Future<String> _hostGoArch() async {
 }
 
 abstract class BuildCommand extends Command {
+  BuildCommand() {
+    argParser.addFlag(
+      'force',
+      negatable: false,
+      help: 'Rebuild requested artifacts even when inputs are unchanged',
+    );
+  }
+
+  bool get force => argResults?['force'] as bool? ?? false;
+
   Future<void> runBuildCommand();
 
   @override
@@ -84,10 +94,21 @@ class BuildAndroidCommand extends BuildCommand {
       flutterTargetPlatforms: flutterTargetPlatforms,
     );
 
-    final builder = GoBuilder(rootDir: _rootDir, config: config);
-    final corePaths = await builder.buildAll(targets);
+    final cache = BuildCache(rootDir: _rootDir);
+    final notice = BuildNotice();
+    final builder = GoBuilder(
+      rootDir: _rootDir,
+      config: config,
+      cache: cache,
+      notice: notice,
+    );
+    final results = await builder.buildAll(targets, force: force);
 
-    _log.info('Build complete: $corePaths');
+    if (results.any((result) => result.rebuilt)) {
+      _log.info(
+        'Build complete: ${results.map((result) => result.primaryOutput)}',
+      );
+    }
   }
 }
 
@@ -119,10 +140,21 @@ class BuildLinuxCommand extends BuildCommand {
       throw BuildException('Invalid arch: $arch');
     }
 
-    final builder = GoBuilder(rootDir: _rootDir, config: config);
-    final corePaths = await builder.buildAll(targets);
+    final cache = BuildCache(rootDir: _rootDir);
+    final notice = BuildNotice();
+    final builder = GoBuilder(
+      rootDir: _rootDir,
+      config: config,
+      cache: cache,
+      notice: notice,
+    );
+    final results = await builder.buildAll(targets, force: force);
 
-    _log.info('Build complete: $corePaths');
+    if (results.any((result) => result.rebuilt)) {
+      _log.info(
+        'Build complete: ${results.map((result) => result.primaryOutput)}',
+      );
+    }
   }
 }
 
@@ -155,28 +187,42 @@ class BuildWindowsCommand extends BuildCommand {
       throw BuildException('Invalid arch: $arch');
     }
 
-    final goBuilder = GoBuilder(rootDir: _rootDir, config: config);
-    final corePaths = await goBuilder.buildAll(targets);
-
-    _log.info('Build mode: ${debug ? 'debug' : 'release'}');
-
-    if (debug) {
-      await Process.run('taskkill', [
-        '/F',
-        '/IM',
-        '${config.helperName}${targets.first.executableExtension}',
-      ]);
-      final rustBuilder = RustBuilder(rootDir: _rootDir, config: config);
-      await rustBuilder.build(targets.first, '', release: false);
-    } else {
-      final coreSha256 = await calcSha256(corePaths.first);
-      final rustBuilder = RustBuilder(rootDir: _rootDir, config: config);
-      await rustBuilder.build(targets.first, coreSha256);
-      await File(p.join(_rootDir, 'core_sha256.json'))
-          .writeAsString(jsonEncode({'CORE_SHA256': coreSha256}));
-    }
+    final cache = BuildCache(rootDir: _rootDir);
+    final notice = BuildNotice();
+    final goBuilder = GoBuilder(
+      rootDir: _rootDir,
+      config: config,
+      cache: cache,
+      notice: notice,
+    );
+    final coreResults = await goBuilder.buildAll(targets, force: force);
+    final corePaths =
+        coreResults.map((result) => result.primaryOutput).toList();
+    final rustBuilder = RustBuilder(
+      rootDir: _rootDir,
+      config: config,
+      cache: cache,
+      notice: notice,
+    );
+    final coreSha256 = await calcSha256(corePaths.first);
+    final helperResult = await rustBuilder.build(
+      targets.first,
+      coreSha256,
+      force: force,
+      beforeBuild: debug
+          ? () async {
+              await Process.run('taskkill', [
+                '/F',
+                '/IM',
+                '${config.helperName}${targets.first.executableExtension}',
+              ]);
+            }
+          : null,
+    );
 
-    _log.info('Build complete: $corePaths');
+    if (helperResult.rebuilt || coreResults.any((result) => result.rebuilt)) {
+      _log.info('Build complete: $corePaths');
+    }
   }
 }
 
@@ -208,10 +254,21 @@ class BuildMacosCommand extends BuildCommand {
       throw BuildException('Invalid arch: $arch');
     }
 
-    final builder = GoBuilder(rootDir: _rootDir, config: config);
-    final corePaths = await builder.buildAll(targets);
+    final cache = BuildCache(rootDir: _rootDir);
+    final notice = BuildNotice();
+    final builder = GoBuilder(
+      rootDir: _rootDir,
+      config: config,
+      cache: cache,
+      notice: notice,
+    );
+    final results = await builder.buildAll(targets, force: force);
 
-    _log.info('Build complete: $corePaths');
+    if (results.any((result) => result.rebuilt)) {
+      _log.info(
+        'Build complete: ${results.map((result) => result.primaryOutput)}',
+      );
+    }
   }
 }
 
diff --git a/plugins/setup/buildkit/build_tool/lib/src/fingerprint.dart b/plugins/setup/buildkit/build_tool/lib/src/fingerprint.dart
new file mode 100644
index 0000000000..6a46767531
--- /dev/null
+++ b/plugins/setup/buildkit/build_tool/lib/src/fingerprint.dart
@@ -0,0 +1,97 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:crypto/crypto.dart';
+import 'package:path/path.dart' as p;
+
+class FingerprintBuilder {
+  FingerprintBuilder({required String rootDir})
+      : _rootDir = p.normalize(p.absolute(rootDir));
+
+  final String _rootDir;
+  final BytesBuilder _bytes = BytesBuilder(copy: false);
+
+  void addValue(String name, Object? value) {
+    _addBytes(utf8.encode(name));
+    _addBytes(utf8.encode(jsonEncode(value)));
+  }
+
+  void addFile(String filePath) {
+    final absolutePath = p.normalize(p.absolute(filePath));
+    final file = File(absolutePath);
+    if (!file.existsSync()) {
+      throw FileSystemException('Fingerprint input does not exist', filePath);
+    }
+
+    final relativePath =
+        p.isWithin(_rootDir, absolutePath) || p.equals(_rootDir, absolutePath)
+            ? p.relative(absolutePath, from: _rootDir)
+            : absolutePath;
+    addValue('file', p.posix.joinAll(p.split(relativePath)));
+    _addBytes(file.readAsBytesSync());
+  }
+
+  void addFiles(Iterable<String> filePaths) {
+    final paths = filePaths.map((path) => p.normalize(p.absolute(path))).toSet()
+      ..removeWhere((path) => !File(path).existsSync());
+    final sortedPaths = paths.toList()..sort();
+    for (final path in sortedPaths) {
+      addFile(path);
+    }
+  }
+
+  String finish() => sha256.convert(_bytes.takeBytes()).toString();
+
+  void _addBytes(List<int> value) {
+    final length = ByteData(8)..setUint64(0, value.length, Endian.big);
+    _bytes
+      ..add(length.buffer.asUint8List())
+      ..add(value);
+  }
+}
+
+List<String> collectFiles(
+  String rootDir, {
+  bool Function(String relativePath)? include,
+  Set<String> excludedDirectories = const {},
+}) {
+  final root = Directory(rootDir);
+  if (!root.existsSync()) return const [];
+
+  final files = <String>[];
+  final pending = <Directory>[root];
+  while (pending.isNotEmpty) {
+    final directory = pending.removeLast();
+    final entries = directory.listSync(followLinks: false).toList()
+      ..sort((a, b) => a.path.compareTo(b.path));
+    for (final entity in entries) {
+      final relativePath = p.relative(entity.path, from: rootDir);
+      if (entity is Directory) {
+        if (!excludedDirectories.contains(p.basename(entity.path))) {
+          pending.add(entity);
+        }
+      } else if (entity is File && (include?.call(relativePath) ?? true)) {
+        files.add(entity.path);
+      }
+    }
+  }
+  files.sort();
+  return files;
+}
+
+List<String> collectBuildToolInputs(String rootDir) {
+  final packageDir = p.join(
+    rootDir,
+    'plugins',
+    'setup',
+    'buildkit',
+    'build_tool',
+  );
+  final inputs = collectFiles(p.join(packageDir, 'lib'));
+  for (final name in const ['pubspec.yaml', 'pubspec.lock']) {
+    final filePath = p.join(packageDir, name);
+    if (File(filePath).existsSync()) inputs.add(filePath);
+  }
+  return inputs;
+}
diff --git a/plugins/setup/buildkit/build_tool/lib/src/go_builder.dart b/plugins/setup/buildkit/build_tool/lib/src/go_builder.dart
index e2854260af..5dde2cc143 100644
--- a/plugins/setup/buildkit/build_tool/lib/src/go_builder.dart
+++ b/plugins/setup/buildkit/build_tool/lib/src/go_builder.dart
@@ -1,10 +1,13 @@
+import 'dart:convert';
 import 'dart:io';
 
 import 'package:logging/logging.dart';
 import 'package:path/path.dart' as p;
 
+import 'build_cache.dart';
 import 'environment.dart';
 import 'error.dart';
+import 'fingerprint.dart';
 import 'logging.dart';
 import 'options.dart';
 import 'target.dart';
@@ -30,13 +33,20 @@ String _resolveCc(Target target) {
 class GoBuilder {
   final String rootDir;
   final BuildConfig config;
+  final BuildCache cache;
+  final BuildNotice notice;
 
-  GoBuilder({required this.rootDir, required this.config});
+  GoBuilder({
+    required this.rootDir,
+    required this.config,
+    required this.cache,
+    required this.notice,
+  });
 
   String get _corePath => p.join(rootDir, config.coreDir);
   String get _outputPath => p.join(rootDir, config.outputDir);
 
-  Future<String> build(Target target) async {
+  Future<BuildExecution> build(Target target, {bool force = false}) async {
     // Desktop: output directly to libclash/{platform}/
     // Android: output to libclash/android/{abi}/
     final outDir = target.isLib
@@ -49,55 +59,196 @@ class GoBuilder {
         : '${config.coreName}${target.executableExtension}';
     final outFile = p.join(outDir, fileName);
 
+    return cache.run(
+      key: '${target.platformDir}-${target.goarch}-core',
+      fingerprint: () => _calculateFingerprint(target),
+      primaryOutput: outFile,
+      force: force,
+      notice: notice,
+      build: () async {
+        final env = _buildEnvironment(target);
+        final args = _buildArguments(target, outFile: outFile);
+
+        _log.info(kDoubleSeparator);
+        _log.info(
+          'Building Go core: $target '
+          '${target.isLib ? "(CGO, c-shared)" : "(standalone)"}',
+        );
+        _log.info(kSeparator);
+
+        await runCommandStream(
+          'go',
+          args,
+          workingDirectory: _corePath,
+          environment: env,
+        );
+
+        final outputs = <String>[outFile];
+        if (target.isLib && target.abi != null) {
+          outputs.addAll(
+            await _adjustAndroidOutput(
+              outDir: p.join(_outputPath, target.platformDir),
+              abiDir: target.abi!,
+              archName: target.abi!,
+              libPath: outFile,
+              libName: fileName,
+            ),
+          );
+        }
+
+        _log.info('Built: $outFile');
+        return outputs;
+      },
+    );
+  }
+
+  Future<List<BuildExecution>> buildAll(
+    List<Target> targets, {
+    bool force = false,
+  }) async {
+    final results = await Future.wait(
+      targets.map((target) => build(target, force: force)),
+    );
+    return results;
+  }
+
+  Map<String, String> _buildEnvironment(Target target) {
     final env = <String, String>{
       'GOOS': target.goos,
       'GOARCH': target.goarch,
     };
-
     if (target.isLib) {
-      env['CGO_ENABLED'] = '1';
-      env['CC'] = _resolveCc(target);
-      env['CFLAGS'] = '-O3 -Werror';
+      env
+        ..['CGO_ENABLED'] = '1'
+        ..['CC'] = _resolveCc(target)
+        ..['CFLAGS'] = '-O3 -Werror';
     } else {
       env['CGO_ENABLED'] = '0';
     }
+    return env;
+  }
 
-    final args = [
-      'build',
-      '-ldflags=${config.goLdflags}',
-      '-tags=${config.tags}',
-      if (target.isLib) '-buildmode=c-shared',
-      '-o',
-      outFile,
-    ];
+  List<String> _buildArguments(Target target, {String? outFile}) => [
+        'build',
+        '-ldflags=${config.goLdflags}',
+        '-tags=${config.tags}',
+        if (target.isLib) '-buildmode=c-shared',
+        if (outFile != null) ...['-o', outFile],
+      ];
 
-    _log.info(kDoubleSeparator);
-    _log.info(
-        'Building Go core: $target ${target.isLib ? "(CGO, c-shared)" : "(standalone)"}');
-    _log.info(kSeparator);
-
-    await runCommandStream('go', args,
-        workingDirectory: _corePath, environment: env);
-
-    if (target.isLib && target.abi != null) {
-      await _adjustAndroidOutput(
-          outDir: p.join(_outputPath, target.platformDir),
-          abiDir: target.abi!,
-          archName: target.abi!,
-          libPath: outFile,
-          libName: fileName);
+  Future<String> _calculateFingerprint(Target target) async {
+    final env = _buildEnvironment(target);
+    final builder = FingerprintBuilder(rootDir: rootDir)
+      ..addValue('cache_schema', BuildCache.schemaVersion)
+      ..addValue('kind', 'go-core')
+      ..addValue('target', {
+        'goos': target.goos,
+        'goarch': target.goarch,
+        'abi': target.abi,
+        'is_lib': target.isLib,
+        'flutter_platform': target.flutterPlatform,
+      })
+      ..addValue('config', config.toFingerprintMap())
+      ..addValue('environment', env)
+      ..addValue('arguments', _buildArguments(target));
+
+    final goVersion = runCommand(
+      'go',
+      ['version'],
+      workingDirectory: _corePath,
+      environment: env,
+    );
+    builder.addValue('go_version', (goVersion.stdout as String).trim());
+
+    final goEnvResult = runCommand(
+      'go',
+      [
+        'env',
+        '-json',
+        'GOVERSION',
+        'GOTOOLCHAIN',
+        'GOFLAGS',
+        'GOEXPERIMENT',
+        'GOAMD64',
+        'GOARM',
+        'GO386',
+        'GOMIPS',
+        'GOMIPS64',
+        'CGO_CFLAGS',
+        'CGO_CPPFLAGS',
+        'CGO_CXXFLAGS',
+        'CGO_LDFLAGS',
+        'GOWORK',
+        'GOENV',
+      ],
+      workingDirectory: _corePath,
+      environment: env,
+    );
+    final goEnvText = (goEnvResult.stdout as String).trim();
+    builder.addValue('go_env', jsonDecode(goEnvText));
+
+    final inputs = _resolveGoInputs(env);
+    final goEnv = jsonDecode(goEnvText) as Map<String, dynamic>;
+    final goWork = goEnv['GOWORK'];
+    if (goWork is String && goWork.isNotEmpty && goWork != 'off') {
+      inputs.add(goWork);
+      final goWorkSum = p.join(p.dirname(goWork), 'go.work.sum');
+      if (File(goWorkSum).existsSync()) inputs.add(goWorkSum);
+    }
+    inputs.addAll(collectBuildToolInputs(rootDir));
+
+    if (target.isLib) {
+      final compiler = env['CC']!;
+      final compilerVersion = runCommand(compiler, ['--version']);
+      builder.addValue(
+        'android_compiler',
+        '${(compilerVersion.stdout as String).trim()}\n'
+            '${(compilerVersion.stderr as String).trim()}',
+      );
+      final ndkProperties = p.join(Environment.androidNdk, 'source.properties');
+      if (File(ndkProperties).existsSync()) inputs.add(ndkProperties);
     }
 
-    _log.info('Built: $outFile');
-    return outFile;
+    builder.addFiles(inputs);
+    return builder.finish();
   }
 
-  Future<List<String>> buildAll(List<Target> targets) async {
-    final results = await Future.wait(targets.map(build));
-    return results;
+  Set<String> _resolveGoInputs(Map<String, String> environment) {
+    const template =
+        r'''{{range .GoFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .CgoFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .CFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .CXXFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .MFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .HFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .FFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .SFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .SwigFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .SwigCXXFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .SysoFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{range .EmbedFiles}}{{$.Dir}}/{{.}}{{"\n"}}{{end}}{{with .Module}}{{if .GoMod}}{{.GoMod}}{{"\n"}}{{end}}{{end}}''';
+    final result = runCommand(
+      'go',
+      ['list', '-deps', '-tags=${config.tags}', '-f', template, '.'],
+      workingDirectory: _corePath,
+      environment: environment,
+    );
+    final corePath = p.normalize(p.absolute(_corePath));
+    final inputs = <String>{};
+    for (final line in (result.stdout as String).split('\n')) {
+      final value = line.trim();
+      if (value.isEmpty) continue;
+      final filePath = p.normalize(
+        p.absolute(p.isAbsolute(value) ? value : p.join(_corePath, value)),
+      );
+      if (!p.isWithin(corePath, filePath) && !p.equals(corePath, filePath)) {
+        continue;
+      }
+      if (!File(filePath).existsSync()) continue;
+      inputs.add(filePath);
+      if (p.basename(filePath) == 'go.mod') {
+        final goSum = p.join(p.dirname(filePath), 'go.sum');
+        if (File(goSum).existsSync()) inputs.add(goSum);
+      }
+    }
+
+    for (final name in const ['go.mod', 'go.sum']) {
+      final filePath = p.join(_corePath, name);
+      if (File(filePath).existsSync()) inputs.add(filePath);
+    }
+    return inputs;
   }
 
-  Future<void> _adjustAndroidOutput({
+  Future<List<String>> _adjustAndroidOutput({
     required String outDir,
     required String abiDir,
     required String archName,
@@ -110,6 +261,7 @@ class GoBuilder {
     final jniLibsPath = p.join(androidCoreMainPath, 'jniLibs', abiDir);
     final cppIncludesPath =
         p.join(androidCoreMainPath, 'cpp', 'includes', archName);
+    final outputs = <String>[];
 
     ensureDir(jniLibsPath);
     ensureDir(includesPath);
@@ -118,7 +270,9 @@ class GoBuilder {
     _clearDirectory(cppIncludesPath);
 
     _deleteIfExists(p.join(jniLibsPath, libName));
-    File(libPath).copySync(p.join(jniLibsPath, libName));
+    final jniLibPath = p.join(jniLibsPath, libName);
+    File(libPath).copySync(jniLibPath);
+    outputs.add(jniLibPath);
 
     final abiDirPath = p.join(outDir, abiDir);
     final headerFiles = [
@@ -129,12 +283,18 @@ class GoBuilder {
       if (!file.path.endsWith('.h')) continue;
       final fileName = p.basename(file.path);
       final source = File(file.path);
-      source.copySync(p.join(includesPath, fileName));
-      source.copySync(p.join(cppIncludesPath, fileName));
+      final includePath = p.join(includesPath, fileName);
+      final cppIncludePath = p.join(cppIncludesPath, fileName);
+      source.copySync(includePath);
+      source.copySync(cppIncludePath);
+      outputs
+        ..add(includePath)
+        ..add(cppIncludePath);
       if (file.path.startsWith(abiDirPath)) {
         source.deleteSync();
       }
     }
+    return outputs;
   }
 
   void _clearDirectory(String dirPath) {
diff --git a/plugins/setup/buildkit/build_tool/lib/src/options.dart b/plugins/setup/buildkit/build_tool/lib/src/options.dart
index 426864bc39..17e65f1615 100644
--- a/plugins/setup/buildkit/build_tool/lib/src/options.dart
+++ b/plugins/setup/buildkit/build_tool/lib/src/options.dart
@@ -62,4 +62,16 @@ class BuildConfig {
       distDir: yaml['dist_dir'] as String? ?? _defaults.distDir,
     );
   }
+
+  Map<String, String> toFingerprintMap() => {
+        'tags': tags,
+        'go_ldflags': goLdflags,
+        'core_dir': coreDir,
+        'core_name': coreName,
+        'lib_name': libName,
+        'output_dir': outputDir,
+        'helper_dir': helperDir,
+        'helper_name': helperName,
+        'dist_dir': distDir,
+      };
 }
diff --git a/plugins/setup/buildkit/build_tool/lib/src/rust_builder.dart b/plugins/setup/buildkit/build_tool/lib/src/rust_builder.dart
index 308f55782f..4930d0d542 100644
--- a/plugins/setup/buildkit/build_tool/lib/src/rust_builder.dart
+++ b/plugins/setup/buildkit/build_tool/lib/src/rust_builder.dart
@@ -1,6 +1,10 @@
+import 'dart:io';
+
 import 'package:logging/logging.dart';
 import 'package:path/path.dart' as p;
 
+import 'build_cache.dart';
+import 'fingerprint.dart';
 import 'logging.dart';
 import 'options.dart';
 import 'target.dart';
@@ -11,31 +15,35 @@ final _log = Logger('rust_builder');
 class RustBuilder {
   final String rootDir;
   final BuildConfig config;
+  final BuildCache cache;
+  final BuildNotice notice;
 
-  RustBuilder({required this.rootDir, required this.config});
+  RustBuilder({
+    required this.rootDir,
+    required this.config,
+    required this.cache,
+    required this.notice,
+  });
 
   String get _helperPath => p.join(rootDir, config.helperDir);
   String get _outputPath => p.join(rootDir, config.outputDir);
 
-  Future<String> build(Target target, String token,
-      {bool release = true}) async {
-    final args = ['build'];
-    if (release) {
-      args.addAll(['--release', '--features', 'windows-service']);
-    }
-    final env = {'TOKEN': token};
-
-    _log.info(kDoubleSeparator);
-    _log.info('Building Rust helper: $target');
-    _log.info(kSeparator);
-
-    await runCommandStream('cargo', args,
-        workingDirectory: _helperPath, environment: env);
+  Future<BuildExecution> build(
+    Target target,
+    String coreSha256, {
+    bool force = false,
+    Future<void> Function()? beforeBuild,
+  }) async {
+    final args = ['build', '--features', 'windows-service', '--release'];
+    final env = {
+      'CORE_SHA256': coreSha256,
+      'CORE_NAME': '${config.coreName}${target.executableExtension}',
+    };
 
     final srcPath = p.join(
       _helperPath,
       'target',
-      release ? 'release' : 'debug',
+      'release',
       'helper${target.executableExtension}',
     );
     final destDir = p.join(_outputPath, target.goos);
@@ -43,10 +51,95 @@ class RustBuilder {
       destDir,
       '${config.helperName}${target.executableExtension}',
     );
-    ensureDir(destDir);
-    copyFile(srcPath, destPath);
+    return cache.run(
+      key: '${target.goos}-${target.goarch}-helper-release',
+      fingerprint: () => _calculateFingerprint(
+        target: target,
+        coreSha256: coreSha256,
+        args: args,
+      ),
+      primaryOutput: destPath,
+      force: force,
+      notice: notice,
+      build: () async {
+        await beforeBuild?.call();
+        _log.info(kDoubleSeparator);
+        _log.info('Building Rust helper: $target');
+        _log.info(kSeparator);
+
+        await runCommandStream(
+          'cargo',
+          args,
+          workingDirectory: _helperPath,
+          environment: env,
+        );
+
+        ensureDir(destDir);
+        copyFile(srcPath, destPath);
+
+        _log.info('Built: $destPath');
+        return [destPath];
+      },
+    );
+  }
 
-    _log.info('Built: $destPath');
-    return destPath;
+  Future<String> _calculateFingerprint({
+    required Target target,
+    required String coreSha256,
+    required List<String> args,
+  }) async {
+    final builder = FingerprintBuilder(rootDir: rootDir)
+      ..addValue('cache_schema', BuildCache.schemaVersion)
+      ..addValue('kind', 'windows-helper')
+      ..addValue('target', {
+        'goos': target.goos,
+        'goarch': target.goarch,
+      })
+      ..addValue('arguments', args)
+      ..addValue('core_sha256', coreSha256)
+      ..addValue('environment', _rustEnvironment())
+      ..addValue('config', config.toFingerprintMap());
+
+    final cargoVersion = runCommand(
+      'cargo',
+      ['--version'],
+      workingDirectory: _helperPath,
+    );
+    builder.addValue('cargo_version', (cargoVersion.stdout as String).trim());
+    final rustVersion = runCommand(
+      'rustc',
+      ['-Vv'],
+      workingDirectory: _helperPath,
+    );
+    builder.addValue('rustc_version', (rustVersion.stdout as String).trim());
+
+    final inputs = collectFiles(
+      _helperPath,
+      excludedDirectories: const {'target', '.git', '.idea'},
+    )..addAll(collectBuildToolInputs(rootDir));
+    builder.addFiles(inputs);
+    return builder.finish();
+  }
+
+  Map<String, String> _rustEnvironment() {
+    const exactKeys = {
+      'CARGO_BUILD_TARGET',
+      'CARGO_ENCODED_RUSTFLAGS',
+      'RUSTFLAGS',
+      'RUSTUP_TOOLCHAIN',
+      'RUSTC_WRAPPER',
+      'RUSTC_WORKSPACE_WRAPPER',
+    };
+    final values = <String, String>{};
+    final entries = Platform.environment.entries.toList()
+      ..sort((a, b) => a.key.compareTo(b.key));
+    for (final entry in entries) {
+      if (exactKeys.contains(entry.key) ||
+          entry.key.startsWith('CARGO_PROFILE_') ||
+          entry.key.startsWith('CARGO_TARGET_')) {
+        values[entry.key] = entry.value;
+      }
+    }
+    return values;
   }
 }
diff --git a/plugins/setup/buildkit/build_tool/test/build_cache_test.dart b/plugins/setup/buildkit/build_tool/test/build_cache_test.dart
new file mode 100644
index 0000000000..2c7999e3ec
--- /dev/null
+++ b/plugins/setup/buildkit/build_tool/test/build_cache_test.dart
@@ -0,0 +1,110 @@
+import 'dart:io';
+
+import 'package:build_tool/src/build_cache.dart';
+import 'package:test/test.dart';
+
+void main() {
+  late Directory temporaryDirectory;
+  late BuildCache cache;
+  late BuildNotice notice;
+  late File output;
+  late int buildCount;
+
+  setUp(() {
+    temporaryDirectory = Directory.systemTemp.createTempSync(
+      'setup_build_cache_test_',
+    );
+    cache = BuildCache(rootDir: temporaryDirectory.path);
+    notice = BuildNotice();
+    output = File('${temporaryDirectory.path}/output/core');
+    buildCount = 0;
+  });
+
+  tearDown(() {
+    temporaryDirectory.deleteSync(recursive: true);
+  });
+
+  Future<BuildExecution> runBuild({
+    String fingerprint = 'fingerprint-a',
+    bool force = false,
+    Duration delay = Duration.zero,
+  }) {
+    return cache.run(
+      key: 'macos-arm64-core',
+      fingerprint: () async => fingerprint,
+      primaryOutput: output.path,
+      force: force,
+      notice: notice,
+      build: () async {
+        buildCount++;
+        if (delay > Duration.zero) await Future<void>.delayed(delay);
+        output
+          ..createSync(recursive: true)
+          ..writeAsStringSync('core-$buildCount');
+        return [output.path];
+      },
+    );
+  }
+
+  test('skips build when fingerprint and outputs are unchanged', () async {
+    final first = await runBuild();
+    final second = await runBuild();
+
+    expect(first.rebuilt, isTrue);
+    expect(second.rebuilt, isFalse);
+    expect(buildCount, 1);
+  });
+
+  test('rebuilds when fingerprint changes', () async {
+    await runBuild();
+    final result = await runBuild(fingerprint: 'fingerprint-b');
+
+    expect(result.rebuilt, isTrue);
+    expect(buildCount, 2);
+  });
+
+  test('rebuilds when an output is missing or modified', () async {
+    await runBuild();
+    output.deleteSync();
+    expect((await runBuild()).rebuilt, isTrue);
+
+    output.writeAsStringSync('externally modified output');
+    expect((await runBuild()).rebuilt, isTrue);
+    expect(buildCount, 3);
+  });
+
+  test('force always rebuilds', () async {
+    await runBuild();
+    final result = await runBuild(force: true);
+
+    expect(result.rebuilt, isTrue);
+    expect(buildCount, 2);
+  });
+
+  test('does not write a successful record after a failed build', () async {
+    final failingBuild = cache.run(
+      key: 'macos-arm64-core',
+      fingerprint: () async => 'fingerprint-a',
+      primaryOutput: output.path,
+      notice: notice,
+      build: () async {
+        buildCount++;
+        throw StateError('build failed');
+      },
+    );
+
+    await expectLater(failingBuild, throwsStateError);
+    expect((await runBuild()).rebuilt, isTrue);
+    expect(buildCount, 2);
+  });
+
+  test('serializes concurrent checks and rebuilds only once', () async {
+    final results = await Future.wait([
+      runBuild(delay: const Duration(milliseconds: 50)),
+      runBuild(delay: const Duration(milliseconds: 50)),
+    ]);
+
+    expect(results.where((result) => result.rebuilt), hasLength(1));
+    expect(buildCount, 1);
+  });
+}
diff --git a/plugins/setup/buildkit/build_tool/test/fingerprint_test.dart b/plugins/setup/buildkit/build_tool/test/fingerprint_test.dart
new file mode 100644
index 0000000000..79dbf94efd
--- /dev/null
+++ b/plugins/setup/buildkit/build_tool/test/fingerprint_test.dart
@@ -0,0 +1,71 @@
+import 'dart:io';
+
+import 'package:build_tool/src/fingerprint.dart';
+import 'package:test/test.dart';
+
+void main() {
+  late Directory temporaryDirectory;
+
+  setUp(() {
+    temporaryDirectory = Directory.systemTemp.createTempSync(
+      'setup_fingerprint_test_',
+    );
+  });
+
+  tearDown(() {
+    temporaryDirectory.deleteSync(recursive: true);
+  });
+
+  String fingerprint({
+    required Iterable<String> files,
+    Object? target = 'macos-arm64',
+  }) {
+    final builder = FingerprintBuilder(rootDir: temporaryDirectory.path)
+      ..addValue('target', target)
+      ..addFiles(files);
+    return builder.finish();
+  }
+
+  test('uses file content instead of modification time', () {
+    final input = File('${temporaryDirectory.path}/input.go')
+      ..writeAsStringSync('package main\n');
+    final before = fingerprint(files: [input.path]);
+
+    input.setLastModifiedSync(DateTime.now().add(const Duration(hours: 1)));
+
+    expect(fingerprint(files: [input.path]), before);
+  });
+
+  test('changes when file content changes', () {
+    final input = File('${temporaryDirectory.path}/input.go')
+      ..writeAsStringSync('package main\n');
+    final before = fingerprint(files: [input.path]);
+
+    input.writeAsStringSync('package core\n');
+
+    expect(fingerprint(files: [input.path]), isNot(before));
+  });
+
+  test('changes when an input file is added or removed', () {
+    final first = File('${temporaryDirectory.path}/first.go')
+      ..writeAsStringSync('package main\n');
+    final second = File('${temporaryDirectory.path}/second.go')
+      ..writeAsStringSync('package main\n');
+    final oneFile = fingerprint(files: [first.path]);
+    final twoFiles = fingerprint(files: [first.path, second.path]);
+
+    expect(twoFiles, isNot(oneFile));
+    second.deleteSync();
+    expect(fingerprint(files: [first.path]), oneFile);
+  });
+
+  test('changes when target parameters change', () {
+    final input = File('${temporaryDirectory.path}/input.go')
+      ..writeAsStringSync('package main\n');
+
+    expect(
+      fingerprint(files: [input.path], target: 'android-arm64'),
+      isNot(fingerprint(files: [input.path], target: 'android-amd64')),
+    );
+  });
+}
diff --git a/plugins/setup/buildkit/build_tool/test/windows_cache_test.dart b/plugins/setup/buildkit/build_tool/test/windows_cache_test.dart
new file mode 100644
index 0000000000..ba9e115a2e
--- /dev/null
+++ b/plugins/setup/buildkit/build_tool/test/windows_cache_test.dart
@@ -0,0 +1,132 @@
+import 'dart:io';
+
+import 'package:build_tool/src/build_cache.dart';
+import 'package:test/test.dart';
+
+void main() {
+  late Directory temporaryDirectory;
+  late BuildCache cache;
+  late BuildNotice notice;
+  late File coreOutput;
+  late File helperOutput;
+  late int coreBuilds;
+  late int helperBuilds;
+  late int taskKills;
+
+  setUp(() {
+    temporaryDirectory = Directory.systemTemp.createTempSync(
+      'setup_windows_cache_test_',
+    );
+    cache = BuildCache(rootDir: temporaryDirectory.path);
+    notice = BuildNotice();
+    coreOutput = File('${temporaryDirectory.path}/core.exe');
+    helperOutput = File('${temporaryDirectory.path}/helper.exe');
+    coreBuilds = 0;
+    helperBuilds = 0;
+    taskKills = 0;
+  });
+
+  tearDown(() {
+    temporaryDirectory.deleteSync(recursive: true);
+  });
+
+  Future<BuildExecution> buildCore(String fingerprint) => cache.run(
+        key: 'windows-amd64-core',
+        fingerprint: () async => fingerprint,
+        primaryOutput: coreOutput.path,
+        notice: notice,
+        build: () async {
+          coreBuilds++;
+          coreOutput.writeAsStringSync('core-$fingerprint');
+          return [coreOutput.path];
+        },
+      );
+
+  Future<BuildExecution> buildHelper({
+    required String coreSha256,
+    required String sourceFingerprint,
+    bool stopRunningHelper = false,
+  }) =>
+      cache.run(
+        key: 'windows-amd64-helper-release',
+        fingerprint: () async => '$sourceFingerprint:$coreSha256',
+        primaryOutput: helperOutput.path,
+        notice: notice,
+        build: () async {
+          if (stopRunningHelper) taskKills++;
+          helperBuilds++;
+          helperOutput.writeAsStringSync(
+            'helper-$sourceFingerprint-$coreSha256',
+          );
+          return [helperOutput.path];
+        },
+      );
+
+  test('core and release helper both skip when unchanged', () async {
+    await buildCore('core-a');
+    await buildHelper(coreSha256: 'sha-a', sourceFingerprint: 'helper-a');
+
+    expect((await buildCore('core-a')).rebuilt, isFalse);
+    expect(
+      (await buildHelper(
+        coreSha256: 'sha-a',
+        sourceFingerprint: 'helper-a',
+      ))
+          .rebuilt,
+      isFalse,
+    );
+    expect(coreBuilds, 1);
+    expect(helperBuilds, 1);
+  });
+
+  test('helper source change does not rebuild core', () async {
+    await buildCore('core-a');
+    await buildHelper(coreSha256: 'sha-a', sourceFingerprint: 'helper-a');
+
+    expect((await buildCore('core-a')).rebuilt, isFalse);
+    expect(
+      (await buildHelper(
+        coreSha256: 'sha-a',
+        sourceFingerprint: 'helper-b',
+      ))
+          .rebuilt,
+      isTrue,
+    );
+    expect(coreBuilds, 1);
+    expect(helperBuilds, 2);
+  });
+
+  test('Core SHA change invalidates hardened helper', () async {
+    await buildHelper(coreSha256: 'sha-a', sourceFingerprint: 'helper-a');
+
+    expect(
+      (await buildHelper(
+        coreSha256: 'sha-b',
+        sourceFingerprint: 'helper-a',
+      ))
+          .rebuilt,
+      isTrue,
+    );
+    expect(helperBuilds, 2);
+  });
+
+  test('development cache hit does not stop running helper', () async {
+    await buildHelper(
+      coreSha256: 'sha-a',
+      sourceFingerprint: 'helper-a',
+      stopRunningHelper: true,
+    );
+    expect(taskKills, 1);
+
+    expect(
+      (await buildHelper(
+        coreSha256: 'sha-a',
+        sourceFingerprint: 'helper-a',
+        stopRunningHelper: true,
+      ))
+          .rebuilt,
+      isFalse,
+    );
+    expect(taskKills, 1);
+  });
+}
diff --git a/plugins/setup/buildkit/cmake/buildkit.cmake b/plugins/setup/buildkit/cmake/buildkit.cmake
index 59ebdc0bc5..740ecc1185 100644
--- a/plugins/setup/buildkit/cmake/buildkit.cmake
+++ b/plugins/setup/buildkit/cmake/buildkit.cmake
@@ -27,6 +27,7 @@ function(apply_buildkit)
     set(_output "${PROJECT_ROOT}/libclash/linux/FlClashCore")
     set(_platform_args "linux")
   endif()
+  set(_phony "${CMAKE_CURRENT_BINARY_DIR}/buildkit_phony")
 
   set(BUILDKIT_ENV
     "BUILDKIT_CONFIGURATION=$<CONFIG>"
@@ -34,13 +35,15 @@ function(apply_buildkit)
   )
 
   add_custom_command(
-    OUTPUT ${_output}
+    OUTPUT ${_output} "${_phony}"
     COMMAND ${CMAKE_COMMAND} -E env ${BUILDKIT_ENV}
     "${_launcher}" ${_platform_args}
     WORKING_DIRECTORY "${PROJECT_ROOT}"
-    COMMENT "Building Go core via buildkit..."
     VERBATIM
   )
 
-  add_custom_target(setup_buildkit_build DEPENDS ${_output})
+  # Match Cargokit's symbolic-output and ALL-target structure so the native
+  # generator reevaluates this build rule on each build.
+  set_source_files_properties("${_phony}" PROPERTIES SYMBOLIC TRUE)
+  add_custom_target(setup_buildkit_build ALL DEPENDS ${_output})
 endfunction()
diff --git a/plugins/setup/buildkit/gradle/plugin.gradle b/plugins/setup/buildkit/gradle/plugin.gradle
index 9adfe08fc3..f223a11834 100644
--- a/plugins/setup/buildkit/gradle/plugin.gradle
+++ b/plugins/setup/buildkit/gradle/plugin.gradle
@@ -3,11 +3,13 @@
 // Apply this from the setup plugin's android/build.gradle:
 //   apply from: "${project.projectDir}/../buildkit/gradle/plugin.gradle"
 //
-// It adds a task that runs build_tool android before mergeNativeLibs.
+// It runs build_tool before the :core module configures or builds its native
+// library. The Go output is consumed by :core's CMake project.
 
 def buildkitDir = file("${project.projectDir}/../buildkit").absolutePath
-def launcher = "${buildkitDir}/run_build_tool.sh"
 def projectRoot = file("${buildkitDir}/../../..").absolutePath
+def isWindows = System.getProperty('os.name').toLowerCase().contains('windows')
+def launcher = "${buildkitDir}/run_build_tool.${isWindows ? 'cmd' : 'sh'}"
 def androidArch = System.getenv('ANDROID_ARCH')
 def targetPlatform = project.findProperty('target-platform') ?:
         rootProject.findProperty('target-platform')
@@ -17,8 +19,12 @@ def archArgs = androidArch
         : (targetPlatform ? ['--target-platform', targetPlatform.toString()] : [])
 
 task buildGoCore(type: Exec) {
-    workingDir buildkitDir
-    commandLine 'bash', launcher, 'android', *archArgs
+    def command = isWindows ? ['cmd', '/c', launcher] : [launcher]
+    command.add('android')
+    command.addAll(archArgs)
+
+    workingDir projectRoot
+    commandLine command
 
     environment 'ANDROID_NDK', androidNdk
     environment 'APP_ENV', project.hasProperty('appEnv') ? project.appEnv : 'pre'
@@ -27,15 +33,19 @@ task buildGoCore(type: Exec) {
 
 def goCoreTask = buildGoCore
 
-// Wire into the Android build across all subprojects
+// CMake checks for libclash and its generated header while configuring :core,
+// so setup must run before both configure and native-build entry points. This
+// is the equivalent consumer boundary to Cargokit's mergeNativeLibs hook.
 afterEvaluate {
-    rootProject.subprojects { sub ->
-        sub.tasks.matching {
-            it.name.startsWith('configureCMake') ||
-                    it.name.startsWith('externalNativeBuild') ||
-                    it.name.startsWith('mergeNativeLibs')
-        }.configureEach {
-            dependsOn goCoreTask
-        }
+    def coreProject = rootProject.findProject(':core')
+    if (coreProject == null) {
+        throw new GradleException('The setup plugin requires the :core Android module.')
+    }
+    coreProject.tasks.matching {
+        it.name.startsWith('configureCMake') ||
+                it.name.startsWith('externalNativeBuild') ||
+                it.name.startsWith('mergeNativeLibs')
+    }.configureEach {
+        dependsOn goCoreTask
     }
 }
diff --git a/plugins/setup/buildkit/run_build_tool.cmd b/plugins/setup/buildkit/run_build_tool.cmd
index c152533de2..2024ad05d2 100644
--- a/plugins/setup/buildkit/run_build_tool.cmd
+++ b/plugins/setup/buildkit/run_build_tool.cmd
@@ -3,10 +3,8 @@ setlocal
 
 setlocal ENABLEDELAYEDEXPANSION
 
-echo warning: [setup] Plugin triggered
-
 SET BASEDIR=%~dp0
-SET PROJECT_DIR=%CD%
+if not defined PROJECT_DIR SET PROJECT_DIR=%CD%
 
 if not exist "%PROJECT_DIR%\pubspec.yaml" (
     echo Error: Could not find project root at "%PROJECT_DIR%"
diff --git a/plugins/setup/buildkit/run_build_tool.sh b/plugins/setup/buildkit/run_build_tool.sh
index 6b7e6ad343..0af383f22c 100755
--- a/plugins/setup/buildkit/run_build_tool.sh
+++ b/plugins/setup/buildkit/run_build_tool.sh
@@ -2,8 +2,6 @@
 
 set -e
 
-echo "warning: [setup] Plugin triggered"
-
 BASEDIR=$(cd "$(dirname "$0")" && pwd)
 PROJECT_DIR="${PROJECT_DIR:-$(pwd)}"
 
diff --git a/plugins/setup/lib/setup.dart b/plugins/setup/lib/setup.dart
index 7ea2530caf..4384a2b89f 100644
--- a/plugins/setup/lib/setup.dart
+++ b/plugins/setup/lib/setup.dart
@@ -1,6 +1,5 @@
-/// FlClash Go core build harness.
-///
-/// This plugin does not expose any Dart API. It exists purely to integrate
-/// the Go core build into each platform's native build system via FFI plugin
-/// hooks (CocoaPods script phases, Gradle tasks, CMake custom commands).
-library setup;
+// FlClash Go core build harness.
+//
+// This plugin does not expose any Dart API. It exists purely to integrate
+// the Go core build into each platform's native build system via FFI plugin
+// hooks (CocoaPods script phases, Gradle tasks, CMake custom commands).
diff --git a/plugins/setup/macos/setup.podspec b/plugins/setup/macos/setup.podspec
index ad0e6b909f..cf7b1b6cc3 100644
--- a/plugins/setup/macos/setup.podspec
+++ b/plugins/setup/macos/setup.podspec
@@ -21,6 +21,6 @@ FlClash Go core build harness (FFI plugin).
     :script => 'sh "$PODS_TARGET_SRCROOT/../buildkit/build_pod.sh"',
     :execution_position => :before_compile,
     :input_files => ['${BUILT_PRODUCTS_DIR}/buildkit_phony'],
-    :output_files => ["${SRCROOT}/../libclash/macos/FlClashCore"],
+    :output_files => ["${PODS_ROOT}/../../libclash/macos/FlClashCore"],
   }
 end
diff --git a/plugins/wifi_ssid/android/build.gradle b/plugins/wifi_ssid/android/build.gradle
index aa0e3f32bc..be3279b2af 100644
--- a/plugins/wifi_ssid/android/build.gradle
+++ b/plugins/wifi_ssid/android/build.gradle
@@ -1,4 +1,4 @@
-group 'com.example.wifi_ssid'
+group 'com.follow.clash.wifi_ssid'
 version '1.0'
 
 buildscript {
@@ -22,7 +22,7 @@ allprojects {
 apply plugin: 'com.android.library'
 
 android {
-    namespace 'com.example.wifi_ssid'
+    namespace 'com.follow.clash.wifi_ssid'
     compileSdk 36
 
     compileOptions {
diff --git a/plugins/wifi_ssid/android/src/main/AndroidManifest.xml b/plugins/wifi_ssid/android/src/main/AndroidManifest.xml
index 7eb45b9690..e363ca4740 100644
--- a/plugins/wifi_ssid/android/src/main/AndroidManifest.xml
+++ b/plugins/wifi_ssid/android/src/main/AndroidManifest.xml
@@ -1,6 +1,6 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    package="com.example.wifi_ssid">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
     <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
 </manifest>
diff --git a/plugins/wifi_ssid/android/src/main/kotlin/com/example/wifi_ssid/WifiSsidPlugin.kt b/plugins/wifi_ssid/android/src/main/kotlin/com/example/wifi_ssid/WifiSsidPlugin.kt
deleted file mode 100644
index ceb53a4450..0000000000
--- a/plugins/wifi_ssid/android/src/main/kotlin/com/example/wifi_ssid/WifiSsidPlugin.kt
+++ /dev/null
@@ -1,162 +0,0 @@
-package com.example.wifi_ssid
-
-import android.Manifest
-import android.app.Activity
-import android.content.Context
-import android.content.pm.PackageManager
-import android.net.ConnectivityManager
-import android.net.NetworkCapabilities
-import android.net.wifi.WifiManager
-import android.os.Build
-import androidx.annotation.NonNull
-import androidx.core.app.ActivityCompat
-import androidx.core.content.ContextCompat
-import io.flutter.embedding.engine.plugins.FlutterPlugin
-import io.flutter.embedding.engine.plugins.activity.ActivityAware
-import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
-import io.flutter.plugin.common.MethodCall
-import io.flutter.plugin.common.MethodChannel
-import io.flutter.plugin.common.MethodChannel.MethodCallHandler
-import io.flutter.plugin.common.MethodChannel.Result
-
-class WifiSsidPlugin : FlutterPlugin, MethodCallHandler, ActivityAware {
-
-    private lateinit var channel: MethodChannel
-    private var context: Context? = null
-    private var activity: Activity? = null
-    private var wifiManager: WifiManager? = null
-    private var connectivityManager: ConnectivityManager? = null
-    private var pendingPermissionResult: Result? = null
-
-    companion object {
-        private const val REQUEST_CODE_LOCATION = 1001
-        // Values must match WifiSsidPermission enum index in Dart
-        private const val PERMISSION_GRANTED = 0
-        private const val PERMISSION_DENIED = 1
-        private const val PERMISSION_PERMANENTLY_DENIED = 2
-    }
-
-    override fun onAttachedToEngine(@NonNull flutterPluginBinding: FlutterPlugin.FlutterPluginBinding) {
-        context = flutterPluginBinding.applicationContext
-        channel = MethodChannel(flutterPluginBinding.binaryMessenger, "wifi_ssid")
-        channel.setMethodCallHandler(this)
-        wifiManager = context?.applicationContext?.getSystemService(Context.WIFI_SERVICE) as? WifiManager
-        connectivityManager = context?.applicationContext?.getSystemService(Context.CONNECTIVITY_SERVICE) as? ConnectivityManager
-    }
-
-    override fun onDetachedFromEngine(@NonNull binding: FlutterPlugin.FlutterPluginBinding) {
-        channel.setMethodCallHandler(null)
-        context = null
-        wifiManager = null
-        connectivityManager = null
-    }
-
-    override fun onAttachedToActivity(binding: ActivityPluginBinding) {
-        activity = binding.activity
-        binding.addRequestPermissionsResultListener { requestCode, _, grantResults ->
-            if (requestCode == REQUEST_CODE_LOCATION) {
-                val result = pendingPermissionResult ?: return@addRequestPermissionsResultListener false
-                pendingPermissionResult = null
-                if (grantResults.isNotEmpty() && grantResults[0] == PackageManager.PERMISSION_GRANTED) {
-                    result.success(PERMISSION_GRANTED)
-                } else {
-                    if (!ActivityCompat.shouldShowRequestPermissionRationale(binding.activity, Manifest.permission.ACCESS_FINE_LOCATION)) {
-                        result.success(PERMISSION_PERMANENTLY_DENIED)
-                    } else {
-                        result.success(PERMISSION_DENIED)
-                    }
-                }
-                true
-            } else {
-                false
-            }
-        }
-    }
-
-    override fun onDetachedFromActivityForConfigChanges() {
-        activity = null
-    }
-
-    override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
-        onAttachedToActivity(binding)
-    }
-
-    override fun onDetachedFromActivity() {
-        activity = null
-    }
-
-    override fun onMethodCall(@NonNull call: MethodCall, @NonNull result: Result) {
-        when (call.method) {
-            "getSsid" -> getSsid(result)
-            "checkPermission" -> checkPermission(result)
-            "requestPermission" -> requestPermission(result)
-            else -> result.notImplemented()
-        }
-    }
-
-    // MARK: - Permission
-
-    private fun checkPermission(result: Result) {
-        val ctx = context ?: run {
-            result.error("UNAVAILABLE", "Context not available", null)
-            return
-        }
-        val granted = ContextCompat.checkSelfPermission(ctx, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED
-        result.success(if (granted) PERMISSION_GRANTED else PERMISSION_DENIED)
-    }
-
-    private fun requestPermission(result: Result) {
-        val act = activity ?: run {
-            result.error("UNAVAILABLE", "Activity not available", null)
-            return
-        }
-        val ctx = context ?: run {
-            result.error("UNAVAILABLE", "Context not available", null)
-            return
-        }
-        if (ContextCompat.checkSelfPermission(ctx, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED) {
-            result.success(PERMISSION_GRANTED)
-            return
-        }
-        pendingPermissionResult = result
-        ActivityCompat.requestPermissions(act, arrayOf(Manifest.permission.ACCESS_FINE_LOCATION), REQUEST_CODE_LOCATION)
-    }
-
-    // MARK: - SSID
-
-    private fun getSsid(result: Result) {
-        val wm = wifiManager ?: run {
-            result.error("UNAVAILABLE", "WifiManager not available", null)
-            return
-        }
-
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
-            val cm = connectivityManager ?: run {
-                result.error("UNAVAILABLE", "ConnectivityManager not available", null)
-                return
-            }
-            val currentNetwork = cm.activeNetwork
-            if (currentNetwork == null) {
-                result.success(null)
-                return
-            }
-            val caps = cm.getNetworkCapabilities(currentNetwork)
-            if (caps == null || !caps.hasTransport(NetworkCapabilities.TRANSPORT_WIFI)) {
-                result.success(null)
-                return
-            }
-        }
-
-        @Suppress("DEPRECATION")
-        val info = wm.connectionInfo
-        result.success(normalizeSsid(info.ssid))
-    }
-
-    private fun normalizeSsid(ssid: String?): String? {
-        return if (ssid == null || ssid == "<unknown ssid>" || ssid == "0x") {
-            null
-        } else {
-            ssid.removeSurrounding("\"")
-        }
-    }
-}
diff --git a/plugins/wifi_ssid/android/src/main/kotlin/com/follow/clash/wifi_ssid/WifiSsidPlugin.kt b/plugins/wifi_ssid/android/src/main/kotlin/com/follow/clash/wifi_ssid/WifiSsidPlugin.kt
new file mode 100644
index 0000000000..6057f8a8f3
--- /dev/null
+++ b/plugins/wifi_ssid/android/src/main/kotlin/com/follow/clash/wifi_ssid/WifiSsidPlugin.kt
@@ -0,0 +1,355 @@
+package com.follow.clash.wifi_ssid
+
+import android.Manifest
+import android.app.Activity
+import android.content.Context
+import android.content.pm.PackageManager
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+import android.net.NetworkRequest
+import android.net.wifi.WifiInfo
+import android.net.wifi.WifiManager
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import androidx.core.app.ActivityCompat
+import androidx.core.content.ContextCompat
+import io.flutter.embedding.engine.plugins.FlutterPlugin
+import io.flutter.embedding.engine.plugins.activity.ActivityAware
+import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
+import io.flutter.plugin.common.MethodCall
+import io.flutter.plugin.common.MethodChannel
+import io.flutter.plugin.common.MethodChannel.MethodCallHandler
+import io.flutter.plugin.common.MethodChannel.Result
+import io.flutter.plugin.common.PluginRegistry.RequestPermissionsResultListener
+import java.util.concurrent.ConcurrentHashMap
+
+class WifiSsidPlugin : FlutterPlugin, MethodCallHandler, ActivityAware {
+    private lateinit var channel: MethodChannel
+    private var context: Context? = null
+    private var activity: Activity? = null
+    private var wifiManager: WifiManager? = null
+    private var connectivityManager: ConnectivityManager? = null
+    private var activityBinding: ActivityPluginBinding? = null
+    private var pendingPermissionResult: Result? = null
+    private var wifiNetworkCallback: ConnectivityManager.NetworkCallback? = null
+    private val wifiInfoByNetwork = ConcurrentHashMap<Network, WifiInfo>()
+    private val pendingSsidResults = mutableListOf<Result>()
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private var ssidTimeout: Runnable? = null
+
+    private val permissionResultListener = RequestPermissionsResultListener { requestCode, _, _ ->
+        if (requestCode != REQUEST_CODE_LOCATION) {
+            return@RequestPermissionsResultListener false
+        }
+        val result = pendingPermissionResult
+            ?: return@RequestPermissionsResultListener false
+        pendingPermissionResult = null
+        val currentActivity = activity
+        if (currentActivity == null) {
+            result.error(ERROR_UNAVAILABLE, "Activity not available", null)
+            return@RequestPermissionsResultListener true
+        }
+        val state = permissionState(currentActivity, afterRequest = true)
+        if (state == PERMISSION_GRANTED) {
+            refreshWifiNetworkCallback()
+        } else {
+            unregisterWifiNetworkCallback()
+        }
+        result.success(state)
+        true
+    }
+
+    companion object {
+        private const val CHANNEL_NAME = "wifi_ssid"
+        private const val METHOD_GET_SSID = "getSsid"
+        private const val METHOD_CHECK_PERMISSION = "checkPermission"
+        private const val METHOD_REQUEST_PERMISSION = "requestPermission"
+        private const val ERROR_UNAVAILABLE = "UNAVAILABLE"
+        private const val ERROR_IN_PROGRESS = "IN_PROGRESS"
+        private const val REQUEST_CODE_LOCATION = 1001
+        private const val SSID_TIMEOUT_MILLIS = 3_000L
+
+        // Values must match WifiSsidPermission enum index in Dart
+        private const val PERMISSION_GRANTED = 0
+        private const val PERMISSION_DENIED = 1
+        private const val PERMISSION_PERMANENTLY_DENIED = 2
+    }
+
+    override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+        context = binding.applicationContext
+        channel = MethodChannel(binding.binaryMessenger, CHANNEL_NAME)
+        channel.setMethodCallHandler(this)
+        wifiManager = binding.applicationContext.getSystemService(Context.WIFI_SERVICE) as? WifiManager
+        connectivityManager = binding.applicationContext.getSystemService(
+            Context.CONNECTIVITY_SERVICE,
+        ) as? ConnectivityManager
+        if (permissionState(binding.applicationContext) == PERMISSION_GRANTED) {
+            registerWifiNetworkCallback()
+        }
+    }
+
+    override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+        completePendingSsidResults(
+            errorMessage = "Plugin detached before SSID lookup completed",
+        )
+        channel.setMethodCallHandler(null)
+        unregisterWifiNetworkCallback()
+        detachFromActivity(cancelPermissionRequest = true)
+        context = null
+        wifiManager = null
+        connectivityManager = null
+    }
+
+    override fun onAttachedToActivity(binding: ActivityPluginBinding) {
+        activityBinding?.removeRequestPermissionsResultListener(permissionResultListener)
+        activityBinding = binding
+        activity = binding.activity
+        binding.addRequestPermissionsResultListener(permissionResultListener)
+    }
+
+    override fun onDetachedFromActivityForConfigChanges() {
+        detachFromActivity(cancelPermissionRequest = false)
+    }
+
+    override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
+        onAttachedToActivity(binding)
+    }
+
+    override fun onDetachedFromActivity() {
+        detachFromActivity(cancelPermissionRequest = true)
+    }
+
+    override fun onMethodCall(call: MethodCall, result: Result) {
+        when (call.method) {
+            METHOD_GET_SSID -> getSsid(result)
+            METHOD_CHECK_PERMISSION -> checkPermission(result)
+            METHOD_REQUEST_PERMISSION -> requestPermission(result)
+            else -> result.notImplemented()
+        }
+    }
+
+    private fun checkPermission(result: Result) {
+        val ctx = context ?: run {
+            result.error(ERROR_UNAVAILABLE, "Context not available", null)
+            return
+        }
+        val state = permissionState(ctx)
+        if (state == PERMISSION_GRANTED) {
+            refreshWifiNetworkCallback()
+        } else {
+            unregisterWifiNetworkCallback()
+        }
+        result.success(state)
+    }
+
+    private fun requestPermission(result: Result) {
+        val act = activity ?: run {
+            result.error(ERROR_UNAVAILABLE, "Activity not available", null)
+            return
+        }
+        val ctx = context ?: run {
+            result.error(ERROR_UNAVAILABLE, "Context not available", null)
+            return
+        }
+        if (permissionState(ctx) == PERMISSION_GRANTED) {
+            refreshWifiNetworkCallback()
+            result.success(PERMISSION_GRANTED)
+            return
+        }
+        if (pendingPermissionResult != null) {
+            result.error(ERROR_IN_PROGRESS, "A permission request is already active", null)
+            return
+        }
+        pendingPermissionResult = result
+        ActivityCompat.requestPermissions(
+            act,
+            arrayOf(
+                Manifest.permission.ACCESS_FINE_LOCATION,
+                Manifest.permission.ACCESS_COARSE_LOCATION,
+            ),
+            REQUEST_CODE_LOCATION,
+        )
+    }
+
+    private fun permissionState(context: Context, afterRequest: Boolean = false): Int {
+        if (
+            ContextCompat.checkSelfPermission(
+                context,
+                Manifest.permission.ACCESS_FINE_LOCATION,
+            ) == PackageManager.PERMISSION_GRANTED
+        ) {
+            return PERMISSION_GRANTED
+        }
+        if (!afterRequest) return PERMISSION_DENIED
+        val activity = activity ?: return PERMISSION_DENIED
+        return if (
+            ActivityCompat.shouldShowRequestPermissionRationale(
+                activity,
+                Manifest.permission.ACCESS_FINE_LOCATION,
+            )
+        ) {
+            PERMISSION_DENIED
+        } else {
+            PERMISSION_PERMANENTLY_DENIED
+        }
+    }
+
+    private fun getSsid(result: Result) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+            val ctx = context ?: run {
+                result.error(ERROR_UNAVAILABLE, "Context not available", null)
+                return
+            }
+            if (permissionState(ctx) != PERMISSION_GRANTED) {
+                result.success(null)
+                return
+            }
+            if (connectivityManager == null) {
+                result.error(ERROR_UNAVAILABLE, "ConnectivityManager not available", null)
+                return
+            }
+            val ssid = currentSsid()
+            if (ssid != null) {
+                result.success(ssid)
+                return
+            }
+            pendingSsidResults.add(result)
+            if (!registerWifiNetworkCallback()) {
+                completePendingSsidResults(ssid = null)
+                return
+            }
+            scheduleSsidTimeout()
+            return
+        }
+
+        val wm = wifiManager ?: run {
+            result.error(ERROR_UNAVAILABLE, "WifiManager not available", null)
+            return
+        }
+        @Suppress("DEPRECATION")
+        result.success(normalizeSsid(wm.connectionInfo?.ssid))
+    }
+
+    private fun currentSsid(): String? {
+        val activeNetwork = connectivityManager?.activeNetwork
+        val info = activeNetwork?.let(wifiInfoByNetwork::get)
+            ?: wifiInfoByNetwork.values.firstOrNull()
+        return normalizeSsid(info?.ssid)
+    }
+
+    private fun normalizeSsid(ssid: String?): String? {
+        val normalized = ssid?.removeSurrounding("\"")
+        return normalized?.takeIf {
+            it.isNotEmpty() && it != WifiManager.UNKNOWN_SSID && it != "0x"
+        }
+    }
+
+    private fun refreshWifiNetworkCallback() {
+        unregisterWifiNetworkCallback()
+        registerWifiNetworkCallback()
+    }
+
+    private fun registerWifiNetworkCallback(): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.S) {
+            return false
+        }
+        val ctx = context ?: return false
+        if (permissionState(ctx) != PERMISSION_GRANTED) {
+            unregisterWifiNetworkCallback()
+            return false
+        }
+        if (wifiNetworkCallback != null) {
+            return true
+        }
+        val cm = connectivityManager ?: return false
+        val callback = object : ConnectivityManager.NetworkCallback(FLAG_INCLUDE_LOCATION_INFO) {
+            override fun onCapabilitiesChanged(
+                network: Network,
+                capabilities: NetworkCapabilities,
+            ) {
+                val wifiInfo = capabilities.transportInfo as? WifiInfo
+                if (wifiInfo == null) {
+                    wifiInfoByNetwork.remove(network)
+                } else {
+                    wifiInfoByNetwork[network] = wifiInfo
+                }
+                currentSsid()?.let { ssid ->
+                    mainHandler.post {
+                        completePendingSsidResults(ssid = ssid)
+                    }
+                }
+            }
+
+            override fun onLost(network: Network) {
+                wifiInfoByNetwork.remove(network)
+            }
+        }
+        val request = NetworkRequest.Builder()
+            .addTransportType(NetworkCapabilities.TRANSPORT_WIFI)
+            .build()
+        return runCatching { cm.registerNetworkCallback(request, callback) }
+            .onSuccess { wifiNetworkCallback = callback }
+            .isSuccess
+    }
+
+    private fun scheduleSsidTimeout() {
+        if (ssidTimeout != null) {
+            return
+        }
+        val timeout = Runnable {
+            ssidTimeout = null
+            completePendingSsidResults(ssid = currentSsid())
+        }
+        ssidTimeout = timeout
+        mainHandler.postDelayed(timeout, SSID_TIMEOUT_MILLIS)
+    }
+
+    private fun completePendingSsidResults(
+        ssid: String? = null,
+        errorMessage: String? = null,
+    ) {
+        val timeout = ssidTimeout
+        ssidTimeout = null
+        if (timeout != null) {
+            mainHandler.removeCallbacks(timeout)
+        }
+        val results = pendingSsidResults.toList()
+        pendingSsidResults.clear()
+        results.forEach { result ->
+            if (errorMessage == null) {
+                result.success(ssid)
+            } else {
+                result.error(ERROR_UNAVAILABLE, errorMessage, null)
+            }
+        }
+    }
+
+    private fun unregisterWifiNetworkCallback() {
+        val callback = wifiNetworkCallback
+        wifiNetworkCallback = null
+        if (callback != null) {
+            connectivityManager?.let { manager ->
+                runCatching { manager.unregisterNetworkCallback(callback) }
+            }
+        }
+        wifiInfoByNetwork.clear()
+    }
+
+    private fun detachFromActivity(cancelPermissionRequest: Boolean) {
+        activityBinding?.removeRequestPermissionsResultListener(permissionResultListener)
+        activityBinding = null
+        activity = null
+        if (cancelPermissionRequest) {
+            completePendingPermissionRequest(
+                "Activity detached before permission request completed",
+            )
+        }
+    }
+
+    private fun completePendingPermissionRequest(message: String) {
+        pendingPermissionResult?.error(ERROR_UNAVAILABLE, message, null)
+        pendingPermissionResult = null
+    }
+}
diff --git a/plugins/wifi_ssid/lib/wifi_ssid_manager.dart b/plugins/wifi_ssid/lib/wifi_ssid_manager.dart
index 4b9dcf60f5..06d8ba46d9 100644
--- a/plugins/wifi_ssid/lib/wifi_ssid_manager.dart
+++ b/plugins/wifi_ssid/lib/wifi_ssid_manager.dart
@@ -1,33 +1,47 @@
 import 'package:flutter/services.dart';
 
-enum WifiSsidPermission {
-  granted,
-  denied,
-  permanentlyDenied,
-}
+/// The platform permission state required to read the current Wi-Fi SSID.
+enum WifiSsidPermission { granted, denied, permanentlyDenied }
 
+/// Provides access to the current Wi-Fi SSID and its required permission.
 class WifiSsidManager {
   WifiSsidManager._();
 
   static final WifiSsidManager instance = WifiSsidManager._();
 
-  final MethodChannel _channel = const MethodChannel('wifi_ssid');
+  static const _channel = MethodChannel('wifi_ssid');
+  static const _getSsidMethod = 'getSsid';
+  static const _checkPermissionMethod = 'checkPermission';
+  static const _requestPermissionMethod = 'requestPermission';
 
   /// Returns the current WiFi SSID, or null if not connected to WiFi.
-  Future<String?> getSsid() async {
-    return await _channel.invokeMethod<String>('getSsid');
+  Future<String?> getSsid() {
+    return _channel.invokeMethod<String>(_getSsidMethod);
   }
 
-  /// Checks whether location permission has been granted.
+  /// Checks whether the required platform permission has been granted.
   Future<WifiSsidPermission> checkPermission() async {
-    final result = await _channel.invokeMethod<int>('checkPermission');
-    return WifiSsidPermission.values[result ?? 1];
+    final result = await _channel.invokeMethod<int>(_checkPermissionMethod);
+    return _decodePermission(result);
   }
 
-  /// Requests location permission from the user.
+  /// Requests the required platform permission from the user.
   Future<WifiSsidPermission> requestPermission() async {
-    final result = await _channel.invokeMethod<int>('requestPermission');
-    return WifiSsidPermission.values[result ?? 1];
+    final result = await _channel.invokeMethod<int>(_requestPermissionMethod);
+    return _decodePermission(result);
+  }
+
+  WifiSsidPermission _decodePermission(int? value) {
+    return switch (value) {
+      0 => WifiSsidPermission.granted,
+      2 => WifiSsidPermission.permanentlyDenied,
+      null || 1 => WifiSsidPermission.denied,
+      _ => throw PlatformException(
+        code: 'INVALID_PERMISSION_STATE',
+        message: 'Native wifi_ssid returned an invalid permission state.',
+        details: value,
+      ),
+    };
   }
 }
 
diff --git a/plugins/wifi_ssid/linux/wifi_ssid_plugin.cc b/plugins/wifi_ssid/linux/wifi_ssid_plugin.cc
index a9df9bda87..496a1900b4 100644
--- a/plugins/wifi_ssid/linux/wifi_ssid_plugin.cc
+++ b/plugins/wifi_ssid/linux/wifi_ssid_plugin.cc
@@ -3,7 +3,6 @@
 #include <flutter_linux/flutter_linux.h>
 #include <gio/gio.h>
 
-#include <cstdio>
 #include <cstring>
 
 #define WIFI_SSID_PLUGIN(obj)                                     \
@@ -12,11 +11,9 @@
 
 struct _WifiSsidPlugin {
   GObject parent_instance;
-  FlPluginRegistrar* registrar;
-  FlMethodChannel* channel;
 };
 
-G_DEFINE_TYPE(WifiSsidPlugin, wifi_ssid_plugin, g_object_get_type())
+G_DEFINE_TYPE(WifiSsidPlugin, wifi_ssid_plugin, G_TYPE_OBJECT)
 
 static constexpr guint32 kNmDeviceTypeWifi = 2;
 static constexpr guint32 kNmDeviceStateActivated = 100;
@@ -300,31 +297,38 @@ static gchar* get_ssid_from_connman() {
 }
 
 static gchar* get_ssid_from_nmcli() {
-  FILE* fp = popen("nmcli -t -f active,ssid dev wifi 2>/dev/null", "r");
-  if (fp == nullptr) {
+  g_auto(GStrv) arguments = nullptr;
+  gint argument_count = 0;
+  g_autoptr(GError) error = nullptr;
+  if (!g_shell_parse_argv(
+          "nmcli --terse --fields active,ssid device wifi", &argument_count,
+          &arguments, &error)) {
     return nullptr;
   }
 
-  char line[256];
-  gchar* ssid = nullptr;
-
-  while (fgets(line, sizeof(line), fp) != nullptr) {
-    // Remove trailing newline
-    size_t len = strlen(line);
-    if (len > 0 && line[len - 1] == '\n') {
-      line[len - 1] = '\0';
-    }
+  g_auto(GStrv) environment = g_get_environ();
+  environment = g_environ_setenv(environment, "LC_ALL", "C", TRUE);
+  g_autofree gchar* standard_output = nullptr;
+  gint wait_status = 0;
+  const gboolean spawned = g_spawn_sync(
+      nullptr, arguments, environment,
+      static_cast<GSpawnFlags>(G_SPAWN_SEARCH_PATH |
+                               G_SPAWN_STDERR_TO_DEV_NULL),
+      nullptr, nullptr, &standard_output, nullptr, &wait_status, &error);
+  if (!spawned || standard_output == nullptr) {
+    return nullptr;
+  }
+  if (!g_spawn_check_wait_status(wait_status, &error)) {
+    return nullptr;
+  }
 
-    // Parse "yes:SSID" or "no:SSID"
-    char* colon = strchr(line, ':');
-    if (colon != nullptr && strncmp(line, "yes", colon - line) == 0) {
-      ssid = unescape_nmcli_value(colon + 1);
-      break;
+  g_auto(GStrv) lines = g_strsplit(standard_output, "\n", -1);
+  for (gchar** line = lines; *line != nullptr; ++line) {
+    if (g_str_has_prefix(*line, "yes:")) {
+      return unescape_nmcli_value(*line + strlen("yes:"));
     }
   }
-
-  pclose(fp);
-  return ssid;
+  return nullptr;
 }
 
 static gchar* get_ssid_value() {
@@ -374,8 +378,7 @@ static void get_ssid_done(GObject* source_object, GAsyncResult* result,
   g_object_unref(method_call);
 }
 
-static void wifi_ssid_plugin_handle_method_call(WifiSsidPlugin* self,
-                                                 FlMethodCall* method_call) {
+static void wifi_ssid_plugin_handle_method_call(FlMethodCall* method_call) {
   g_autoptr(FlMethodResponse) response = nullptr;
   const gchar* method = fl_method_call_get_name(method_call);
 
@@ -384,8 +387,9 @@ static void wifi_ssid_plugin_handle_method_call(WifiSsidPlugin* self,
         g_task_new(nullptr, nullptr, get_ssid_done, g_object_ref(method_call));
     g_task_run_in_thread(task, get_ssid_task);
     return;
-  } else if (strcmp(method, "checkPermission") == 0 || strcmp(method, "requestPermission") == 0) {
-    // Linux does not require location permission for WiFi SSID
+  } else if (strcmp(method, "checkPermission") == 0 ||
+             strcmp(method, "requestPermission") == 0) {
+    // Linux does not require location permission for the Wi-Fi SSID.
     response = FL_METHOD_RESPONSE(
         fl_method_success_response_new(fl_value_new_int(0)));
   } else {
@@ -405,24 +409,21 @@ static void wifi_ssid_plugin_class_init(WifiSsidPluginClass* klass) {
 
 static void wifi_ssid_plugin_init(WifiSsidPlugin* self) {}
 
-static void method_call_cb(FlMethodChannel* channel,
-                            FlMethodCall* method_call, gpointer user_data) {
-  WifiSsidPlugin* plugin = WIFI_SSID_PLUGIN(user_data);
-  wifi_ssid_plugin_handle_method_call(plugin, method_call);
+static void method_call_cb(FlMethodChannel*, FlMethodCall* method_call,
+                           gpointer) {
+  wifi_ssid_plugin_handle_method_call(method_call);
 }
 
 void wifi_ssid_plugin_register_with_registrar(FlPluginRegistrar* registrar) {
   WifiSsidPlugin* plugin = WIFI_SSID_PLUGIN(
       g_object_new(wifi_ssid_plugin_get_type(), nullptr));
 
-  plugin->registrar = FL_PLUGIN_REGISTRAR(g_object_ref(registrar));
-
   g_autoptr(FlStandardMethodCodec) codec = fl_standard_method_codec_new();
-  plugin->channel =
+  g_autoptr(FlMethodChannel) channel =
       fl_method_channel_new(fl_plugin_registrar_get_messenger(registrar),
                             "wifi_ssid", FL_METHOD_CODEC(codec));
   fl_method_channel_set_method_call_handler(
-      plugin->channel, method_call_cb, g_object_ref(plugin), g_object_unref);
+      channel, method_call_cb, g_object_ref(plugin), g_object_unref);
 
   g_object_unref(plugin);
 }
diff --git a/plugins/wifi_ssid/macos/wifi_ssid/Sources/wifi_ssid/WifiSsidPlugin.swift b/plugins/wifi_ssid/macos/wifi_ssid/Sources/wifi_ssid/WifiSsidPlugin.swift
index 9f9d9b7049..b130c87467 100644
--- a/plugins/wifi_ssid/macos/wifi_ssid/Sources/wifi_ssid/WifiSsidPlugin.swift
+++ b/plugins/wifi_ssid/macos/wifi_ssid/Sources/wifi_ssid/WifiSsidPlugin.swift
@@ -3,17 +3,25 @@ import CoreLocation
 import CoreWLAN
 import FlutterMacOS
 
-// Permission values must match WifiSsidPermission enum index in Dart:
-//   0 = granted, 1 = denied, 2 = permanentlyDenied
 public class WifiSsidPlugin: NSObject, FlutterPlugin, CLLocationManagerDelegate {
 
     private let locationManager = CLLocationManager()
+    private let wifiClient = CWWiFiClient.shared()
     private var pendingPermissionResult: FlutterResult?
 
+    private enum Method {
+        static let getSsid = "getSsid"
+        static let checkPermission = "checkPermission"
+        static let requestPermission = "requestPermission"
+    }
+
+    private enum ErrorCode {
+        static let inProgress = "IN_PROGRESS"
+    }
+
     public static func register(with registrar: FlutterPluginRegistrar) {
         let channel = FlutterMethodChannel(
-            name: "wifi_ssid",
-            binaryMessenger: registrar.messenger
+            name: "wifi_ssid", binaryMessenger: registrar.messenger
         )
         let instance = WifiSsidPlugin()
         registrar.addMethodCallDelegate(instance, channel: channel)
@@ -26,11 +34,11 @@ public class WifiSsidPlugin: NSObject, FlutterPlugin, CLLocationManagerDelegate
 
     public func handle(_ call: FlutterMethodCall, result: @escaping FlutterResult) {
         switch call.method {
-        case "getSsid":
+        case Method.getSsid:
             getSsid(result: result)
-        case "checkPermission":
+        case Method.checkPermission:
             checkPermission(result: result)
-        case "requestPermission":
+        case Method.requestPermission:
             requestPermission(result: result)
         default:
             result(FlutterMethodNotImplemented)
@@ -40,18 +48,23 @@ public class WifiSsidPlugin: NSObject, FlutterPlugin, CLLocationManagerDelegate
     // MARK: - Permission
 
     private func checkPermission(result: @escaping FlutterResult) {
-        let status = locationManager.authorizationStatus
-        result(mapAuthStatus(status).rawValue)
+        result(mapAuthStatus(locationManager.authorizationStatus).rawValue)
     }
 
     private func requestPermission(result: @escaping FlutterResult) {
-        let status = locationManager.authorizationStatus
-        if status == .authorizedAlways {
-            result(0) // granted
+        let permission = mapAuthStatus(locationManager.authorizationStatus)
+        if permission != .denied {
+            result(permission.rawValue)
             return
         }
-        if status == .denied {
-            result(2) // permanentlyDenied
+        if pendingPermissionResult != nil {
+            result(
+                FlutterError(
+                    code: ErrorCode.inProgress,
+                    message: "A permission request is already active",
+                    details: nil
+                )
+            )
             return
         }
         pendingPermissionResult = result
@@ -66,7 +79,7 @@ public class WifiSsidPlugin: NSObject, FlutterPlugin, CLLocationManagerDelegate
 
     private func mapAuthStatus(_ status: CLAuthorizationStatus) -> WifiSsidPermission {
         switch status {
-        case .authorizedAlways:
+        case .authorizedAlways, .authorizedWhenInUse:
             return .granted
         case .denied, .restricted:
             return .permanentlyDenied
@@ -76,6 +89,7 @@ public class WifiSsidPlugin: NSObject, FlutterPlugin, CLLocationManagerDelegate
     }
 
     private enum WifiSsidPermission: Int {
+        // Values must match WifiSsidPermission.index in Dart.
         case granted = 0
         case denied = 1
         case permanentlyDenied = 2
@@ -84,14 +98,6 @@ public class WifiSsidPlugin: NSObject, FlutterPlugin, CLLocationManagerDelegate
     // MARK: - SSID
 
     private func getSsid(result: @escaping FlutterResult) {
-        if #available(macOS 10.10, *) {
-            if let interface = CWWiFiClient.shared().interface() {
-                result(interface.ssid())
-            } else {
-                result(nil)
-            }
-        } else {
-            result(nil)
-        }
+        result(wifiClient.interface()?.ssid())
     }
 }
diff --git a/plugins/wifi_ssid/pubspec.yaml b/plugins/wifi_ssid/pubspec.yaml
index d5fdc81bb4..5314d43508 100644
--- a/plugins/wifi_ssid/pubspec.yaml
+++ b/plugins/wifi_ssid/pubspec.yaml
@@ -1,27 +1,25 @@
 name: wifi_ssid
-description: "A Flutter plugin to retrieve the current WiFi SSID."
+description: A Flutter plugin to retrieve the current Wi-Fi SSID.
 version: 0.0.1
-homepage:
 
 environment:
-  sdk: '>=3.4.4 <4.0.0'
+  sdk: '>=3.8.0 <4.0.0'
   flutter: '>=3.3.0'
 
 dependencies:
   flutter:
     sdk: flutter
-  plugin_platform_interface: ^2.0.2
 
 dev_dependencies:
   flutter_test:
     sdk: flutter
-  flutter_lints: ^3.0.0
+  flutter_lints: ^6.0.0
 
 flutter:
   plugin:
     platforms:
       android:
-        package: com.example.wifi_ssid
+        package: com.follow.clash.wifi_ssid
         pluginClass: WifiSsidPlugin
       macos:
         pluginClass: WifiSsidPlugin
diff --git a/plugins/wifi_ssid/test/wifi_ssid_manager_test.dart b/plugins/wifi_ssid/test/wifi_ssid_manager_test.dart
new file mode 100644
index 0000000000..90d13c6d5d
--- /dev/null
+++ b/plugins/wifi_ssid/test/wifi_ssid_manager_test.dart
@@ -0,0 +1,76 @@
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:wifi_ssid/wifi_ssid.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  const channel = MethodChannel('wifi_ssid');
+  final manager = WifiSsidManager.instance;
+
+  tearDown(() async {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, null);
+  });
+
+  test('getSsid returns the native value', () async {
+    MethodCall? receivedCall;
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (call) async {
+          receivedCall = call;
+          return 'Office Wi-Fi';
+        });
+
+    expect(await manager.getSsid(), 'Office Wi-Fi');
+    expect(receivedCall?.method, 'getSsid');
+  });
+
+  test('getSsid preserves a null native value', () async {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (_) async => null);
+
+    expect(await manager.getSsid(), isNull);
+  });
+
+  test('checkPermission maps every native permission state', () async {
+    var nativeState = 0;
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (call) async {
+          expect(call.method, 'checkPermission');
+          return nativeState;
+        });
+
+    expect(await manager.checkPermission(), WifiSsidPermission.granted);
+    nativeState = 1;
+    expect(await manager.checkPermission(), WifiSsidPermission.denied);
+    nativeState = 2;
+    expect(
+      await manager.checkPermission(),
+      WifiSsidPermission.permanentlyDenied,
+    );
+  });
+
+  test('requestPermission treats a null native value as denied', () async {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (call) async {
+          expect(call.method, 'requestPermission');
+          return null;
+        });
+
+    expect(await manager.requestPermission(), WifiSsidPermission.denied);
+  });
+
+  test('invalid native permission state produces a platform error', () async {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (_) async => 99);
+
+    await expectLater(
+      manager.checkPermission(),
+      throwsA(
+        isA<PlatformException>()
+            .having((error) => error.code, 'code', 'INVALID_PERMISSION_STATE')
+            .having((error) => error.details, 'details', 99),
+      ),
+    );
+  });
+}
diff --git a/plugins/wifi_ssid/windows/CMakeLists.txt b/plugins/wifi_ssid/windows/CMakeLists.txt
index 3b99051169..8c4a4c6d3e 100644
--- a/plugins/wifi_ssid/windows/CMakeLists.txt
+++ b/plugins/wifi_ssid/windows/CMakeLists.txt
@@ -24,7 +24,7 @@ target_compile_definitions(${PLUGIN_NAME} PRIVATE FLUTTER_PLUGIN_IMPL)
 
 target_include_directories(${PLUGIN_NAME} INTERFACE
   "${CMAKE_CURRENT_SOURCE_DIR}/include")
-target_link_libraries(${PLUGIN_NAME} PRIVATE flutter flutter_wrapper_plugin wlanapi ole32)
+target_link_libraries(${PLUGIN_NAME} PRIVATE flutter flutter_wrapper_plugin wlanapi)
 
 set(wifi_ssid_bundled_libraries
   ""
diff --git a/plugins/wifi_ssid/windows/wifi_ssid_plugin.cpp b/plugins/wifi_ssid/windows/wifi_ssid_plugin.cpp
index 41c5d2150a..2b837c770f 100644
--- a/plugins/wifi_ssid/windows/wifi_ssid_plugin.cpp
+++ b/plugins/wifi_ssid/windows/wifi_ssid_plugin.cpp
@@ -2,58 +2,77 @@
 
 #include <windows.h>
 #include <wlanapi.h>
-#include <objbase.h>
 
 #include <flutter/method_channel.h>
 #include <flutter/standard_method_codec.h>
 
 #include <memory>
 #include <string>
-
-#pragma comment(lib, "wlanapi.lib")
-#pragma comment(lib, "ole32.lib")
+#include <utility>
 
 namespace wifi_ssid {
 
 namespace {
 
-std::unique_ptr<
-    flutter::MethodChannel<flutter::EncodableValue>,
-    std::default_delete<flutter::MethodChannel<flutter::EncodableValue>>>
-    channel = nullptr;
-
 constexpr int kPermissionGranted = 0;
+constexpr char kChannelName[] = "wifi_ssid";
+constexpr char kGetSsidMethod[] = "getSsid";
+constexpr char kCheckPermissionMethod[] = "checkPermission";
+constexpr char kRequestPermissionMethod[] = "requestPermission";
+
+struct WlanHandleDeleter {
+  using pointer = HANDLE;
+
+  void operator()(HANDLE handle) const {
+    if (handle != nullptr) {
+      WlanCloseHandle(handle, nullptr);
+    }
+  }
+};
+
+struct WlanMemoryDeleter {
+  template <typename T>
+  void operator()(T *memory) const {
+    if (memory != nullptr) {
+      WlanFreeMemory(memory);
+    }
+  }
+};
+
+using ScopedWlanHandle = std::unique_ptr<void, WlanHandleDeleter>;
+using ScopedInterfaceList =
+    std::unique_ptr<WLAN_INTERFACE_INFO_LIST, WlanMemoryDeleter>;
+using ScopedConnectionAttributes =
+    std::unique_ptr<WLAN_CONNECTION_ATTRIBUTES, WlanMemoryDeleter>;
 
 }  // namespace
 
 void WifiSsidPlugin::RegisterWithRegistrar(
     flutter::PluginRegistrarWindows *registrar) {
-  channel =
+  auto channel =
       std::make_unique<flutter::MethodChannel<flutter::EncodableValue>>(
-          registrar->messenger(), "wifi_ssid",
+          registrar->messenger(), kChannelName,
           &flutter::StandardMethodCodec::GetInstance());
-
   auto plugin = std::make_unique<WifiSsidPlugin>();
 
   channel->SetMethodCallHandler(
       [plugin_pointer = plugin.get()](const auto &call, auto result) {
         plugin_pointer->HandleMethodCall(call, std::move(result));
       });
-
   registrar->AddPlugin(std::move(plugin));
 }
 
-WifiSsidPlugin::WifiSsidPlugin() {}
+WifiSsidPlugin::WifiSsidPlugin() = default;
 
-WifiSsidPlugin::~WifiSsidPlugin() {}
+WifiSsidPlugin::~WifiSsidPlugin() = default;
 
 void WifiSsidPlugin::HandleMethodCall(
     const flutter::MethodCall<flutter::EncodableValue> &method_call,
     std::unique_ptr<flutter::MethodResult<flutter::EncodableValue>> result) {
-  if (method_call.method_name().compare("getSsid") == 0) {
+  if (method_call.method_name() == kGetSsidMethod) {
     GetSsid(std::move(result));
-  } else if (method_call.method_name().compare("checkPermission") == 0 ||
-             method_call.method_name().compare("requestPermission") == 0) {
+  } else if (method_call.method_name() == kCheckPermissionMethod ||
+             method_call.method_name() == kRequestPermissionMethod) {
     result->Success(flutter::EncodableValue(kPermissionGranted));
   } else {
     result->NotImplemented();
@@ -62,72 +81,70 @@ void WifiSsidPlugin::HandleMethodCall(
 
 void WifiSsidPlugin::GetSsid(
     std::unique_ptr<flutter::MethodResult<flutter::EncodableValue>> result) {
-  HANDLE hClient = nullptr;
-  DWORD dwMaxClient = 2;
-  DWORD dwCurVersion = 0;
-  DWORD dwResult =
-      WlanOpenHandle(dwMaxClient, nullptr, &dwCurVersion, &hClient);
-  if (dwResult == ERROR_ACCESS_DENIED) {
+  HANDLE client_handle = nullptr;
+  DWORD current_version = 0;
+  DWORD result_code = WlanOpenHandle(WLAN_API_VERSION_2_0, nullptr,
+                                     &current_version, &client_handle);
+  if (result_code == ERROR_ACCESS_DENIED) {
     result->Success(flutter::EncodableValue());
     return;
   }
-  if (dwResult != ERROR_SUCCESS) {
+  if (result_code != ERROR_SUCCESS) {
     result->Error("WLAN_ERROR", "Failed to open WLAN handle",
-                  flutter::EncodableValue(static_cast<int>(dwResult)));
+                  flutter::EncodableValue(static_cast<int>(result_code)));
     return;
   }
+  ScopedWlanHandle client(client_handle);
 
-  PWLAN_INTERFACE_INFO_LIST pIfList = nullptr;
-  dwResult = WlanEnumInterfaces(hClient, nullptr, &pIfList);
-  if (dwResult == ERROR_ACCESS_DENIED) {
-    WlanCloseHandle(hClient, nullptr);
+  PWLAN_INTERFACE_INFO_LIST interface_list = nullptr;
+  result_code = WlanEnumInterfaces(client.get(), nullptr, &interface_list);
+  if (result_code == ERROR_ACCESS_DENIED) {
     result->Success(flutter::EncodableValue());
     return;
   }
-  if (dwResult != ERROR_SUCCESS) {
-    WlanCloseHandle(hClient, nullptr);
+  if (result_code != ERROR_SUCCESS) {
     result->Error("WLAN_ERROR", "Failed to enumerate WLAN interfaces",
-                  flutter::EncodableValue(static_cast<int>(dwResult)));
+                  flutter::EncodableValue(static_cast<int>(result_code)));
     return;
   }
+  ScopedInterfaceList interfaces(interface_list);
 
   std::string ssid;
-  DWORD query_error = ERROR_SUCCESS;
-  for (DWORD i = 0; i < pIfList->dwNumberOfItems; i++) {
-    PWLAN_CONNECTION_ATTRIBUTES pConnAttrib = nullptr;
-    DWORD dwDataSize = sizeof(WLAN_CONNECTION_ATTRIBUTES);
-    WLAN_INTF_OPCODE opCode = wlan_intf_opcode_current_connection;
-
-    dwResult = WlanQueryInterface(
-        hClient, &pIfList->InterfaceInfo[i].InterfaceGuid, opCode, nullptr,
-        &dwDataSize, (PVOID *)&pConnAttrib, nullptr);
-
-    if (dwResult == ERROR_SUCCESS && pConnAttrib != nullptr) {
-      if (pConnAttrib->isState == wlan_interface_state_connected) {
-        DWORD ssidLen =
-            pConnAttrib->wlanAssociationAttributes.dot11Ssid.uSSIDLength;
-        if (ssidLen > 0 && ssidLen <= 32) {
-          ssid.assign(
-              reinterpret_cast<const char *>(
-                  pConnAttrib->wlanAssociationAttributes.dot11Ssid.ucSSID),
-              ssidLen);
-        }
-        WlanFreeMemory(pConnAttrib);
-        break;
-      }
-      WlanFreeMemory(pConnAttrib);
-    } else if (dwResult == ERROR_ACCESS_DENIED) {
-      query_error = dwResult;
+  bool access_denied = false;
+  for (DWORD i = 0; i < interfaces->dwNumberOfItems; ++i) {
+    const auto &interface_info = interfaces->InterfaceInfo[i];
+    if (interface_info.isState != wlan_interface_state_connected) {
+      continue;
+    }
+
+    PWLAN_CONNECTION_ATTRIBUTES connection_attributes = nullptr;
+    DWORD data_size = 0;
+    result_code = WlanQueryInterface(
+        client.get(), &interface_info.InterfaceGuid,
+        wlan_intf_opcode_current_connection, nullptr, &data_size,
+        reinterpret_cast<PVOID *>(&connection_attributes), nullptr);
+
+    if (result_code == ERROR_ACCESS_DENIED) {
+      access_denied = true;
       break;
-    } else if (query_error == ERROR_SUCCESS) {
-      query_error = dwResult;
     }
-  }
+    if (result_code != ERROR_SUCCESS || connection_attributes == nullptr) {
+      continue;
+    }
 
-  WlanFreeMemory(pIfList);
-  WlanCloseHandle(hClient, nullptr);
+    ScopedConnectionAttributes connection(connection_attributes);
+    const auto &dot11_ssid =
+        connection->wlanAssociationAttributes.dot11Ssid;
+    if (dot11_ssid.uSSIDLength == 0 ||
+        dot11_ssid.uSSIDLength > DOT11_SSID_MAX_LENGTH) {
+      continue;
+    }
+    ssid.assign(reinterpret_cast<const char *>(dot11_ssid.ucSSID),
+                dot11_ssid.uSSIDLength);
+    break;
+  }
 
-  if (query_error == ERROR_ACCESS_DENIED || ssid.empty()) {
+  if (access_denied || ssid.empty()) {
     result->Success(flutter::EncodableValue());
     return;
   }
diff --git a/plugins/wifi_ssid/windows/wifi_ssid_plugin.h b/plugins/wifi_ssid/windows/wifi_ssid_plugin.h
index 62740d33d2..23daeacfb0 100644
--- a/plugins/wifi_ssid/windows/wifi_ssid_plugin.h
+++ b/plugins/wifi_ssid/windows/wifi_ssid_plugin.h
@@ -15,7 +15,7 @@ class WifiSsidPlugin : public flutter::Plugin {
       flutter::PluginRegistrarWindows *registrar);
 
   WifiSsidPlugin();
-  virtual ~WifiSsidPlugin();
+  ~WifiSsidPlugin() override;
 
   WifiSsidPlugin(const WifiSsidPlugin &) = delete;
   WifiSsidPlugin &operator=(const WifiSsidPlugin &) = delete;
@@ -27,6 +27,7 @@ class WifiSsidPlugin : public flutter::Plugin {
 
   void GetSsid(
       std::unique_ptr<flutter::MethodResult<flutter::EncodableValue>> result);
+
 };
 
 }  // namespace wifi_ssid
diff --git a/pubspec.lock b/pubspec.lock
index 78082c16f5..50d89699bf 100755
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -5,42 +5,26 @@ packages:
     dependency: transitive
     description:
       name: _fe_analyzer_shared
-      sha256: "5b7468c326d2f8a4f630056404ca0d291ade42918f4a3c6233618e724f39da8e"
+      sha256: a49d6cf99e8d8e7a8e93668d09ced0bbdb954d0b4fccc2f5f9241c6b87fad95c
       url: "https://pub.dev"
     source: hosted
-    version: "92.0.0"
-  analysis_server_plugin:
-    dependency: transitive
-    description:
-      name: analysis_server_plugin
-      sha256: "44adba4d74a2541173bad4c11531d2a4d22810c29c5ddb458a38e9f4d0e5eac7"
-      url: "https://pub.dev"
-    source: hosted
-    version: "0.3.4"
+    version: "99.0.0"
   analyzer:
     dependency: transitive
     description:
       name: analyzer
-      sha256: "70e4b1ef8003c64793a9e268a551a82869a8a96f39deb73dea28084b0e8bf75e"
+      sha256: "663efa951fb8a45e06f491223a604c93820598f20e6a99c25617a1576065e8b7"
       url: "https://pub.dev"
     source: hosted
-    version: "9.0.0"
+    version: "12.1.0"
   analyzer_buffer:
     dependency: transitive
     description:
       name: analyzer_buffer
-      sha256: ff4bd291778c7417fe53fe24ee0d0a1f1ffe281a2d4ea887e7094f16e36eace7
-      url: "https://pub.dev"
-    source: hosted
-    version: "0.3.0"
-  analyzer_plugin:
-    dependency: transitive
-    description:
-      name: analyzer_plugin
-      sha256: "6645a029da947ffd823d98118f385d4bd26b54eb069c006b22e0b94e451814b5"
+      sha256: "445b77e2054fa3e8c8a8ef1b5e9e6b23bb8028fffd34b5e60eaef315b7750674"
       url: "https://pub.dev"
     source: hosted
-    version: "0.13.11"
+    version: "0.3.3"
   animations:
     dependency: "direct main"
     description:
@@ -53,10 +37,10 @@ packages:
     dependency: "direct main"
     description:
       name: app_links
-      sha256: "4ec328cd9fd51fd0e7eb8870a9612c1fde0f091901932238c4f4e60b5f7f1315"
+      sha256: f8db46d2ea9ff6f3a37191a7fd5b7813da1253ace8c32c1b9eadace41d1188ea
       url: "https://pub.dev"
     source: hosted
-    version: "7.1.2"
+    version: "7.2.1"
   app_links_linux:
     dependency: transitive
     description:
@@ -69,10 +53,10 @@ packages:
     dependency: transitive
     description:
       name: app_links_platform_interface
-      sha256: "78a18580eecac98108d1eef52a7db668bc317714f5205e616973363326efe333"
+      sha256: "7546f09a6e93f4a2df2fe2bd40a5c6c64310ac461b036d82b43033be7a59f809"
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.3"
+    version: "2.0.4"
   app_links_web:
     dependency: transitive
     description:
@@ -117,10 +101,10 @@ packages:
     dependency: transitive
     description:
       name: build
-      sha256: a156715e7cd728130c592f30552575908aae5b100005fbc1f0fb16b3c03a3d10
+      sha256: "45d14a0fb23e018d8287c32fc98d726ce466b231928ed9b9200f29bd3ccd39ae"
       url: "https://pub.dev"
     source: hosted
-    version: "4.0.6"
+    version: "4.0.7"
   build_cli_annotations:
     dependency: transitive
     description:
@@ -133,26 +117,26 @@ packages:
     dependency: transitive
     description:
       name: build_config
-      sha256: "4070d2a59f8eec34c97c86ceb44403834899075f66e8a9d59706f8e7834f6f71"
+      sha256: "94eaf6708fe64408c632ef2689ca3777b112f9421306ccf4f8c84d7c5c9f83f8"
       url: "https://pub.dev"
     source: hosted
-    version: "1.3.0"
+    version: "1.3.2"
   build_daemon:
     dependency: transitive
     description:
       name: build_daemon
-      sha256: bf05f6e12cfea92d3c09308d7bcdab1906cd8a179b023269eed00c071004b957
+      sha256: "8c0535c3b2f625619f4dd1036ef1127f2e77bfedf89ed2eb2676ef076e0b6712"
       url: "https://pub.dev"
     source: hosted
-    version: "4.1.1"
+    version: "4.1.3"
   build_runner:
     dependency: "direct dev"
     description:
       name: build_runner
-      sha256: "1523ce62448ebac2c15a8ba5fbad8acac169788658a7dd2a1c2d9c2a9318b9a6"
+      sha256: "5367e521935b102bdf1e735d2aab461e36b2edca6517662d088dd04cc39f8d16"
       url: "https://pub.dev"
     source: hosted
-    version: "2.15.0"
+    version: "2.15.1"
   built_collection:
     dependency: transitive
     description:
@@ -277,10 +261,10 @@ packages:
     dependency: transitive
     description:
       name: cross_file
-      sha256: "28bb3ae56f117b5aec029d702a90f57d285cd975c3c5c281eaca38dbc47c5937"
+      sha256: "92c9c43c383bfa1c32079d3bc492d55d6d4318044b7b47edaff8971cbb555c51"
       url: "https://pub.dev"
     source: hosted
-    version: "0.3.5+2"
+    version: "0.3.5+4"
   crypto:
     dependency: "direct main"
     description:
@@ -293,10 +277,10 @@ packages:
     dependency: transitive
     description:
       name: dart_style
-      sha256: a9c30492da18ff84efe2422ba2d319a89942d93e58eb0b73d32abe822ef54b7b
+      sha256: a4c1ccfee44c7e75ed80484071a5c142a385345e658fd8bd7c4b5c97e7198f98
       url: "https://pub.dev"
     source: hosted
-    version: "3.1.3"
+    version: "3.1.8"
   dbus:
     dependency: transitive
     description:
@@ -317,10 +301,10 @@ packages:
     dependency: "direct main"
     description:
       name: device_info_plus
-      sha256: "6a642e1daa10190af89ba6cb6386c0df7d071a3592080bfe1e44faa63ae1df65"
+      sha256: "0891702f96b2e465fe567b7ec448380e6b1c14f60af552a8536d9f583b6b8442"
       url: "https://pub.dev"
     source: hosted
-    version: "13.1.0"
+    version: "13.2.0"
   device_info_plus_platform_interface:
     dependency: transitive
     description:
@@ -333,42 +317,42 @@ packages:
     dependency: "direct main"
     description:
       name: dio
-      sha256: aff32c08f92787a557dd5c0145ac91536481831a01b4648136373cddb0e64f8c
+      sha256: "0df44ebba85e503958eb75d07eedd3c86275a58c1d3eda2f2ce8f0a2c3abbb3c"
       url: "https://pub.dev"
     source: hosted
-    version: "5.9.2"
+    version: "5.11.0"
   dio_web_adapter:
     dependency: transitive
     description:
       name: dio_web_adapter
-      sha256: "2f9e64323a7c3c7ef69567d5c800424a11f8337b8b228bad02524c9fb3c1f340"
+      sha256: "0786d0b7295a373de356fc0af4f6f1d0ab2844ed31b19dfc5e7556b70e24212c"
       url: "https://pub.dev"
     source: hosted
-    version: "2.1.2"
+    version: "2.2.1"
   drift:
     dependency: "direct main"
     description:
       name: drift
-      sha256: "970cd188fddb111b26ea6a9b07a62bf5c2432d74147b8122c67044ae3b97e99e"
+      sha256: "3a3f1f6f905037d7426e4c445854139fd6a3d592135f7c96d7931682b73d16f4"
       url: "https://pub.dev"
     source: hosted
-    version: "2.31.0"
+    version: "2.34.3"
   drift_dev:
     dependency: "direct dev"
     description:
       name: drift_dev
-      sha256: "917184b2fb867b70a548a83bf0d36268423b38d39968c06cce4905683da49587"
+      sha256: "9cfff1576b49725da0d32c040651a41ae195e8c4af8d8da301593e41d7abc2f7"
       url: "https://pub.dev"
     source: hosted
-    version: "2.31.0"
+    version: "2.34.0"
   drift_flutter:
     dependency: "direct main"
     description:
       name: drift_flutter
-      sha256: c07120854742a0cae2f7501a0da02493addde550db6641d284983c08762e60a7
+      sha256: "91acf4bee7c3c84467cba46455aa70e5292a3b889f4582645d74f2e5a8c106f2"
       url: "https://pub.dev"
     source: hosted
-    version: "0.2.8"
+    version: "0.3.1"
   dynamic_color:
     dependency: "direct main"
     description:
@@ -389,10 +373,10 @@ packages:
     dependency: transitive
     description:
       name: equatable
-      sha256: "3e0141505477fd8ad55d6eb4e7776d3fe8430be8e497ccb1521370c3f21a3e2b"
+      sha256: "3bce007a596ff8b3119c45d68aaef631272537c03d30e5d4534dd24bf4c5eaa2"
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.8"
+    version: "2.1.0"
   fake_async:
     dependency: transitive
     description:
@@ -482,10 +466,10 @@ packages:
     dependency: "direct main"
     description:
       name: flutter_cache_manager
-      sha256: "400b6592f16a4409a7f2bb929a9a7e38c72cceb8ffb99ee57bbf2cb2cecf8386"
+      sha256: "1de7849213b4c73c85aca7e0ac687a9a5d82ccdb594366b9dcc26cb6a2189cd2"
       url: "https://pub.dev"
     source: hosted
-    version: "3.4.1"
+    version: "3.4.2"
   flutter_js:
     dependency: "direct main"
     description:
@@ -519,10 +503,10 @@ packages:
     dependency: "direct main"
     description:
       name: flutter_riverpod
-      sha256: "4e166be88e1dbbaa34a280bdb744aeae73b7ef25fdf8db7a3bb776760a3648e2"
+      sha256: "9255e1e3ad6e38906a1b4f8287678f95f378744c5b46b1985588543f3f19046e"
       url: "https://pub.dev"
     source: hosted
-    version: "3.3.1"
+    version: "3.3.2"
   flutter_rust_bridge:
     dependency: transitive
     description:
@@ -561,10 +545,10 @@ packages:
     dependency: "direct dev"
     description:
       name: freezed
-      sha256: f23ea33b3863f119b58ed1b586e881a46bd28715ddcc4dbc33104524e3434131
+      sha256: "8599ba37236328ff6f97269ecce875d251a367eb2929c9bbf9b811b2ce56c74e"
       url: "https://pub.dev"
     source: hosted
-    version: "3.2.5"
+    version: "3.2.6-dev.1"
   freezed_annotation:
     dependency: "direct main"
     description:
@@ -681,10 +665,10 @@ packages:
     dependency: "direct main"
     description:
       name: image_picker
-      sha256: "91c025426c2881c551100bce834e201c835a170151545f58d17da5180ca7d9ac"
+      sha256: d8402284df184bc05f4a2210c6c23983b0720f4cd87cbd05c5390a78af602667
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.2"
+    version: "1.2.3"
   image_picker_android:
     dependency: transitive
     description:
@@ -753,10 +737,10 @@ packages:
     dependency: "direct dev"
     description:
       name: intl_utils
-      sha256: "07469a81dcb011ab3708ed4a324403f0f556f2e3663b769006f92c9e62a0066a"
+      sha256: d6bc24bad6fa8b76b6bdb5d44de561b7a8088f375852f305b60b72cb608b27ce
       url: "https://pub.dev"
     source: hosted
-    version: "2.8.14"
+    version: "2.8.15"
   io:
     dependency: transitive
     description:
@@ -785,34 +769,42 @@ packages:
     dependency: transitive
     description:
       name: jni
-      sha256: c2230682d5bc2362c1c9e8d3c7f406d9cbba23ab3f2e203a025dd47e0fb2e68f
+      sha256: f038e58b4dc2c9037f50e233175086337e0b305e356d28211bf55f21c504cbd3
       url: "https://pub.dev"
     source: hosted
-    version: "1.0.0"
+    version: "1.0.3"
   jni_flutter:
     dependency: transitive
     description:
       name: jni_flutter
-      sha256: "8b59e590786050b1cd866677dddaf76b1ade5e7bc751abe04b86e84d379d3ba6"
+      sha256: "7b717011ea40d04fd47c2731d3d1d36eb99eba3435c2753d62489e8c3c9991d5"
       url: "https://pub.dev"
     source: hosted
-    version: "1.0.1"
+    version: "1.0.2"
+  jni_util:
+    dependency: transitive
+    description:
+      name: jni_util
+      sha256: "1ba86da04a5f2bf18fde2edb235587e70c5b0fc5bd4ba955f46b00942c3fc35f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
   json_annotation:
     dependency: "direct main"
     description:
       name: json_annotation
-      sha256: cb09e7dac6210041fad964ed7fbee004f14258b4eca4040f72d1234062ace4c8
+      sha256: "2a743920d81b7910627f68ee2c9ac1fc0bfee32b9fc3403587d7c6791ca12f80"
       url: "https://pub.dev"
     source: hosted
-    version: "4.11.0"
+    version: "4.12.0"
   json_serializable:
     dependency: "direct dev"
     description:
       name: json_serializable
-      sha256: "44729f5c45748e6748f6b9a57ab8f7e4336edc8ae41fc295070e3814e616a6c0"
+      sha256: e45aefa0324f08c683caafbb94b72837aa6193c61822799c916e45f4a263113d
       url: "https://pub.dev"
     source: hosted
-    version: "6.13.0"
+    version: "6.14.1"
   launch_at_startup:
     dependency: "direct main"
     description:
@@ -906,10 +898,10 @@ packages:
     dependency: "direct main"
     description:
       name: mobile_scanner
-      sha256: c92c26bf2231695b6d3477c8dcf435f51e28f87b1745966b1fe4c47a286171ce
+      sha256: ce3f059ebd6dbfab7292bba0e893e354b46730636820d3c9ef69005ce2d55bce
       url: "https://pub.dev"
     source: hosted
-    version: "7.2.0"
+    version: "7.4.0"
   mockito:
     dependency: transitive
     description:
@@ -926,14 +918,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.5"
+  native_toolchain_c:
+    dependency: transitive
+    description:
+      name: native_toolchain_c
+      sha256: f9c168717100ae6d9fee9ffb0be379bf1f8b26b0f6bcbd4fdddcd931993a6a72
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.19.2"
   navigator_resizable:
     dependency: transitive
     description:
       name: navigator_resizable
-      sha256: d1f58a264b9995234561043904ec59623d4b69446a41548c311b03f1ed800dd5
+      sha256: "831350d4d44c6defbe06860944da1d9cbb4951ffe7cbc179cea7d049afa50622"
       url: "https://pub.dev"
     source: hosted
-    version: "3.0.2"
+    version: "3.0.3"
   nm:
     dependency: transitive
     description:
@@ -954,10 +954,10 @@ packages:
     dependency: transitive
     description:
       name: objective_c
-      sha256: "6cb691c686fa2838c6deb34980d426145c2a5d537491cb83d463c33cdbc726ed"
+      sha256: b7fb95a6d9a4f009edd63dc5ac69f07420b23a16161c6dd8660290b59c602e8e
       url: "https://pub.dev"
     source: hosted
-    version: "9.4.1"
+    version: "9.5.0"
   package_config:
     dependency: transitive
     description:
@@ -970,10 +970,10 @@ packages:
     dependency: "direct main"
     description:
       name: package_info_plus
-      sha256: "4bf625947f6c7713ee242296a682e23e44823c09cf9d79e4f1238923c92db852"
+      sha256: "127e1751e37ffb2ff4658beeaca77bad0c27bf5f932bd3a501c2296926d4b481"
       url: "https://pub.dev"
     source: hosted
-    version: "10.1.0"
+    version: "10.2.1"
   package_info_plus_platform_interface:
     dependency: transitive
     description:
@@ -1026,10 +1026,10 @@ packages:
     dependency: transitive
     description:
       name: path_provider_linux
-      sha256: f7a1fe3a634fe7734c8d3f2766ad746ae2a2884abe22e241a8b301bf5cac3279
+      sha256: "58c2005f147315b11e9b4a7bc889cd5203e250cba8e3f012dae259b4972b5c16"
       url: "https://pub.dev"
     source: hosted
-    version: "2.2.1"
+    version: "2.2.2"
   path_provider_platform_interface:
     dependency: transitive
     description:
@@ -1082,10 +1082,10 @@ packages:
     dependency: transitive
     description:
       name: posix
-      sha256: "185ef7606574f789b40f289c233efa52e96dead518aed988e040a10737febb07"
+      sha256: bc1bad54ad2b735816e31f8d4600cfde6c7839975085ddfbca48b6c9f7c4044e
       url: "https://pub.dev"
     source: hosted
-    version: "6.5.0"
+    version: "6.5.2"
   proxy:
     dependency: "direct main"
     description:
@@ -1113,10 +1113,10 @@ packages:
     dependency: "direct main"
     description:
       name: re_editor
-      sha256: "73e5daf7041b382c07ed707d5efd2d0a53851bb9eb6d6987260229ae0ed2f458"
+      sha256: "66671c4774a6b4c5254c9a53ab35a083e7e7da9ae371c519bcf491c70a2a4e56"
       url: "https://pub.dev"
     source: hosted
-    version: "0.9.0"
+    version: "0.10.0"
   re_highlight:
     dependency: "direct main"
     description:
@@ -1153,42 +1153,34 @@ packages:
     dependency: "direct main"
     description:
       name: riverpod
-      sha256: "8c22216be8ad3ef2b44af3a329693558c98eca7b8bd4ef495c92db0bba279f83"
+      sha256: "17100416c51db7810c71a7bb2c34d1f881faa0074fd452afb0c4db6f8f126c76"
       url: "https://pub.dev"
     source: hosted
-    version: "3.2.1"
+    version: "3.3.2"
   riverpod_analyzer_utils:
     dependency: transitive
     description:
       name: riverpod_analyzer_utils
-      sha256: e55bc08c084a424e1bbdc303fe8ea75daafe4269b68fd0e0f6f1678413715b66
+      sha256: "3e275138862ccc22ed61444a1f9a840f753094c367f28f4123f50289cd204d68"
       url: "https://pub.dev"
     source: hosted
-    version: "1.0.0-dev.9"
+    version: "1.0.0-dev.10"
   riverpod_annotation:
     dependency: "direct main"
     description:
       name: riverpod_annotation
-      sha256: "16471a1260b94e939394d78f1c63a9350936ac4a68c9fbdab40be47268c0b04f"
+      sha256: "674dbb26e2db3d9253166faf4758c796af14146b8fbcf5e7102bc8a04cd359b8"
       url: "https://pub.dev"
     source: hosted
-    version: "4.0.2"
+    version: "4.0.3"
   riverpod_generator:
     dependency: "direct dev"
     description:
       name: riverpod_generator
-      sha256: "6f9220534d7a353b53c875ea191a84d28cb4e52ac420a66a1bd7318329d977b0"
+      sha256: "54d790c3fee1ae281c448801bfdbfaa9fd961a9d3998494e0fcd9ee32184d7eb"
       url: "https://pub.dev"
     source: hosted
-    version: "4.0.3"
-  riverpod_lint:
-    dependency: "direct dev"
-    description:
-      name: riverpod_lint
-      sha256: "64e8debf5b719a37d48b9785dd595d34133fdcd84b8fd07157a621c54ab2156f"
-      url: "https://pub.dev"
-    source: hosted
-    version: "3.1.3"
+    version: "4.0.4"
   rust_api:
     dependency: "direct main"
     description:
@@ -1208,42 +1200,42 @@ packages:
     dependency: "direct main"
     description:
       name: screen_retriever
-      sha256: "42cc3b402a0f67d2455a0d067553d0f13453f6a008d98eababf8b63958d506bd"
+      sha256: ace919117a7520c13a50a6259e60c4a0d4cbe98809468792a91b5c5adada2aa6
       url: "https://pub.dev"
     source: hosted
-    version: "0.2.1"
+    version: "0.2.2"
   screen_retriever_linux:
     dependency: transitive
     description:
       name: screen_retriever_linux
-      sha256: "2a476f1a5538065bc5badf376cfdc83d6ecf07d77eb2391b9c2bff5a76970048"
+      sha256: "7b52006a5ceae1f3d5af7f77188c3290d6e7d8ded16d99809bea84967c65c257"
       url: "https://pub.dev"
     source: hosted
-    version: "0.2.1"
+    version: "0.2.2"
   screen_retriever_macos:
     dependency: transitive
     description:
       name: screen_retriever_macos
-      sha256: b5abb900fcb86614ff10b738b34e37b9e1d03b0447280668e2bc8a98bdc7bd59
+      sha256: a1489b99cce597c45a54b9aae1cd94c8d4705353b7e0bb2457a6e4de44e0ad8a
       url: "https://pub.dev"
     source: hosted
-    version: "0.2.1"
+    version: "0.2.2"
   screen_retriever_platform_interface:
     dependency: transitive
     description:
       name: screen_retriever_platform_interface
-      sha256: "3af22d926bedf20c2caa308eea376776451a3af125919ce072e56525fded8901"
+      sha256: "94a5535277510a63184ca178ce12a1449bc0b38618879aa1c18bf57369c5064a"
       url: "https://pub.dev"
     source: hosted
-    version: "0.2.1"
+    version: "0.2.2"
   screen_retriever_windows:
     dependency: transitive
     description:
       name: screen_retriever_windows
-      sha256: c44b38a4c4bab34af259180a70a4eee1e29384e7b82e627c9faa68afcdab2e73
+      sha256: dafc6922b0bfbf1d48cf3ccbf519b4fff47bdcb820da1728ea6db675fecc9324
       url: "https://pub.dev"
     source: hosted
-    version: "0.2.1"
+    version: "0.2.2"
   setup:
     dependency: "direct main"
     description:
@@ -1263,10 +1255,10 @@ packages:
     dependency: transitive
     description:
       name: shared_preferences_android
-      sha256: "93ae5884a9df5d3bb696825bceb3a17590754548b5d740eba51500afc8d088f5"
+      sha256: "0634e64bd719f89c012f392938e173521f535d3ecaf66558fa94a056d22b5cc7"
       url: "https://pub.dev"
     source: hosted
-    version: "2.4.26"
+    version: "2.4.27"
   shared_preferences_foundation:
     dependency: transitive
     description:
@@ -1356,26 +1348,26 @@ packages:
     dependency: "direct main"
     description:
       name: smooth_sheets
-      sha256: "7c9ad593964802f59a2d5b0ca5e3bc03fa8d429b2d76c82bb3cce90f0a2e0079"
+      sha256: "325a8f6ae6dc2a86edbcc1f9f07a4ebaf4ef09db8d050e77c53e7b67c699dff9"
       url: "https://pub.dev"
     source: hosted
-    version: "1.0.2"
+    version: "1.0.3"
   source_gen:
     dependency: transitive
     description:
       name: source_gen
-      sha256: ec37cc0e6694374cbef59ed79685572c870a54ede6fa30a3e420feb3adffea02
+      sha256: a603f1fb984a7391ae5978d1b92bfaaa08b350dca5c825256f925818f7943bf5
       url: "https://pub.dev"
     source: hosted
-    version: "4.2.3"
+    version: "4.2.4"
   source_helper:
     dependency: transitive
     description:
       name: source_helper
-      sha256: "4227d54ceefd0bb8ca4c8fcb96e1719dc53f1ee1b6e2ca9d7a6069da160e4eae"
+      sha256: "5e6f216fdf6376c9f3852381ae037499797a3385377d388b011dac98d303c67c"
       url: "https://pub.dev"
     source: hosted
-    version: "1.3.12"
+    version: "1.3.13"
   source_map_stack_trace:
     dependency: transitive
     description:
@@ -1428,10 +1420,10 @@ packages:
     dependency: transitive
     description:
       name: sqflite_darwin
-      sha256: "164a5d73ab87a134566057219988bafde837029a64264e61f1f04376ef3cfcd2"
+      sha256: c86ca18b8f666bbf903924687fe21cc16fc385d086005067e26619ca530bef9f
       url: "https://pub.dev"
     source: hosted
-    version: "2.4.3"
+    version: "2.4.3+1"
   sqflite_platform_interface:
     dependency: transitive
     description:
@@ -1440,30 +1432,38 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.4.1"
+  sqlcipher_flutter_libs:
+    dependency: transitive
+    description:
+      name: sqlcipher_flutter_libs
+      sha256: "38d62d659d2fb8739bf25a42c9a350d1fdd6c29a5a61f13a946778ec75d27929"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.0+eol"
   sqlite3:
     dependency: transitive
     description:
       name: sqlite3
-      sha256: "3145bd74dcdb4fd6f5c6dda4d4e4490a8087d7f286a14dee5d37087290f0f8a2"
+      sha256: c73fd75df1332d76a6257f4823ae4df9c791f522b97e4a60cbcad214de1becf4
       url: "https://pub.dev"
     source: hosted
-    version: "2.9.4"
+    version: "3.5.0"
   sqlite3_flutter_libs:
     dependency: transitive
     description:
       name: sqlite3_flutter_libs
-      sha256: eeb9e3a45207649076b808f8a5a74d68770d0b7f26ccef6d5f43106eee5375ad
+      sha256: "3ed7553eee7bb368f8950f58ba29f634e06e813c029aff6a0d60862b96de8454"
       url: "https://pub.dev"
     source: hosted
-    version: "0.5.42"
+    version: "0.6.0+eol"
   sqlparser:
     dependency: transitive
     description:
       name: sqlparser
-      sha256: "337e9997f7141ffdd054259128553c348635fa318f7ca492f07a4ab76f850d19"
+      sha256: "40bdddb306a727be9ce510bd2d2b9a6c9db6c586d846ef7b22e3990a2b24f02d"
       url: "https://pub.dev"
     source: hosted
-    version: "0.43.1"
+    version: "0.44.5"
   stack_trace:
     dependency: transitive
     description:
@@ -1524,10 +1524,10 @@ packages:
     dependency: transitive
     description:
       name: synchronized
-      sha256: "93b153dcb6a26dcddee6ca087dd634b53e38c10b5aa163e8e49501a776456153"
+      sha256: "61894a1956de6b4fc1aefd0892e109514a1a706cbece3ac59decd90ff5a7a423"
       url: "https://pub.dev"
     source: hosted
-    version: "3.4.1"
+    version: "3.4.1+1"
   term_glyph:
     dependency: transitive
     description:
@@ -1653,18 +1653,18 @@ packages:
     dependency: transitive
     description:
       name: uuid
-      sha256: "1fef9e8e11e2991bb773070d4656b7bd5d850967a2456cfc83cf47925ba79489"
+      sha256: "9b129329f58692f6e6578329498a8fe9fbe98f090beb764ffbb8ee2eadd01dcd"
       url: "https://pub.dev"
     source: hosted
-    version: "4.5.3"
+    version: "4.6.0"
   vector_graphics:
     dependency: transitive
     description:
       name: vector_graphics
-      sha256: "2306c03da2ba81724afeb589c351ebbc0aa7d86005925be8f8735856dbe5e42d"
+      sha256: "9d0e3b9cb16542ad660daee871e726a10d13a93b7b5391677c3160e8f5e83935"
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.2"
+    version: "1.2.3"
   vector_graphics_codec:
     dependency: transitive
     description:
@@ -1677,10 +1677,10 @@ packages:
     dependency: transitive
     description:
       name: vector_graphics_compiler
-      sha256: "142a9146f447d15b10bdc00e21d5f4d83e5b32bb5f8f8f5a04c75311344923a3"
+      sha256: "4dca4feb77dc3ec7f6e27e49c53241eb8217f55e4f9b12599a27f8903bca5682"
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.6"
+    version: "1.3.0"
   vector_math:
     dependency: transitive
     description:
@@ -1801,21 +1801,13 @@ packages:
     source: hosted
     version: "6.6.1"
   yaml:
-    dependency: transitive
+    dependency: "direct dev"
     description:
       name: yaml
       sha256: b9da305ac7c39faa3f030eccd175340f968459dae4af175130b3fc47e40d76ce
       url: "https://pub.dev"
     source: hosted
     version: "3.1.3"
-  yaml_edit:
-    dependency: transitive
-    description:
-      name: yaml_edit
-      sha256: "07c9e63ba42519745182b88ca12264a7ba2484d8239958778dfe4d44fe760488"
-      url: "https://pub.dev"
-    source: hosted
-    version: "2.2.4"
   yaml_writer:
     dependency: "direct main"
     description:
diff --git a/pubspec.yaml b/pubspec.yaml
index 1e5d8f8074..9c4275e422 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -1,7 +1,7 @@
 name: fl_clash
 description: A multi-platform proxy client based on ClashMeta, simple and easy to use, open-source and ad-free.
 publish_to: 'none'
-version: 0.8.94+2026071102
+version: 0.8.95+2026080101
 environment:
   sdk: '>=3.8.0 <4.0.0'
 
@@ -28,9 +28,9 @@ dependencies:
     git:
       url: https://github.com/chen08209/launch_at_startup.git
       ref: main
-  json_annotation: ^4.11.0
+  json_annotation: ^4.12.0
   file_picker: ^12.0.0-beta.7
-  mobile_scanner: ^7.2.0
+  mobile_scanner: ^7.4.0
   app_links: ^7.1.2
   win32_registry: ^3.0.3
   tray_manager:
@@ -42,7 +42,7 @@ dependencies:
     path: plugins/wifi_ssid
   collection: ^1.19.1
   animations: ^2.1.1
-  package_info_plus: ^10.1.0
+  package_info_plus: ^10.2.1
   url_launcher: ^6.3.2
   freezed_annotation: ^3.1.0
   image_picker: ^1.2.0
@@ -51,19 +51,19 @@ dependencies:
   webdav_client: ^1.2.2
   dio: ^5.8.0+1
   win32: ^6.0.1
-  re_editor: ^0.9.0
+  re_editor: ^0.10.0
   re_highlight: ^0.0.3
   archive: ^4.0.7
   emoji_regex: ^0.0.5
   hotkey_manager: ^0.2.3
   uni_platform: ^0.1.3
-  device_info_plus: ^13.1.0
-  connectivity_plus: ^7.2.0
+  device_info_plus: ^13.2.0
+  connectivity_plus: 7.2.0
   screen_retriever: ^0.2.1
   defer_pointer: ^0.0.2
-  flutter_riverpod: ^3.3.1
-  riverpod_annotation: ^4.0.2
-  riverpod: ^3.2.1
+  flutter_riverpod: ^3.3.2
+  riverpod_annotation: ^4.0.3
+  riverpod: ^3.3.2
   material_color_utilities: ^0.13.0
   flutter_js: ^0.8.7
   flutter_svg: ^2.1.0
@@ -74,8 +74,8 @@ dependencies:
       url: https://github.com/chen08209/yaml_writer
       ref: master
   super_sliver_list: ^0.4.1
-  drift: ^2.31.0
-  drift_flutter: ^0.2.8
+  drift: ^2.34.3
+  drift_flutter: ^0.3.1
   fractional_indexing: ^1.0.0
   reorderable_grid: ^1.0.13
   smooth_sheets: ^1.0.2
@@ -87,17 +87,17 @@ dev_dependencies:
   flutter_test:
     sdk: flutter
   flutter_lints: ^6.0.0
-  json_serializable: ^6.8.0
-  build_runner: ^2.14.1
+  json_serializable: ^6.14.1
+  build_runner: ^2.15.1
   args: ^2.4.2
-  freezed: ^3.2.5
-  riverpod_generator: ^4.0.3
-  riverpod_lint: ^3.1.3
+  freezed: 3.2.6-dev.1
+  riverpod_generator: ^4.0.4
 
-  drift_dev: ^2.31.0
-  intl_utils: ^2.8.14
-  test: ^1.30.0
+  drift_dev: ^2.34.0
+  intl_utils: ^2.8.15
+  test: ^1.31.0
   mocktail: ^1.0.4
+  yaml: ^3.1.3
 
 flutter:
   uses-material-design: true
diff --git a/services/helper/Cargo.lock b/services/helper/Cargo.lock
index b9a53d0fd6..6dc934fbe3 100644
--- a/services/helper/Cargo.lock
+++ b/services/helper/Cargo.lock
@@ -284,10 +284,12 @@ dependencies = [
  "anyhow",
  "once_cell",
  "serde",
+ "serde_json",
  "sha2",
  "tokio",
  "warp",
  "windows-service",
+ "windows-sys",
 ]
 
 [[package]]
diff --git a/services/helper/Cargo.toml b/services/helper/Cargo.toml
index 668f1ae4f9..7d9561a2da 100644
--- a/services/helper/Cargo.toml
+++ b/services/helper/Cargo.toml
@@ -13,9 +13,12 @@ tokio = { version = "1", features = ["full"] }
 anyhow = "1.0.93"
 warp = "0.3.7"
 serde = { version = "1.0.215", features = ["derive"] }
+serde_json = "1.0"
 once_cell = "1.20.2"
 sha2 = "0.10.8"
 
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.52.0", features = ["Win32_Storage_FileSystem"] }
 
 [profile.release]
 panic = "abort"
diff --git a/services/helper/build.rs b/services/helper/build.rs
index a4ce261548..920c87e32c 100644
--- a/services/helper/build.rs
+++ b/services/helper/build.rs
@@ -1,5 +1,8 @@
 fn main() {
-    let version = std::env::var("TOKEN").unwrap_or_default();
-    println!("cargo:rustc-env=TOKEN={}", version);
-    println!("cargo:rerun-if-env-changed=TOKEN");
+    let core_sha256 = std::env::var("CORE_SHA256").unwrap_or_default();
+    let core_name = std::env::var("CORE_NAME").unwrap_or_else(|_| "FlClashCore.exe".to_string());
+    println!("cargo:rustc-env=CORE_SHA256={}", core_sha256);
+    println!("cargo:rustc-env=CORE_NAME={}", core_name);
+    println!("cargo:rerun-if-env-changed=CORE_SHA256");
+    println!("cargo:rerun-if-env-changed=CORE_NAME");
 }
diff --git a/services/helper/src/main.rs b/services/helper/src/main.rs
index 90f0072279..ddcc9f5913 100644
--- a/services/helper/src/main.rs
+++ b/services/helper/src/main.rs
@@ -1,12 +1,12 @@
 #[cfg(not(all(feature = "windows-service", target_os = "windows")))]
-use tokio::runtime::Runtime;
-#[cfg(not(all(feature = "windows-service", target_os = "windows")))]
 use crate::service::hub::run_service;
+#[cfg(not(all(feature = "windows-service", target_os = "windows")))]
+use tokio::runtime::Runtime;
 
 mod service;
 
 #[cfg(all(feature = "windows-service", target_os = "windows"))]
-pub fn main() -> windows_service::Result<()> {
+pub fn main() -> anyhow::Result<()> {
     service::windows::main()
 }
 
diff --git a/services/helper/src/service/hub.rs b/services/helper/src/service/hub.rs
index 58a5da03dc..bd12c29f01 100644
--- a/services/helper/src/service/hub.rs
+++ b/services/helper/src/service/hub.rs
@@ -2,23 +2,95 @@ use once_cell::sync::Lazy;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::VecDeque;
-use std::fs::File;
+use std::convert::Infallible;
+use std::fs::{File, OpenOptions};
+#[cfg(not(all(feature = "windows-service", target_os = "windows")))]
+use std::future::pending;
+use std::future::Future;
 use std::io::{BufRead, Error, Read};
+#[cfg(windows)]
+use std::os::windows::fs::OpenOptionsExt;
+use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use std::sync::{Arc, Mutex};
 use std::{io, thread};
-use warp::{Filter, Reply};
+use warp::http::StatusCode;
+use warp::{Filter, Rejection, Reply};
+#[cfg(windows)]
+use windows_sys::Win32::Storage::FileSystem::FILE_SHARE_READ;
 
 const LISTEN_PORT: u16 = 47890;
+const CORE_PIPE_PREFIX: &str = r"\\.\pipe\FlClashCore_";
+const PROTOCOL_VERSION_HEADER: &str = "x-flclash-helper-protocol";
+const PROTOCOL_VERSION: &str = "5";
+const EXPECTED_CORE_SHA256: &str = env!("CORE_SHA256");
 
 #[derive(Debug, Deserialize, Serialize, Clone)]
+#[serde(deny_unknown_fields)]
 pub struct StartParams {
-    pub path: String,
-    pub arg: String,
+    pub address: String,
+    #[serde(rename = "sessionId")]
+    pub session_id: String,
 }
 
-fn sha256_file(path: &str) -> Result<String, Error> {
-    let mut file = File::open(path)?;
+#[derive(Debug, Deserialize, Serialize, Clone)]
+#[serde(deny_unknown_fields)]
+pub struct StopParams {
+    #[serde(rename = "sessionId")]
+    pub session_id: String,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct StartResponse {
+    session_id: String,
+    pid: u32,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct StopResponse {
+    session_id: String,
+    stopped: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    reason: Option<&'static str>,
+}
+
+#[derive(Serialize)]
+struct ErrorResponse {
+    code: &'static str,
+    message: String,
+}
+
+struct ManagedCore {
+    session_id: String,
+    child: std::process::Child,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum StopDecision {
+    NotRunning,
+    Stop,
+    SessionMismatch,
+}
+
+fn core_path() -> Result<PathBuf, Error> {
+    let helper_path = std::env::current_exe()?;
+    let directory = helper_path
+        .parent()
+        .ok_or_else(|| Error::other("helper executable has no parent directory"))?;
+    Ok(directory.join(env!("CORE_NAME")))
+}
+
+fn open_core(path: &Path) -> Result<File, Error> {
+    let mut options = OpenOptions::new();
+    options.read(true);
+    #[cfg(windows)]
+    options.share_mode(FILE_SHARE_READ);
+    options.open(path)
+}
+
+fn sha256_file(file: &mut File) -> Result<String, Error> {
     let mut hasher = Sha256::new();
     let mut buffer = [0; 4096];
 
@@ -33,29 +105,107 @@ fn sha256_file(path: &str) -> Result<String, Error> {
     Ok(format!("{:x}", hasher.finalize()))
 }
 
+fn open_verified_core(path: &Path, expected_sha256: &str) -> Result<File, Error> {
+    if expected_sha256.is_empty() {
+        return Err(Error::other("expected Core SHA256 is empty"));
+    }
+    let mut core_file = open_core(path)?;
+    if sha256_file(&mut core_file)? != expected_sha256 {
+        return Err(Error::other("Core executable SHA256 mismatch"));
+    }
+    Ok(core_file)
+}
+
+fn open_fixed_verified_core() -> Result<(PathBuf, File), Error> {
+    let path = core_path()?;
+    let file = open_verified_core(&path, EXPECTED_CORE_SHA256)?;
+    Ok((path, file))
+}
+
+fn is_allowed_core_pipe(address: &str) -> bool {
+    let Some(suffix) = address.strip_prefix(CORE_PIPE_PREFIX) else {
+        return false;
+    };
+    is_valid_session_id(suffix)
+}
+
+fn is_valid_session_id(value: &str) -> bool {
+    value.len() == 32
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+fn stop_decision(current: Option<&str>, requested: &str) -> StopDecision {
+    match current {
+        None => StopDecision::NotRunning,
+        Some(session_id) if session_id == requested => StopDecision::Stop,
+        Some(_) => StopDecision::SessionMismatch,
+    }
+}
+
 static LOGS: Lazy<Arc<Mutex<VecDeque<String>>>> =
     Lazy::new(|| Arc::new(Mutex::new(VecDeque::with_capacity(100))));
-static PROCESS: Lazy<Arc<Mutex<Option<std::process::Child>>>> =
-    Lazy::new(|| Arc::new(Mutex::new(None)));
-
-fn start(start_params: StartParams) -> impl Reply {
-    if !cfg!(debug_assertions) {
-        let sha256 = sha256_file(start_params.path.as_str()).unwrap_or("".to_string());
-        if sha256 != env!("TOKEN") {
-            return format!("The SHA256 hash of the program requesting execution is: {}. The helper program only allows execution of applications with the SHA256 hash: {}.", sha256,  env!("TOKEN"),);
-        }
+static PROCESS: Lazy<Arc<Mutex<Option<ManagedCore>>>> = Lazy::new(|| Arc::new(Mutex::new(None)));
+static PROCESS_OPERATION: Lazy<Mutex<()>> = Lazy::new(|| Mutex::new(()));
+
+fn json_response<T: Serialize>(value: &T, status: StatusCode) -> warp::reply::Response {
+    warp::reply::with_status(warp::reply::json(value), status).into_response()
+}
+
+fn error_response(
+    code: &'static str,
+    message: impl Into<String>,
+    status: StatusCode,
+) -> warp::reply::Response {
+    json_response(
+        &ErrorResponse {
+            code,
+            message: message.into(),
+        },
+        status,
+    )
+}
+
+fn start(start_params: StartParams) -> warp::reply::Response {
+    if !is_allowed_core_pipe(&start_params.address) {
+        return error_response(
+            "invalidRequest",
+            "invalid Core pipe address",
+            StatusCode::BAD_REQUEST,
+        );
+    }
+    if !is_valid_session_id(&start_params.session_id) {
+        return error_response(
+            "invalidRequest",
+            "invalid Core session ID",
+            StatusCode::BAD_REQUEST,
+        );
     }
-    stop();
+
+    let _operation = PROCESS_OPERATION.lock().unwrap();
+    let (core_path, _core_file) = match open_fixed_verified_core() {
+        Ok(core) => core,
+        Err(error) => {
+            return error_response(
+                "coreVerificationFailed",
+                error.to_string(),
+                StatusCode::CONFLICT,
+            )
+        }
+    };
+
+    stop_core_locked();
     let mut process = PROCESS.lock().unwrap();
-    match Command::new(&start_params.path)
+    match Command::new(&core_path)
+        .current_dir(core_path.parent().unwrap())
         .stderr(Stdio::piped())
-        .arg(&start_params.arg)
+        .arg(&start_params.address)
         .spawn()
     {
-        Ok(child) => {
-            *process = Some(child);
-            if let Some(ref mut child) = *process {
-                let stderr = child.stderr.take().unwrap();
+        Ok(mut child) => {
+            let process_id = child.id();
+            if let Some(stderr) = child.stderr.take() {
                 let reader = io::BufReader::new(stderr);
                 thread::spawn(move || {
                     for line in reader.lines() {
@@ -70,23 +220,88 @@ fn start(start_params: StartParams) -> impl Reply {
                     }
                 });
             }
-            "".to_string()
+            *process = Some(ManagedCore {
+                session_id: start_params.session_id.clone(),
+                child,
+            });
+            json_response(
+                &StartResponse {
+                    session_id: start_params.session_id,
+                    pid: process_id,
+                },
+                StatusCode::OK,
+            )
         }
         Err(e) => {
             log_message(e.to_string());
-            e.to_string()
+            error_response(
+                "processLaunchFailed",
+                e.to_string(),
+                StatusCode::INTERNAL_SERVER_ERROR,
+            )
         }
     }
 }
 
-fn stop() -> impl Reply {
+fn stop_core(stop_params: StopParams) -> warp::reply::Response {
+    if !is_valid_session_id(&stop_params.session_id) {
+        return error_response(
+            "invalidRequest",
+            "invalid Core session ID",
+            StatusCode::BAD_REQUEST,
+        );
+    }
+    let _operation = PROCESS_OPERATION.lock().unwrap();
     let mut process = PROCESS.lock().unwrap();
-    if let Some(mut child) = process.take() {
-        let _ = child.kill();
-        let _ = child.wait();
+    match stop_decision(
+        process.as_ref().map(|managed| managed.session_id.as_str()),
+        &stop_params.session_id,
+    ) {
+        StopDecision::NotRunning => json_response(
+            &StopResponse {
+                session_id: stop_params.session_id,
+                stopped: false,
+                reason: Some("notRunning"),
+            },
+            StatusCode::OK,
+        ),
+        StopDecision::SessionMismatch => json_response(
+            &StopResponse {
+                session_id: stop_params.session_id,
+                stopped: false,
+                reason: Some("sessionMismatch"),
+            },
+            StatusCode::CONFLICT,
+        ),
+        StopDecision::Stop => {
+            if let Some(mut managed) = process.take() {
+                let _ = managed.child.kill();
+                let _ = managed.child.wait();
+            }
+            json_response(
+                &StopResponse {
+                    session_id: stop_params.session_id,
+                    stopped: true,
+                    reason: None,
+                },
+                StatusCode::OK,
+            )
+        }
+    }
+}
+
+fn stop_core_unconditional() {
+    let _operation = PROCESS_OPERATION.lock().unwrap();
+    stop_core_locked();
+}
+
+fn stop_core_locked() {
+    let mut process = PROCESS.lock().unwrap();
+    if let Some(mut managed) = process.take() {
+        let _ = managed.child.kill();
+        let _ = managed.child.wait();
     }
     *process = None;
-    "".to_string()
 }
 
 fn log_message(message: String) {
@@ -104,24 +319,370 @@ fn get_logs() -> impl Reply {
         .cloned()
         .collect::<Vec<String>>()
         .join("\n");
-    warp::reply::with_header(value, "Content-Type", "text/plain")
+    warp::reply::with_header(
+        warp::reply::with_header(value, "Content-Type", "text/plain; charset=utf-8"),
+        "Cache-Control",
+        "no-store",
+    )
 }
 
-pub async fn run_service() -> anyhow::Result<()> {
-    let api_ping = warp::get().and(warp::path("ping")).map(|| env!("TOKEN"));
+fn ping_response(result: Result<PathBuf, Error>) -> warp::reply::Response {
+    let (value, status) = match result {
+        Ok(path) => (path.to_string_lossy().into_owned(), StatusCode::OK),
+        Err(error) => (error.to_string(), StatusCode::CONFLICT),
+    };
+    warp::reply::with_header(
+        warp::reply::with_status(value, status),
+        PROTOCOL_VERSION_HEADER,
+        PROTOCOL_VERSION,
+    )
+    .into_response()
+}
+
+fn ping() -> warp::reply::Response {
+    let result = open_fixed_verified_core().and_then(|_| std::env::current_exe());
+    if let Err(error) = &result {
+        log_message(format!("Helper ping failed: {error}"));
+    }
+    ping_response(result)
+}
+
+async fn start_request(start_params: StartParams) -> Result<warp::reply::Response, Infallible> {
+    Ok(
+        match tokio::task::spawn_blocking(move || start(start_params)).await {
+            Ok(response) => response,
+            Err(error) => error_response(
+                "internalError",
+                format!("Core start task failed: {error}"),
+                StatusCode::INTERNAL_SERVER_ERROR,
+            ),
+        },
+    )
+}
+
+async fn stop_request(stop_params: StopParams) -> Result<warp::reply::Response, Infallible> {
+    Ok(
+        match tokio::task::spawn_blocking(move || stop_core(stop_params)).await {
+            Ok(response) => response,
+            Err(error) => error_response(
+                "internalError",
+                format!("Core stop task failed: {error}"),
+                StatusCode::INTERNAL_SERVER_ERROR,
+            ),
+        },
+    )
+}
+
+async fn ping_request() -> Result<warp::reply::Response, Infallible> {
+    Ok(tokio::task::spawn_blocking(ping)
+        .await
+        .unwrap_or_else(|error| {
+            ping_response(Err(Error::other(format!(
+                "Helper ping task failed: {error}"
+            ))))
+        }))
+}
+
+async fn handle_rejection(rejection: Rejection) -> Result<warp::reply::Response, Infallible> {
+    if rejection
+        .find::<warp::filters::body::BodyDeserializeError>()
+        .is_some()
+    {
+        return Ok(error_response(
+            "invalidRequest",
+            "invalid JSON request body",
+            StatusCode::BAD_REQUEST,
+        ));
+    }
+    if rejection.is_not_found() {
+        return Ok(error_response(
+            "notFound",
+            "Helper endpoint not found",
+            StatusCode::NOT_FOUND,
+        ));
+    }
+    Ok(error_response(
+        "internalError",
+        "unhandled Helper request rejection",
+        StatusCode::INTERNAL_SERVER_ERROR,
+    ))
+}
+
+fn routes() -> impl Filter<Extract = (impl Reply,), Error = Infallible> + Clone {
+    let api_ping = warp::get()
+        .and(warp::path("ping"))
+        .and(warp::path::end())
+        .and_then(ping_request);
 
     let api_start = warp::post()
         .and(warp::path("start"))
+        .and(warp::path::end())
         .and(warp::body::json())
-        .map(|start_params: StartParams| start(start_params));
+        .and_then(start_request);
 
-    let api_stop = warp::post().and(warp::path("stop")).map(|| stop());
+    let api_stop = warp::post()
+        .and(warp::path("stop"))
+        .and(warp::path::end())
+        .and(warp::body::json())
+        .and_then(stop_request);
+
+    let api_logs = warp::get()
+        .and(warp::path("logs"))
+        .and(warp::path::end())
+        .map(get_logs);
 
-    let api_logs = warp::get().and(warp::path("logs")).map(|| get_logs());
+    api_ping
+        .or(api_start)
+        .or(api_stop)
+        .or(api_logs)
+        .recover(handle_rejection)
+}
 
-    warp::serve(api_ping.or(api_start).or(api_stop).or(api_logs))
-        .run(([127, 0, 0, 1], LISTEN_PORT))
-        .await;
+#[cfg(not(all(feature = "windows-service", target_os = "windows")))]
+pub async fn run_service() -> anyhow::Result<()> {
+    run_service_until(pending(), || Ok(())).await
+}
+
+pub(super) async fn run_service_until<F, S>(shutdown: F, on_started: S) -> anyhow::Result<()>
+where
+    F: Future<Output = ()> + Send + 'static,
+    S: FnOnce() -> anyhow::Result<()>,
+{
+    if EXPECTED_CORE_SHA256.is_empty() {
+        anyhow::bail!("expected Core SHA256 is empty");
+    }
+
+    let (_, server) = warp::serve(routes())
+        .try_bind_with_graceful_shutdown(([127, 0, 0, 1], LISTEN_PORT), shutdown)
+        .map_err(|error| anyhow::anyhow!("bind helper server: {error}"))?;
+    on_started()?;
+    server.await;
+    stop_core_unconditional();
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    #[test]
+    fn protocol_5_uses_lowercase_session_ownership() {
+        assert_eq!(PROTOCOL_VERSION, "5");
+        assert!(is_valid_session_id("0123456789abcdef0123456789abcdef"));
+        assert!(!is_valid_session_id("ABCDEF0123456789abcdef0123456789"));
+        assert!(!is_valid_session_id("0123456789abcdef"));
+    }
+
+    #[test]
+    fn stop_decision_never_touches_another_session() {
+        let requested = "0123456789abcdef0123456789abcdef";
+        let other = "fedcba9876543210fedcba9876543210";
+
+        assert_eq!(stop_decision(None, requested), StopDecision::NotRunning);
+        assert_eq!(
+            stop_decision(Some(requested), requested),
+            StopDecision::Stop
+        );
+        assert_eq!(
+            stop_decision(Some(other), requested),
+            StopDecision::SessionMismatch
+        );
+    }
+
+    #[tokio::test]
+    async fn ping_returns_running_helper_path_for_verified_core() {
+        let response = ping_response(Ok(PathBuf::from("FlClashHelperService.exe")));
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            response.headers().get(PROTOCOL_VERSION_HEADER).unwrap(),
+            PROTOCOL_VERSION
+        );
+        assert_eq!(
+            warp::hyper::body::to_bytes(response.into_body())
+                .await
+                .unwrap(),
+            "FlClashHelperService.exe"
+        );
+    }
+
+    #[tokio::test]
+    async fn ping_rejects_unverified_core() {
+        let response = ping_response(Err(Error::other("Core executable SHA256 mismatch")));
+
+        assert_eq!(response.status(), StatusCode::CONFLICT);
+        assert_eq!(
+            response.headers().get(PROTOCOL_VERSION_HEADER).unwrap(),
+            PROTOCOL_VERSION
+        );
+        assert_eq!(
+            warp::hyper::body::to_bytes(response.into_body())
+                .await
+                .unwrap(),
+            "Core executable SHA256 mismatch"
+        );
+    }
+
+    #[tokio::test]
+    async fn ping_is_available_without_authentication() {
+        let response = warp::test::request()
+            .method("GET")
+            .path("/ping")
+            .reply(&routes())
+            .await;
+
+        assert!(response.status() == StatusCode::OK || response.status() == StatusCode::CONFLICT);
+        assert_eq!(
+            response.headers().get(PROTOCOL_VERSION_HEADER).unwrap(),
+            PROTOCOL_VERSION
+        );
+    }
+
+    #[tokio::test]
+    async fn logs_are_available_without_authentication() {
+        let response = warp::test::request()
+            .method("GET")
+            .path("/logs")
+            .reply(&routes())
+            .await;
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            response.headers().get("content-type").unwrap(),
+            "text/plain; charset=utf-8"
+        );
+        assert_eq!(response.headers().get("cache-control").unwrap(), "no-store");
+    }
+
+    #[tokio::test]
+    async fn start_rejects_a_caller_supplied_core_argument() {
+        let response = warp::test::request()
+            .method("POST")
+            .path("/start")
+            .header("content-type", "application/json")
+            .body(
+                r#"{"address":"\\\\.\\pipe\\FlClashCore_0123456789abcdef0123456789abcdef","sessionId":"0123456789abcdef0123456789abcdef","path":"attacker.exe"}"#,
+            )
+            .reply(&routes())
+            .await;
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+        let body: serde_json::Value = serde_json::from_slice(response.body()).unwrap();
+        assert_eq!(body["code"], "invalidRequest");
+    }
+
+    #[tokio::test]
+    async fn start_rejects_an_invalid_session_before_core_verification() {
+        let response = warp::test::request()
+            .method("POST")
+            .path("/start")
+            .json(&StartParams {
+                address: r"\\.\pipe\FlClashCore_0123456789abcdef0123456789abcdef".to_string(),
+                session_id: "ABCDEF0123456789abcdef0123456789".to_string(),
+            })
+            .reply(&routes())
+            .await;
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+        let body: serde_json::Value = serde_json::from_slice(response.body()).unwrap();
+        assert_eq!(body["code"], "invalidRequest");
+    }
+
+    #[test]
+    fn verifies_core_sha256_in_all_build_modes() {
+        let path =
+            std::env::temp_dir().join(format!("flclash-helper-core-sha256-{}", std::process::id()));
+        let mut file = File::create(&path).unwrap();
+        file.write_all(b"test").unwrap();
+        drop(file);
+
+        assert!(open_verified_core(
+            &path,
+            "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
+        )
+        .is_ok());
+        assert_eq!(
+            open_verified_core(&path, "invalid")
+                .unwrap_err()
+                .to_string(),
+            "Core executable SHA256 mismatch"
+        );
+        std::fs::remove_file(path).unwrap();
+    }
+
+    #[tokio::test]
+    async fn stop_is_available_without_authentication() {
+        let response = warp::test::request()
+            .method("POST")
+            .path("/stop")
+            .json(&StopParams {
+                session_id: "0123456789abcdef0123456789abcdef".to_string(),
+            })
+            .reply(&routes())
+            .await;
+
+        assert_eq!(response.status(), StatusCode::OK);
+        let body: serde_json::Value = serde_json::from_slice(response.body()).unwrap();
+        assert_eq!(body["sessionId"], "0123456789abcdef0123456789abcdef");
+        assert_eq!(body["stopped"], false);
+        assert_eq!(body["reason"], "notRunning");
+    }
+
+    #[tokio::test]
+    async fn stop_requires_a_session_json_body() {
+        let response = warp::test::request()
+            .method("POST")
+            .path("/stop")
+            .reply(&routes())
+            .await;
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+        let body: serde_json::Value = serde_json::from_slice(response.body()).unwrap();
+        assert_eq!(body["code"], "invalidRequest");
+    }
+
+    #[tokio::test]
+    async fn stop_rejects_unknown_fields() {
+        let response = warp::test::request()
+            .method("POST")
+            .path("/stop")
+            .header("content-type", "application/json")
+            .body(r#"{"sessionId":"0123456789abcdef0123456789abcdef","force":true}"#)
+            .reply(&routes())
+            .await;
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+        let body: serde_json::Value = serde_json::from_slice(response.body()).unwrap();
+        assert_eq!(body["code"], "invalidRequest");
+    }
+
+    #[test]
+    fn core_path_is_fixed_beside_the_helper() {
+        assert_eq!(
+            core_path().unwrap().file_name().unwrap(),
+            std::ffi::OsStr::new(env!("CORE_NAME"))
+        );
+    }
+
+    #[test]
+    fn only_accepts_random_core_pipe_namespace() {
+        assert!(is_allowed_core_pipe(
+            r"\\.\pipe\FlClashCore_0123456789abcdef0123456789abcdef"
+        ));
+        assert!(!is_allowed_core_pipe(r"\\.\pipe\FlClashCore"));
+        assert!(!is_allowed_core_pipe(
+            r"\\.\pipe\Other_0123456789abcdef0123456789abcdef"
+        ));
+        assert!(!is_allowed_core_pipe(
+            r"\\.\pipe\FlClashCore_0123456789abcdef"
+        ));
+        assert!(!is_allowed_core_pipe(
+            r"\\.\pipe\FlClashCore_0123456789abcdef0123456789abcdeg"
+        ));
+        assert!(!is_allowed_core_pipe(
+            r"\\.\pipe\FlClashCore_ABCDEF0123456789abcdef0123456789"
+        ));
+    }
+}
diff --git a/services/helper/src/service/mod.rs b/services/helper/src/service/mod.rs
index 64349908c7..cbfaa994e0 100644
--- a/services/helper/src/service/mod.rs
+++ b/services/helper/src/service/mod.rs
@@ -1,8 +1,3 @@
 pub mod hub;
 #[cfg(all(feature = "windows-service", target_os = "windows"))]
 pub mod windows;
-
-
-
-
-
diff --git a/services/helper/src/service/windows.rs b/services/helper/src/service/windows.rs
index 277eebe297..ac76ecb9e5 100644
--- a/services/helper/src/service/windows.rs
+++ b/services/helper/src/service/windows.rs
@@ -1,67 +1,328 @@
-use crate::service::hub::run_service;
+use crate::service::hub::run_service_until;
 
-use std::ffi::OsString;
-
-use std::time::Duration;
+use anyhow::{bail, Context, Result};
+use std::ffi::{OsStr, OsString};
+use std::thread::sleep;
+use std::time::{Duration, Instant};
 
 use tokio::runtime::Runtime;
+use tokio::sync::watch;
 
 use windows_service::{
     define_windows_service,
     service::{
-        ServiceControl, ServiceControlAccept, ServiceExitCode, ServiceState, ServiceStatus,
-        ServiceType,
+        Service, ServiceAccess, ServiceControl, ServiceControlAccept, ServiceErrorControl,
+        ServiceExitCode, ServiceInfo, ServiceStartType, ServiceState, ServiceStatus, ServiceType,
     },
     service_control_handler::{self, ServiceControlHandlerResult},
-    service_dispatcher, Result,
+    service_dispatcher,
+    service_manager::{ServiceManager, ServiceManagerAccess},
 };
 
 const SERVICE_NAME: &str = "FlClashHelperService";
-
 const SERVICE_TYPE: ServiceType = ServiceType::OWN_PROCESS;
+const SERVICE_OPERATION_TIMEOUT: Duration = Duration::from_secs(10);
+const SERVICE_POLL_INTERVAL: Duration = Duration::from_millis(100);
+
+const ERROR_SERVICE_ALREADY_RUNNING: i32 = 1056;
+const ERROR_SERVICE_DOES_NOT_EXIST: i32 = 1060;
+const ERROR_SERVICE_CANNOT_ACCEPT_CTRL: i32 = 1061;
+const ERROR_SERVICE_NOT_ACTIVE: i32 = 1062;
+const ERROR_SERVICE_MARKED_FOR_DELETE: i32 = 1072;
+
+#[derive(Debug, PartialEq, Eq)]
+enum ServiceCommand {
+    Run,
+    Install,
+    Uninstall,
+}
 
 pub fn main() -> Result<()> {
-    start_service()
+    match service_command(std::env::args_os().skip(1))? {
+        ServiceCommand::Run => start_service().map_err(Into::into),
+        ServiceCommand::Install => install_service(),
+        ServiceCommand::Uninstall => uninstall_service(),
+    }
 }
 
-pub fn start_service() -> Result<()> {
-    service_dispatcher::start(SERVICE_NAME, serveice)
+fn service_command(args: impl IntoIterator<Item = OsString>) -> Result<ServiceCommand> {
+    let mut args = args.into_iter();
+    let command = match args.next().as_deref() {
+        None => ServiceCommand::Run,
+        Some(value) if value == OsStr::new("install") => ServiceCommand::Install,
+        Some(value) if value == OsStr::new("uninstall") => ServiceCommand::Uninstall,
+        Some(value) => bail!("unknown helper command: {}", value.to_string_lossy()),
+    };
+    if args.next().is_some() {
+        bail!("helper accepts at most one command");
+    }
+    Ok(command)
 }
 
-define_windows_service!(serveice, service_main);
+fn start_service() -> windows_service::Result<()> {
+    service_dispatcher::start(SERVICE_NAME, ffi_service_main)
+}
 
-pub fn service_main(_arguments: Vec<OsString>) {
-    if let Ok(rt) = Runtime::new() {
-        rt.block_on(async {
-            let _ = run_windows_service().await;
-        });
-    }
+define_windows_service!(ffi_service_main, service_main);
+
+fn service_main(_arguments: Vec<OsString>) {
+    let _ = run_windows_service();
 }
-async fn run_windows_service() -> anyhow::Result<()> {
+
+fn run_windows_service() -> Result<()> {
+    let (shutdown_tx, mut shutdown_rx) = watch::channel(false);
     let status_handle = service_control_handler::register(
         SERVICE_NAME,
         move |event| -> ServiceControlHandlerResult {
             match event {
                 ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
-                ServiceControl::Stop => std::process::exit(0),
+                ServiceControl::Stop => {
+                    let _ = shutdown_tx.send(true);
+                    ServiceControlHandlerResult::NoError
+                }
                 _ => ServiceControlHandlerResult::NotImplemented,
             }
         },
-    )?;
+    )
+    .context("register helper service control handler")?;
+
+    status_handle
+        .set_service_status(service_status(
+            ServiceState::StartPending,
+            ServiceControlAccept::empty(),
+            1,
+            SERVICE_OPERATION_TIMEOUT,
+            0,
+        ))
+        .context("report helper service startup")?;
+
+    let runtime = match Runtime::new() {
+        Ok(runtime) => runtime,
+        Err(error) => {
+            let _ = status_handle.set_service_status(service_status(
+                ServiceState::Stopped,
+                ServiceControlAccept::empty(),
+                0,
+                Duration::default(),
+                1,
+            ));
+            return Err(error).context("create helper runtime");
+        }
+    };
+
+    let shutdown_status_handle = status_handle;
+    let running_status_handle = status_handle;
+    let service_result = runtime.block_on(run_service_until(
+        async move {
+            if !*shutdown_rx.borrow() {
+                let _ = shutdown_rx.changed().await;
+            }
+            let _ = shutdown_status_handle.set_service_status(service_status(
+                ServiceState::StopPending,
+                ServiceControlAccept::empty(),
+                1,
+                SERVICE_OPERATION_TIMEOUT,
+                0,
+            ));
+        },
+        move || {
+            running_status_handle
+                .set_service_status(service_status(
+                    ServiceState::Running,
+                    ServiceControlAccept::STOP,
+                    0,
+                    Duration::default(),
+                    0,
+                ))
+                .context("report helper service running")
+        },
+    ));
+    let exit_code = u32::from(service_result.is_err());
+    let status_result = status_handle.set_service_status(service_status(
+        ServiceState::Stopped,
+        ServiceControlAccept::empty(),
+        0,
+        Duration::default(),
+        exit_code,
+    ));
+
+    service_result.context("run helper service")?;
+    status_result.context("report helper service stopped")?;
+    Ok(())
+}
+
+fn install_service() -> Result<()> {
+    let manager = ServiceManager::local_computer(
+        None::<&str>,
+        ServiceManagerAccess::CONNECT | ServiceManagerAccess::CREATE_SERVICE,
+    )
+    .context("open Windows service manager")?;
+    remove_existing_service(&manager)?;
 
-    status_handle.set_service_status(ServiceStatus {
+    let executable_path = std::env::current_exe().context("resolve helper executable path")?;
+    let service_info = ServiceInfo {
+        name: OsString::from(SERVICE_NAME),
+        display_name: OsString::from(SERVICE_NAME),
         service_type: SERVICE_TYPE,
-        current_state: ServiceState::Running,
-        controls_accepted: ServiceControlAccept::STOP,
-        exit_code: ServiceExitCode::Win32(0),
-        checkpoint: 0,
-        wait_hint: Duration::default(),
-        process_id: None,
-    })?;
+        start_type: ServiceStartType::AutoStart,
+        error_control: ServiceErrorControl::Normal,
+        executable_path,
+        launch_arguments: Vec::new(),
+        dependencies: Vec::new(),
+        account_name: None,
+        account_password: None,
+    };
+    let service = manager
+        .create_service(
+            &service_info,
+            ServiceAccess::QUERY_STATUS | ServiceAccess::START,
+        )
+        .context("create helper service")?;
+    if let Err(error) = service.start::<&OsStr>(&[]) {
+        if !has_error_code(&error, ERROR_SERVICE_ALREADY_RUNNING) {
+            return Err(error).context("start helper service");
+        }
+    }
+    wait_for_running(&service)
+}
 
-    run_service().await
+fn uninstall_service() -> Result<()> {
+    let manager = ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT)
+        .context("open Windows service manager")?;
+    remove_existing_service(&manager)
 }
 
+fn remove_existing_service(manager: &ServiceManager) -> Result<()> {
+    let access = ServiceAccess::QUERY_STATUS | ServiceAccess::STOP | ServiceAccess::DELETE;
+    let service = match manager.open_service(SERVICE_NAME, access) {
+        Ok(service) => service,
+        Err(error) if has_error_code(&error, ERROR_SERVICE_DOES_NOT_EXIST) => return Ok(()),
+        Err(error) if has_error_code(&error, ERROR_SERVICE_MARKED_FOR_DELETE) => {
+            return wait_for_deletion(manager)
+        }
+        Err(error) => return Err(error).context("open existing helper service"),
+    };
 
+    stop_service(&service)?;
+    if let Err(error) = service.delete() {
+        if !has_error_code(&error, ERROR_SERVICE_MARKED_FOR_DELETE)
+            && !has_error_code(&error, ERROR_SERVICE_DOES_NOT_EXIST)
+        {
+            return Err(error).context("delete helper service");
+        }
+    }
+    drop(service);
+    wait_for_deletion(manager)
+}
+
+fn stop_service(service: &Service) -> Result<()> {
+    let started_at = Instant::now();
+    loop {
+        let state = service
+            .query_status()
+            .context("query helper service before stopping")?
+            .current_state;
+        if state == ServiceState::Stopped {
+            return Ok(());
+        }
+        if state != ServiceState::StopPending {
+            if let Err(error) = service.stop() {
+                if has_error_code(&error, ERROR_SERVICE_NOT_ACTIVE) {
+                    return Ok(());
+                }
+                if !has_error_code(&error, ERROR_SERVICE_CANNOT_ACCEPT_CTRL) {
+                    return Err(error).context("stop helper service");
+                }
+            }
+        }
+        if started_at.elapsed() >= SERVICE_OPERATION_TIMEOUT {
+            bail!("timed out waiting for helper service to stop from {state:?}");
+        }
+        sleep(SERVICE_POLL_INTERVAL);
+    }
+}
+
+fn wait_for_deletion(manager: &ServiceManager) -> Result<()> {
+    let started_at = Instant::now();
+    loop {
+        match manager.open_service(SERVICE_NAME, ServiceAccess::QUERY_STATUS) {
+            Err(error) if has_error_code(&error, ERROR_SERVICE_DOES_NOT_EXIST) => return Ok(()),
+            Err(error) if !has_error_code(&error, ERROR_SERVICE_MARKED_FOR_DELETE) => {
+                return Err(error).context("check helper service deletion")
+            }
+            Ok(service) => drop(service),
+            Err(_) => {}
+        }
+        if started_at.elapsed() >= SERVICE_OPERATION_TIMEOUT {
+            bail!("timed out waiting for helper service deletion");
+        }
+        sleep(SERVICE_POLL_INTERVAL);
+    }
+}
 
+fn wait_for_running(service: &Service) -> Result<()> {
+    let started_at = Instant::now();
+    loop {
+        let state = service
+            .query_status()
+            .context("query helper service after starting")?
+            .current_state;
+        match state {
+            ServiceState::Running => return Ok(()),
+            ServiceState::Stopped => bail!("helper service stopped during startup"),
+            _ => {}
+        }
+        if started_at.elapsed() >= SERVICE_OPERATION_TIMEOUT {
+            bail!("timed out waiting for helper service to run from {state:?}");
+        }
+        sleep(SERVICE_POLL_INTERVAL);
+    }
+}
 
+fn has_error_code(error: &windows_service::Error, code: i32) -> bool {
+    matches!(error, windows_service::Error::Winapi(error) if error.raw_os_error() == Some(code))
+}
+
+fn service_status(
+    current_state: ServiceState,
+    controls_accepted: ServiceControlAccept,
+    checkpoint: u32,
+    wait_hint: Duration,
+    exit_code: u32,
+) -> ServiceStatus {
+    ServiceStatus {
+        service_type: SERVICE_TYPE,
+        current_state,
+        controls_accepted,
+        exit_code: ServiceExitCode::Win32(exit_code),
+        checkpoint,
+        wait_hint,
+        process_id: None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_service_commands() {
+        assert_eq!(service_command([]).unwrap(), ServiceCommand::Run);
+        assert_eq!(
+            service_command([OsString::from("install")]).unwrap(),
+            ServiceCommand::Install
+        );
+        assert_eq!(
+            service_command([OsString::from("uninstall")]).unwrap(),
+            ServiceCommand::Uninstall
+        );
+    }
+
+    #[test]
+    fn rejects_unknown_or_extra_service_commands() {
+        assert!(service_command([OsString::from("unknown")]).is_err());
+        assert!(
+            service_command([OsString::from("install"), OsString::from("unexpected")]).is_err()
+        );
+    }
+}
diff --git a/setup.dart b/setup.dart
index e46f5bcd8e..358bb06a0f 100755
--- a/setup.dart
+++ b/setup.dart
@@ -75,7 +75,7 @@ ArgParser createSetupArgParser() {
     ..addOption(
       'env',
       defaultsTo: 'pre',
-      allowed: ['pre', 'stable'],
+      allowed: ['dev', 'pre', 'stable'],
       help: 'Application environment',
     )
     ..addOption(
@@ -111,6 +111,10 @@ List<String> createFlutterBuildArgs({
   return flutterBuildArgs;
 }
 
+Map<String, String> createBuildEnvironment(String env) {
+  return {'APP_ENV': env};
+}
+
 String _getTargets(String platform, String arch, String? customTargets) {
   if (customTargets != null) return customTargets;
   if (platform == 'linux' && arch == 'amd64') return 'deb,appimage,rpm';
@@ -136,13 +140,8 @@ Future<int> _package(
   String? androidArch,
   required bool verbose,
 }) async {
-  final coreSha256 = platform == 'windows' ? await _buildGoCore(rootDir) : null;
-
   final file = File(p.join(rootDir, 'env.json'));
-
-  await file.writeAsString(
-    jsonEncode({'APP_ENV': env, 'CORE_SHA256': ?coreSha256}),
-  );
+  await file.writeAsString(jsonEncode(createBuildEnvironment(env)));
 
   final flutterBuildArgs = createFlutterBuildArgs(
     platform: platform,
@@ -203,32 +202,6 @@ Future<int> _package(
   return exitCode;
 }
 
-Future<String?> _buildGoCore(String rootDir) async {
-  final buildToolDir = p.join(
-    rootDir,
-    'plugins',
-    'setup',
-    'buildkit',
-    'build_tool',
-  );
-  final result = await Process.run('dart', [
-    'run',
-    'build_tool',
-    'windows',
-    '--root-dir',
-    rootDir,
-  ], workingDirectory: buildToolDir);
-  if (result.exitCode != 0) {
-    stderr.write(result.stderr);
-    return null;
-  }
-  final shaFile = File(p.join(rootDir, 'core_sha256.json'));
-  if (!shaFile.existsSync()) return null;
-  final content =
-      jsonDecode(shaFile.readAsStringSync()) as Map<String, dynamic>;
-  return content['CORE_SHA256'] as String?;
-}
-
 String _detectArch() {
   if (Platform.isWindows) {
     final pa = Platform.environment['PROCESSOR_ARCHITECTURE'] ?? 'AMD64';
@@ -277,6 +250,7 @@ Future<int> _ensureLinuxDependencies(String arch) async {
     ['ninja-build', 'libgtk-3-dev'],
     ['libayatana-appindicator3-dev'],
     ['libkeybinder-3.0-dev'],
+    ['libsecret-1-dev'],
     ['locate'],
   ];
   if (arch == 'amd64') {
diff --git a/test/common/color_test.dart b/test/common/color_test.dart
new file mode 100644
index 0000000000..0353f490d8
--- /dev/null
+++ b/test/common/color_test.dart
@@ -0,0 +1,16 @@
+import 'package:fl_clash/common/color.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('opacity extensions use their named alpha values', () {
+    const color = Colors.blue;
+    const tolerance = 0.0001;
+
+    expect(color.opacity80.a, closeTo(0.8, tolerance));
+    expect(color.opacity50.a, closeTo(0.5, tolerance));
+    expect(color.opacity10.a, closeTo(0.1, tolerance));
+    expect(color.opacity3.a, closeTo(0.03, tolerance));
+    expect(color.opacity0.a, 0);
+  });
+}
diff --git a/test/common/dav_client_test.dart b/test/common/dav_client_test.dart
new file mode 100644
index 0000000000..403036b09c
--- /dev/null
+++ b/test/common/dav_client_test.dart
@@ -0,0 +1,89 @@
+import 'dart:async';
+
+import 'package:fl_clash/common/dav_client.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+class _FakeDAVClient extends DAVClient {
+  _FakeDAVClient(super.dav, this.result, [this.onPing]);
+
+  final Future<bool> result;
+  final void Function()? onPing;
+
+  @override
+  Future<bool> ping() {
+    onPing?.call();
+    return result;
+  }
+}
+
+void main() {
+  const firstProps = DAVProps(
+    uri: 'https://dav.example.com',
+    user: 'first',
+    password: 'first-password',
+  );
+  const secondProps = DAVProps(
+    uri: 'https://dav.example.com',
+    user: 'second',
+    password: 'second-password',
+  );
+
+  test('latest DAV connectivity check wins', () async {
+    final firstResult = Completer<bool>();
+    final secondResult = Completer<bool>();
+    final results = [firstResult.future, secondResult.future];
+    var index = 0;
+    final controller = DAVConnectionController(
+      createClient: (props) {
+        return _FakeDAVClient(props, results[index++]);
+      },
+    );
+    addTearDown(controller.dispose);
+
+    final firstUpdate = controller.update(firstProps);
+    final secondUpdate = controller.update(secondProps);
+
+    secondResult.complete(true);
+    await secondUpdate;
+    expect(controller.value, isTrue);
+
+    firstResult.complete(false);
+    await firstUpdate;
+    expect(controller.value, isTrue);
+  });
+
+  test('changing only the remote file name does not ping again', () async {
+    var pingCount = 0;
+    final controller = DAVConnectionController(
+      createClient: (props) {
+        return _FakeDAVClient(props, Future.value(true), () => pingCount++);
+      },
+    );
+    addTearDown(controller.dispose);
+
+    await controller.update(firstProps);
+    await controller.update(firstProps.copyWith(fileName: 'another.zip'));
+
+    expect(pingCount, 1);
+    expect(controller.value, isTrue);
+    expect(controller.client?.fileName, 'another.zip');
+  });
+
+  test('new credentials reset connectivity while ping is pending', () async {
+    final result = Completer<bool>();
+    final controller = DAVConnectionController(
+      createClient: (props) {
+        return _FakeDAVClient(props, result.future);
+      },
+    );
+    addTearDown(controller.dispose);
+
+    final update = controller.update(firstProps);
+
+    expect(controller.value, isNull);
+    result.complete(true);
+    await update;
+    expect(controller.value, isTrue);
+  });
+}
diff --git a/test/common/function_test.dart b/test/common/function_test.dart
index 2415606a51..8f205535d0 100644
--- a/test/common/function_test.dart
+++ b/test/common/function_test.dart
@@ -1,7 +1,60 @@
+import 'dart:async';
+import 'dart:math';
+
 import 'package:fl_clash/common/function.dart';
 import 'package:test/test.dart';
 
 void main() {
+  group('SerialTaskScheduler', () {
+    test('serializes tasks in submission order', () async {
+      final scheduler = SerialTaskScheduler();
+      final firstStarted = Completer<void>();
+      final releaseFirst = Completer<void>();
+      final events = <String>[];
+      var runningTasks = 0;
+      var maxRunningTasks = 0;
+
+      final first = scheduler.run(() async {
+        runningTasks++;
+        maxRunningTasks = max(maxRunningTasks, runningTasks);
+        firstStarted.complete();
+        await releaseFirst.future;
+        events.add('first');
+        runningTasks--;
+      });
+      await firstStarted.future;
+
+      final second = scheduler.run(() async {
+        runningTasks++;
+        maxRunningTasks = max(maxRunningTasks, runningTasks);
+        events.add('second');
+        runningTasks--;
+      });
+      await Future<void>.delayed(Duration.zero);
+
+      expect(events, isEmpty);
+      releaseFirst.complete();
+      await Future.wait([first, second]);
+
+      expect(events, ['first', 'second']);
+      expect(maxRunningTasks, 1);
+    });
+
+    test('continues after a failed serialized task', () async {
+      final scheduler = SerialTaskScheduler();
+
+      await expectLater(
+        scheduler.run<void>(() async {
+          throw StateError('failed');
+        }),
+        throwsStateError,
+      );
+
+      final result = await scheduler.run(() async => 'next');
+      expect(result, 'next');
+    });
+  });
+
   group('retry', () {
     test('returns immediately when first result does not need retry', () async {
       var attempts = 0;
diff --git a/test/common/migration_test.dart b/test/common/migration_test.dart
new file mode 100644
index 0000000000..3afe6c10f0
--- /dev/null
+++ b/test/common/migration_test.dart
@@ -0,0 +1,257 @@
+import 'dart:convert';
+
+import 'package:fl_clash/common/migration.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  group('Migration', () {
+    test('returns current config without rewriting storage', () async {
+      final configMap = _createConfigMap(
+        davProps: const DAVProps(
+          uri: 'https://example.com/dav',
+          user: 'user',
+          password: 'secret',
+        ),
+      );
+      final store = _FakeMigrationStore(
+        configMap: configMap,
+        version: Migration.currentVersion,
+      );
+
+      final config = await Migration(store: store).run();
+
+      expect(config, Config.realFromJson(configMap));
+      expect(config.davProps?.password, 'secret');
+      expect(store.events, ['getConfigMap', 'getVersion']);
+    });
+
+    test(
+      'obfuscates a compatible DAV password without a version migration',
+      () async {
+        final configMap = _createConfigMap(
+          davProps: const DAVProps(
+            uri: 'https://example.com/dav',
+            user: 'user',
+          ),
+        );
+        final davProps = configMap['davProps']! as Map<String, Object?>;
+        davProps['password'] = 'secret';
+        final store = _FakeMigrationStore(configMap: configMap, version: 1);
+
+        final config = await Migration(store: store).run();
+
+        expect(config.davProps?.user, 'user');
+        expect(config.davProps?.password, 'secret');
+        expect(store.savedConfig, config);
+        expect(store.version, Migration.currentVersion);
+        expect(store.events, ['getConfigMap', 'getVersion', 'saveConfig']);
+        final savedConfigMap =
+            jsonDecode(jsonEncode(store.savedConfig)) as Map<String, Object?>;
+        final savedDavProps =
+            savedConfigMap['davProps']! as Map<String, Object?>;
+        expect(savedDavProps['password'], startsWith('v1.'));
+        expect(savedDavProps['password'], isNot(contains('secret')));
+      },
+    );
+
+    test(
+      'commits v0 cleanup and version only after migrated data is saved',
+      () async {
+        final configMap = <String, Object?>{
+          'proxiesStyle': <String, Object?>{},
+          'dav': <String, Object?>{
+            'uri': 'https://example.com/dav',
+            'user': 'user',
+            'password': 'secret',
+          },
+        };
+        final store = _FakeMigrationStore(
+          configMap: configMap,
+          version: 0,
+          clashConfigMap: <String, Object?>{'mixed-port': 7890},
+        );
+        final migration = Migration(
+          store: store,
+          migrateV0: (configMap) async {
+            store.events.add('migrateV0');
+            expect(configMap['patchClashConfig'], store.clashConfigMap);
+            return MigrationData(
+              configMap: _createConfigMap(
+                davProps: const DAVProps(
+                  uri: 'https://example.com/dav',
+                  user: 'user',
+                  password: 'secret',
+                ),
+              ),
+            );
+          },
+        );
+
+        await migration.run();
+
+        expect(store.events, [
+          'getConfigMap',
+          'getVersion',
+          'getClashConfigMap',
+          'migrateV0',
+          'restore',
+          'saveConfig',
+          'clearClashConfig',
+          'setVersion',
+        ]);
+        expect(store.savedConfig?.davProps?.password, 'secret');
+        expect(store.didClearClashConfig, isTrue);
+        expect(store.version, Migration.currentVersion);
+      },
+    );
+
+    test(
+      'preserves legacy clash config when current-shaped data has version zero',
+      () async {
+        final configMap = _createConfigMap()..remove('patchClashConfig');
+        final clashConfigMap = _createClashConfigMap(mixedPort: 1234);
+        final store = _FakeMigrationStore(
+          configMap: configMap,
+          version: 0,
+          clashConfigMap: clashConfigMap,
+        );
+
+        final config = await Migration(store: store).run();
+
+        expect(config.patchClashConfig.mixedPort, 1234);
+        expect(store.savedConfig?.patchClashConfig.mixedPort, 1234);
+        expect(store.didClearClashConfig, isTrue);
+        expect(store.events, [
+          'getConfigMap',
+          'getVersion',
+          'getClashConfigMap',
+          'restore',
+          'saveConfig',
+          'clearClashConfig',
+          'setVersion',
+        ]);
+      },
+    );
+
+    test('does not clear legacy clash config when saving fails', () async {
+      final configMap = _createConfigMap()..remove('patchClashConfig');
+      final store = _FakeMigrationStore(
+        configMap: configMap,
+        version: 0,
+        clashConfigMap: _createClashConfigMap(mixedPort: 1234),
+        configSaveResult: false,
+      );
+
+      await expectLater(
+        Migration(store: store).run(),
+        throwsA(isA<StateError>()),
+      );
+
+      expect(store.didClearClashConfig, isFalse);
+      expect(store.version, 0);
+      expect(store.events, [
+        'getConfigMap',
+        'getVersion',
+        'getClashConfigMap',
+        'restore',
+        'saveConfig',
+      ]);
+    });
+
+    test('keeps the current version when password obfuscation fails', () async {
+      final configMap = _createConfigMap(
+        davProps: const DAVProps(uri: 'https://example.com/dav', user: 'user'),
+      );
+      final davProps = configMap['davProps']! as Map<String, Object?>;
+      davProps['password'] = 'secret';
+      final store = _FakeMigrationStore(
+        configMap: configMap,
+        version: Migration.currentVersion,
+        configSaveResult: false,
+      );
+
+      await expectLater(
+        Migration(store: store).run(),
+        throwsA(isA<StateError>()),
+      );
+
+      expect(store.events, ['getConfigMap', 'getVersion', 'saveConfig']);
+      expect(store.version, Migration.currentVersion);
+    });
+  });
+}
+
+Map<String, Object?> _createConfigMap({DAVProps? davProps}) {
+  return jsonDecode(
+        jsonEncode(Config(themeProps: defaultThemeProps, davProps: davProps)),
+      )
+      as Map<String, Object?>;
+}
+
+Map<String, Object?> _createClashConfigMap({required int mixedPort}) {
+  return jsonDecode(jsonEncode(PatchClashConfig(mixedPort: mixedPort)))
+      as Map<String, Object?>;
+}
+
+class _FakeMigrationStore implements MigrationStore {
+  final Map<String, Object?>? configMap;
+  final Map<String, Object?>? clashConfigMap;
+  final bool configSaveResult;
+  final List<String> events = [];
+
+  int version;
+  Config? savedConfig;
+  MigrationData? restoredData;
+  bool didClearClashConfig = false;
+
+  _FakeMigrationStore({
+    required this.configMap,
+    required this.version,
+    this.clashConfigMap,
+    this.configSaveResult = true,
+  });
+
+  @override
+  Future<void> clearClashConfig() async {
+    events.add('clearClashConfig');
+    didClearClashConfig = true;
+  }
+
+  @override
+  Future<Map<String, Object?>?> getClashConfigMap() async {
+    events.add('getClashConfigMap');
+    return clashConfigMap;
+  }
+
+  @override
+  Future<Map<String, Object?>?> getConfigMap() async {
+    events.add('getConfigMap');
+    return configMap;
+  }
+
+  @override
+  Future<int> getVersion() async {
+    events.add('getVersion');
+    return version;
+  }
+
+  @override
+  Future<void> restore(MigrationData data) async {
+    events.add('restore');
+    restoredData = data;
+  }
+
+  @override
+  Future<bool> saveConfig(Config config) async {
+    events.add('saveConfig');
+    savedConfig = config;
+    return configSaveResult;
+  }
+
+  @override
+  Future<void> setVersion(int version) async {
+    events.add('setVersion');
+    this.version = version;
+  }
+}
diff --git a/test/common/task_test.dart b/test/common/task_test.dart
new file mode 100644
index 0000000000..8c2de34ba5
--- /dev/null
+++ b/test/common/task_test.dart
@@ -0,0 +1,207 @@
+import 'package:fl_clash/common/task.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:yaml/yaml.dart';
+
+int _double(int value) => value * 2;
+
+void main() {
+  test('encoding helpers round-trip structured data', () async {
+    final encoded = await encodeJSONTask({
+      'name': 'FlClash',
+      'values': [1, true, null],
+    });
+    final decoded = await decodeJSONTask<Map<String, dynamic>>(encoded);
+
+    expect(decoded['name'], 'FlClash');
+    expect(decoded['values'], [1, true, null]);
+    expect(await encodeYamlTask({'enabled': true}), contains('enabled: true'));
+    expect(await encodeMD5Task('abc'), '900150983cd24fb0d6963f7d28e17f72');
+  });
+
+  test('toGroupsTask converts, selects, and sorts core proxy data', () async {
+    final proxies = <String, dynamic>{
+      'Selector': {
+        'name': 'Selector',
+        'type': 'Selector',
+        'now': 'Beta',
+        'all': ['Zulu', 'Beta', 'missing'],
+      },
+      'Direct': {'name': 'Direct', 'type': 'Direct'},
+      'Zulu': {'name': 'Zulu', 'type': 'Direct'},
+      'Beta': {'name': 'Beta', 'type': 'Direct'},
+    };
+    final groups = await toGroupsTask(
+      ComputeGroupsState(
+        proxiesData: ProxiesData(
+          all: const ['Selector', 'Direct'],
+          proxies: proxies,
+        ),
+        sortType: ProxiesSortType.name,
+        delayMap: const {},
+        selectedMap: const {'Selector': 'Beta'},
+        defaultTestUrl: 'https://example.com/generate_204',
+      ),
+    );
+
+    expect(groups, hasLength(1));
+    expect(groups.single.name, 'Selector');
+    expect(groups.single.all.map((proxy) => proxy.name), ['Beta', 'Zulu']);
+  });
+
+  test('toGroupsTask returns empty data without proxies', () async {
+    final groups = await toGroupsTask(
+      const ComputeGroupsState(
+        proxiesData: ProxiesData(proxies: {}, all: []),
+        sortType: ProxiesSortType.none,
+        delayMap: {},
+        selectedMap: {},
+        defaultTestUrl: '',
+      ),
+    );
+
+    expect(groups, isEmpty);
+  });
+
+  test(
+    'makeRealProfileTask normalizes runtime config and added rules',
+    () async {
+      final rawConfig = await decodeJSONTask<Map<String, dynamic>>(
+        await encodeJSONTask({
+          'dns': {
+            'enable': true,
+            'nameserver': ['1.1.1.1'],
+          },
+          'sniffer': {
+            'sniff': {
+              'HTTP': {
+                'ports': [80, '443'],
+              },
+            },
+          },
+          'proxy-providers': {
+            'remote': {'type': 'http', 'url': 'https://example.com/proxy.yaml'},
+            'file': {'type': 'file', 'path': './local.yaml'},
+          },
+          'rule-providers': {
+            'remote': {'type': 'http', 'url': 'https://example.com/rule.yaml'},
+          },
+          'rules': ['DOMAIN,existing.example,DIRECT', 'MATCH,Original'],
+        }),
+      );
+      final result = await makeRealProfileTask(
+        MakeRealProfileState(
+          profilesPath: '/profiles',
+          profileId: 7,
+          rawConfig: rawConfig,
+          realPatchConfig: const PatchClashConfig(
+            mixedPort: 7893,
+            port: 7890,
+            socksPort: 7891,
+            redirPort: 7892,
+            tproxyPort: 7894,
+            allowLan: true,
+            ipv6: true,
+            hosts: {'router.local': '192.168.1.1,192.168.1.2'},
+          ),
+          overrideDns: false,
+          appendSystemDns: true,
+          proxyGroups: const [],
+          rules: const [],
+          addedRules: const [
+            Rule(
+              ruleAction: RuleAction.DOMAIN_SUFFIX,
+              content: 'added.example',
+              ruleTarget: 'MATCH',
+            ),
+          ],
+          defaultUA: 'FlClash-Test',
+        ),
+      );
+      final config = loadYaml(result.a) as YamlMap;
+
+      expect(result.b, hasLength(32));
+      expect(config['mixed-port'], 7893);
+      expect(config['allow-lan'], true);
+      expect(config['global-ua'], 'FlClash-Test');
+      expect(config['profile']['store-selected'], false);
+      expect(
+        config['dns']['nameserver'],
+        containsAll(['1.1.1.1', 'system://']),
+      );
+      expect(config['hosts']['router.local'], ['192.168.1.1', '192.168.1.2']);
+      expect(config['sniffer']['sniff']['HTTP']['ports'], ['80', '443']);
+      expect(
+        config['proxy-providers']['remote']['path'],
+        startsWith('/profiles/providers/7/proxies/'),
+      );
+      expect(
+        config['rule-providers']['remote']['path'],
+        startsWith('/profiles/providers/7/rules/'),
+      );
+      expect(config['rules'], [
+        'DOMAIN-SUFFIX,added.example,Original',
+        'DOMAIN,existing.example,DIRECT',
+        'MATCH,Original',
+      ]);
+    },
+  );
+
+  test('makeRealProfileTask replaces DNS and explicit custom data', () async {
+    final result = await makeRealProfileTask(
+      const MakeRealProfileState(
+        profilesPath: '/profiles',
+        profileId: 9,
+        rawConfig: {},
+        realPatchConfig: PatchClashConfig(),
+        overrideDns: true,
+        appendSystemDns: false,
+        proxyGroups: [
+          ProxyGroup(
+            id: 1,
+            name: 'Select',
+            type: GroupType.Selector,
+            proxies: ['DIRECT'],
+          ),
+        ],
+        rules: [
+          Rule(
+            ruleAction: RuleAction.DOMAIN,
+            content: 'custom.example',
+            ruleTarget: 'DIRECT',
+          ),
+        ],
+        addedRules: [],
+        defaultUA: 'Fallback-UA',
+      ),
+    );
+    final config = loadYaml(result.a) as YamlMap;
+
+    expect(config['dns']['enable'], true);
+    expect(config['dns']['nameserver'], contains('system://'));
+    expect(config['proxy-groups'], hasLength(1));
+    expect(config['rules'], ['DOMAIN,custom.example,DIRECT']);
+  });
+
+  test('log and list tasks produce stable mapped output', () async {
+    final logs = [
+      const Log(
+        logLevel: LogLevel.info,
+        payload: 'first',
+        dateTime: '2026-07-26 10:00:00',
+      ),
+      const Log(
+        logLevel: LogLevel.error,
+        payload: 'second',
+        dateTime: '2026-07-26 10:00:01',
+      ),
+    ];
+
+    final encoded = await encodeLogsTask(logs);
+
+    expect(encoded, contains('first'));
+    expect(encoded, contains('\n'));
+    expect(await mapListTask([1, 2, 3], _double), [2, 4, 6]);
+  });
+}
diff --git a/test/common/utils_test.dart b/test/common/utils_test.dart
index d83cd72cac..d3a3444fac 100644
--- a/test/common/utils_test.dart
+++ b/test/common/utils_test.dart
@@ -58,8 +58,12 @@ void main() {
       expect(utils.getTimeText(3661000), '01:01:01');
     });
 
-    test('caps at 99:59:59', () {
-      expect(utils.getTimeText(100 * 3600 * 1000), '99:59:59');
+    test('formats three digit hours', () {
+      expect(utils.getTimeText(100 * 3600 * 1000), '100:00:00');
+    });
+
+    test('caps at 999:59:59', () {
+      expect(utils.getTimeText(1000 * 3600 * 1000), '999:59:59');
     });
   });
 
diff --git a/test/core/controller_test.dart b/test/core/controller_test.dart
index f5f81db139..7417d71832 100644
--- a/test/core/controller_test.dart
+++ b/test/core/controller_test.dart
@@ -1,7 +1,7 @@
 import 'dart:async';
-import 'dart:convert';
 
 import 'package:fl_clash/core/controller.dart';
+import 'package:fl_clash/core/desktop/model.dart';
 import 'package:fl_clash/core/interface.dart';
 import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/models/models.dart';
@@ -10,11 +10,6 @@ import 'package:test/test.dart';
 
 class MockCoreHandlerInterface extends Mock implements CoreHandlerInterface {}
 
-class FakeCompleter extends Fake implements Completer<dynamic> {
-  @override
-  bool get isCompleted => true;
-}
-
 void main() {
   late MockCoreHandlerInterface mock;
   late CoreController controller;
@@ -69,17 +64,25 @@ void main() {
   });
 
   group('lifecycle methods', () {
-    test('preload delegates to interface', () async {
-      when(() => mock.preload()).thenAnswer((_) async => 'ready');
-      final result = await controller.preload();
-      expect(result, 'ready');
-      verify(() => mock.preload()).called(1);
-    });
+    test('start, restart, stop, and close delegate to interface', () async {
+      const result = CoreLifecycleResult(
+        revision: 1,
+        outcome: CoreLifecycleOutcome.applied,
+      );
+      when(() => mock.start()).thenAnswer((_) async => result);
+      when(() => mock.restart()).thenAnswer((_) async => result);
+      when(() => mock.stop()).thenAnswer((_) async => result);
+      when(() => mock.close()).thenAnswer((_) async => result);
+
+      expect(await controller.start(), same(result));
+      expect(await controller.restart(), same(result));
+      expect(await controller.stop(), same(result));
+      expect(await controller.close(), same(result));
 
-    test('shutdown delegates to interface', () async {
-      when(() => mock.shutdown(true)).thenAnswer((_) async => true);
-      await controller.shutdown(true);
-      verify(() => mock.shutdown(true)).called(1);
+      verify(() => mock.start()).called(1);
+      verify(() => mock.restart()).called(1);
+      verify(() => mock.stop()).called(1);
+      verify(() => mock.close()).called(1);
     });
 
     test('isInit delegates to interface', () async {
@@ -87,6 +90,14 @@ void main() {
       final result = await controller.isInit;
       expect(result, true);
     });
+
+    test('crash delegates to interface', () async {
+      when(() => mock.crash()).thenAnswer((_) async => true);
+
+      await controller.crash();
+
+      verify(() => mock.crash()).called(1);
+    });
   });
 
   group('config methods', () {
@@ -114,6 +125,33 @@ void main() {
       final result = await controller.updateConfig(params);
       expect(result, 'ok');
     });
+
+    test('setupConfig waits for asynchronous preload', () async {
+      const params = SetupParams(selectedMap: {}, testUrl: 'http://x.com');
+      final preloadCompleter = Completer<void>();
+      final events = <String>[];
+      when(() => mock.setupConfig(params)).thenAnswer((_) {
+        events.add('setup');
+        return Future.value('ok');
+      });
+
+      final setupFuture = controller.setupConfig(
+        params: params,
+        preloadInvoke: () async {
+          events.add('preload');
+          await preloadCompleter.future;
+        },
+      );
+      var completed = false;
+      setupFuture.then((_) => completed = true);
+      await Future<void>.delayed(Duration.zero);
+
+      expect(events, ['setup', 'preload']);
+      expect(completed, isFalse);
+
+      preloadCompleter.complete();
+      expect(await setupFuture, 'ok');
+    });
   });
 
   group('proxy methods', () {
@@ -126,32 +164,25 @@ void main() {
   });
 
   group('connection methods', () {
-    test('getConnections parses JSON response', () async {
-      when(() => mock.getConnections()).thenAnswer(
-        (_) async => json.encode({
-          'connections': [
-            {
-              'id': '1',
-              'metadata': {'network': 'tcp'},
-              'upload': 0,
-              'download': 0,
-              'start': '2024-01-01',
-              'chains': ['Proxy'],
-              'rule': 'DIRECT',
-              'rulePayload': '',
-            },
-          ],
-        }),
-      );
+    test('getConnections delegates structured connections', () async {
+      final connection = TrackerInfo.fromJson({
+        'id': '1',
+        'metadata': {'network': 'tcp'},
+        'upload': 0,
+        'download': 0,
+        'start': '2024-01-01',
+        'chains': ['Proxy'],
+        'rule': 'DIRECT',
+        'rulePayload': '',
+      });
+      when(() => mock.getConnections()).thenAnswer((_) async => [connection]);
       final result = await controller.getConnections();
       expect(result.length, 1);
       expect(result.first.id, '1');
     });
 
     test('getConnections handles empty connections', () async {
-      when(
-        () => mock.getConnections(),
-      ).thenAnswer((_) async => json.encode({'connections': []}));
+      when(() => mock.getConnections()).thenAnswer((_) async => []);
       final result = await controller.getConnections();
       expect(result, isEmpty);
     });
@@ -164,55 +195,58 @@ void main() {
   });
 
   group('external providers', () {
-    test('getExternalProviders parses JSON', () async {
-      when(() => mock.getExternalProviders()).thenAnswer(
-        (_) async => json.encode([
-          {
-            'name': 'provider1',
-            'type': 'Proxy',
-            'count': 5,
-            'vehicle-type': 'HTTP',
-            'update-at': DateTime.now().toIso8601String(),
-          },
-        ]),
+    test('getExternalProviders delegates structured providers', () async {
+      final provider = ExternalProvider(
+        name: 'provider1',
+        type: 'Proxy',
+        count: 5,
+        vehicleType: 'HTTP',
+        updateAt: DateTime.now(),
       );
+      when(
+        () => mock.getExternalProviders(),
+      ).thenAnswer((_) async => [provider]);
       final result = await controller.getExternalProviders();
       expect(result.length, 1);
       expect(result.first.name, 'provider1');
     });
 
-    test('getExternalProviders handles empty string', () async {
-      when(() => mock.getExternalProviders()).thenAnswer((_) async => '');
+    test('getExternalProviders handles empty list', () async {
+      when(() => mock.getExternalProviders()).thenAnswer((_) async => []);
       final result = await controller.getExternalProviders();
       expect(result, isEmpty);
     });
 
-    test('getExternalProvider returns null on empty', () async {
-      when(() => mock.getExternalProvider(any())).thenAnswer((_) async => '');
+    test('getExternalProvider returns null when missing', () async {
+      when(() => mock.getExternalProvider(any())).thenAnswer((_) async => null);
       final result = await controller.getExternalProvider('test');
       expect(result, isNull);
     });
   });
 
   group('traffic methods', () {
-    test('getTraffic handles empty string', () async {
-      when(() => mock.getTraffic(false)).thenAnswer((_) async => '');
+    test('getTraffic delegates structured traffic', () async {
+      when(
+        () => mock.getTraffic(false),
+      ).thenAnswer((_) async => const Traffic(up: 1, down: 2));
       final result = await controller.getTraffic(false);
-      expect(result.up, 0);
-      expect(result.down, 0);
+      expect(result.up, 1);
+      expect(result.down, 2);
     });
 
-    test('getTotalTraffic handles empty string', () async {
-      when(() => mock.getTotalTraffic(false)).thenAnswer((_) async => '');
+    test('getTotalTraffic delegates structured traffic', () async {
+      when(
+        () => mock.getTotalTraffic(false),
+      ).thenAnswer((_) async => const Traffic(up: 3, down: 4));
       final result = await controller.getTotalTraffic(false);
-      expect(result.up, 0);
-      expect(result.down, 0);
+      expect(result.up, 3);
+      expect(result.down, 4);
     });
 
-    test('getMemory handles empty string', () async {
-      when(() => mock.getMemory()).thenAnswer((_) async => '');
+    test('getMemory delegates numeric memory', () async {
+      when(() => mock.getMemory()).thenAnswer((_) async => 2048);
       final result = await controller.getMemory();
-      expect(result, 0);
+      expect(result, 2048);
     });
   });
 
@@ -223,10 +257,9 @@ void main() {
       expect(result, isNull);
     });
 
-    test('getDelay parses JSON response', () async {
+    test('getDelay delegates structured delay', () async {
       when(() => mock.asyncTestDelay(any(), any())).thenAnswer(
-        (_) async =>
-            json.encode({'name': 'P1', 'value': 100, 'url': 'test.com'}),
+        (_) async => const Delay(name: 'P1', value: 100, url: 'test.com'),
       );
       final result = await controller.getDelay('test.com', 'P1');
       expect(result.name, 'P1');
@@ -257,9 +290,9 @@ void main() {
       verify(() => mock.forceGc()).called(1);
     });
 
-    test('deleteFile delegates', () async {
-      when(() => mock.deleteFile('/tmp/x')).thenAnswer((_) async => 'ok');
-      final result = await controller.deleteFile('/tmp/x');
+    test('clearEffect delegates', () async {
+      when(() => mock.clearEffect(42)).thenAnswer((_) async => 'ok');
+      final result = await controller.clearEffect(42);
       expect(result, 'ok');
     });
   });
diff --git a/test/core/desktop/fakes.dart b/test/core/desktop/fakes.dart
new file mode 100644
index 0000000000..b6ca668fe7
--- /dev/null
+++ b/test/core/desktop/fakes.dart
@@ -0,0 +1,243 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:fl_clash/core/desktop/launcher.dart';
+import 'package:fl_clash/core/desktop/model.dart';
+import 'package:fl_clash/core/desktop/transport.dart';
+
+final class FakeDesktopCoreTransport implements DesktopCoreTransport {
+  @override
+  final String address;
+
+  final List<String> sentMessages = [];
+  Object? sendError;
+  final StreamController<DesktopTransportEvent> _eventController =
+      StreamController<DesktopTransportEvent>.broadcast();
+  final StreamController<Uint8List> _frameController =
+      StreamController<Uint8List>.broadcast();
+
+  @override
+  DesktopTransportState state;
+
+  TransportConnected? _connection;
+  TransportFailed? _failure;
+  Object? closeError;
+  Future<void>? _closeOperation;
+  final Completer<void> _closed = Completer<void>();
+  int closeCount = 0;
+
+  FakeDesktopCoreTransport({
+    this.address = 'test-address',
+    this.state = DesktopTransportState.idle,
+  });
+
+  factory FakeDesktopCoreTransport.connected({
+    String address = 'test-address',
+    int? pid = 1234,
+  }) {
+    final transport = FakeDesktopCoreTransport(
+      address: address,
+      state: DesktopTransportState.connected,
+    );
+    transport._connection = TransportConnected(pid: pid, generation: 1);
+    return transport;
+  }
+
+  @override
+  Stream<DesktopTransportEvent> get events => _eventController.stream;
+
+  @override
+  Stream<Uint8List> get frames => _frameController.stream;
+
+  @override
+  Future<void> open() async {
+    if (state == DesktopTransportState.closed) {
+      throw StateError('IPC transport is closed');
+    }
+    if (state == DesktopTransportState.ready ||
+        state == DesktopTransportState.connected) {
+      return;
+    }
+    state = DesktopTransportState.starting;
+    final event = await events.firstWhere(
+      (event) => event is TransportReady || event is TransportFailed,
+    );
+    if (event case TransportFailed(:final error, :final stackTrace)) {
+      Error.throwWithStackTrace(error, stackTrace);
+    }
+  }
+
+  void ready() {
+    state = DesktopTransportState.ready;
+    _eventController.add(const TransportReady());
+  }
+
+  void connect({int? pid, int generation = 1}) {
+    final connection = TransportConnected(pid: pid, generation: generation);
+    _connection = connection;
+    state = DesktopTransportState.connected;
+    _eventController.add(connection);
+  }
+
+  void disconnect(int generation) {
+    if (_connection?.generation == generation) {
+      _connection = null;
+      state = DesktopTransportState.ready;
+    }
+    _eventController.add(TransportDisconnected(generation));
+  }
+
+  void addJson(Map<String, Object?> value) {
+    addFrame(Uint8List.fromList(utf8.encode(jsonEncode(value))));
+  }
+
+  void addFrame(Uint8List value) {
+    _frameController.add(value);
+  }
+
+  void fail(Object error, [StackTrace? stackTrace]) {
+    state = DesktopTransportState.failed;
+    _failure = TransportFailed(error, stackTrace ?? StackTrace.current);
+    _eventController.add(_failure!);
+  }
+
+  @override
+  Future<TransportConnected> waitUntilConnected(Duration timeout) {
+    final connection = _connection;
+    if (connection != null) {
+      return Future.value(connection);
+    }
+    final failure = _failure;
+    if (failure != null) {
+      return Future.error(failure.error, failure.stackTrace);
+    }
+    return events
+        .firstWhere(
+          (event) => event is TransportConnected || event is TransportFailed,
+        )
+        .then<TransportConnected>((event) {
+          if (event case TransportConnected()) {
+            return event;
+          }
+          final failure = event as TransportFailed;
+          Error.throwWithStackTrace(failure.error, failure.stackTrace);
+        })
+        .timeout(timeout);
+  }
+
+  @override
+  Future<void> send(String message) async {
+    if (state == DesktopTransportState.closed) {
+      throw StateError('IPC transport is closed');
+    }
+    final error = sendError;
+    if (error != null) {
+      throw error;
+    }
+    sentMessages.add(message);
+  }
+
+  @override
+  Future<void> close() {
+    return _closeOperation ??= _close();
+  }
+
+  Future<void> _close() async {
+    closeCount++;
+    state = DesktopTransportState.closed;
+    _connection = null;
+    await _eventController.close();
+    await _frameController.close();
+    if (!_closed.isCompleted) {
+      _closed.complete();
+    }
+    final error = closeError;
+    if (error != null) {
+      throw error;
+    }
+  }
+
+  Future<void> get closed => _closed.future;
+}
+
+final class FakeProcessLease implements CoreProcessLease {
+  @override
+  final String sessionId;
+
+  @override
+  final CoreProcessOwner owner;
+
+  @override
+  final int pid;
+
+  CoreProcessStopResult stopResult;
+  Completer<void>? stopGate;
+  final Completer<void> _stopStarted = Completer<void>();
+  int stopCount = 0;
+
+  FakeProcessLease({
+    required this.owner,
+    required this.pid,
+    this.sessionId = '0123456789abcdef0123456789abcdef',
+    this.stopResult = const CoreProcessStopResult(
+      stopped: true,
+      exitConfirmed: true,
+    ),
+  });
+
+  Future<void> get stopStarted => _stopStarted.future;
+
+  @override
+  Future<CoreProcessStopResult> stop(Duration timeout) async {
+    stopCount++;
+    if (!_stopStarted.isCompleted) {
+      _stopStarted.complete();
+    }
+    await stopGate?.future;
+    return stopResult;
+  }
+}
+
+final class FakeLauncher implements CoreProcessLauncher {
+  final FakeProcessLease lease;
+  Completer<void>? startGate;
+  final Completer<void> _started = Completer<void>();
+  int startCount = 0;
+
+  FakeLauncher({required CoreProcessOwner owner, required int pid})
+    : lease = FakeProcessLease(owner: owner, pid: pid);
+
+  FakeLauncher.withLease(this.lease);
+
+  @override
+  CoreProcessOwner get owner => lease.owner;
+
+  Future<void> get started => _started.future;
+
+  @override
+  Future<CoreProcessLease> start({
+    required String sessionId,
+    required String address,
+  }) async {
+    startCount++;
+    if (!_started.isCompleted) {
+      _started.complete();
+    }
+    await startGate?.future;
+    return lease;
+  }
+}
+
+final class MutableLauncherResolver implements DesktopCoreLauncherResolver {
+  CoreProcessLauncher launcher;
+  int resolveCount = 0;
+
+  MutableLauncherResolver(this.launcher);
+
+  @override
+  Future<CoreProcessLauncher> resolve() async {
+    resolveCount++;
+    return launcher;
+  }
+}
diff --git a/test/core/desktop/helper_client_test.dart b/test/core/desktop/helper_client_test.dart
new file mode 100644
index 0000000000..9552a8f2cd
--- /dev/null
+++ b/test/core/desktop/helper_client_test.dart
@@ -0,0 +1,346 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:dio/dio.dart';
+import 'package:fl_clash/common/constant.dart';
+import 'package:fl_clash/core/desktop/helper_client.dart';
+import 'package:fl_clash/core/desktop/model.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'fakes.dart';
+
+const _sessionId = '0123456789abcdef0123456789abcdef';
+
+void main() {
+  test(
+    'start returns a Helper lease identity with matching session and PID',
+    () async {
+      final adapter = _ResponseAdapter((options) {
+        expect(options.path, endsWith('/start'));
+        expect(options.data, {
+          'address': r'\\.\pipe\FlClashCore_abc',
+          'sessionId': _sessionId,
+        });
+        return _jsonResponse({'sessionId': _sessionId, 'pid': 6456});
+      });
+      final client = _client(adapter);
+
+      final response = await client.start(
+        address: r'\\.\pipe\FlClashCore_abc',
+        sessionId: _sessionId,
+      );
+
+      expect(response.pid, 6456);
+      expect(response.sessionId, _sessionId);
+    },
+  );
+
+  test('start rejects a response for another session', () async {
+    final client = _client(
+      _ResponseAdapter(
+        (_) => _jsonResponse({
+          'sessionId': 'fedcba9876543210fedcba9876543210',
+          'pid': 6456,
+        }),
+      ),
+    );
+
+    await expectLater(
+      client.start(address: 'test-address', sessionId: _sessionId),
+      throwsA(
+        isA<WindowsHelperException>().having(
+          (error) => error.code,
+          'code',
+          'invalidResponse',
+        ),
+      ),
+    );
+  });
+
+  test('matching stop parses a confirmed response', () async {
+    final adapter = _ResponseAdapter((options) {
+      expect(options.path, endsWith('/stop'));
+      expect(options.data, {'sessionId': _sessionId});
+      return _jsonResponse({'sessionId': _sessionId, 'stopped': true});
+    });
+    final client = _client(adapter);
+
+    final response = await client.stop(_sessionId);
+
+    expect(response.sessionId, _sessionId);
+    expect(response.stopped, isTrue);
+    expect(response.reason, isNull);
+  });
+
+  test('stop rejects an unknown unconfirmed reason', () async {
+    final client = _client(
+      _ResponseAdapter(
+        (_) => _jsonResponse({
+          'sessionId': _sessionId,
+          'stopped': false,
+          'reason': 'unknown',
+        }),
+      ),
+    );
+
+    await expectLater(
+      client.stop(_sessionId),
+      throwsA(
+        isA<WindowsHelperException>().having(
+          (error) => error.code,
+          'code',
+          'invalidResponse',
+        ),
+      ),
+    );
+  });
+
+  test('session mismatch is typed and never reported as stopped', () async {
+    final client = _client(
+      _ResponseAdapter(
+        (_) => _jsonResponse({
+          'sessionId': _sessionId,
+          'stopped': false,
+          'reason': 'sessionMismatch',
+        }, statusCode: 409),
+      ),
+    );
+
+    await expectLater(
+      client.stop(_sessionId),
+      throwsA(
+        isA<WindowsHelperException>().having(
+          (error) => error.code,
+          'code',
+          'sessionMismatch',
+        ),
+      ),
+    );
+  });
+
+  test('Helper lease stops only its immutable session', () async {
+    final requestedSessions = <Object?>[];
+    final client = _client(
+      _ResponseAdapter((options) {
+        if (options.path.endsWith('/start')) {
+          return _jsonResponse({'sessionId': _sessionId, 'pid': 6456});
+        }
+        requestedSessions.add(options.data);
+        return _jsonResponse({
+          'sessionId': _sessionId,
+          'stopped': false,
+          'reason': 'notRunning',
+        });
+      }),
+    );
+    final launcher = WindowsHelperLauncher(client);
+    final lease = await launcher.start(
+      sessionId: _sessionId,
+      address: 'test-address',
+    );
+
+    final result = await lease.stop(const Duration(seconds: 1));
+
+    expect(lease.owner, CoreProcessOwner.windowsHelper);
+    expect(lease.pid, 6456);
+    expect(requestedSessions, [
+      {'sessionId': _sessionId},
+    ]);
+    expect(result.stopped, isFalse);
+    expect(result.exitConfirmed, isTrue);
+  });
+
+  test('Helper lease retries stop after a transport failure', () async {
+    var stopRequests = 0;
+    final client = _client(
+      _ResponseAdapter((options) {
+        if (options.path.endsWith('/start')) {
+          return _jsonResponse({'sessionId': _sessionId, 'pid': 6456});
+        }
+        stopRequests++;
+        if (stopRequests == 1) {
+          throw DioException(
+            requestOptions: options,
+            type: DioExceptionType.connectionError,
+          );
+        }
+        return _jsonResponse({
+          'sessionId': _sessionId,
+          'stopped': false,
+          'reason': 'notRunning',
+        });
+      }),
+    );
+    final launcher = WindowsHelperLauncher(client);
+    final lease = await launcher.start(
+      sessionId: _sessionId,
+      address: 'test-address',
+    );
+
+    await expectLater(
+      lease.stop(const Duration(seconds: 1)),
+      throwsA(
+        isA<WindowsHelperException>().having(
+          (error) => error.code,
+          'code',
+          'transportError',
+        ),
+      ),
+    );
+    final result = await lease.stop(const Duration(seconds: 1));
+
+    expect(stopRequests, 2);
+    expect(result.stopped, isFalse);
+    expect(result.exitConfirmed, isTrue);
+  });
+
+  test(
+    'Helper launcher compensates an uncertain start with exact stop',
+    () async {
+      final requests = <RequestOptions>[];
+      final client = _client(
+        _ResponseAdapter((options) {
+          requests.add(options);
+          if (options.path.endsWith('/start')) {
+            throw DioException(
+              requestOptions: options,
+              type: DioExceptionType.connectionError,
+            );
+          }
+          return _jsonResponse({
+            'sessionId': _sessionId,
+            'stopped': false,
+            'reason': 'notRunning',
+          });
+        }),
+      );
+      final launcher = WindowsHelperLauncher(client);
+
+      await expectLater(
+        launcher.start(sessionId: _sessionId, address: 'test-address'),
+        throwsA(isA<WindowsHelperException>()),
+      );
+
+      expect(requests.map((request) => request.path), [
+        endsWith('/start'),
+        endsWith('/stop'),
+      ]);
+      expect(requests.last.data, {'sessionId': _sessionId});
+    },
+  );
+
+  test('ping requires protocol 5 and the expected Helper path', () async {
+    final adapter = _ResponseAdapter(
+      (_) => ResponseBody.fromString(
+        r'C:\Program Files\FlClash\FlClashHelperService.exe',
+        200,
+        headers: {
+          helperProtocolVersionHeader: [helperProtocolVersion],
+          Headers.contentTypeHeader: ['text/plain'],
+        },
+      ),
+    );
+    final client = _client(
+      adapter,
+      expectedHelperPath: () =>
+          r'C:\Program Files\FlClash\FlClashHelperService.exe',
+    );
+
+    expect(await client.isReady(), isTrue);
+  });
+
+  test('invalid session IDs are rejected before the request', () async {
+    final adapter = _ResponseAdapter(
+      (_) => _jsonResponse({'sessionId': _sessionId, 'pid': 1}),
+    );
+    final client = _client(adapter);
+
+    await expectLater(
+      client.start(address: 'test-address', sessionId: 'ABCDEF'),
+      throwsA(isA<WindowsHelperException>()),
+    );
+    expect(adapter.requestCount, 0);
+  });
+
+  test(
+    'Windows launcher resolver uses Helper only while it is ready',
+    () async {
+      final direct = FakeLauncher(owner: CoreProcessOwner.direct, pid: 1);
+      final helper = FakeLauncher(
+        owner: CoreProcessOwner.windowsHelper,
+        pid: 2,
+      );
+      var helperReady = true;
+      final resolver = WindowsHelperLauncherResolver(
+        isWindows: true,
+        directLauncher: direct,
+        helperLauncher: helper,
+        helperReady: () async => helperReady,
+      );
+
+      expect(await resolver.resolve(), same(helper));
+      helperReady = false;
+      expect(await resolver.resolve(), same(direct));
+    },
+  );
+
+  test('non-Windows launcher resolver never probes Helper', () async {
+    final direct = FakeLauncher(owner: CoreProcessOwner.direct, pid: 1);
+    final helper = FakeLauncher(owner: CoreProcessOwner.windowsHelper, pid: 2);
+    var readyCalls = 0;
+    final resolver = WindowsHelperLauncherResolver(
+      isWindows: false,
+      directLauncher: direct,
+      helperLauncher: helper,
+      helperReady: () async {
+        readyCalls++;
+        return true;
+      },
+    );
+
+    expect(await resolver.resolve(), same(direct));
+    expect(readyCalls, 0);
+  });
+}
+
+WindowsHelperClient _client(
+  _ResponseAdapter adapter, {
+  String Function()? expectedHelperPath,
+}) {
+  final dio = Dio()..httpClientAdapter = adapter;
+  return WindowsHelperClient(
+    dio: dio,
+    expectedHelperPath: expectedHelperPath ?? () => r'C:\Helper.exe',
+  );
+}
+
+ResponseBody _jsonResponse(Map<String, Object?> body, {int statusCode = 200}) {
+  return ResponseBody.fromString(
+    jsonEncode(body),
+    statusCode,
+    headers: {
+      Headers.contentTypeHeader: ['application/json'],
+    },
+  );
+}
+
+final class _ResponseAdapter implements HttpClientAdapter {
+  final ResponseBody Function(RequestOptions options) response;
+  int requestCount = 0;
+
+  _ResponseAdapter(this.response);
+
+  @override
+  Future<ResponseBody> fetch(
+    RequestOptions options,
+    Stream<Uint8List>? requestStream,
+    Future<void>? cancelFuture,
+  ) async {
+    requestCount++;
+    return response(options);
+  }
+
+  @override
+  void close({bool force = false}) {}
+}
diff --git a/test/core/desktop/launcher_test.dart b/test/core/desktop/launcher_test.dart
new file mode 100644
index 0000000000..bc13df6c38
--- /dev/null
+++ b/test/core/desktop/launcher_test.dart
@@ -0,0 +1,108 @@
+import 'dart:async';
+import 'dart:io';
+
+import 'package:fl_clash/core/desktop/launcher.dart';
+import 'package:fl_clash/core/desktop/model.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('createCoreSessionId returns lowercase 128-bit hex', () {
+    expect(createCoreSessionId(), matches(RegExp(r'^[0-9a-f]{32}$')));
+  });
+
+  test('direct lease kills and confirms the owned process exit', () async {
+    final process = _FakeProcess(pid: 42, exitCode: Future.value(0));
+    String? executable;
+    List<String>? arguments;
+    final launcher = DirectCoreLauncher(
+      startProcess: (value, valueArguments) async {
+        executable = value;
+        arguments = valueArguments;
+        return process;
+      },
+      corePath: 'FlClashCore',
+    );
+
+    final lease = await launcher.start(
+      sessionId: '0123456789abcdef0123456789abcdef',
+      address: 'test-address',
+    );
+    final result = await lease.stop(const Duration(seconds: 1));
+
+    expect(lease.owner, CoreProcessOwner.direct);
+    expect(lease.pid, 42);
+    expect(executable, 'FlClashCore');
+    expect(arguments, ['test-address']);
+    expect(process.killed, isTrue);
+    expect(
+      result,
+      const CoreProcessStopResult(stopped: true, exitConfirmed: true),
+    );
+  });
+
+  test('direct lease reports an unconfirmed exit after timeout', () async {
+    final process = _FakeProcess(pid: 42, exitCode: Completer<int>().future);
+    final launcher = DirectCoreLauncher(
+      startProcess: (_, _) async => process,
+      corePath: 'FlClashCore',
+    );
+    final lease = await launcher.start(
+      sessionId: '0123456789abcdef0123456789abcdef',
+      address: 'test-address',
+    );
+
+    final result = await lease.stop(Duration.zero);
+
+    expect(result.stopped, isTrue);
+    expect(result.exitConfirmed, isFalse);
+  });
+
+  test('direct lease rechecks exit after an unconfirmed timeout', () async {
+    final exitCode = Completer<int>();
+    final process = _FakeProcess(pid: 42, exitCode: exitCode.future);
+    final launcher = DirectCoreLauncher(
+      startProcess: (_, _) async => process,
+      corePath: 'FlClashCore',
+    );
+    final lease = await launcher.start(
+      sessionId: '0123456789abcdef0123456789abcdef',
+      address: 'test-address',
+    );
+
+    final firstResult = await lease.stop(Duration.zero);
+    exitCode.complete(0);
+    final secondResult = await lease.stop(const Duration(seconds: 1));
+
+    expect(firstResult.exitConfirmed, isFalse);
+    expect(secondResult.exitConfirmed, isTrue);
+  });
+}
+
+class _FakeProcess implements Process {
+  @override
+  final int pid;
+
+  @override
+  final Future<int> exitCode;
+
+  @override
+  final Stream<List<int>> stdout = const Stream.empty();
+
+  @override
+  final Stream<List<int>> stderr = const Stream.empty();
+
+  bool killed = false;
+
+  _FakeProcess({required this.pid, required this.exitCode});
+
+  @override
+  bool kill([ProcessSignal signal = ProcessSignal.sigterm]) {
+    killed = true;
+    return true;
+  }
+
+  @override
+  dynamic noSuchMethod(Invocation invocation) {
+    return super.noSuchMethod(invocation);
+  }
+}
diff --git a/test/core/desktop/lifecycle_test.dart b/test/core/desktop/lifecycle_test.dart
new file mode 100644
index 0000000000..081e92c95e
--- /dev/null
+++ b/test/core/desktop/lifecycle_test.dart
@@ -0,0 +1,498 @@
+import 'dart:async';
+
+import 'package:fl_clash/core/desktop/lifecycle.dart';
+import 'package:fl_clash/core/desktop/model.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'fakes.dart';
+
+const _sessionId = '0123456789abcdef0123456789abcdef';
+
+void main() {
+  test(
+    'publishes running only after ready, launch, connection, and PID match',
+    () async {
+      final transport = FakeDesktopCoreTransport();
+      final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+      final lifecycle = _createLifecycle(
+        transport: transport,
+        resolver: MutableLauncherResolver(launcher),
+      );
+
+      final start = lifecycle.start();
+      expect(lifecycle.state, isA<DesktopCoreStarting>());
+      transport.ready();
+      await launcher.started;
+      expect(lifecycle.state, isNot(isA<DesktopCoreRunning>()));
+      transport.connect(pid: 42, generation: 1);
+
+      final result = await start;
+      expect(result.session?.owner, CoreProcessOwner.direct);
+      expect(result.session?.connectionGeneration, 1);
+      expect(lifecycle.state, isA<DesktopCoreRunning>());
+      await _closeRunning(lifecycle, transport, launcher.lease, 1);
+    },
+  );
+
+  test(
+    'restart stops the App-owned lease before resolving Helper ownership',
+    () async {
+      final transport = FakeDesktopCoreTransport();
+      final direct = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+      final helper = FakeLauncher(
+        owner: CoreProcessOwner.windowsHelper,
+        pid: 84,
+      );
+      final resolver = MutableLauncherResolver(direct);
+      final lifecycle = _createLifecycle(
+        transport: transport,
+        resolver: resolver,
+      );
+      await _startConnected(lifecycle, transport, direct, pid: 42);
+      resolver.launcher = helper;
+
+      final restart = lifecycle.restart();
+      await direct.lease.stopStarted;
+      expect(helper.startCount, 0);
+      transport.disconnect(1);
+      await helper.started;
+      transport.connect(pid: 84, generation: 2);
+
+      final result = await restart;
+      expect(direct.lease.stopCount, 1);
+      expect(result.session?.owner, CoreProcessOwner.windowsHelper);
+      expect(helper.lease.stopCount, 0);
+      await _closeRunning(lifecycle, transport, helper.lease, 2);
+    },
+  );
+
+  test('concurrent restarts coalesce behind one replacement', () async {
+    final transport = FakeDesktopCoreTransport();
+    final direct = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+    final helper = FakeLauncher(owner: CoreProcessOwner.windowsHelper, pid: 84);
+    final resolver = MutableLauncherResolver(direct);
+    final lifecycle = _createLifecycle(
+      transport: transport,
+      resolver: resolver,
+    );
+    await _startConnected(lifecycle, transport, direct, pid: 42);
+    direct.lease.stopGate = Completer<void>();
+    resolver.launcher = helper;
+
+    final first = lifecycle.restart();
+    await direct.lease.stopStarted;
+    final second = lifecycle.restart();
+    await pumpEventQueue();
+    expect(direct.lease.stopCount, 1);
+
+    transport.disconnect(1);
+    direct.lease.stopGate!.complete();
+    await helper.started;
+    transport.connect(pid: 84, generation: 2);
+
+    final results = await Future.wait([first, second]);
+    expect(helper.startCount, 1);
+    expect(results[0].session, same(results[1].session));
+    expect(results[0].outcome, CoreLifecycleOutcome.coalesced);
+    expect(results[1].outcome, CoreLifecycleOutcome.applied);
+    await _closeRunning(lifecycle, transport, helper.lease, 2);
+  });
+
+  test('close supersedes an in-flight start and cleans its lease', () async {
+    final transport = FakeDesktopCoreTransport();
+    final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+    final lifecycle = _createLifecycle(
+      transport: transport,
+      resolver: MutableLauncherResolver(launcher),
+    );
+    final states = <DesktopCoreState>[];
+    final subscription = lifecycle.states.listen(states.add);
+
+    final start = lifecycle.start();
+    transport.ready();
+    await launcher.started;
+    final close = lifecycle.close();
+    transport.connect(pid: 42, generation: 1);
+
+    final startResult = await start;
+    await close;
+    expect(startResult.outcome, CoreLifecycleOutcome.superseded);
+    expect(launcher.lease.stopCount, 1);
+    expect(states.whereType<DesktopCoreRunning>(), isEmpty);
+    expect(lifecycle.state, isA<DesktopCoreClosed>());
+    await subscription.cancel();
+  });
+
+  test('stop supersedes an in-flight start and publishes idle', () async {
+    final transport = FakeDesktopCoreTransport();
+    final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+    final lifecycle = _createLifecycle(
+      transport: transport,
+      resolver: MutableLauncherResolver(launcher),
+    );
+
+    final start = lifecycle.start();
+    expect(lifecycle.state, isA<DesktopCoreStarting>());
+    final stop = lifecycle.stop();
+
+    final results = await Future.wait([start, stop]);
+    expect(results[0].outcome, CoreLifecycleOutcome.superseded);
+    expect(results[1].outcome, CoreLifecycleOutcome.applied);
+    expect(lifecycle.state, isA<DesktopCoreIdle>());
+    expect(launcher.startCount, 0);
+    await lifecycle.close();
+  });
+
+  test(
+    'terminal close failure settles once instead of retrying forever',
+    () async {
+      final transport = FakeDesktopCoreTransport()
+        ..closeError = StateError('close failed');
+      final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+      final lifecycle = _createLifecycle(
+        transport: transport,
+        resolver: MutableLauncherResolver(launcher),
+      );
+
+      final close = lifecycle.close();
+      await expectLater(
+        close,
+        throwsA(
+          isA<DesktopCoreFailure>().having(
+            (error) => error.code,
+            'code',
+            'lifecycle_error',
+          ),
+        ),
+      );
+
+      expect(lifecycle.state, isA<DesktopCoreFailed>());
+      expect(identical(lifecycle.close(), close), isTrue);
+      expect(transport.closeCount, 1);
+    },
+  );
+
+  test('expected disconnect does not emit crash', () async {
+    final transport = FakeDesktopCoreTransport();
+    final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+    final lifecycle = _createLifecycle(
+      transport: transport,
+      resolver: MutableLauncherResolver(launcher),
+    );
+    await _startConnected(lifecycle, transport, launcher, pid: 42);
+    final crashes = <DesktopCoreFailure>[];
+    final subscription = lifecycle.crashEvents.listen(crashes.add);
+
+    final stop = lifecycle.stop();
+    await launcher.lease.stopStarted;
+    transport.disconnect(1);
+    await stop;
+
+    expect(crashes, isEmpty);
+    expect(lifecycle.state, isA<DesktopCoreIdle>());
+    await subscription.cancel();
+    await lifecycle.close();
+  });
+
+  test(
+    'unexpected disconnect cleans one session and emits one crash',
+    () async {
+      final transport = FakeDesktopCoreTransport();
+      final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+      final lifecycle = _createLifecycle(
+        transport: transport,
+        resolver: MutableLauncherResolver(launcher),
+      );
+      await _startConnected(lifecycle, transport, launcher, pid: 42);
+      final crash = lifecycle.crashEvents.first;
+
+      transport.disconnect(1);
+
+      expect((await crash).code, 'unexpected_disconnect');
+      await launcher.lease.stopStarted;
+      await pumpEventQueue();
+      expect(launcher.lease.stopCount, 1);
+      expect(lifecycle.state, isA<DesktopCoreFailed>());
+      await lifecycle.close();
+    },
+  );
+
+  test('stale disconnect generation cannot stop the current session', () async {
+    final transport = FakeDesktopCoreTransport();
+    final direct = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+    final helper = FakeLauncher(owner: CoreProcessOwner.windowsHelper, pid: 84);
+    final resolver = MutableLauncherResolver(direct);
+    final lifecycle = _createLifecycle(
+      transport: transport,
+      resolver: resolver,
+    );
+    await _startConnected(lifecycle, transport, direct, pid: 42);
+    resolver.launcher = helper;
+    final restart = lifecycle.restart();
+    await direct.lease.stopStarted;
+    transport.disconnect(1);
+    await helper.started;
+    transport.connect(pid: 84, generation: 2);
+    await restart;
+
+    transport.disconnect(1);
+    await pumpEventQueue();
+
+    expect(lifecycle.state, isA<DesktopCoreRunning>());
+    expect(helper.lease.stopCount, 0);
+    await _closeRunning(lifecycle, transport, helper.lease, 2);
+  });
+
+  test('unconfirmed process exit blocks replacement start', () async {
+    final transport = FakeDesktopCoreTransport();
+    final direct = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+    direct.lease.stopResult = const CoreProcessStopResult(
+      stopped: true,
+      exitConfirmed: false,
+    );
+    final helper = FakeLauncher(owner: CoreProcessOwner.windowsHelper, pid: 84);
+    final resolver = MutableLauncherResolver(direct);
+    final lifecycle = _createLifecycle(
+      transport: transport,
+      resolver: resolver,
+    );
+    await _startConnected(lifecycle, transport, direct, pid: 42);
+    resolver.launcher = helper;
+
+    await expectLater(
+      lifecycle.restart(),
+      throwsA(
+        isA<DesktopCoreFailure>().having(
+          (error) => error.code,
+          'code',
+          'process_exit_unconfirmed',
+        ),
+      ),
+    );
+
+    expect(helper.startCount, 0);
+    expect(lifecycle.state, isA<DesktopCoreFailed>());
+    await lifecycle.close();
+  });
+
+  test(
+    'connection timeout cleans the lease returned by the launcher',
+    () async {
+      final transport = FakeDesktopCoreTransport();
+      final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+      final lifecycle = DesktopCoreLifecycle(
+        transportFactory: () => transport,
+        launcherResolver: MutableLauncherResolver(launcher),
+        sessionIdFactory: () => _sessionId,
+        verifyPeerPid: true,
+        timeouts: const DesktopCoreTimeouts(
+          ready: Duration(seconds: 1),
+          connection: Duration(milliseconds: 10),
+          disconnection: Duration(seconds: 1),
+        ),
+      );
+
+      final start = lifecycle.start();
+      transport.ready();
+      await launcher.started;
+
+      await expectLater(
+        start,
+        throwsA(
+          isA<DesktopCoreFailure>().having(
+            (error) => error.code,
+            'code',
+            'start_failed',
+          ),
+        ),
+      );
+      expect(launcher.lease.stopCount, 1);
+      await lifecycle.close();
+    },
+  );
+
+  test(
+    'confirmed exit without disconnect replaces transport before restart',
+    () async {
+      final transports = <FakeDesktopCoreTransport>[];
+      FakeDesktopCoreTransport createTransport() {
+        final transport = FakeDesktopCoreTransport(
+          address: 'test-address-${transports.length + 1}',
+        );
+        transports.add(transport);
+        return transport;
+      }
+
+      final direct = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+      final helper = FakeLauncher(
+        owner: CoreProcessOwner.windowsHelper,
+        pid: 84,
+      );
+      final resolver = MutableLauncherResolver(direct);
+      final lifecycle = DesktopCoreLifecycle(
+        transportFactory: createTransport,
+        launcherResolver: resolver,
+        sessionIdFactory: () => _sessionId,
+        verifyPeerPid: true,
+        timeouts: const DesktopCoreTimeouts(
+          ready: Duration(seconds: 1),
+          connection: Duration(seconds: 1),
+          disconnection: Duration(milliseconds: 10),
+        ),
+      );
+      final firstTransport = transports.single;
+      await _startConnected(lifecycle, firstTransport, direct, pid: 42);
+      resolver.launcher = helper;
+
+      final restart = lifecycle.restart();
+      await firstTransport.closed;
+      expect(transports, hasLength(2));
+      final replacement = transports.last;
+      replacement.ready();
+      await helper.started;
+      replacement.connect(pid: 84, generation: 1);
+
+      final result = await restart;
+      expect(result.session?.owner, CoreProcessOwner.windowsHelper);
+      expect(firstTransport.closeCount, 1);
+      await _closeRunning(lifecycle, replacement, helper.lease, 1);
+    },
+  );
+
+  test(
+    'confirmed exit without disconnect replaces transport during stop',
+    () async {
+      final transports = <FakeDesktopCoreTransport>[];
+      FakeDesktopCoreTransport createTransport() {
+        final transport = FakeDesktopCoreTransport(
+          address: 'test-address-${transports.length + 1}',
+        );
+        transports.add(transport);
+        return transport;
+      }
+
+      final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42);
+      final lifecycle = DesktopCoreLifecycle(
+        transportFactory: createTransport,
+        launcherResolver: MutableLauncherResolver(launcher),
+        sessionIdFactory: () => _sessionId,
+        verifyPeerPid: true,
+        timeouts: const DesktopCoreTimeouts(
+          ready: Duration(seconds: 1),
+          connection: Duration(seconds: 1),
+          disconnection: Duration(milliseconds: 10),
+        ),
+      );
+      final firstTransport = transports.single;
+      await _startConnected(lifecycle, firstTransport, launcher, pid: 42);
+
+      await lifecycle.stop();
+
+      expect(firstTransport.closeCount, 1);
+      expect(transports, hasLength(2));
+      expect(lifecycle.state, isA<DesktopCoreIdle>());
+      await lifecycle.close();
+    },
+  );
+
+  test('PID mismatch cleans the launched lease', () async {
+    final transport = FakeDesktopCoreTransport();
+    final launcher = FakeLauncher(
+      owner: CoreProcessOwner.windowsHelper,
+      pid: 42,
+    );
+    final lifecycle = _createLifecycle(
+      transport: transport,
+      resolver: MutableLauncherResolver(launcher),
+    );
+
+    final start = lifecycle.start();
+    transport.ready();
+    await launcher.started;
+    transport.connect(pid: 84, generation: 1);
+
+    await expectLater(
+      start,
+      throwsA(
+        isA<DesktopCoreFailure>().having(
+          (error) => error.code,
+          'code',
+          'peer_pid_mismatch',
+        ),
+      ),
+    );
+    expect(launcher.lease.stopCount, 1);
+    await lifecycle.close();
+  });
+
+  test(
+    'connection timeout while launcher is pending is handled once',
+    () async {
+      final transport = FakeDesktopCoreTransport();
+      final launcher = FakeLauncher(owner: CoreProcessOwner.direct, pid: 42)
+        ..startGate = Completer<void>();
+      final lifecycle = DesktopCoreLifecycle(
+        transportFactory: () => transport,
+        launcherResolver: MutableLauncherResolver(launcher),
+        sessionIdFactory: () => _sessionId,
+        timeouts: const DesktopCoreTimeouts(
+          ready: Duration(seconds: 1),
+          connection: Duration(milliseconds: 10),
+          disconnection: Duration(seconds: 1),
+        ),
+      );
+
+      final start = lifecycle.start();
+      transport.ready();
+      await launcher.started;
+      await Future<void>.delayed(const Duration(milliseconds: 20));
+      launcher.startGate!.complete();
+
+      await expectLater(start, throwsA(isA<DesktopCoreFailure>()));
+      expect(launcher.lease.stopCount, 1);
+      await lifecycle.close();
+    },
+  );
+}
+
+DesktopCoreLifecycle _createLifecycle({
+  required FakeDesktopCoreTransport transport,
+  required MutableLauncherResolver resolver,
+}) {
+  return DesktopCoreLifecycle(
+    transportFactory: () => transport,
+    launcherResolver: resolver,
+    sessionIdFactory: () => _sessionId,
+    verifyPeerPid: true,
+    timeouts: const DesktopCoreTimeouts(
+      ready: Duration(seconds: 1),
+      connection: Duration(seconds: 1),
+      disconnection: Duration(seconds: 1),
+    ),
+  );
+}
+
+Future<CoreLifecycleResult> _startConnected(
+  DesktopCoreLifecycle lifecycle,
+  FakeDesktopCoreTransport transport,
+  FakeLauncher launcher, {
+  required int pid,
+}) async {
+  final start = lifecycle.start();
+  transport.ready();
+  await launcher.started;
+  transport.connect(pid: pid, generation: 1);
+  return start;
+}
+
+Future<void> _closeRunning(
+  DesktopCoreLifecycle lifecycle,
+  FakeDesktopCoreTransport transport,
+  FakeProcessLease lease,
+  int generation,
+) async {
+  final close = lifecycle.close();
+  await lease.stopStarted;
+  transport.disconnect(generation);
+  await close;
+}
diff --git a/test/core/desktop/rpc_client_test.dart b/test/core/desktop/rpc_client_test.dart
new file mode 100644
index 0000000000..f94aca3888
--- /dev/null
+++ b/test/core/desktop/rpc_client_test.dart
@@ -0,0 +1,206 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:fl_clash/core/desktop/rpc_client.dart';
+import 'package:fl_clash/core/event.dart';
+import 'package:fl_clash/core/method.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'fakes.dart';
+
+Future<Map<String, Object?>> _sentRequest(
+  FakeDesktopCoreTransport transport,
+) async {
+  await pumpEventQueue();
+  return jsonDecode(transport.sentMessages.single) as Map<String, Object?>;
+}
+
+void main() {
+  test('correlates a response and ignores a late duplicate', () async {
+    final transport = FakeDesktopCoreTransport.connected();
+    final client = CoreRpcClient(transport);
+    final invocation = client.invoke<bool>(method: CoreMethod.getIsInit);
+    final request = await _sentRequest(transport);
+
+    transport.addJson({'id': request['id'], 'result': true});
+    expect(await invocation, isTrue);
+    transport.addJson({'id': request['id'], 'result': false});
+    await pumpEventQueue();
+
+    expect(client.pendingCount, 0);
+    await client.close();
+    await transport.close();
+  });
+
+  test('disconnect fails every pending request exactly once', () async {
+    final transport = FakeDesktopCoreTransport.connected();
+    final client = CoreRpcClient(transport);
+    final invocation = client.invoke<bool>(method: CoreMethod.getIsInit);
+    await _sentRequest(transport);
+
+    transport.disconnect(1);
+
+    await expectLater(
+      invocation,
+      throwsA(
+        isA<CoreMethodException>().having(
+          (error) => error.code,
+          'code',
+          'transport_disconnected',
+        ),
+      ),
+    );
+    expect(client.pendingCount, 0);
+    await client.close();
+    await transport.close();
+  });
+
+  test('maps a Core error envelope to CoreMethodException', () async {
+    final transport = FakeDesktopCoreTransport.connected();
+    final client = CoreRpcClient(transport);
+    final invocation = client.invoke<bool>(method: CoreMethod.getIsInit);
+    final request = await _sentRequest(transport);
+
+    transport.addJson({
+      'id': request['id'],
+      'error': {
+        'code': 'core_error',
+        'message': 'Core rejected the request',
+        'details': 'details',
+      },
+    });
+
+    await expectLater(
+      invocation,
+      throwsA(
+        isA<CoreMethodException>()
+            .having((error) => error.code, 'code', 'core_error')
+            .having((error) => error.details, 'details', 'details'),
+      ),
+    );
+    await client.close();
+    await transport.close();
+  });
+
+  test('maps send failures to a transport error', () async {
+    final transport = FakeDesktopCoreTransport.connected()
+      ..sendError = StateError('send failed');
+    final client = CoreRpcClient(transport);
+
+    await expectLater(
+      client.invoke<bool>(method: CoreMethod.getIsInit),
+      throwsA(
+        isA<CoreMethodException>().having(
+          (error) => error.code,
+          'code',
+          'transport_error',
+        ),
+      ),
+    );
+    expect(client.pendingCount, 0);
+    await client.close();
+    await transport.close();
+  });
+
+  test('request timeout cleans only that pending request', () async {
+    final transport = FakeDesktopCoreTransport.connected();
+    final client = CoreRpcClient(transport);
+
+    final result = await client.invoke<bool>(
+      method: CoreMethod.getIsInit,
+      timeout: Duration.zero,
+    );
+
+    expect(result, isNull);
+    expect(client.pendingCount, 0);
+    await client.close();
+    await transport.close();
+  });
+
+  test('malformed data does not terminate response processing', () async {
+    final transport = FakeDesktopCoreTransport.connected();
+    final client = CoreRpcClient(transport);
+    transport.addFrame(Uint8List.fromList(utf8.encode('{invalid')));
+    final invocation = client.invoke<bool>(method: CoreMethod.getIsInit);
+    final request = await _sentRequest(transport);
+
+    transport.addJson({'id': request['id'], 'result': true});
+
+    expect(await invocation, isTrue);
+    await client.close();
+    await transport.close();
+  });
+
+  test('forwards Core message events', () async {
+    final transport = FakeDesktopCoreTransport.connected();
+    final client = CoreRpcClient(transport);
+    final listener = _LoadedListener();
+    coreEventManager.addListener(listener);
+
+    transport.addJson({
+      'method': CoreMethod.message.name,
+      'arguments': {'type': 'loaded', 'data': 'provider-a'},
+    });
+
+    expect(await listener.loaded.future, 'provider-a');
+    coreEventManager.removeListener(listener);
+    await client.close();
+    await transport.close();
+  });
+
+  test('close fails pending requests and is idempotent', () async {
+    final transport = FakeDesktopCoreTransport.connected();
+    final client = CoreRpcClient(transport);
+    final invocation = client.invoke<bool>(method: CoreMethod.getIsInit);
+    await _sentRequest(transport);
+
+    final failure = expectLater(
+      invocation,
+      throwsA(
+        isA<CoreMethodException>().having(
+          (error) => error.code,
+          'code',
+          'transport_disconnected',
+        ),
+      ),
+    );
+    await client.close();
+    await client.close();
+
+    await failure;
+    expect(client.pendingCount, 0);
+    await transport.close();
+  });
+
+  test('transport failure before connection fails without waiting', () async {
+    final transport = FakeDesktopCoreTransport();
+    final client = CoreRpcClient(transport);
+    final invocation = client.invoke<bool>(method: CoreMethod.getIsInit);
+
+    transport.fail(StateError('bind failed'));
+
+    await expectLater(
+      invocation,
+      throwsA(
+        isA<CoreMethodException>().having(
+          (error) => error.code,
+          'code',
+          'transport_error',
+        ),
+      ),
+    );
+    expect(client.pendingCount, 0);
+    await client.close();
+    await transport.close();
+  });
+}
+
+final class _LoadedListener with CoreEventListener {
+  final Completer<String> loaded = Completer<String>();
+
+  @override
+  void onLoaded(String providerName) {
+    loaded.complete(providerName);
+  }
+}
diff --git a/test/core/desktop/transport_test.dart b/test/core/desktop/transport_test.dart
new file mode 100644
index 0000000000..2eb034a2bd
--- /dev/null
+++ b/test/core/desktop/transport_test.dart
@@ -0,0 +1,279 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:fl_clash/core/desktop/transport.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'fakes.dart';
+
+Uint8List _frame(int type, [List<int> payload = const []]) {
+  return Uint8List.fromList([type, ...payload]);
+}
+
+Uint8List _processIdPayload(int processId) {
+  return Uint8List(4)
+    ..buffer.asByteData().setUint32(0, processId, Endian.little);
+}
+
+void main() {
+  group('IPCCoreTransport typed events', () {
+    late StreamController<Uint8List> rawEvents;
+    late List<List<int>> sentMessages;
+    late int stopCount;
+    late IPCCoreTransport transport;
+
+    setUp(() {
+      rawEvents = StreamController<Uint8List>();
+      sentMessages = [];
+      stopCount = 0;
+      transport = IPCCoreTransport(
+        address: 'test-address',
+        startServer: (_) => rawEvents.stream,
+        sendMessage: (data) async => sentMessages.add(data),
+        stopServer: () async => stopCount++,
+      );
+    });
+
+    tearDown(() async {
+      await transport.close();
+      if (!rawEvents.isClosed) {
+        await rawEvents.close();
+      }
+    });
+
+    test(
+      'emits ready, connected PID, frame, and disconnect generation',
+      () async {
+        final events = <DesktopTransportEvent>[];
+        final subscription = transport.events.listen(events.add);
+        final open = transport.open();
+        rawEvents.add(_frame(0x00));
+        await open;
+
+        final frame = transport.frames.first;
+        rawEvents.add(_frame(0x01, _processIdPayload(1234)));
+        rawEvents.add(_frame(0x03, utf8.encode('payload')));
+        expect(await frame, utf8.encode('payload'));
+        rawEvents.add(_frame(0x02));
+        await pumpEventQueue();
+
+        expect(events.whereType<TransportReady>(), hasLength(1));
+        expect(events.whereType<TransportConnected>().single.pid, 1234);
+        expect(events.whereType<TransportConnected>().single.generation, 1);
+        expect(events.whereType<TransportDisconnected>().single.generation, 1);
+        expect(transport.state, DesktopTransportState.ready);
+        await subscription.cancel();
+      },
+    );
+
+    test('waitUntilConnected waits for a typed connected event', () async {
+      final open = transport.open();
+      rawEvents.add(_frame(0x00));
+      await open;
+
+      final connected = transport.waitUntilConnected(
+        const Duration(seconds: 1),
+      );
+      rawEvents.add(_frame(0x01, _processIdPayload(4321)));
+
+      expect((await connected).pid, 4321);
+      expect(transport.state, DesktopTransportState.connected);
+    });
+
+    test('forwards outgoing messages after ready', () async {
+      final open = transport.open();
+      rawEvents.add(_frame(0x00));
+      await open;
+
+      await transport.send('hello');
+
+      expect(sentMessages, [utf8.encode('hello')]);
+    });
+
+    test('emits startup failure and fails open', () async {
+      final failures = transport.events
+          .where((event) => event is TransportFailed)
+          .cast<TransportFailed>()
+          .first;
+      final open = transport.open();
+      rawEvents.add(_frame(0x04, utf8.encode('bind failed')));
+
+      await expectLater(open, throwsA(isA<StateError>()));
+      expect((await failures).error.toString(), contains('bind failed'));
+      expect(transport.state, DesktopTransportState.failed);
+    });
+
+    test('fails when the Rust event stream closes before ready', () async {
+      final open = transport.open();
+      await rawEvents.close();
+
+      await expectLater(open, throwsA(isA<StateError>()));
+      expect(transport.state, DesktopTransportState.failed);
+    });
+
+    test('rejects an invalid connected process ID frame', () async {
+      final open = transport.open();
+      rawEvents.add(_frame(0x00));
+      await open;
+
+      final failure = transport.events
+          .where((event) => event is TransportFailed)
+          .cast<TransportFailed>()
+          .first;
+      rawEvents.add(_frame(0x01, [0x01]));
+
+      expect((await failure).error.toString(), contains('Invalid IPC'));
+      expect(transport.state, DesktopTransportState.failed);
+    });
+
+    test('propagates send failures', () async {
+      final failingTransport = IPCCoreTransport(
+        address: 'test-address',
+        startServer: (_) => rawEvents.stream,
+        sendMessage: (_) async => throw StateError('send failed'),
+        stopServer: () async => stopCount++,
+      );
+      final open = failingTransport.open();
+      rawEvents.add(_frame(0x00));
+      await open;
+
+      await expectLater(
+        failingTransport.send('hello'),
+        throwsA(
+          isA<StateError>().having(
+            (error) => error.message,
+            'message',
+            'send failed',
+          ),
+        ),
+      );
+      await failingTransport.close();
+    });
+
+    test('assigns a fresh generation after reconnecting', () async {
+      final open = transport.open();
+      rawEvents.add(_frame(0x00));
+      await open;
+
+      final connections = <TransportConnected>[];
+      final subscription = transport.events.listen((event) {
+        if (event is TransportConnected) {
+          connections.add(event);
+        }
+      });
+      rawEvents.add(_frame(0x01));
+      rawEvents.add(_frame(0x02));
+      rawEvents.add(_frame(0x01, _processIdPayload(4321)));
+      await pumpEventQueue();
+
+      expect(connections.map((event) => event.generation), [1, 2]);
+      expect(connections.last.pid, 4321);
+      await subscription.cancel();
+    });
+
+    test('close is idempotent', () async {
+      final open = transport.open();
+      rawEvents.add(_frame(0x00));
+      await open;
+
+      await transport.close();
+      await transport.close();
+
+      expect(stopCount, 1);
+      expect(transport.state, DesktopTransportState.closed);
+    });
+  });
+
+  test(
+    'transport binding forwards events after replacing its transport',
+    () async {
+      final firstEvents = StreamController<Uint8List>();
+      final secondEvents = StreamController<Uint8List>();
+      var firstStopCount = 0;
+      final first = IPCCoreTransport(
+        address: 'first',
+        startServer: (_) => firstEvents.stream,
+        sendMessage: (_) async {},
+        stopServer: () async => firstStopCount++,
+      );
+      final second = IPCCoreTransport(
+        address: 'second',
+        startServer: (_) => secondEvents.stream,
+        sendMessage: (_) async {},
+        stopServer: () async {},
+      );
+      final binding = DesktopCoreTransportBinding(first);
+      final connectedEvents = <TransportConnected>[];
+      final subscription = binding.events.listen((event) {
+        if (event is TransportConnected) {
+          connectedEvents.add(event);
+        }
+      });
+
+      final firstOpen = binding.open();
+      firstEvents.add(_frame(0x00));
+      await firstOpen;
+      await binding.replace(second);
+      final secondOpen = binding.open();
+      secondEvents.add(_frame(0x00));
+      await secondOpen;
+      secondEvents.add(_frame(0x01, _processIdPayload(5678)));
+      await pumpEventQueue();
+
+      expect(firstStopCount, 1);
+      expect(binding.address, 'second');
+      expect(connectedEvents.single.pid, 5678);
+
+      await subscription.cancel();
+      await binding.close();
+      await firstEvents.close();
+      await secondEvents.close();
+    },
+  );
+
+  test('replacing a connected transport emits a typed failure', () async {
+    final first = FakeDesktopCoreTransport.connected();
+    final second = FakeDesktopCoreTransport();
+    final binding = DesktopCoreTransportBinding(first);
+    final failure = binding.events
+        .where((event) => event is TransportFailed)
+        .cast<TransportFailed>()
+        .first;
+
+    await binding.replace(second);
+
+    expect((await failure).error.toString(), contains('replaced'));
+    await binding.close();
+  });
+
+  test(
+    'replacement remains usable when the old transport close fails',
+    () async {
+      final first = FakeDesktopCoreTransport()
+        ..closeError = StateError('close failed');
+      final second = FakeDesktopCoreTransport();
+      final binding = DesktopCoreTransportBinding(first);
+
+      await expectLater(
+        binding.replace(second),
+        throwsA(
+          isA<StateError>().having(
+            (error) => error.message,
+            'message',
+            'close failed',
+          ),
+        ),
+      );
+
+      expect(binding.address, second.address);
+      final ready = binding.events
+          .where((event) => event is TransportReady)
+          .cast<TransportReady>()
+          .first;
+      second.ready();
+      await ready;
+      await binding.close();
+    },
+  );
+}
diff --git a/test/core/protocol_contract_test.dart b/test/core/protocol_contract_test.dart
new file mode 100644
index 0000000000..b431ae09e0
--- /dev/null
+++ b/test/core/protocol_contract_test.dart
@@ -0,0 +1,287 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:fl_clash/core/event.dart';
+import 'package:fl_clash/core/desktop/model.dart';
+import 'package:fl_clash/core/interface.dart';
+import 'package:fl_clash/core/method.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+class _RecordingCoreHandler extends CoreHandlerInterface {
+  final Map<CoreMethod, Object?> calls = {};
+
+  @override
+  Future<CoreLifecycleResult> start() async => const CoreLifecycleResult(
+    revision: 1,
+    outcome: CoreLifecycleOutcome.applied,
+  );
+
+  @override
+  Future<CoreLifecycleResult> restart() => start();
+
+  @override
+  Future<CoreLifecycleResult> stop() => start();
+
+  @override
+  Future<CoreLifecycleResult> close() => start();
+
+  @override
+  Future<T?> invokeMethod<T>({
+    required CoreMethod method,
+    Object? arguments,
+    Duration? timeout,
+  }) async {
+    calls[method] = arguments;
+    final result = switch (method) {
+      CoreMethod.initClash => true as T,
+      CoreMethod.getTraffic ||
+      CoreMethod.getTotalTraffic => {'up': 12, 'down': 34},
+      CoreMethod.asyncTestDelay => {
+        'name': 'DIRECT',
+        'url': 'https://example.com',
+        'value': 42,
+      },
+      CoreMethod.getConnections => {
+        'connections': [
+          {
+            'id': 'connection-1',
+            'metadata': {'network': 'tcp'},
+            'upload': 0,
+            'download': 0,
+            'start': '2024-01-01',
+            'chains': ['DIRECT'],
+            'rule': 'DIRECT',
+            'rulePayload': '',
+          },
+        ],
+      },
+      CoreMethod.getExternalProviders => [
+        {
+          'name': 'provider-1',
+          'type': 'Proxy',
+          'count': 1,
+          'vehicle-type': 'HTTP',
+          'update-at': '2024-01-01T00:00:00.000Z',
+        },
+      ],
+      CoreMethod.getExternalProvider => {
+        'name': 'provider-1',
+        'type': 'Proxy',
+        'count': 1,
+        'vehicle-type': 'HTTP',
+        'update-at': '2024-01-01T00:00:00.000Z',
+      },
+      CoreMethod.getConfig => {
+        'mode': 'rule',
+        'rule': ['MATCH,DIRECT'],
+      },
+      CoreMethod.getMemory => 2048,
+      _ => '',
+    };
+    return result as T;
+  }
+}
+
+class _FailingConfigCoreHandler extends _RecordingCoreHandler {
+  @override
+  Future<T?> invokeMethod<T>({
+    required CoreMethod method,
+    Object? arguments,
+    Duration? timeout,
+  }) async {
+    if (method == CoreMethod.getConfig) {
+      throw const CoreMethodException(
+        code: 'core_error',
+        message: 'config not found',
+        details: {'path': '/missing.yaml'},
+      );
+    }
+    return super.invokeMethod(
+      method: method,
+      arguments: arguments,
+      timeout: timeout,
+    );
+  }
+}
+
+class _EmptyConfigCoreHandler extends _RecordingCoreHandler {
+  @override
+  Future<T?> invokeMethod<T>({
+    required CoreMethod method,
+    Object? arguments,
+    Duration? timeout,
+  }) async {
+    if (method == CoreMethod.getConfig) {
+      return null;
+    }
+    return super.invokeMethod(
+      method: method,
+      arguments: arguments,
+      timeout: timeout,
+    );
+  }
+}
+
+void main() {
+  test('method call keeps structured arguments', () async {
+    final fixture =
+        json.decode(
+              await File('test/fixtures/core_protocol.json').readAsString(),
+            )
+            as Map<String, dynamic>;
+    final call = CoreMethodCall.fromJson(
+      Map<String, Object?>.from(fixture['methodCall'] as Map),
+    );
+
+    expect(call.method, CoreMethod.updateConfig);
+    expect(call.arguments, isA<Map<String, dynamic>>());
+    expect((call.arguments as Map)['mixed-port'], 7890);
+    expect(call.toJson(), containsPair('arguments', call.arguments));
+    expect(call.toJson(), isNot(contains('data')));
+  });
+
+  test('core interface sends structured request parameters', () async {
+    final handler = _RecordingCoreHandler();
+
+    await handler.init(const InitParams(homeDir: '/tmp/flclash', version: 35));
+    await handler.setupConfig(
+      const SetupParams(selectedMap: {'GLOBAL': 'DIRECT'}, testUrl: 'test'),
+    );
+    await handler.changeProxy(
+      const ChangeProxyParams(groupName: 'GLOBAL', proxyName: 'DIRECT'),
+    );
+    await handler.sideLoadExternalProvider(providerName: 'provider', data: 'x');
+    await handler.asyncTestDelay('https://example.com', 'DIRECT');
+    await handler.clearEffect(42);
+
+    for (final method in [
+      CoreMethod.initClash,
+      CoreMethod.setupConfig,
+      CoreMethod.changeProxy,
+      CoreMethod.sideLoadExternalProvider,
+      CoreMethod.asyncTestDelay,
+    ]) {
+      expect(handler.calls[method], isA<Map>());
+    }
+    expect(handler.calls[CoreMethod.clearEffect], 42);
+  });
+
+  test('event contract accepts batches and legacy single events', () async {
+    final fixture =
+        json.decode(
+              await File('test/fixtures/core_protocol.json').readAsString(),
+            )
+            as Map<String, dynamic>;
+    final call = CoreMethodCall.fromJson(
+      Map<String, Object?>.from(fixture['eventCall'] as Map),
+    );
+
+    final events = coreEventsFromData(call.arguments);
+    expect(events, hasLength(2));
+    expect(events.first.type, CoreEventType.loaded);
+    expect(events.last.type, CoreEventType.delay);
+
+    final legacy = coreEventsFromData({'type': 'loaded', 'data': 'provider-b'});
+    expect(legacy.single.data, 'provider-b');
+  });
+
+  test('event contract skips malformed entries without dropping the batch', () {
+    final events = coreEventsFromData([
+      {'type': 'loaded', 'data': 'provider-a'},
+      {'type': 'invalid-event', 'data': null},
+      {'type': 'loaded', 'data': 'provider-b'},
+    ]);
+
+    expect(events.map((event) => event.data), ['provider-a', 'provider-b']);
+  });
+
+  test('core interface converts structured method results', () async {
+    final handler = _RecordingCoreHandler();
+
+    expect(await handler.getTraffic(false), const Traffic(up: 12, down: 34));
+    expect(
+      await handler.getTotalTraffic(false),
+      const Traffic(up: 12, down: 34),
+    );
+    expect(
+      await handler.asyncTestDelay('https://example.com', 'DIRECT'),
+      const Delay(name: 'DIRECT', url: 'https://example.com', value: 42),
+    );
+    expect((await handler.getConnections()).single.id, 'connection-1');
+    expect((await handler.getExternalProviders()).single.name, 'provider-1');
+    expect(
+      (await handler.getExternalProvider('provider-1'))?.name,
+      'provider-1',
+    );
+    expect(await handler.getConfig('/config.yaml'), {
+      'mode': 'rule',
+      'rule': ['MATCH,DIRECT'],
+    });
+    expect(await handler.getMemory(), 2048);
+  });
+
+  test('getConfig preserves structured core errors', () async {
+    final handler = _FailingConfigCoreHandler();
+
+    await expectLater(
+      handler.getConfig('/missing.yaml'),
+      throwsA(
+        isA<CoreMethodException>()
+            .having((error) => error.code, 'code', 'core_error')
+            .having((error) => error.details, 'details', {
+              'path': '/missing.yaml',
+            }),
+      ),
+    );
+  });
+
+  test('getConfig rejects empty transport results', () async {
+    final handler = _EmptyConfigCoreHandler();
+
+    await expectLater(
+      handler.getConfig('/config.yaml'),
+      throwsA(
+        isA<CoreMethodException>().having(
+          (error) => error.code,
+          'code',
+          'empty_result',
+        ),
+      ),
+    );
+  });
+
+  test('method response separates result and structured errors', () async {
+    final fixture =
+        json.decode(
+              await File('test/fixtures/core_protocol.json').readAsString(),
+            )
+            as Map<String, dynamic>;
+    final success = CoreMethodResponse.fromJson(
+      Map<String, Object?>.from(fixture['successResponse'] as Map),
+    );
+    final structured = CoreMethodResponse.fromJson(
+      Map<String, Object?>.from(fixture['structuredResponse'] as Map),
+    );
+    final failure = CoreMethodResponse.fromJson(
+      Map<String, Object?>.from(fixture['errorResponse'] as Map),
+    );
+
+    expect(success.unwrap<String>(), '');
+    expect(success.toJson(), containsPair('result', ''));
+    expect(structured.result, isA<Map>());
+    expect(structured.result, isNot(isA<String>()));
+    expect(structured.unwrap<Map<String, dynamic>>()?['up'], 12);
+    expect(
+      () => failure.unwrap<Object?>(),
+      throwsA(
+        isA<CoreMethodException>()
+            .having((error) => error.code, 'code', 'core_error')
+            .having((error) => error.message, 'message', 'config not found'),
+      ),
+    );
+    expect(failure.toJson(), contains('error'));
+    expect(failure.toJson(), isNot(contains('code')));
+  });
+}
diff --git a/test/core/service_test.dart b/test/core/service_test.dart
new file mode 100644
index 0000000000..9efdd4518a
--- /dev/null
+++ b/test/core/service_test.dart
@@ -0,0 +1,112 @@
+import 'dart:async';
+
+import 'package:fl_clash/core/desktop/lifecycle.dart';
+import 'package:fl_clash/core/desktop/model.dart';
+import 'package:fl_clash/core/desktop/rpc_client.dart';
+import 'package:fl_clash/core/event.dart';
+import 'package:fl_clash/core/method.dart';
+import 'package:fl_clash/core/service.dart';
+import 'package:mocktail/mocktail.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+final class _MockLifecycle extends Mock
+    implements DesktopCoreLifecycleController {}
+
+final class _MockRpcClient extends Mock implements CoreRpcChannel {}
+
+void main() {
+  late _MockLifecycle lifecycle;
+  late _MockRpcClient rpcClient;
+  late StreamController<DesktopCoreFailure> crashes;
+  late CoreService service;
+
+  const result = CoreLifecycleResult(
+    revision: 1,
+    outcome: CoreLifecycleOutcome.applied,
+  );
+
+  setUp(() {
+    lifecycle = _MockLifecycle();
+    rpcClient = _MockRpcClient();
+    crashes = StreamController<DesktopCoreFailure>.broadcast();
+    when(() => lifecycle.crashEvents).thenAnswer((_) => crashes.stream);
+    when(() => lifecycle.start()).thenAnswer((_) async => result);
+    when(() => lifecycle.restart()).thenAnswer((_) async => result);
+    when(() => lifecycle.stop()).thenAnswer((_) async => result);
+    when(() => lifecycle.close()).thenAnswer((_) async => result);
+    when(() => rpcClient.close()).thenAnswer((_) async {});
+    service = CoreService.forTesting(
+      lifecycle: lifecycle,
+      rpcClient: rpcClient,
+    );
+  });
+
+  tearDown(() async {
+    await service.close();
+    await crashes.close();
+  });
+
+  test(
+    'delegates lifecycle commands without owning platform details',
+    () async {
+      expect(await service.start(), same(result));
+      expect(await service.restart(), same(result));
+      expect(await service.stop(), same(result));
+
+      verify(() => lifecycle.start()).called(1);
+      verify(() => lifecycle.restart()).called(1);
+      verify(() => lifecycle.stop()).called(1);
+    },
+  );
+
+  test('delegates Core method calls to the RPC channel', () async {
+    when(
+      () => rpcClient.invoke<bool>(
+        method: CoreMethod.getIsInit,
+        arguments: null,
+        timeout: null,
+      ),
+    ).thenAnswer((_) async => true);
+
+    expect(
+      await service.invokeMethod<bool>(method: CoreMethod.getIsInit),
+      isTrue,
+    );
+  });
+
+  test('forwards lifecycle crash events once', () async {
+    final listener = _CrashListener();
+    coreEventManager.addListener(listener);
+
+    crashes.add(
+      const DesktopCoreFailure(
+        code: 'unexpected_disconnect',
+        phase: DesktopCorePhase.running,
+        revision: 2,
+      ),
+    );
+    await pumpEventQueue();
+
+    expect(listener.messages, ['core done']);
+    coreEventManager.removeListener(listener);
+  });
+
+  test('close coalesces lifecycle and RPC cleanup', () async {
+    final first = service.close();
+    final second = service.close();
+
+    expect(await first, same(result));
+    expect(await second, same(result));
+    verify(() => lifecycle.close()).called(1);
+    verify(() => rpcClient.close()).called(1);
+  });
+}
+
+final class _CrashListener with CoreEventListener {
+  final List<String> messages = [];
+
+  @override
+  void onCrash(String message) {
+    messages.add(message);
+  }
+}
diff --git a/test/core/transport_test.dart b/test/core/transport_test.dart
new file mode 100644
index 0000000000..b2c7a88af7
--- /dev/null
+++ b/test/core/transport_test.dart
@@ -0,0 +1,13 @@
+import 'package:fl_clash/common/constant.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('Windows Core pipe uses a 128-bit random suffix', () {
+    const prefix = r'\\.\pipe\FlClashCore_';
+    expect(windowsPipeName, startsWith(prefix));
+    expect(
+      windowsPipeName.substring(prefix.length),
+      matches(RegExp(r'^[0-9a-f]{32}$')),
+    );
+  });
+}
diff --git a/test/database/dao_coverage_test.dart b/test/database/dao_coverage_test.dart
new file mode 100644
index 0000000000..9bf92d23c1
--- /dev/null
+++ b/test/database/dao_coverage_test.dart
@@ -0,0 +1,480 @@
+import 'package:drift/drift.dart';
+import 'package:drift/native.dart';
+import 'package:fl_clash/database/database.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  late Database database;
+
+  setUp(() {
+    database = Database(NativeDatabase.memory());
+  });
+
+  tearDown(() async {
+    await database.close();
+  });
+
+  test(
+    'profiles DAO round-trips fields, ordering, filenames, and setAll',
+    () async {
+      final first = Profile(
+        id: 1,
+        label: 'First',
+        currentGroupName: 'Selector',
+        url: 'https://first.example',
+        lastUpdateDate: DateTime(2026, 1, 2),
+        autoUpdateDuration: const Duration(hours: 6),
+        subscriptionInfo: const SubscriptionInfo(
+          upload: 1,
+          download: 2,
+          total: 3,
+          expire: 4,
+        ),
+        autoUpdate: false,
+        selectedMap: const {'Selector': 'Proxy'},
+        unfoldSet: const {'Selector'},
+        overwriteType: OverwriteType.custom,
+        scriptId: 7,
+        order: 1,
+      );
+      const second = Profile(
+        id: 2,
+        label: 'Second',
+        autoUpdateDuration: Duration.zero,
+        order: 0,
+      );
+
+      await database.profilesDao.putAll([
+        first.toCompanion(),
+        second.toCompanion(),
+      ]);
+
+      final profiles = await database.profilesDao.query().get();
+      expect(profiles.map((profile) => profile.id), [2, 1]);
+      expect(profiles.last, first);
+      expect(await database.profilesDao.fileNames().get(), [
+        '1.yaml',
+        '2.yaml',
+      ]);
+      expect(await database.profiles.count.getSingle(), 2);
+
+      final replacement = first.copyWith(label: 'Replaced', order: 0);
+      await database.profilesDao.setAll([replacement]);
+
+      expect(await database.profilesDao.query().get(), [replacement]);
+      expect(await database.profiles.remove((table) => table.id.equals(1)), 1);
+      expect(await database.profiles.count.getSingle(), 0);
+    },
+  );
+
+  test(
+    'generated table managers create, filter, order, and update rows',
+    () async {
+      final date = DateTime.utc(2026, 7, 26);
+      await database.managers.profiles.create(
+        (row) => row(
+          label: 'Managed profile',
+          url: 'https://example.com/profile.yaml',
+          overwriteType: OverwriteType.custom,
+          autoUpdateDurationMillis: 60000,
+          autoUpdate: true,
+          selectedMap: const {'Proxy': 'DIRECT'},
+          unfoldSet: const {'Proxy'},
+        ),
+      );
+      await database.managers.scripts.create(
+        (row) => row(label: 'Managed script', lastUpdateTime: date),
+      );
+      await database.managers.rules.create(
+        (row) => row(
+          ruleAction: RuleAction.DOMAIN,
+          content: const Value('example.com'),
+          ruleTarget: const Value('DIRECT'),
+        ),
+      );
+      await database.managers.profileRuleLinks.create(
+        (row) => row(id: 'managed', profileId: const Value(1), ruleId: 1),
+      );
+      await database.managers.proxyGroups.create(
+        (row) => row(
+          profileId: const Value(1),
+          name: 'Managed group',
+          type: GroupType.Selector.name,
+          proxies: const Value(['DIRECT']),
+        ),
+      );
+      await database.managers.iconRecords.create(
+        (row) => row(url: 'https://example.com/icon.png', lastAccessed: 1),
+      );
+
+      final profiles = await database.managers.profiles
+          .filter((row) => row.label.contains('Managed'))
+          .orderBy((row) => row.label.asc())
+          .get();
+      expect(profiles.single.label, 'Managed profile');
+
+      await database.managers.profiles
+          .filter((row) => row.id.equals(profiles.single.id))
+          .update((row) => row(label: const Value('Updated profile')));
+      expect(
+        (await database.managers.profiles
+                .filter((row) => row.currentGroupName.isNull())
+                .getSingle())
+            .label,
+        'Updated profile',
+      );
+
+      expect(
+        await database.managers.scripts
+            .filter((row) => row.lastUpdateTime.equals(date))
+            .getSingle(),
+        isA<RawScript>(),
+      );
+      expect(
+        await database.managers.rules
+            .filter((row) => row.content.equals('example.com'))
+            .getSingle(),
+        isA<RawRule>(),
+      );
+      expect(
+        await database.managers.profileRuleLinks
+            .filter((row) => row.scene.isNull())
+            .getSingle(),
+        isA<RawProfileRuleLink>(),
+      );
+      expect(
+        await database.managers.proxyGroups
+            .filter((row) => row.proxies.isNotNull())
+            .getSingle(),
+        isA<RawProxyGroup>(),
+      );
+      expect(
+        await database.managers.iconRecords
+            .filter((row) => row.lastAccessed.equals(1))
+            .getSingle(),
+        isA<IconRecord>(),
+      );
+
+      final profileWithReferences = await database.managers.profiles
+          .withReferences(
+            (prefetch) =>
+                prefetch(profileRuleLinksRefs: true, proxyGroupsRefs: true),
+          )
+          .getSingle();
+      expect(
+        await profileWithReferences.$2.profileRuleLinksRefs.get(),
+        hasLength(1),
+      );
+      expect(
+        await profileWithReferences.$2.proxyGroupsRefs.get(),
+        hasLength(1),
+      );
+
+      final ruleWithReferences = await database.managers.rules
+          .withReferences((prefetch) => prefetch(profileRuleLinksRefs: true))
+          .getSingle();
+      expect(
+        await ruleWithReferences.$2.profileRuleLinksRefs.get(),
+        hasLength(1),
+      );
+
+      final linkWithReferences = await database.managers.profileRuleLinks
+          .withReferences((prefetch) => prefetch(profileId: true, ruleId: true))
+          .getSingle();
+      expect((await linkWithReferences.$2.profileId?.getSingle())?.id, 1);
+      expect((await linkWithReferences.$2.ruleId.getSingle()).id, 1);
+
+      final groupWithReferences = await database.managers.proxyGroups
+          .withReferences((prefetch) => prefetch(profileId: true))
+          .getSingle();
+      expect((await groupWithReferences.$2.profileId?.getSingle())?.id, 1);
+    },
+  );
+
+  test(
+    'scripts DAO supports insert, update, lookup, filenames, and replacement',
+    () async {
+      final first = Script(
+        id: 10,
+        label: 'First',
+        lastUpdateTime: DateTime(2026),
+      );
+      final second = Script(
+        id: 11,
+        label: 'Second',
+        lastUpdateTime: DateTime(2026, 2),
+      );
+
+      await database.scripts.put(first.toCompanion());
+      expect(await database.scriptsDao.get(10).getSingle(), first);
+      expect(await database.scriptsDao.fileNames().get(), ['10.js']);
+
+      await database.scripts.put(
+        first.copyWith(label: 'Updated').toCompanion(),
+      );
+      expect((await database.scriptsDao.get(10).getSingle()).label, 'Updated');
+
+      await database.scriptsDao.setAll([second]);
+      expect(await database.scriptsDao.query().get(), [second]);
+      expect(await database.scriptsDao.get(10).getSingleOrNull(), null);
+    },
+  );
+
+  test(
+    'proxy groups DAO round-trips all options and rewrites proxy names',
+    () async {
+      const profile = Profile(id: 1, autoUpdateDuration: Duration.zero);
+      const first = ProxyGroup(
+        id: 20,
+        name: 'Primary',
+        type: GroupType.URLTest,
+        proxies: ['Old', 'Backup'],
+        use: ['provider'],
+        interval: 60,
+        lazy: true,
+        disableUDP: true,
+        url: 'https://group.example',
+        timeout: 3000,
+        maxFailedTimes: 2,
+        filter: 'include',
+        excludeFilter: 'exclude',
+        excludeType: 'Direct',
+        expectedStatus: '204',
+        includeAll: true,
+        includeAllProxies: false,
+        includeAllProviders: true,
+        hidden: false,
+        icon: 'https://icon.example',
+        order: 'a',
+      );
+      const second = ProxyGroup(
+        id: 21,
+        name: 'Secondary',
+        type: GroupType.Selector,
+        proxies: ['Primary'],
+        order: 'b',
+      );
+      await database.profiles.put(profile.toCompanion());
+      await database.proxyGroups.put(first.toCompanion(profile.id));
+      await database.proxyGroups.put(second.toCompanion(profile.id));
+
+      final groups = await database.proxyGroupsDao.query(profile.id).get();
+      expect(groups.first, first.copyWith(profileId: profile.id));
+      expect(await database.proxyGroupsDao.count(profile.id).getSingle(), 2);
+
+      await database.proxyGroupsDao.renameProxies(
+        profile.id,
+        oldName: 'Primary',
+        newName: 'Renamed',
+      );
+      expect(
+        (await database.proxyGroupsDao.query(profile.id).get()).last.proxies,
+        ['Renamed'],
+      );
+
+      await database.proxyGroupsDao.order(
+        profile.id,
+        proxyGroup: second,
+        order: '0',
+      );
+      expect(
+        (await database.proxyGroupsDao.query(profile.id).get()).first.name,
+        'Secondary',
+      );
+
+      await database.batch((batch) {
+        database.proxyGroupsDao.setAllWithBatch(profile.id, batch, [first]);
+      });
+      expect(
+        (await database.proxyGroupsDao.query(profile.id).get()).single.name,
+        'Primary',
+      );
+    },
+  );
+
+  test(
+    'rules DAO handles global, added, custom, disabled, order, and rename',
+    () async {
+      const profile = Profile(id: 1, autoUpdateDuration: Duration.zero);
+      const global = Rule(
+        id: 30,
+        ruleAction: RuleAction.DOMAIN,
+        content: 'global.example',
+        ruleTarget: 'DIRECT',
+        order: 'b',
+      );
+      const added = Rule(
+        id: 31,
+        ruleAction: RuleAction.IP_CIDR,
+        content: '10.0.0.0/8',
+        ruleTarget: 'Proxy',
+        noResolve: true,
+        src: true,
+        order: 'a',
+      );
+      const custom = Rule(
+        id: 32,
+        ruleAction: RuleAction.RULE_SET,
+        ruleProvider: 'provider',
+        ruleTarget: 'OldGroup',
+        order: 'c',
+      );
+      await database.profiles.put(profile.toCompanion());
+      await database.rulesDao.putGlobalRule(global);
+      await database.rulesDao.putProfileAddedRule(profile.id, added);
+      await database.rulesDao.putProfileCustomRule(profile.id, custom);
+
+      expect(await database.rulesDao.queryGlobalAddedRules().get(), [global]);
+      expect(await database.rulesDao.queryProfileAddedRules(profile.id).get(), [
+        added,
+      ]);
+      expect(
+        await database.rulesDao.queryProfileCustomRules(profile.id).get(),
+        [custom],
+      );
+      expect(
+        await database.rulesDao.profileCustomRulesCount(profile.id).getSingle(),
+        1,
+      );
+
+      await database.rulesDao.putDisabledLink(profile.id, global.id);
+      expect(
+        (await database.rulesDao.queryProfileDisabledRules(profile.id).get())
+            .single
+            .id,
+        global.id,
+      );
+      expect(
+        (await database.rulesDao.queryAddedRules(profile.id).get()).map(
+          (rule) => rule.id,
+        ),
+        [added.id],
+      );
+      expect(
+        await database.rulesDao.delDisabledLink(profile.id, global.id),
+        isTrue,
+      );
+
+      await database.rulesDao.orderGlobalRule(ruleId: global.id, order: '0');
+      await database.rulesDao.orderProfileAddedRule(
+        profile.id,
+        ruleId: added.id,
+        order: '1',
+      );
+      await database.rulesDao.orderProfileCustomRule(
+        profile.id,
+        ruleId: custom.id,
+        order: '2',
+      );
+      await database.rulesDao.renameCustomRuleTarget(
+        profile.id,
+        oldName: 'OldGroup',
+        newName: 'NewGroup',
+      );
+      expect(
+        (await database.rulesDao.queryProfileCustomRules(profile.id).get())
+            .single
+            .ruleTarget,
+        'NewGroup',
+      );
+
+      await database.rulesDao.resetOrders();
+      await database.rulesDao.delRules([added.id, custom.id]);
+      expect(
+        await database.rulesDao.queryProfileAddedRules(profile.id).get(),
+        isEmpty,
+      );
+      expect(
+        await database.rulesDao.queryProfileCustomRules(profile.id).get(),
+        isEmpty,
+      );
+    },
+  );
+
+  test('database restore and custom data replace related records', () async {
+    const profile = Profile(id: 1, autoUpdateDuration: Duration.zero);
+    final script = Script(
+      id: 40,
+      label: 'Script',
+      lastUpdateTime: DateTime(2026),
+    );
+    const rule = Rule(id: 41, content: 'example.com', ruleTarget: 'DIRECT');
+    const link = ProfileRuleLink(
+      profileId: 1,
+      ruleId: 41,
+      scene: RuleScene.custom,
+    );
+    const group = ProxyGroup(
+      id: 42,
+      profileId: 1,
+      name: 'Group',
+      type: GroupType.Selector,
+      proxies: ['DIRECT'],
+    );
+
+    await database.restore([profile], [script], [rule], [link], [
+      group,
+    ], isOverride: true);
+    expect(await database.profilesDao.query().get(), [
+      profile.copyWith(order: 0),
+    ]);
+    expect(await database.scriptsDao.query().get(), [script]);
+    final restoredRules = await database.rulesDao
+        .queryProfileCustomRules(profile.id)
+        .get();
+    expect(restoredRules.single.id, rule.id);
+    expect(restoredRules.single.order, isNot(equals(null)));
+    final restoredGroups = await database.proxyGroupsDao
+        .query(profile.id)
+        .get();
+    expect(restoredGroups.single.id, group.id);
+    expect(restoredGroups.single.profileId, profile.id);
+    expect(restoredGroups.single.order, isNot(equals(null)));
+
+    const replacementRule = Rule(
+      id: 43,
+      content: 'replacement.example',
+      ruleTarget: 'Group',
+    );
+    const replacementGroup = ProxyGroup(
+      id: 44,
+      name: 'Replacement',
+      type: GroupType.Fallback,
+    );
+    await database.setProfileCustomData(
+      profile.id,
+      [replacementGroup],
+      [replacementRule],
+    );
+    expect(
+      (await database.rulesDao.queryProfileCustomRules(profile.id).get())
+          .single
+          .id,
+      replacementRule.id,
+    );
+    expect(
+      (await database.proxyGroupsDao.query(profile.id).get()).single.id,
+      replacementGroup.id,
+    );
+  });
+
+  test(
+    'icon records update access time, avoid duplicates, and filter queries',
+    () async {
+      await database.iconRecordsDao.put('https://example.com/a.png');
+      await database.iconRecordsDao.putIfAbsent('https://example.com/a.png');
+      await database.iconRecordsDao.putIfAbsent('https://other.com/b.png');
+
+      final before = await database.iconRecordsDao.query('example.com');
+      expect(before.map((record) => record.url), ['https://example.com/a.png']);
+      final record = await database.iconRecordsDao.get(
+        'https://example.com/a.png',
+      );
+      expect(record?.url, 'https://example.com/a.png');
+      expect(await database.iconRecordsDao.get('missing'), null);
+      expect(await database.iconRecords.count.getSingle(), 2);
+    },
+  );
+}
diff --git a/test/database/generated_contract_test.dart b/test/database/generated_contract_test.dart
new file mode 100644
index 0000000000..e2d09e9807
--- /dev/null
+++ b/test/database/generated_contract_test.dart
@@ -0,0 +1,379 @@
+import 'package:drift/drift.dart';
+import 'package:fl_clash/database/database.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('profile and script generated data classes preserve all fields', () {
+    final date = DateTime.utc(2026, 7, 26);
+    final profile = RawProfile(
+      id: 1,
+      label: 'Profile',
+      currentGroupName: 'Select',
+      url: 'https://example.com/profile.yaml',
+      lastUpdateDate: date,
+      overwriteType: OverwriteType.custom,
+      scriptId: 2,
+      autoUpdateDurationMillis: 3600000,
+      subscriptionInfo: const SubscriptionInfo(
+        upload: 1,
+        download: 2,
+        total: 3,
+        expire: 4,
+      ),
+      autoUpdate: true,
+      selectedMap: const {'Select': 'DIRECT'},
+      unfoldSet: const {'Select'},
+      order: 3,
+    );
+
+    expect(profile.toColumns(true), hasLength(13));
+    expect(profile.toCompanion(true).toColumns(true), hasLength(13));
+    expect(RawProfile.fromJson(profile.toJson()).toJson(), profile.toJson());
+    expect(profile.copyWith(label: 'Next').label, 'Next');
+    expect(
+      profile
+          .copyWithCompanion(
+            const ProfilesCompanion(
+              currentGroupName: Value(null),
+              scriptId: Value(null),
+              order: Value(9),
+            ),
+          )
+          .order,
+      9,
+    );
+    expect(profile.copyWith(), profile);
+    expect(profile.hashCode, isNonZero);
+    expect(profile.toString(), contains('Profile'));
+
+    const emptyProfile = RawProfile(
+      id: 2,
+      label: 'Empty',
+      url: '',
+      overwriteType: OverwriteType.standard,
+      autoUpdateDurationMillis: 0,
+      autoUpdate: false,
+      selectedMap: {},
+      unfoldSet: {},
+    );
+    expect(emptyProfile.toColumns(true), hasLength(8));
+    expect(emptyProfile.toColumns(false), hasLength(13));
+    expect(emptyProfile.toCompanion(true).toColumns(true), hasLength(8));
+
+    final insertedProfile = ProfilesCompanion.insert(
+      label: 'Inserted',
+      url: 'url',
+      overwriteType: OverwriteType.script,
+      autoUpdateDurationMillis: 60,
+      autoUpdate: true,
+      selectedMap: const {},
+      unfoldSet: const {},
+    ).copyWith(id: const Value(8), order: const Value(1));
+    expect(insertedProfile.toColumns(true), hasLength(9));
+    expect(insertedProfile.toString(), contains('Inserted'));
+    expect(
+      ProfilesCompanion.custom(
+        id: const Variable(1),
+        label: const Variable('custom'),
+        currentGroupName: const Variable('group'),
+        url: const Variable('url'),
+        lastUpdateDate: Variable(date),
+        overwriteType: const Variable('custom'),
+        scriptId: const Variable(2),
+        autoUpdateDurationMillis: const Variable(60),
+        subscriptionInfo: const Variable('{}'),
+        autoUpdate: const Variable(true),
+        selectedMap: const Variable('{}'),
+        unfoldSet: const Variable('[]'),
+        order: const Variable(1),
+      ).toColumns(false),
+      hasLength(13),
+    );
+
+    final script = RawScript(id: 2, label: 'Script', lastUpdateTime: date);
+    expect(script.toColumns(true), hasLength(3));
+    expect(script.toCompanion(true).toColumns(true), hasLength(3));
+    final restoredScript = RawScript.fromJson(script.toJson());
+    expect(restoredScript.id, script.id);
+    expect(restoredScript.label, script.label);
+    expect(restoredScript.lastUpdateTime.isAtSameMomentAs(date), true);
+    expect(script.copyWith(label: 'Changed').label, 'Changed');
+    expect(
+      script
+          .copyWithCompanion(
+            ScriptsCompanion(
+              label: const Value('Companion'),
+              lastUpdateTime: Value(date.add(const Duration(days: 1))),
+            ),
+          )
+          .label,
+      'Companion',
+    );
+    expect(script.toString(), contains('Script'));
+    expect(script.hashCode, isNonZero);
+
+    final scriptCompanion = ScriptsCompanion.insert(
+      label: 'Inserted',
+      lastUpdateTime: date,
+    ).copyWith(id: const Value(3));
+    expect(scriptCompanion.toColumns(true), hasLength(3));
+    expect(scriptCompanion.toString(), contains('Inserted'));
+    expect(
+      ScriptsCompanion.custom(
+        id: const Variable(1),
+        label: const Variable('custom'),
+        lastUpdateTime: Variable(date),
+      ).toColumns(false),
+      hasLength(3),
+    );
+  });
+
+  test('rule and link generated classes preserve nullable contracts', () {
+    const rule = RawRule(
+      id: 10,
+      ruleAction: RuleAction.RULE_SET,
+      content: 'content',
+      ruleTarget: 'Proxy',
+      ruleProvider: 'provider',
+      subRule: 'sub',
+      noResolve: true,
+      src: true,
+    );
+
+    expect(rule.toColumns(true), hasLength(8));
+    expect(rule.toCompanion(true).toColumns(true), hasLength(8));
+    expect(RawRule.fromJson(rule.toJson()), rule);
+    expect(rule.copyWith(content: const Value(null)).content, null);
+    expect(
+      rule
+          .copyWithCompanion(
+            const RulesCompanion(
+              ruleAction: Value(RuleAction.DOMAIN),
+              noResolve: Value(false),
+            ),
+          )
+          .ruleAction,
+      RuleAction.DOMAIN,
+    );
+    expect(rule.toString(), contains('RULE_SET'));
+    expect(rule.hashCode, isNonZero);
+
+    const emptyRule = RawRule(
+      id: 11,
+      ruleAction: RuleAction.MATCH,
+      noResolve: false,
+      src: false,
+    );
+    expect(emptyRule.toColumns(true), hasLength(4));
+    expect(emptyRule.toColumns(false), hasLength(8));
+
+    final ruleCompanion =
+        RulesCompanion.insert(ruleAction: RuleAction.DOMAIN_SUFFIX).copyWith(
+          id: const Value(12),
+          content: const Value('example.com'),
+          ruleTarget: const Value('DIRECT'),
+          ruleProvider: const Value('provider'),
+          subRule: const Value('sub'),
+          noResolve: const Value(true),
+          src: const Value(true),
+        );
+    expect(ruleCompanion.toColumns(true), hasLength(8));
+    expect(ruleCompanion.toString(), contains('DOMAIN_SUFFIX'));
+    expect(
+      RulesCompanion.custom(
+        id: const Variable(1),
+        ruleAction: const Variable('DOMAIN'),
+        content: const Variable('example.com'),
+        ruleTarget: const Variable('DIRECT'),
+        ruleProvider: const Variable('provider'),
+        subRule: const Variable('sub'),
+        noResolve: const Variable(true),
+        src: const Variable(false),
+      ).toColumns(false),
+      hasLength(8),
+    );
+
+    const link = RawProfileRuleLink(
+      id: '1_10_added',
+      profileId: 1,
+      ruleId: 10,
+      scene: RuleScene.added,
+      order: 'a0',
+    );
+    expect(link.toColumns(true), hasLength(5));
+    expect(link.toCompanion(true).toColumns(true), hasLength(5));
+    expect(RawProfileRuleLink.fromJson(link.toJson()), link);
+    expect(link.copyWith(profileId: const Value(null)).profileId, null);
+    expect(
+      link
+          .copyWithCompanion(
+            const ProfileRuleLinksCompanion(order: Value('b0')),
+          )
+          .order,
+      'b0',
+    );
+    expect(link.toString(), contains('1_10_added'));
+    expect(link.hashCode, isNonZero);
+
+    const emptyLink = RawProfileRuleLink(id: '10', ruleId: 10);
+    expect(emptyLink.toColumns(true), hasLength(2));
+    expect(emptyLink.toColumns(false), hasLength(5));
+    final linkCompanion =
+        ProfileRuleLinksCompanion.insert(id: 'link', ruleId: 10).copyWith(
+          profileId: const Value(1),
+          scene: const Value(RuleScene.custom),
+          order: const Value('c0'),
+          rowid: const Value(5),
+        );
+    expect(linkCompanion.toColumns(true), hasLength(6));
+    expect(linkCompanion.toString(), contains('link'));
+    expect(
+      ProfileRuleLinksCompanion.custom(
+        id: const Variable('id'),
+        profileId: const Variable(1),
+        ruleId: const Variable(2),
+        scene: const Variable('custom'),
+        order: const Variable('a'),
+        rowid: const Variable(3),
+      ).toColumns(false),
+      hasLength(6),
+    );
+  });
+
+  test('proxy group and icon generated classes preserve every field', () {
+    const group = RawProxyGroup(
+      id: 20,
+      profileId: 1,
+      name: 'Select',
+      type: 'select',
+      proxies: ['DIRECT'],
+      use: ['provider'],
+      url: 'https://example.com/generate_204',
+      interval: 300,
+      timeout: 5000,
+      maxFailedTimes: 3,
+      lazy: true,
+      disableUDP: false,
+      filter: 'include',
+      excludeFilter: 'exclude',
+      excludeType: 'Direct',
+      expectedStatus: '204',
+      includeAll: true,
+      includeAllProxies: true,
+      includeAllProviders: true,
+      hidden: false,
+      icon: 'icon',
+      order: 'a0',
+    );
+
+    expect(group.toColumns(true), hasLength(22));
+    expect(group.toCompanion(true).toColumns(true), hasLength(22));
+    expect(RawProxyGroup.fromJson(group.toJson()).toJson(), group.toJson());
+    expect(group.copyWith(name: 'Changed').name, 'Changed');
+    expect(
+      group
+          .copyWithCompanion(
+            const ProxyGroupsCompanion(
+              profileId: Value(null),
+              hidden: Value(true),
+            ),
+          )
+          .hidden,
+      true,
+    );
+    expect(group.copyWith(), group);
+    expect(group.toString(), contains('Select'));
+    expect(group.hashCode, isNonZero);
+
+    const emptyGroup = RawProxyGroup(id: 21, name: 'Empty', type: 'select');
+    expect(emptyGroup.toColumns(true), hasLength(3));
+    expect(emptyGroup.toColumns(false), hasLength(22));
+
+    final companion =
+        ProxyGroupsCompanion.insert(name: 'Inserted', type: 'select').copyWith(
+          id: const Value(22),
+          profileId: const Value(1),
+          proxies: const Value(['DIRECT']),
+          use: const Value(['provider']),
+          url: const Value('url'),
+          interval: const Value(60),
+          timeout: const Value(1000),
+          maxFailedTimes: const Value(2),
+          lazy: const Value(true),
+          disableUDP: const Value(false),
+          filter: const Value('filter'),
+          excludeFilter: const Value('exclude'),
+          excludeType: const Value('Direct'),
+          expectedStatus: const Value('204'),
+          includeAll: const Value(true),
+          includeAllProxies: const Value(true),
+          includeAllProviders: const Value(true),
+          hidden: const Value(false),
+          icon: const Value('icon'),
+          order: const Value('a0'),
+        );
+    expect(companion.toColumns(true), hasLength(22));
+    expect(companion.toString(), contains('Inserted'));
+    expect(
+      ProxyGroupsCompanion.custom(
+        id: const Variable(1),
+        profileId: const Variable(2),
+        name: const Variable('name'),
+        type: const Variable('select'),
+        proxies: const Variable('[]'),
+        use: const Variable('[]'),
+        url: const Variable('url'),
+        interval: const Variable(60),
+        timeout: const Variable(1000),
+        maxFailedTimes: const Variable(2),
+        lazy: const Variable(true),
+        disableUDP: const Variable(false),
+        filter: const Variable('filter'),
+        excludeFilter: const Variable('exclude'),
+        excludeType: const Variable('Direct'),
+        expectedStatus: const Variable('204'),
+        includeAll: const Variable(true),
+        includeAllProxies: const Variable(true),
+        includeAllProviders: const Variable(true),
+        hidden: const Variable(false),
+        icon: const Variable('icon'),
+        order: const Variable('a0'),
+      ).toColumns(false),
+      hasLength(22),
+    );
+
+    const icon = IconRecord(
+      url: 'https://example.com/icon.png',
+      lastAccessed: 1,
+    );
+    expect(icon.toColumns(true), hasLength(2));
+    expect(icon.toCompanion(true).toColumns(true), hasLength(2));
+    expect(IconRecord.fromJson(icon.toJson()), icon);
+    expect(icon.copyWith(lastAccessed: 2).lastAccessed, 2);
+    expect(
+      icon
+          .copyWithCompanion(const IconRecordsCompanion(lastAccessed: Value(3)))
+          .lastAccessed,
+      3,
+    );
+    expect(icon.toString(), contains('icon.png'));
+    expect(icon.hashCode, isNonZero);
+
+    final iconCompanion = IconRecordsCompanion.insert(
+      url: 'url',
+      lastAccessed: 4,
+    ).copyWith(rowid: const Value(1));
+    expect(iconCompanion.toColumns(true), hasLength(3));
+    expect(iconCompanion.toString(), contains('url'));
+    expect(
+      IconRecordsCompanion.custom(
+        url: const Variable('url'),
+        lastAccessed: const Variable(1),
+        rowid: const Variable(2),
+      ).toColumns(false),
+      hasLength(3),
+    );
+  });
+}
diff --git a/test/database/rules_test.dart b/test/database/rules_test.dart
new file mode 100644
index 0000000000..c568998154
--- /dev/null
+++ b/test/database/rules_test.dart
@@ -0,0 +1,40 @@
+import 'package:drift/native.dart';
+import 'package:fl_clash/database/database.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  late Database database;
+
+  setUp(() async {
+    database = Database(NativeDatabase.memory());
+    await database.profilesDao.putAll([
+      const Profile(id: 1, autoUpdateDuration: Duration.zero).toCompanion(),
+    ]);
+  });
+
+  tearDown(() async {
+    await database.close();
+  });
+
+  test('added rules follow profile then global UI order', () async {
+    await database.rulesDao.putGlobalRule(
+      const Rule(id: 4, content: 'global second', order: 'b'),
+    );
+    await database.rulesDao.putProfileAddedRule(
+      1,
+      const Rule(id: 2, content: 'profile second', order: 'b'),
+    );
+    await database.rulesDao.putGlobalRule(
+      const Rule(id: 3, content: 'global first', order: 'a'),
+    );
+    await database.rulesDao.putProfileAddedRule(
+      1,
+      const Rule(id: 1, content: 'profile first', order: 'a'),
+    );
+
+    final rules = await database.rulesDao.queryAddedRules(1).get();
+
+    expect(rules.map((rule) => rule.id), [1, 2, 3, 4]);
+  });
+}
diff --git a/test/fixtures/core_protocol.json b/test/fixtures/core_protocol.json
new file mode 100644
index 0000000000..1aaeac6482
--- /dev/null
+++ b/test/fixtures/core_protocol.json
@@ -0,0 +1,50 @@
+{
+  "methodCall": {
+    "id": "updateConfig#contract",
+    "method": "updateConfig",
+    "arguments": {
+      "mixed-port": 7890,
+      "allow-lan": true,
+      "ipv6": false,
+      "geo-auto-update": true,
+      "geo-update-interval": 24
+    }
+  },
+  "eventCall": {
+    "method": "message",
+    "arguments": [
+      {
+        "type": "loaded",
+        "data": "provider-a"
+      },
+      {
+        "type": "delay",
+        "data": {
+          "name": "proxy-a",
+          "url": "https://example.com",
+          "value": 42
+        }
+      }
+    ]
+  },
+  "successResponse": {
+    "id": "updateConfig#contract",
+    "result": ""
+  },
+  "structuredResponse": {
+    "id": "getTraffic#contract",
+    "result": {
+      "up": 12,
+      "down": 34
+    }
+  },
+  "errorResponse": {
+    "id": "getConfig#contract",
+    "result": null,
+    "error": {
+      "code": "core_error",
+      "message": "config not found",
+      "details": null
+    }
+  }
+}
diff --git a/test/l10n/app_localizations_test.dart b/test/l10n/app_localizations_test.dart
new file mode 100644
index 0000000000..f98d466e02
--- /dev/null
+++ b/test/l10n/app_localizations_test.dart
@@ -0,0 +1,589 @@
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test(
+    'all public localization accessors return text for every locale',
+    () async {
+      for (final locale in AppLocalizations.delegate.supportedLocales) {
+        final appLocalizations = await AppLocalizations.load(locale);
+        final messages = _allMessages(appLocalizations);
+
+        expect(
+          messages,
+          everyElement(isNotEmpty),
+          reason: '$locale must resolve every public localization accessor',
+        );
+      }
+    },
+  );
+
+  test('delegate recognizes only supported locales', () {
+    expect(AppLocalizations.delegate.isSupported(const Locale('en')), isTrue);
+    expect(AppLocalizations.delegate.isSupported(const Locale('fr')), isFalse);
+    expect(
+      AppLocalizations.delegate.shouldReload(AppLocalizations.delegate),
+      isFalse,
+    );
+  });
+}
+
+List<String> _allMessages(AppLocalizations appLocalizations) {
+  return [
+    appLocalizations.rule,
+    appLocalizations.global,
+    appLocalizations.direct,
+    appLocalizations.dashboard,
+    appLocalizations.proxies,
+    appLocalizations.profile,
+    appLocalizations.profiles,
+    appLocalizations.tools,
+    appLocalizations.logs,
+    appLocalizations.logsDesc,
+    appLocalizations.resources,
+    appLocalizations.resourcesDesc,
+    appLocalizations.trafficUsage,
+    appLocalizations.networkSpeed,
+    appLocalizations.outboundMode,
+    appLocalizations.networkDetection,
+    appLocalizations.upload,
+    appLocalizations.download,
+    appLocalizations.nullProfileDesc,
+    appLocalizations.settings,
+    appLocalizations.language,
+    appLocalizations.defaultText,
+    appLocalizations.more,
+    appLocalizations.other,
+    appLocalizations.about,
+    appLocalizations.en,
+    appLocalizations.ja,
+    appLocalizations.ru,
+    appLocalizations.zh_CN,
+    appLocalizations.theme,
+    appLocalizations.themeDesc,
+    appLocalizations.override,
+    appLocalizations.allowLan,
+    appLocalizations.allowLanDesc,
+    appLocalizations.tun,
+    appLocalizations.tunDesc,
+    appLocalizations.minimizeOnExit,
+    appLocalizations.minimizeOnExitDesc,
+    appLocalizations.autoLaunch,
+    appLocalizations.autoLaunchDesc,
+    appLocalizations.silentLaunch,
+    appLocalizations.silentLaunchDesc,
+    appLocalizations.autoRun,
+    appLocalizations.autoRunDesc,
+    appLocalizations.logcat,
+    appLocalizations.logcatDesc,
+    appLocalizations.autoCheckUpdate,
+    appLocalizations.autoCheckUpdateDesc,
+    appLocalizations.accessControl,
+    appLocalizations.accessControlDesc,
+    appLocalizations.application,
+    appLocalizations.applicationDesc,
+    appLocalizations.edit,
+    appLocalizations.confirm,
+    appLocalizations.update,
+    appLocalizations.add,
+    appLocalizations.save,
+    appLocalizations.delete,
+    appLocalizations.seconds,
+    appLocalizations.qrcode,
+    appLocalizations.qrcodeDesc,
+    appLocalizations.url,
+    appLocalizations.urlDesc,
+    appLocalizations.file,
+    appLocalizations.fileDesc,
+    appLocalizations.name,
+    appLocalizations.profileNameNullValidationDesc,
+    appLocalizations.profileUrlNullValidationDesc,
+    appLocalizations.profileUrlInvalidValidationDesc,
+    appLocalizations.autoUpdate,
+    appLocalizations.autoUpdateInterval,
+    appLocalizations.profileAutoUpdateIntervalNullValidationDesc,
+    appLocalizations.profileAutoUpdateIntervalInvalidValidationDesc,
+    appLocalizations.themeMode,
+    appLocalizations.themeColor,
+    appLocalizations.preview,
+    appLocalizations.auto,
+    appLocalizations.light,
+    appLocalizations.dark,
+    appLocalizations.importFromURL,
+    appLocalizations.submit,
+    appLocalizations.doYouWantToPass,
+    appLocalizations.create,
+    appLocalizations.pleaseUploadValidQrcode,
+    appLocalizations.blacklistMode,
+    appLocalizations.whitelistMode,
+    appLocalizations.selectAll,
+    appLocalizations.cancelSelectAll,
+    appLocalizations.appAccessControl,
+    appLocalizations.accessControlAllowDesc,
+    appLocalizations.accessControlNotAllowDesc,
+    appLocalizations.selected,
+    appLocalizations.proxyPort,
+    appLocalizations.port,
+    appLocalizations.logLevel,
+    appLocalizations.show,
+    appLocalizations.exit,
+    appLocalizations.systemProxy,
+    appLocalizations.project,
+    appLocalizations.core,
+    appLocalizations.tabAnimation,
+    appLocalizations.desc,
+    appLocalizations.startVpn,
+    appLocalizations.stopVpn,
+    appLocalizations.compatible,
+    appLocalizations.notSelectedTip,
+    appLocalizations.tip,
+    appLocalizations.account,
+    appLocalizations.backup,
+    appLocalizations.backupSuccess,
+    appLocalizations.noInfo,
+    appLocalizations.pleaseBindWebDAV,
+    appLocalizations.bind,
+    appLocalizations.connectivity,
+    appLocalizations.webDAVConfiguration,
+    appLocalizations.address,
+    appLocalizations.addressHelp,
+    appLocalizations.addressTip,
+    appLocalizations.password,
+    appLocalizations.checkUpdate,
+    appLocalizations.discoverNewVersion,
+    appLocalizations.checkUpdateError,
+    appLocalizations.goDownload,
+    appLocalizations.unknown,
+    appLocalizations.country,
+    appLocalizations.search,
+    appLocalizations.allowBypass,
+    appLocalizations.allowBypassDesc,
+    appLocalizations.externalController,
+    appLocalizations.externalControllerDesc,
+    appLocalizations.ipv6Desc,
+    appLocalizations.app,
+    appLocalizations.general,
+    appLocalizations.systemProxyDesc,
+    appLocalizations.userAgent,
+    appLocalizations.unifiedDelay,
+    appLocalizations.unifiedDelayDesc,
+    appLocalizations.tcpConcurrent,
+    appLocalizations.tcpConcurrentDesc,
+    appLocalizations.geodataLoader,
+    appLocalizations.geodataLoaderDesc,
+    appLocalizations.requests,
+    appLocalizations.requestsDesc,
+    appLocalizations.findProcessMode,
+    appLocalizations.init,
+    appLocalizations.infiniteTime,
+    appLocalizations.connections,
+    appLocalizations.connectionsDesc,
+    appLocalizations.intranetIP,
+    appLocalizations.view,
+    appLocalizations.cut,
+    appLocalizations.copy,
+    appLocalizations.paste,
+    appLocalizations.testUrl,
+    appLocalizations.sync,
+    appLocalizations.exclude,
+    appLocalizations.excludeDesc,
+    appLocalizations.expand,
+    appLocalizations.shrink,
+    appLocalizations.min,
+    appLocalizations.tab,
+    appLocalizations.list,
+    appLocalizations.delay,
+    appLocalizations.style,
+    appLocalizations.size,
+    appLocalizations.sort,
+    appLocalizations.columns,
+    appLocalizations.proxyGroup,
+    appLocalizations.go,
+    appLocalizations.externalLink,
+    appLocalizations.otherContributors,
+    appLocalizations.autoCloseConnections,
+    appLocalizations.autoCloseConnectionsDesc,
+    appLocalizations.onlyStatisticsProxy,
+    appLocalizations.onlyStatisticsProxyDesc,
+    appLocalizations.pureBlackMode,
+    appLocalizations.keepAliveIntervalDesc,
+    appLocalizations.entries,
+    appLocalizations.local,
+    appLocalizations.remote,
+    appLocalizations.remoteBackupDesc,
+    appLocalizations.localBackupDesc,
+    appLocalizations.mode,
+    appLocalizations.time,
+    appLocalizations.source,
+    appLocalizations.action,
+    appLocalizations.intelligentSelected,
+    appLocalizations.clipboardImport,
+    appLocalizations.clipboardExport,
+    appLocalizations.layout,
+    appLocalizations.tight,
+    appLocalizations.standard,
+    appLocalizations.loose,
+    appLocalizations.profilesSort,
+    appLocalizations.start,
+    appLocalizations.stop,
+    appLocalizations.dnsDesc,
+    appLocalizations.key,
+    appLocalizations.value,
+    appLocalizations.hostsDesc,
+    appLocalizations.vpnTip,
+    appLocalizations.vpnEnableDesc,
+    appLocalizations.options,
+    appLocalizations.loopback,
+    appLocalizations.loopbackDesc,
+    appLocalizations.providers,
+    appLocalizations.proxyProviders,
+    appLocalizations.ruleProviders,
+    appLocalizations.overrideDns,
+    appLocalizations.overrideDnsDesc,
+    appLocalizations.status,
+    appLocalizations.statusDesc,
+    appLocalizations.preferH3Desc,
+    appLocalizations.respectRules,
+    appLocalizations.respectRulesDesc,
+    appLocalizations.dnsMode,
+    appLocalizations.fakeipRange,
+    appLocalizations.fakeipFilter,
+    appLocalizations.defaultNameserver,
+    appLocalizations.defaultNameserverDesc,
+    appLocalizations.nameserver,
+    appLocalizations.nameserverDesc,
+    appLocalizations.useHosts,
+    appLocalizations.useSystemHosts,
+    appLocalizations.nameserverPolicy,
+    appLocalizations.nameserverPolicyDesc,
+    appLocalizations.proxyNameserver,
+    appLocalizations.proxyNameserverDesc,
+    appLocalizations.fallback,
+    appLocalizations.fallbackDesc,
+    appLocalizations.fallbackFilter,
+    appLocalizations.geoipCode,
+    appLocalizations.ipcidr,
+    appLocalizations.domain,
+    appLocalizations.reset,
+    appLocalizations.action_view,
+    appLocalizations.action_start,
+    appLocalizations.action_mode,
+    appLocalizations.action_proxy,
+    appLocalizations.action_tun,
+    appLocalizations.disclaimer,
+    appLocalizations.disclaimerDesc,
+    appLocalizations.agree,
+    appLocalizations.hotkeyManagement,
+    appLocalizations.hotkeyManagementDesc,
+    appLocalizations.pressKeyboard,
+    appLocalizations.inputCorrectHotkey,
+    appLocalizations.hotkeyConflict,
+    appLocalizations.remove,
+    appLocalizations.noHotKey,
+    appLocalizations.noNetwork,
+    appLocalizations.ipv6InboundDesc,
+    appLocalizations.exportLogs,
+    appLocalizations.exportSuccess,
+    appLocalizations.iconStyle,
+    appLocalizations.onlyIcon,
+    appLocalizations.stackMode,
+    appLocalizations.network,
+    appLocalizations.networkDesc,
+    appLocalizations.bypassDomain,
+    appLocalizations.bypassDomainDesc,
+    appLocalizations.resetTip,
+    appLocalizations.icon,
+    appLocalizations.noData,
+    appLocalizations.fontFamily,
+    appLocalizations.toggle,
+    appLocalizations.system,
+    appLocalizations.routeMode,
+    appLocalizations.routeMode_bypassPrivate,
+    appLocalizations.routeMode_config,
+    appLocalizations.routeAddress,
+    appLocalizations.routeAddressDesc,
+    appLocalizations.pleaseInputAdminPassword,
+    appLocalizations.copyEnvVar,
+    appLocalizations.memoryInfo,
+    appLocalizations.cancel,
+    appLocalizations.fileIsUpdate,
+    appLocalizations.profileHasUpdate,
+    appLocalizations.hasCacheChange,
+    appLocalizations.copySuccess,
+    appLocalizations.copyLink,
+    appLocalizations.exportFile,
+    appLocalizations.cacheCorrupt,
+    appLocalizations.detectionTip,
+    appLocalizations.listen,
+    appLocalizations.undo,
+    appLocalizations.redo,
+    appLocalizations.none,
+    appLocalizations.basicConfig,
+    appLocalizations.basicConfigDesc,
+    appLocalizations.advancedConfig,
+    appLocalizations.advancedConfigDesc,
+    appLocalizations.selectedCountTitle('value'),
+    appLocalizations.addRule,
+    appLocalizations.ruleName,
+    appLocalizations.content,
+    appLocalizations.subRule,
+    appLocalizations.ruleTarget,
+    appLocalizations.sourceIp,
+    appLocalizations.noResolve,
+    appLocalizations.saveChanges,
+    appLocalizations.findProcessModeDesc,
+    appLocalizations.tabAnimationDesc,
+    appLocalizations.colorSchemes,
+    appLocalizations.palette,
+    appLocalizations.tonalSpotScheme,
+    appLocalizations.fidelityScheme,
+    appLocalizations.monochromeScheme,
+    appLocalizations.neutralScheme,
+    appLocalizations.vibrantScheme,
+    appLocalizations.expressiveScheme,
+    appLocalizations.contentScheme,
+    appLocalizations.rainbowScheme,
+    appLocalizations.fruitSaladScheme,
+    appLocalizations.developerMode,
+    appLocalizations.developerModeEnableTip,
+    appLocalizations.messageTest,
+    appLocalizations.messageTestTip,
+    appLocalizations.crashTest,
+    appLocalizations.crashDetected,
+    appLocalizations.crashDetectedTip,
+    appLocalizations.clearData,
+    appLocalizations.textScale,
+    appLocalizations.internet,
+    appLocalizations.systemApp,
+    appLocalizations.noNetworkApp,
+    appLocalizations.restoreStrategy,
+    appLocalizations.restoreStrategy_override,
+    appLocalizations.restoreStrategy_compatible,
+    appLocalizations.logsTest,
+    appLocalizations.emptyTip('value'),
+    appLocalizations.urlTip('value'),
+    appLocalizations.numberTip('value'),
+    appLocalizations.interval,
+    appLocalizations.existsTip('value'),
+    appLocalizations.deleteTip('value'),
+    appLocalizations.deleteMultipTip('value'),
+    appLocalizations.nullTip('value'),
+    appLocalizations.script,
+    appLocalizations.color,
+    appLocalizations.rename,
+    appLocalizations.unnamed,
+    appLocalizations.pleaseEnterScriptName,
+    appLocalizations.mixedPort,
+    appLocalizations.socksPort,
+    appLocalizations.redirPort,
+    appLocalizations.tproxyPort,
+    appLocalizations.portTip('value'),
+    appLocalizations.portConflictTip,
+    appLocalizations.import,
+    appLocalizations.importFile,
+    appLocalizations.importUrl,
+    appLocalizations.autoSetSystemDns,
+    appLocalizations.details('value'),
+    appLocalizations.creationTime,
+    appLocalizations.process,
+    appLocalizations.host,
+    appLocalizations.destination,
+    appLocalizations.destinationGeoIP,
+    appLocalizations.destinationIPASN,
+    appLocalizations.specialProxy,
+    appLocalizations.specialRules,
+    appLocalizations.remoteDestination,
+    appLocalizations.networkType,
+    appLocalizations.proxyChains,
+    appLocalizations.log,
+    appLocalizations.connection,
+    appLocalizations.request,
+    appLocalizations.connected,
+    appLocalizations.disconnected,
+    appLocalizations.connecting,
+    appLocalizations.restartCoreTip,
+    appLocalizations.forceRestartCoreTip,
+    appLocalizations.dnsHijacking,
+    appLocalizations.coreStatus,
+    appLocalizations.dataCollectionTip,
+    appLocalizations.dataCollectionContent,
+    appLocalizations.crashlytics,
+    appLocalizations.crashlyticsTip,
+    appLocalizations.appendSystemDns,
+    appLocalizations.appendSystemDnsTip,
+    appLocalizations.editRule,
+    appLocalizations.overrideMode,
+    appLocalizations.standardModeDesc,
+    appLocalizations.scriptModeDesc,
+    appLocalizations.addedRules,
+    appLocalizations.controlGlobalAddedRules,
+    appLocalizations.overrideScript,
+    appLocalizations.goToConfigureScript,
+    appLocalizations.editGlobalRules,
+    appLocalizations.externalFetch,
+    appLocalizations.confirmForceCrashCore,
+    appLocalizations.confirmClearAllData,
+    appLocalizations.loading,
+    appLocalizations.loadTest,
+    appLocalizations.yearsAgo(2),
+    appLocalizations.monthsAgo(2),
+    appLocalizations.daysAgo(2),
+    appLocalizations.hoursAgo(2),
+    appLocalizations.minutesAgo(2),
+    appLocalizations.justNow,
+    appLocalizations.noLongerRemind,
+    appLocalizations.accessControlSettings,
+    appLocalizations.turnOn,
+    appLocalizations.turnOff,
+    appLocalizations.vpnConfigChangeDetected,
+    appLocalizations.restart,
+    appLocalizations.speedStatistics,
+    appLocalizations.resetPageChangesTip,
+    appLocalizations.overwriteTypeCustom,
+    appLocalizations.overwriteTypeCustomDesc,
+    appLocalizations.unknownNetworkError,
+    appLocalizations.restoreException,
+    appLocalizations.networkException,
+    appLocalizations.invalidBackupFile,
+    appLocalizations.pruneCache,
+    appLocalizations.backupAndRestore,
+    appLocalizations.backupAndRestoreDesc,
+    appLocalizations.restore,
+    appLocalizations.restoreSuccess,
+    appLocalizations.restoreFromWebDAVDesc,
+    appLocalizations.restoreFromFileDesc,
+    appLocalizations.restoreOnlyConfig,
+    appLocalizations.restoreAllData,
+    appLocalizations.addProfile,
+    appLocalizations.delayTest,
+    appLocalizations.proxyGroupEmpty,
+    appLocalizations.proxyGroupNameEmpty,
+    appLocalizations.proxyGroupNameDuplicate,
+    appLocalizations.confirmExitWindow,
+    appLocalizations.dataChangedSave,
+    appLocalizations.selectProxyProviders,
+    appLocalizations.proxyFilter,
+    appLocalizations.optional,
+    appLocalizations.maxFailedTimes,
+    appLocalizations.testInterval,
+    appLocalizations.excludeProxyFilter,
+    appLocalizations.excludeType,
+    appLocalizations.expectedStatus,
+    appLocalizations.selectProxies,
+    appLocalizations.inputProxyGroupName,
+    appLocalizations.hideFromList,
+    appLocalizations.testWhenUsed,
+    appLocalizations.disableUDP,
+    appLocalizations.confirmDeleteProxyGroup,
+    appLocalizations.ruleEmpty,
+    appLocalizations.inputRuleContent,
+    appLocalizations.ruleSet,
+    appLocalizations.selectRuleSet,
+    appLocalizations.splitStrategy,
+    appLocalizations.selectSplitStrategy,
+    appLocalizations.selectSubRule,
+    appLocalizations.noResolveHostname,
+    appLocalizations.matchSourceIp,
+    appLocalizations.basicInfo,
+    appLocalizations.additionalParameters,
+    appLocalizations.proxyType,
+    appLocalizations.basicStrategy,
+    appLocalizations.editProxy,
+    appLocalizations.includeAllProxyProviders,
+    appLocalizations.includeAllProxyProvidersTip,
+    appLocalizations.addProxyProviders,
+    appLocalizations.includeAllProxies,
+    appLocalizations.includeAllProxiesTip,
+    appLocalizations.proxiesEmpty,
+    appLocalizations.addProxies,
+    appLocalizations.addProxyGroup,
+    appLocalizations.editProxyGroup,
+    appLocalizations.confirmOverwriteTip,
+    appLocalizations.configDataDetected,
+    appLocalizations.quickFill,
+    appLocalizations.iconUrl,
+    appLocalizations.iconRecords,
+    appLocalizations.noRecords,
+    appLocalizations.custom,
+    appLocalizations.ruleActionDomainDesc,
+    appLocalizations.ruleActionDomainSuffixDesc,
+    appLocalizations.ruleActionDomainKeywordDesc,
+    appLocalizations.ruleActionDomainRegexDesc,
+    appLocalizations.ruleActionGeositeDesc,
+    appLocalizations.ruleActionIpCidrDesc,
+    appLocalizations.ruleActionIpCidr6Desc,
+    appLocalizations.ruleActionIpSuffixDesc,
+    appLocalizations.ruleActionIpAsnDesc,
+    appLocalizations.ruleActionGeoipDesc,
+    appLocalizations.ruleActionSrcGeoipDesc,
+    appLocalizations.ruleActionSrcIpAsnDesc,
+    appLocalizations.ruleActionSrcIpCidrDesc,
+    appLocalizations.ruleActionSrcIpSuffixDesc,
+    appLocalizations.ruleActionDstPortDesc,
+    appLocalizations.ruleActionSrcPortDesc,
+    appLocalizations.ruleActionInPortDesc,
+    appLocalizations.ruleActionInTypeDesc,
+    appLocalizations.ruleActionInUserDesc,
+    appLocalizations.ruleActionInNameDesc,
+    appLocalizations.ruleActionProcessPathDesc,
+    appLocalizations.ruleActionProcessPathRegexDesc,
+    appLocalizations.ruleActionProcessNameDesc,
+    appLocalizations.ruleActionProcessNameRegexDesc,
+    appLocalizations.ruleActionUidDesc,
+    appLocalizations.ruleActionNetworkDesc,
+    appLocalizations.ruleActionDscpDesc,
+    appLocalizations.ruleActionRuleSetDesc,
+    appLocalizations.ruleActionAndDesc,
+    appLocalizations.ruleActionOrDesc,
+    appLocalizations.ruleActionNotDesc,
+    appLocalizations.ruleActionSubRuleDesc,
+    appLocalizations.ruleActionMatchDesc,
+    appLocalizations.subRuleEmpty,
+    appLocalizations.proxyProvidersNotEmpty,
+    appLocalizations.contentNotEmpty,
+    appLocalizations.subRuleNotEmpty,
+    appLocalizations.splitStrategyNotEmpty,
+    appLocalizations.proxyProvidersEmpty,
+    appLocalizations.timeout,
+    appLocalizations.invalidSubRule('value'),
+    appLocalizations.invalidPolicy('value'),
+    appLocalizations.invalidProxyProvider('value'),
+    appLocalizations.invalidProxy('value'),
+    appLocalizations.proxyGroupDetectedAbnormal,
+    appLocalizations.proxyProviderDetectedAbnormal,
+    appLocalizations.proxyDetectedAbnormal,
+    appLocalizations.createProfile,
+    appLocalizations.locationPermissionRequired,
+    appLocalizations.locationPermissionGuide('value'),
+    appLocalizations.prerequisites,
+    appLocalizations.ignoreBatteryOptimization,
+    appLocalizations.batteryOptimizationDesc,
+    appLocalizations.batteryOptimizationStatusTip,
+    appLocalizations.locationPermission,
+    appLocalizations.locationPermissionDesc,
+    appLocalizations.excludeSsids,
+    appLocalizations.excludeSsidsDesc,
+    appLocalizations.ssidsEmpty,
+    appLocalizations.onDemand,
+    appLocalizations.onDemandDesc,
+    appLocalizations.locationPermissionDeniedMessage,
+    appLocalizations.addSsid,
+    appLocalizations.editSsid,
+    appLocalizations.authorized,
+    appLocalizations.tapToAuthorize,
+    appLocalizations.suspended,
+    appLocalizations.geoOptions,
+    appLocalizations.geoAutoUpdate,
+    appLocalizations.geoAutoUpdateInterval,
+    appLocalizations.geoAutoUpdateIntervalTip,
+    appLocalizations.hours,
+    appLocalizations.hoursCount('value'),
+    appLocalizations.geoResources,
+    appLocalizations.geoUpdating('value'),
+    appLocalizations.geoSkipped('value'),
+    appLocalizations.geoUpdated('value'),
+    appLocalizations.secondsCount('value'),
+    appLocalizations.entriesCount('value'),
+  ];
+}
diff --git a/test/l10n/localization_contract_test.dart b/test/l10n/localization_contract_test.dart
new file mode 100644
index 0000000000..05f459ea93
--- /dev/null
+++ b/test/l10n/localization_contract_test.dart
@@ -0,0 +1,67 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:fl_clash/l10n/intl/messages_en.dart' as messages_en;
+import 'package:fl_clash/l10n/intl/messages_ja.dart' as messages_ja;
+import 'package:fl_clash/l10n/intl/messages_ru.dart' as messages_ru;
+import 'package:fl_clash/l10n/intl/messages_zh_CN.dart' as messages_zh_cn;
+import 'package:flutter_test/flutter_test.dart';
+import 'package:intl/message_lookup_by_library.dart';
+
+void main() {
+  final lookups = <String, MessageLookupByLibrary>{
+    'en': messages_en.messages,
+    'ja': messages_ja.messages,
+    'ru': messages_ru.messages,
+    'zh_CN': messages_zh_cn.messages,
+  };
+
+  test('every generated locale exposes and evaluates every source message', () {
+    final arbByLocale = <String, Map<String, dynamic>>{
+      for (final locale in lookups.keys)
+        locale:
+            jsonDecode(File('arb/intl_$locale.arb').readAsStringSync())
+                as Map<String, dynamic>,
+    };
+    final expectedKeys = arbByLocale['en']!.keys
+        .where((key) => !key.startsWith('@'))
+        .toSet();
+
+    for (final entry in lookups.entries) {
+      final locale = entry.key;
+      final lookup = entry.value;
+      final messages = lookup.messages;
+      expect(
+        messages.keys.toSet(),
+        expectedKeys,
+        reason: '$locale generated messages must match the English contract',
+      );
+
+      for (final key in expectedKeys) {
+        final template = arbByLocale['en']![key] as String;
+        final placeholderNames = RegExp(
+          r'\{([A-Za-z_][A-Za-z0-9_]*)\b',
+        ).allMatches(template).map((match) => match.group(1)).toSet();
+        final argumentCount = placeholderNames.length;
+        final arguments = List<dynamic>.filled(argumentCount, 2);
+        late final dynamic translated;
+        try {
+          translated = Function.apply(messages[key]!, arguments);
+        } on NoSuchMethodError catch (error) {
+          fail('$locale.$key has mismatched placeholder metadata: $error');
+        }
+
+        expect(
+          translated,
+          isA<String>(),
+          reason: '$locale.$key must evaluate to text',
+        );
+        expect(
+          translated as String,
+          isNotEmpty,
+          reason: '$locale.$key must not be empty',
+        );
+      }
+    }
+  });
+}
diff --git a/test/manager/core_manager_test.dart b/test/manager/core_manager_test.dart
new file mode 100644
index 0000000000..0dfdea21ca
--- /dev/null
+++ b/test/manager/core_manager_test.dart
@@ -0,0 +1,52 @@
+import 'package:fl_clash/core/core.dart';
+import 'package:fl_clash/core/interface.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/manager/core_manager.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:fl_clash/providers/app.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:mocktail/mocktail.dart';
+
+class _MockCoreHandlerInterface extends Mock implements CoreHandlerInterface {}
+
+void main() {
+  testWidgets('duplicate crash events disconnect the core only once', (
+    tester,
+  ) async {
+    final coreInterface = _MockCoreHandlerInterface();
+    when(() => coreInterface.stopLog()).thenAnswer((_) {});
+    final controller = CoreController.test(coreInterface);
+    final container = ProviderContainer();
+    addTearDown(container.dispose);
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: MaterialApp(
+          home: CoreManager(controller: controller, child: const SizedBox()),
+        ),
+      ),
+    );
+    container.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+    final transitions = <CoreStatus>[];
+    final subscription = container.listen<CoreStatus>(
+      coreStatusProvider,
+      (_, next) => transitions.add(next),
+    );
+    addTearDown(subscription.close);
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.paused);
+
+    const crash = CoreEvent(type: CoreEventType.crash, data: 'boom');
+    coreEventManager.sendEvent(crash);
+    coreEventManager.sendEvent(crash);
+    await tester.pump();
+
+    expect(container.read(coreStatusProvider), CoreStatus.disconnected);
+    expect(transitions, [CoreStatus.disconnected]);
+    verifyNever(() => coreInterface.stop());
+
+    await tester.pumpWidget(const SizedBox());
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.resumed);
+  });
+}
diff --git a/test/models/common_test.dart b/test/models/common_test.dart
index 37357cadd6..caee4b289e 100644
--- a/test/models/common_test.dart
+++ b/test/models/common_test.dart
@@ -1,8 +1,122 @@
+import 'dart:io';
+
 import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/l10n/l10n.dart';
 import 'package:fl_clash/models/models.dart';
-import 'package:test/test.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:mocktail/mocktail.dart';
+
+class MockFile extends Mock implements File {}
 
 void main() {
+  group('FileInfo', () {
+    late MockFile file;
+
+    setUp(() {
+      file = MockFile();
+    });
+
+    test('reads size and valid last modified time', () async {
+      final lastModified = DateTime(2026, 7, 29);
+      when(() => file.exists()).thenAnswer((_) async => true);
+      when(() => file.length()).thenAnswer((_) async => 2048);
+      when(() => file.lastModified()).thenAnswer((_) async => lastModified);
+
+      final fileInfo = await file.getFileInfo();
+
+      expect(fileInfo, FileInfo(size: 2048, lastModified: lastModified));
+    });
+
+    test(
+      'treats positive timestamps within the epoch year as unknown',
+      () async {
+        when(() => file.exists()).thenAnswer((_) async => true);
+        when(() => file.length()).thenAnswer((_) async => 1024);
+        when(
+          () => file.lastModified(),
+        ).thenAnswer((_) async => DateTime(1970, 12, 31, 23, 59, 59));
+
+        final fileInfo = await file.getFileInfo();
+
+        expect(fileInfo, const FileInfo(size: 1024));
+      },
+    );
+
+    test('keeps size when last modified time cannot be read', () async {
+      when(() => file.exists()).thenAnswer((_) async => true);
+      when(() => file.length()).thenAnswer((_) async => 1024);
+      when(
+        () => file.lastModified(),
+      ).thenThrow(const FileSystemException('last modified unavailable'));
+
+      final fileInfo = await file.getFileInfo();
+
+      expect(fileInfo, const FileInfo(size: 1024));
+    });
+
+    test('returns null when file does not exist', () async {
+      when(() => file.exists()).thenAnswer((_) async => false);
+
+      expect(await file.getFileInfo(), isNull);
+      verifyNever(() => file.length());
+      verifyNever(() => file.lastModified());
+    });
+
+    testWidgets('shows unknown while preserving file size', (tester) async {
+      await tester.pumpWidget(
+        MaterialApp(
+          localizationsDelegates: const [
+            AppLocalizations.delegate,
+            GlobalMaterialLocalizations.delegate,
+            GlobalWidgetsLocalizations.delegate,
+            GlobalCupertinoLocalizations.delegate,
+          ],
+          supportedLocales: AppLocalizations.delegate.supportedLocales,
+          home: Builder(
+            builder: (context) {
+              return Text(const FileInfo(size: 1024).getDesc(context));
+            },
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(find.text('1KB  ·  Unknown'), findsOneWidget);
+    });
+
+    testWidgets('shows relative time for valid last modified time', (
+      tester,
+    ) async {
+      final lastModified = DateTime.now().subtract(const Duration(days: 2));
+      await tester.pumpWidget(
+        MaterialApp(
+          localizationsDelegates: const [
+            AppLocalizations.delegate,
+            GlobalMaterialLocalizations.delegate,
+            GlobalWidgetsLocalizations.delegate,
+            GlobalCupertinoLocalizations.delegate,
+          ],
+          supportedLocales: AppLocalizations.delegate.supportedLocales,
+          home: Builder(
+            builder: (context) {
+              return Text(
+                FileInfo(
+                  size: 1024,
+                  lastModified: lastModified,
+                ).getDesc(context),
+              );
+            },
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(find.text('1KB  ·  2 days ago'), findsOneWidget);
+    });
+  });
+
   group('PackagesExt', () {
     const packages = [
       Package(
diff --git a/test/models/config_test.dart b/test/models/config_test.dart
index bf037ac8c5..baedffc222 100644
--- a/test/models/config_test.dart
+++ b/test/models/config_test.dart
@@ -18,20 +18,20 @@ T roundTrip<T>(
 
 void main() {
   group('GeoResource JSON', () {
-    test('exposes lowercase GeoResource values', () {
-      expect(GeoResource.MMDB.value, 'mmdb');
-      expect(GeoResource.ASN.value, 'asn');
-      expect(GeoResource.GEOIP.value, 'geo-ip');
-      expect(GeoResource.GEOSITE.value, 'geo-site');
+    test('exposes mihomo raw config keys', () {
+      expect(GeoResource.MMDB.configKey, 'mmdb');
+      expect(GeoResource.ASN.configKey, 'asn');
+      expect(GeoResource.GEOIP.configKey, 'geoip');
+      expect(GeoResource.GEOSITE.configKey, 'geosite');
     });
 
-    test('parses current lowercase GeoResource keys from config JSON', () {
+    test('parses canonical GeoResource keys from config JSON', () {
       final config = PatchClashConfig.fromJson({
         'geox-url': {
           'mmdb': 'https://example.com/mmdb',
           'asn': 'https://example.com/asn.mmdb',
-          'geo-ip': 'https://example.com/geoip.dat',
-          'geo-site': 'https://example.com/geosite.dat',
+          'geoip': 'https://example.com/geoip.dat',
+          'geosite': 'https://example.com/geosite.dat',
         },
       });
 
@@ -43,11 +43,11 @@ void main() {
       });
     });
 
-    test('parses legacy GeoResource keys from config JSON', () {
+    test('parses hyphenated GeoResource keys from config JSON', () {
       final config = PatchClashConfig.fromJson({
         'geox-url': {
-          'geoip': 'https://example.com/legacy-geoip.dat',
-          'geosite': 'https://example.com/legacy-geosite.dat',
+          'geo-ip': 'https://example.com/legacy-geoip.dat',
+          'geo-site': 'https://example.com/legacy-geosite.dat',
         },
       });
 
@@ -66,7 +66,7 @@ void main() {
         geoXUrl: {GeoResource.GEOIP: 'https://example.com/geoip.dat'},
       ).toJson();
 
-      expect(json['geox-url'], {'geo-ip': 'https://example.com/geoip.dat'});
+      expect(json['geox-url'], {'geoip': 'https://example.com/geoip.dat'});
     });
 
     test('converts geoXUrl map to raw config map', () {
@@ -77,7 +77,7 @@ void main() {
 
       expect(geoXUrl.raw, {
         'mmdb': 'https://example.com/mmdb',
-        'geo-site': 'https://example.com/geosite.dat',
+        'geosite': 'https://example.com/geosite.dat',
       });
     });
 
@@ -348,6 +348,46 @@ void main() {
   });
 
   group('Config composite serialization', () {
+    test('DAVProps obfuscates and restores its password', () {
+      const props = DAVProps(
+        uri: 'https://dav.example.com',
+        user: 'user',
+        password: '密碼-🔐',
+      );
+
+      final json = props.toJson();
+
+      expect(json['password'], startsWith('v1.'));
+      expect(json['password'], isNot(contains('密碼')));
+      expect(DAVProps.fromJson(json), props);
+      expect(props.toString(), isNot(contains('密碼')));
+      expect(props.toString(), contains('password: ***'));
+    });
+
+    test('DAVProps accepts and rewrites a legacy plain-text password', () {
+      final props = DAVProps.fromJson({
+        'uri': 'https://dav.example.com',
+        'user': 'user',
+        'password': 'legacy-secret',
+        'fileName': 'backup.zip',
+      });
+
+      expect(props.password, 'legacy-secret');
+      expect(props.toJson()['password'], startsWith('v1.'));
+      expect(props.toJson()['password'], isNot(contains('legacy-secret')));
+    });
+
+    test('DAVProps rejects a damaged obfuscated password', () {
+      final props = DAVProps.fromJson({
+        'uri': 'https://dav.example.com',
+        'user': 'user',
+        'password': 'v1.invalid.invalid',
+        'fileName': 'backup.zip',
+      });
+
+      expect(props.password, isEmpty);
+    });
+
     test('default Config round-trip', () {
       const config = Config(themeProps: ThemeProps());
       final restored = roundTrip(() => config.toJson(), Config.fromJson);
diff --git a/test/models/core_test.dart b/test/models/core_test.dart
index 0fbdcb96d7..d123888fdb 100644
--- a/test/models/core_test.dart
+++ b/test/models/core_test.dart
@@ -178,28 +178,4 @@ void main() {
       expect(msg.type, InvokeMessageType.protect);
     });
   });
-
-  group('ActionResult', () {
-    test('toResult returns success Result for success code', () {
-      const ar = ActionResult(
-        method: ActionMethod.getConfig,
-        data: {'key': 'value'},
-        code: ResultType.success,
-      );
-      final result = ar.toResult;
-      expect(result.isSuccess, true);
-      expect(result.data, {'key': 'value'});
-    });
-
-    test('toResult returns error Result for error code', () {
-      const ar = ActionResult(
-        method: ActionMethod.getConfig,
-        data: 'something went wrong',
-        code: ResultType.error,
-      );
-      final result = ar.toResult;
-      expect(result.isSuccess, false);
-      expect(result.message, 'something went wrong');
-    });
-  });
 }
diff --git a/test/models/tailscale_test.dart b/test/models/tailscale_test.dart
new file mode 100644
index 0000000000..8a0a7f17f3
--- /dev/null
+++ b/test/models/tailscale_test.dart
@@ -0,0 +1,325 @@
+import 'dart:convert';
+
+import 'package:fl_clash/models/models.dart';
+import 'package:test/test.dart';
+
+void main() {
+  group('TailscaleProxy.toOutboundJson', () {
+    test('emits only name and type when optionals are empty', () {
+      const proxy = TailscaleProxy(name: 'ts-node');
+      final json = proxy.toOutboundJson();
+      expect(json, {'name': 'ts-node', 'type': 'tailscale'});
+    });
+
+    test('trims name and type value matches core parser', () {
+      const proxy = TailscaleProxy(name: '  ts-node  ');
+      final json = proxy.toOutboundJson();
+      expect(json['name'], 'ts-node');
+      expect(json['type'], tailscaleProxyType);
+    });
+
+    test('emits kebab-case keys for populated fields', () {
+      const proxy = TailscaleProxy(
+        name: 'ts-node',
+        authKey: 'tskey-auth-abc',
+        hostname: 'my-host',
+        controlUrl: 'https://controlplane.example.com',
+        stateDir: 'tailscale-state',
+        ephemeral: true,
+        udp: true,
+        acceptRoutes: true,
+      );
+      final json = proxy.toOutboundJson();
+      expect(json['auth-key'], 'tskey-auth-abc');
+      expect(json['hostname'], 'my-host');
+      expect(json['control-url'], 'https://controlplane.example.com');
+      expect(json['state-dir'], 'tailscale-state');
+      expect(json['ephemeral'], true);
+      expect(json['udp'], true);
+      expect(json['accept-routes'], true);
+    });
+
+    test('omits false boolean flags', () {
+      const proxy = TailscaleProxy(name: 'ts-node');
+      final json = proxy.toOutboundJson();
+      expect(json.containsKey('ephemeral'), isFalse);
+      expect(json.containsKey('udp'), isFalse);
+      expect(json.containsKey('accept-routes'), isFalse);
+      expect(json.containsKey('exit-node'), isFalse);
+      expect(json.containsKey('exit-node-allow-lan-access'), isFalse);
+    });
+
+    test('includes exit-node-allow-lan-access only when exit-node is set', () {
+      const proxy = TailscaleProxy(
+        name: 'ts-node',
+        exitNode: '100.64.0.1',
+        exitNodeAllowLanAccess: true,
+      );
+      final json = proxy.toOutboundJson();
+      expect(json['exit-node'], '100.64.0.1');
+      expect(json['exit-node-allow-lan-access'], true);
+    });
+
+    test('exit-node-allow-lan-access defaults to false alongside exit-node', () {
+      const proxy = TailscaleProxy(name: 'ts-node', exitNode: '100.64.0.1');
+      final json = proxy.toOutboundJson();
+      expect(json['exit-node'], '100.64.0.1');
+      expect(json['exit-node-allow-lan-access'], false);
+    });
+  });
+
+  group('TailscaleProxy validation and serialization', () {
+    test('isValid requires a non-empty trimmed name', () {
+      expect(const TailscaleProxy(name: '').isValid, isFalse);
+      expect(const TailscaleProxy(name: '   ').isValid, isFalse);
+      expect(const TailscaleProxy(name: 'ts-node').isValid, isTrue);
+    });
+
+    test('round-trips through json for persistence', () {
+      const proxy = TailscaleProxy(
+        name: 'ts-node',
+        authKey: 'tskey-auth-abc',
+        exitNode: '100.64.0.1',
+        ephemeral: true,
+      );
+      final restored = TailscaleProxy.fromJson(
+        jsonDecode(jsonEncode(proxy.toJson())) as Map<String, Object?>,
+      );
+      expect(restored, proxy);
+    });
+  });
+
+  group('TailscaleProps', () {
+    test('is disabled with no nodes by default', () {
+      const props = TailscaleProps();
+      expect(props.enable, isFalse);
+      expect(props.proxies, isEmpty);
+    });
+
+    test('activeProxies is empty when disabled', () {
+      const props = TailscaleProps(
+        enable: false,
+        proxies: [TailscaleProxy(name: 'ts-node')],
+      );
+      expect(props.activeProxies, isEmpty);
+    });
+
+    test('activeProxies returns nodes when enabled', () {
+      const props = TailscaleProps(
+        enable: true,
+        proxies: [TailscaleProxy(name: 'ts-node')],
+      );
+      expect(props.activeProxies.length, 1);
+    });
+
+    test('safeFromJson falls back to default on invalid input', () {
+      expect(TailscaleProps.safeFromJson(null), defaultTailscaleProps);
+      expect(
+        TailscaleProps.safeFromJson({'proxies': 'not-a-list'}),
+        defaultTailscaleProps,
+      );
+    });
+
+    test('round-trips through json', () {
+      const props = TailscaleProps(
+        enable: true,
+        bypassTraffic: true,
+        proxies: [
+          TailscaleProxy(name: 'ts-node', authKey: 'k', routes: ['home-pc']),
+        ],
+      );
+      final restored = TailscaleProps.fromJson(
+        jsonDecode(jsonEncode(props.toJson())) as Map<String, Object?>,
+      );
+      expect(restored, props);
+    });
+  });
+
+  group('buildTailscaleRouteRule', () {
+    test('uses DOMAIN-SUFFIX for hostnames', () {
+      expect(
+        buildTailscaleRouteRule('home-pc.tailnet.ts.net', 'ts-node'),
+        'DOMAIN-SUFFIX,home-pc.tailnet.ts.net,ts-node',
+      );
+    });
+
+    test('uses IP-CIDR with /32 for bare IPv4', () {
+      expect(
+        buildTailscaleRouteRule('100.64.0.5', 'ts-node'),
+        'IP-CIDR,100.64.0.5/32,ts-node,no-resolve',
+      );
+    });
+
+    test('keeps an explicit IPv4 CIDR', () {
+      expect(
+        buildTailscaleRouteRule('192.168.1.0/24', 'ts-node'),
+        'IP-CIDR,192.168.1.0/24,ts-node,no-resolve',
+      );
+    });
+
+    test('uses IP-CIDR6 with /128 for bare IPv6', () {
+      expect(
+        buildTailscaleRouteRule('fd7a:115c:a1e0::1', 'ts-node'),
+        'IP-CIDR6,fd7a:115c:a1e0::1/128,ts-node,no-resolve',
+      );
+    });
+  });
+
+  group('TailscaleProps.buildInjectedRules', () {
+    test('is empty by default', () {
+      expect(const TailscaleProps().buildInjectedRules(), isEmpty);
+    });
+
+    test('emits bypass rules when bypassTraffic is on', () {
+      const props = TailscaleProps(bypassTraffic: true);
+      expect(props.buildInjectedRules(), tailscaleBypassRules);
+      expect(
+        props.buildInjectedRules(),
+        containsAll([
+          'DOMAIN-SUFFIX,tailscale.com,DIRECT',
+          'DOMAIN-SUFFIX,tailscale.io,DIRECT',
+          'DOMAIN-SUFFIX,ts.net,DIRECT',
+        ]),
+      );
+    });
+
+    test('emits fake-ip filters only when bypassTraffic is on', () {
+      expect(const TailscaleProps().buildFakeIpFilters(), isEmpty);
+      expect(
+        const TailscaleProps(bypassTraffic: true).buildFakeIpFilters(),
+        tailscaleFakeIpFilters,
+      );
+      expect(
+        const TailscaleProps(bypassTraffic: true).buildFakeIpFilters(),
+        containsAll(['+.tailscale.com', '+.tailscale.io', '+.ts.net']),
+      );
+    });
+
+    test('does not emit route rules when disabled', () {
+      const props = TailscaleProps(
+        enable: false,
+        proxies: [
+          TailscaleProxy(name: 'ts-node', routes: ['100.64.0.5']),
+        ],
+      );
+      expect(props.buildInjectedRules(), isEmpty);
+    });
+
+    test('emits route rules for active nodes when enabled', () {
+      const props = TailscaleProps(
+        enable: true,
+        proxies: [
+          TailscaleProxy(
+            name: 'ts-node',
+            routes: ['100.64.0.5', 'home-pc.ts.net'],
+          ),
+        ],
+      );
+      expect(props.buildInjectedRules(), [
+        'IP-CIDR,100.64.0.5/32,ts-node,no-resolve',
+        'DOMAIN-SUFFIX,home-pc.ts.net,ts-node',
+      ]);
+    });
+
+    test('route rules come before bypass rules', () {
+      const props = TailscaleProps(
+        enable: true,
+        bypassTraffic: true,
+        proxies: [
+          TailscaleProxy(name: 'ts-node', routes: ['home-pc.ts.net']),
+        ],
+      );
+      final rules = props.buildInjectedRules();
+      expect(rules.first, 'DOMAIN-SUFFIX,home-pc.ts.net,ts-node');
+      expect(rules.sublist(1), tailscaleBypassRules);
+    });
+
+    test('skips invalid nodes and empty routes', () {
+      const props = TailscaleProps(
+        enable: true,
+        proxies: [
+          TailscaleProxy(name: '', routes: ['ignored']),
+          TailscaleProxy(name: 'ts-node', routes: ['', '  ']),
+        ],
+      );
+      expect(props.buildInjectedRules(), isEmpty);
+    });
+  });
+
+  group('TailscaleProxyListExt.mergeInto', () {
+    test('adds tailscale proxies to a config without a proxies list', () {
+      final config = <String, dynamic>{'mode': 'rule'};
+      const proxies = [TailscaleProxy(name: 'ts-node')];
+      final result = proxies.mergeInto(config);
+      expect(result['proxies'], [
+        {'name': 'ts-node', 'type': 'tailscale'},
+      ]);
+      expect(result['mode'], 'rule');
+    });
+
+    test('appends while preserving existing proxies', () {
+      final config = <String, dynamic>{
+        'proxies': [
+          {'name': 'ss-node', 'type': 'ss'},
+        ],
+      };
+      const proxies = [TailscaleProxy(name: 'ts-node')];
+      final result = proxies.mergeInto(config);
+      final resultProxies = result['proxies'] as List;
+      expect(resultProxies.length, 2);
+      expect(resultProxies.first, {'name': 'ss-node', 'type': 'ss'});
+      expect(resultProxies.last, {'name': 'ts-node', 'type': 'tailscale'});
+    });
+
+    test('replaces an existing proxy with the same name', () {
+      final config = <String, dynamic>{
+        'proxies': [
+          {'name': 'ts-node', 'type': 'ss'},
+        ],
+      };
+      const proxies = [TailscaleProxy(name: 'ts-node', authKey: 'new-key')];
+      final result = proxies.mergeInto(config);
+      final resultProxies = result['proxies'] as List;
+      expect(resultProxies.length, 1);
+      expect(resultProxies.first, {
+        'name': 'ts-node',
+        'type': 'tailscale',
+        'auth-key': 'new-key',
+      });
+    });
+
+    test('skips invalid nodes', () {
+      final config = <String, dynamic>{};
+      const proxies = [
+        TailscaleProxy(name: ''),
+        TailscaleProxy(name: 'ts-node'),
+      ];
+      final result = proxies.mergeInto(config);
+      expect((result['proxies'] as List).length, 1);
+    });
+
+    test('returns config unchanged when there are no valid nodes', () {
+      final config = <String, dynamic>{
+        'proxies': [
+          {'name': 'ss-node', 'type': 'ss'},
+        ],
+      };
+      const proxies = [TailscaleProxy(name: '')];
+      final result = proxies.mergeInto(config);
+      expect(result['proxies'], [
+        {'name': 'ss-node', 'type': 'ss'},
+      ]);
+    });
+
+    test('does not mutate the input config', () {
+      final config = <String, dynamic>{
+        'proxies': [
+          {'name': 'ss-node', 'type': 'ss'},
+        ],
+      };
+      const proxies = [TailscaleProxy(name: 'ts-node')];
+      proxies.mergeInto(config);
+      expect((config['proxies'] as List).length, 1);
+    });
+  });
+}
diff --git a/test/pages/home_test.dart b/test/pages/home_test.dart
new file mode 100644
index 0000000000..f640032c49
--- /dev/null
+++ b/test/pages/home_test.dart
@@ -0,0 +1,271 @@
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/common/theme.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/manager/app_manager.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:fl_clash/pages/home.dart';
+import 'package:fl_clash/providers/providers.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/views/application_setting.dart';
+import 'package:fl_clash/views/tools.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets(
+    'screen-size transition preserves current content and animates navigation',
+    (tester) async {
+      tester.view.physicalSize = const Size(1200, 800);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.resetPhysicalSize);
+      addTearDown(tester.view.resetDevicePixelRatio);
+
+      final container = ProviderContainer(
+        overrides: [
+          navigationItemsStateProvider.overrideWithValue(
+            NavigationItemsState(
+              value: [
+                NavigationItem(
+                  icon: const Icon(Icons.space_dashboard),
+                  label: PageLabel.dashboard,
+                  builder: (_) => const _StatefulContent(
+                    key: GlobalObjectKey(PageLabel.dashboard),
+                  ),
+                ),
+                NavigationItem(
+                  icon: const Icon(Icons.construction),
+                  label: PageLabel.tools,
+                  builder: (_) => const SizedBox.shrink(),
+                ),
+              ],
+            ),
+          ),
+        ],
+      );
+      addTearDown(container.dispose);
+      globalState.container = container;
+      container.read(viewSizeProvider.notifier).value = const Size(1200, 800);
+
+      await tester.pumpWidget(
+        UncontrolledProviderScope(
+          container: container,
+          child: const MaterialApp(home: HomePage()),
+        ),
+      );
+      await tester.pump();
+
+      final sidebarBackground = find.descendant(
+        of: find.byType(AppSidebarContainer),
+        matching: find.byWidgetPredicate(
+          (widget) => widget is Container && widget.child is Row,
+        ),
+      );
+      final sidebarContainer = tester.widget<Container>(
+        sidebarBackground.first,
+      );
+      expect(
+        sidebarContainer.color,
+        Theme.of(
+          tester.element(find.byType(AppSidebarContainer)),
+        ).colorScheme.surfaceContainer,
+      );
+
+      await tester.tap(find.text('count: 0'));
+      await tester.pump();
+      expect(find.text('count: 1'), findsOneWidget);
+      expect(find.byType(NavigationRail), findsOneWidget);
+      expect(find.byType(NavigationBar), findsNothing);
+
+      for (var width = 1180.0; width >= 500; width -= 20) {
+        tester.view.physicalSize = Size(width, 800);
+        container.read(viewSizeProvider.notifier).value = Size(width, 800);
+        await tester.pump(const Duration(milliseconds: 16));
+        expect(tester.takeException(), isNull, reason: 'width: $width');
+      }
+
+      expect(find.text('count: 1'), findsOneWidget);
+      expect(find.byType(NavigationRail), findsOneWidget);
+      expect(find.byType(NavigationBar), findsOneWidget);
+      await tester.pump(const Duration(milliseconds: 150));
+      expect(tester.takeException(), isNull);
+
+      final outgoingTools = find.descendant(
+        of: find.byType(NavigationRail),
+        matching: find.byIcon(Icons.construction),
+      );
+      await tester.tap(outgoingTools, warnIfMissed: false);
+      await tester.pump();
+      expect(container.read(currentPageLabelProvider), PageLabel.dashboard);
+
+      await tester.pump(const Duration(milliseconds: 301));
+      expect(find.byType(NavigationRail), findsNothing);
+      expect(find.byType(NavigationBar), findsOneWidget);
+
+      tester.view.physicalSize = const Size(1200, 800);
+      container.read(viewSizeProvider.notifier).value = const Size(1200, 800);
+      await tester.pump();
+
+      expect(find.text('count: 1'), findsOneWidget);
+      expect(find.byType(NavigationRail), findsOneWidget);
+      expect(find.byType(NavigationBar), findsOneWidget);
+
+      await tester.pump(const Duration(milliseconds: 301));
+      expect(find.byType(NavigationRail), findsOneWidget);
+      expect(find.byType(NavigationBar), findsNothing);
+      expect(tester.takeException(), isNull);
+    },
+  );
+
+  testWidgets(
+    'list content stays valid while resizing through the breakpoint',
+    (tester) async {
+      tester.view.physicalSize = const Size(1200, 800);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.resetPhysicalSize);
+      addTearDown(tester.view.resetDevicePixelRatio);
+
+      final container = ProviderContainer(
+        overrides: [
+          navigationItemsStateProvider.overrideWithValue(
+            NavigationItemsState(
+              value: [
+                NavigationItem(
+                  icon: const Icon(Icons.space_dashboard),
+                  label: PageLabel.dashboard,
+                  builder: (_) => const ToolsView(
+                    key: GlobalObjectKey(PageLabel.dashboard),
+                  ),
+                ),
+                NavigationItem(
+                  icon: const Icon(Icons.construction),
+                  label: PageLabel.tools,
+                  builder: (_) => const SizedBox.shrink(),
+                ),
+              ],
+            ),
+          ),
+        ],
+      );
+      addTearDown(container.dispose);
+      globalState.container = container;
+      container.read(viewSizeProvider.notifier).value = const Size(1200, 800);
+
+      await tester.pumpWidget(
+        UncontrolledProviderScope(
+          container: container,
+          child: const _TestApp(child: HomePage()),
+        ),
+      );
+      await tester.pump();
+
+      for (var width = 1180.0; width >= 380; width -= 20) {
+        tester.view.physicalSize = Size(width, 800);
+        container.read(viewSizeProvider.notifier).value = Size(width, 800);
+        await tester.pump(const Duration(milliseconds: 16));
+        expect(tester.takeException(), isNull, reason: 'width: $width');
+      }
+    },
+  );
+
+  testWidgets(
+    'desktop navigation keeps the tools route when logs are enabled',
+    (tester) async {
+      tester.view.physicalSize = const Size(1400, 1000);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.resetPhysicalSize);
+      addTearDown(tester.view.resetDevicePixelRatio);
+
+      final container = ProviderContainer();
+      addTearDown(container.dispose);
+      globalState.container = container;
+      container.read(viewSizeProvider.notifier).value = const Size(1400, 1000);
+      container.read(currentPageLabelProvider.notifier).toPage(PageLabel.tools);
+
+      await tester.pumpWidget(
+        UncontrolledProviderScope(
+          container: container,
+          child: const _TestApp(child: HomePage()),
+        ),
+      );
+      await tester.pump();
+
+      final applicationItem = find.text('Application');
+      await tester.scrollUntilVisible(
+        applicationItem,
+        500,
+        scrollable: find.byType(Scrollable).first,
+      );
+      await tester.tap(applicationItem);
+      await tester.pumpAndSettle();
+      expect(find.byType(ApplicationSettingView), findsOneWidget);
+
+      final logItem = find.text('Logcat');
+      await tester.scrollUntilVisible(
+        logItem,
+        500,
+        scrollable: find.byType(Scrollable).first,
+      );
+      await tester.tap(logItem);
+      await tester.pumpAndSettle();
+
+      expect(container.read(appSettingProvider).openLogs, isTrue);
+      expect(find.byType(ApplicationSettingView), findsOneWidget);
+      expect(tester.takeException(), isNull);
+    },
+  );
+}
+
+class _TestApp extends StatelessWidget {
+  final Widget child;
+
+  const _TestApp({required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      localizationsDelegates: const [
+        AppLocalizations.delegate,
+        GlobalMaterialLocalizations.delegate,
+        GlobalCupertinoLocalizations.delegate,
+        GlobalWidgetsLocalizations.delegate,
+      ],
+      supportedLocales: AppLocalizations.delegate.supportedLocales,
+      builder: (context, child) {
+        globalState.measure = Measure.of(context, 1);
+        globalState.theme = CommonTheme.of(context, 1);
+        return child!;
+      },
+      home: child,
+    );
+  }
+}
+
+class _StatefulContent extends StatefulWidget {
+  const _StatefulContent({super.key});
+
+  @override
+  State<_StatefulContent> createState() => _StatefulContentState();
+}
+
+class _StatefulContentState extends State<_StatefulContent> {
+  var _count = 0;
+
+  @override
+  Widget build(BuildContext context) {
+    return ListTile(
+      contentPadding: const EdgeInsets.symmetric(horizontal: 16),
+      leading: const SizedBox(width: 80),
+      title: TextButton(
+        onPressed: () {
+          setState(() {
+            _count++;
+          });
+        },
+        child: Text('count: $_count'),
+      ),
+    );
+  }
+}
diff --git a/test/plugins/app_test.dart b/test/plugins/app_test.dart
new file mode 100644
index 0000000000..482595c206
--- /dev/null
+++ b/test/plugins/app_test.dart
@@ -0,0 +1,46 @@
+import 'package:fl_clash/common/constant.dart';
+import 'package:fl_clash/plugins/app.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  const channel = MethodChannel('$packageName/app');
+
+  tearDown(() {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, null);
+  });
+
+  test('reads previous execution crash state from Android', () async {
+    MethodCall? receivedCall;
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (call) async {
+          receivedCall = call;
+          return true;
+        });
+
+    final didCrash = await App().didCrashOnPreviousExecution();
+
+    expect(didCrash, isTrue);
+    expect(receivedCall, isNotNull);
+    expect(receivedCall!.method, 'didCrashOnPreviousExecution');
+  });
+
+  test('uses false when Android returns no crash state', () async {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (_) async => null);
+
+    expect(await App().didCrashOnPreviousExecution(), isFalse);
+  });
+
+  test('uses false when crash detection is unavailable', () async {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (_) async {
+          throw PlatformException(code: 'unavailable');
+        });
+
+    expect(await App().didCrashOnPreviousExecution(), isFalse);
+  });
+}
diff --git a/test/providers/action_test.dart b/test/providers/action_test.dart
index e8cc6164cc..3e762e3953 100644
--- a/test/providers/action_test.dart
+++ b/test/providers/action_test.dart
@@ -1,9 +1,13 @@
+import 'dart:async';
+
+import 'package:fl_clash/core/desktop/model.dart';
 import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/models/models.dart';
 import 'package:fl_clash/providers/action.dart';
 import 'package:fl_clash/providers/app.dart';
 import 'package:fl_clash/providers/config.dart';
 import 'package:fl_clash/providers/database.dart';
+import 'package:fl_clash/providers/state.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:riverpod/riverpod.dart';
 
@@ -37,6 +41,83 @@ void main() {
       expect(profile?.label, edited.label);
       expect(profile?.url, edited.url);
     });
+
+    test('updates selection, inserts first profile, and reorders profiles', () {
+      final first = Profile.normal(label: 'First');
+      final second = Profile.normal(label: 'Second');
+      final container = ProviderContainer(
+        overrides: [
+          currentProfileIdProvider.overrideWithBuild((_, _) => first.id),
+          profilesProvider.overrideWith(() => _TestProfiles([first])),
+        ],
+      );
+      addTearDown(container.dispose);
+      final action = container.read(profilesActionProvider.notifier);
+
+      action.updateCurrentSelectedMap('Group', 'Proxy');
+      final updatedFirst = container.read(profilesProvider).single;
+      expect(updatedFirst.selectedMap['Group'], 'Proxy');
+
+      action.updateCurrentSelectedMap('Group', 'Proxy');
+      expect(container.read(profilesProvider), hasLength(1));
+
+      container.read(currentProfileIdProvider.notifier).value = null;
+      action.putProfile(second);
+      expect(container.read(currentProfileIdProvider), second.id);
+      expect(container.read(profilesProvider), [updatedFirst, second]);
+
+      action.reorder([second, updatedFirst]);
+      expect(container.read(profilesProvider), [second, updatedFirst]);
+    });
+
+    test(
+      'skips profile updates that are disabled, fresh, or file-based',
+      () async {
+        final profiles = [
+          Profile.normal(label: 'Disabled').copyWith(autoUpdate: false),
+          Profile.normal(label: 'Fresh').copyWith(
+            autoUpdate: true,
+            lastUpdateDate: DateTime.now().add(const Duration(days: 1)),
+          ),
+          Profile.normal(label: 'File').copyWith(
+            autoUpdate: true,
+            lastUpdateDate: DateTime.now().subtract(const Duration(days: 1)),
+          ),
+        ];
+        final container = ProviderContainer(
+          overrides: [
+            currentProfileIdProvider.overrideWithBuild((_, _) => null),
+            profilesProvider.overrideWith(() => _TestProfiles(profiles)),
+          ],
+        );
+        addTearDown(container.dispose);
+        final action = container.read(profilesActionProvider.notifier);
+
+        await action.autoUpdateProfiles();
+        await action.updateProfiles();
+
+        expect(container.read(profilesProvider), profiles);
+      },
+    );
+
+    test('setProfileAndAutoApply stores a non-current profile', () {
+      final current = Profile.normal(label: 'Current');
+      final other = Profile.normal(label: 'Other');
+      final container = ProviderContainer(
+        overrides: [
+          currentProfileIdProvider.overrideWithBuild((_, _) => current.id),
+          profilesProvider.overrideWith(() => _TestProfiles([current])),
+        ],
+      );
+      addTearDown(container.dispose);
+
+      container
+          .read(profilesActionProvider.notifier)
+          .setProfileAndAutoApply(other);
+
+      expect(container.read(profilesProvider), [current, other]);
+      expect(container.read(currentProfileIdProvider), current.id);
+    });
   });
 
   group('GeoResourceAction', () {
@@ -60,6 +141,381 @@ void main() {
       container.read(isUpdatingProvider(key).notifier).value = false;
       expect(container.read(isUpdatingProvider(key)), false);
     });
+
+    test('updates valid resource URLs and rejects malformed URLs', () {
+      final container = ProviderContainer();
+      addTearDown(container.dispose);
+      final action = container.read(geoResourceActionProvider.notifier);
+
+      expect(
+        () => action.updateGeoResourceUrl(GeoResource.MMDB, 'not-a-url'),
+        throwsA('Invalid url'),
+      );
+
+      const url = 'https://example.com/Country.mmdb';
+      action.updateGeoResourceUrl(GeoResource.MMDB, url);
+      expect(
+        container.read(patchClashConfigProvider).geoXUrl[GeoResource.MMDB],
+        url,
+      );
+    });
+  });
+
+  group('CoreAction', () {
+    test('applies the profile after restarting a stopped core', () async {
+      final container = ProviderContainer(
+        overrides: [
+          coreActionProvider.overrideWith(_TestCoreAction.new),
+          setupActionProvider.overrideWith(_TestSetupAction.new),
+        ],
+      );
+      addTearDown(container.dispose);
+      final coreAction =
+          container.read(coreActionProvider.notifier) as _TestCoreAction;
+      final setupAction =
+          container.read(setupActionProvider.notifier) as _TestSetupAction;
+
+      await coreAction.restartCore();
+
+      expect(coreAction.lifecycleRestartCount, 1);
+      expect(setupAction.setRunningCount, 0);
+      expect(setupAction.applyProfileCount, 1);
+    });
+
+    test(
+      'restores the started state after restarting a running core',
+      () async {
+        final container = ProviderContainer(
+          overrides: [
+            coreActionProvider.overrideWith(_TestCoreAction.new),
+            setupActionProvider.overrideWith(_TestSetupAction.new),
+          ],
+        );
+        addTearDown(container.dispose);
+        container.read(runTimeProvider.notifier).value = 0;
+        final coreAction =
+            container.read(coreActionProvider.notifier) as _TestCoreAction;
+        final setupAction =
+            container.read(setupActionProvider.notifier) as _TestSetupAction;
+
+        await coreAction.restartCore();
+
+        expect(coreAction.lifecycleRestartCount, 1);
+        expect(setupAction.setRunningCount, 1);
+        expect(setupAction.applyProfileCount, 0);
+      },
+    );
+
+    test(
+      'coalesces concurrent restart requests into one lifecycle restart',
+      () async {
+        final container = ProviderContainer(
+          overrides: [
+            coreActionProvider.overrideWith(_TestCoreAction.new),
+            setupActionProvider.overrideWith(_TestSetupAction.new),
+          ],
+        );
+        addTearDown(container.dispose);
+        final coreAction =
+            container.read(coreActionProvider.notifier) as _TestCoreAction;
+        final setupAction =
+            container.read(setupActionProvider.notifier) as _TestSetupAction;
+        final restartCompleter = Completer<CoreLifecycleResult>();
+        coreAction.restartCompleter = restartCompleter;
+
+        final first = coreAction.restartCore();
+        final second = coreAction.restartCore();
+        await Future<void>.delayed(Duration.zero);
+
+        expect(coreAction.lifecycleRestartCount, 1);
+        restartCompleter.complete(_restartResult);
+        await Future.wait([first, second]);
+
+        expect(setupAction.applyProfileCount, 1);
+      },
+    );
+
+    test('reapplies the latest request without restarting twice', () async {
+      final container = ProviderContainer(
+        overrides: [
+          coreActionProvider.overrideWith(_TestCoreAction.new),
+          setupActionProvider.overrideWith(_TestSetupAction.new),
+        ],
+      );
+      addTearDown(container.dispose);
+      final coreAction =
+          container.read(coreActionProvider.notifier) as _TestCoreAction;
+      final setupAction =
+          container.read(setupActionProvider.notifier) as _TestSetupAction;
+      final restartCompleter = Completer<CoreLifecycleResult>();
+      final firstApplyStarted = Completer<void>();
+      final firstApplyCompleter = Completer<void>();
+      coreAction.restartCompleter = restartCompleter;
+      setupAction.firstApplyStarted = firstApplyStarted;
+      setupAction.firstApplyCompleter = firstApplyCompleter;
+
+      final first = coreAction.restartCore();
+      await Future<void>.delayed(Duration.zero);
+      restartCompleter.complete(_restartResult);
+      await firstApplyStarted.future;
+
+      final second = coreAction.restartCore();
+      firstApplyCompleter.complete();
+      await Future.wait([first, second]);
+
+      expect(coreAction.lifecycleRestartCount, 1);
+      expect(setupAction.applyProfileCount, 2);
+    });
+  });
+
+  group('SetupAction', () {
+    group('rapid status changes', () {
+      test('updates runtime and traffic while core start is pending', () async {
+        final startCompleter = Completer<bool>();
+        final container = ProviderContainer(
+          overrides: [
+            initProvider.overrideWithBuild((_, _) => true),
+            commonActionProvider.overrideWith(_RaceCommonAction.new),
+            setupActionProvider.overrideWith(_RaceSetupAction.new),
+          ],
+        );
+        addTearDown(container.dispose);
+        final action =
+            container.read(setupActionProvider.notifier) as _RaceSetupAction;
+        final commonAction =
+            container.read(commonActionProvider.notifier) as _RaceCommonAction;
+        action.startCompleter = startCompleter;
+
+        final startFuture = action.setRunning(true);
+        final initialRunTime = container.read(runTimeProvider)!;
+        await Future<void>.delayed(const Duration(milliseconds: 1100));
+
+        expect(container.read(runTimeProvider), greaterThan(initialRunTime));
+        expect(commonAction.updateTrafficCount, greaterThanOrEqualTo(2));
+
+        startCompleter.complete(true);
+        await startFuture;
+
+        expect(action.transitions, [true]);
+        await action.setRunning(false);
+      });
+
+      test('serializes listener changes while latest start owns UI', () async {
+        final stopCompleter = Completer<bool>();
+        final container = ProviderContainer(
+          overrides: [
+            initProvider.overrideWithBuild((_, _) => true),
+            commonActionProvider.overrideWith(_RaceCommonAction.new),
+            setupActionProvider.overrideWith(_RaceSetupAction.new),
+          ],
+        );
+        addTearDown(container.dispose);
+        final action =
+            container.read(setupActionProvider.notifier) as _RaceSetupAction;
+        await action.setRunning(true);
+        action.transitions.clear();
+        action.applyProfileDebounceCount = 0;
+        action.stopCompleter = stopCompleter;
+
+        final stopFuture = action.setRunning(false);
+        await Future<void>.delayed(Duration.zero);
+        expect(action.transitions, [false]);
+
+        final startFuture = action.setRunning(true);
+
+        expect(container.read(runTimeProvider), isNotNull);
+
+        stopCompleter.complete(true);
+        await Future.wait([stopFuture, startFuture]);
+
+        expect(action.transitions, [false, true]);
+        expect(container.read(runTimeProvider), isNotNull);
+        expect(container.read(isStartProvider), isTrue);
+        expect(action.applyProfileDebounceCount, 1);
+        expect(action.resetCoreTrafficCount, 0);
+
+        await action.setRunning(false);
+      });
+
+      test('newer stop prevents stale start continuation', () async {
+        final startCompleter = Completer<bool>();
+        final container = ProviderContainer(
+          overrides: [
+            initProvider.overrideWithBuild((_, _) => true),
+            commonActionProvider.overrideWith(_RaceCommonAction.new),
+            setupActionProvider.overrideWith(_RaceSetupAction.new),
+          ],
+        );
+        addTearDown(container.dispose);
+        final action =
+            container.read(setupActionProvider.notifier) as _RaceSetupAction;
+        action.startCompleter = startCompleter;
+
+        final startFuture = action.setRunning(true);
+        await Future<void>.delayed(Duration.zero);
+        expect(action.transitions, [true]);
+
+        final stopFuture = action.setRunning(false);
+        expect(container.read(runTimeProvider), isNull);
+
+        startCompleter.complete(true);
+        await Future.wait([startFuture, stopFuture]);
+
+        expect(action.transitions, [true, false]);
+        expect(container.read(runTimeProvider), isNull);
+        expect(container.read(isStartProvider), isFalse);
+        expect(action.applyProfileDebounceCount, 0);
+        expect(action.resetCoreTrafficCount, 1);
+      });
+
+      test('skips an intermediate stop when a newer start is queued', () async {
+        final startCompleter = Completer<bool>();
+        final container = ProviderContainer(
+          overrides: [
+            initProvider.overrideWithBuild((_, _) => true),
+            commonActionProvider.overrideWith(_RaceCommonAction.new),
+            setupActionProvider.overrideWith(_RaceSetupAction.new),
+          ],
+        );
+        addTearDown(container.dispose);
+        final action =
+            container.read(setupActionProvider.notifier) as _RaceSetupAction;
+        action.startCompleter = startCompleter;
+
+        final firstStart = action.setRunning(true);
+        await Future<void>.delayed(Duration.zero);
+        final stop = action.setRunning(false);
+        final latestStart = action.setRunning(true);
+
+        startCompleter.complete(true);
+        await Future.wait([firstStart, stop, latestStart]);
+
+        expect(action.transitions, [true, true]);
+        expect(container.read(isStartProvider), isTrue);
+        expect(action.applyProfileDebounceCount, 1);
+        expect(action.resetCoreTrafficCount, 0);
+
+        await action.setRunning(false);
+      });
+
+      test('stale initialization cannot start after a newer stop', () async {
+        final container = ProviderContainer(
+          overrides: [
+            initProvider.overrideWithBuild((_, _) => true),
+            commonActionProvider.overrideWith(_RaceCommonAction.new),
+            setupActionProvider.overrideWith(_InitializingSetupAction.new),
+          ],
+        );
+        addTearDown(container.dispose);
+        final action =
+            container.read(setupActionProvider.notifier)
+                as _InitializingSetupAction;
+
+        final start = action.setRunning(true, initialize: true);
+        final stop = action.setRunning(false);
+        await stop;
+
+        expect(action.transitions, [false]);
+        expect(container.read(isStartProvider), isFalse);
+
+        action.continueInitialization();
+        await start;
+
+        expect(action.transitions, [false]);
+        expect(container.read(isStartProvider), isFalse);
+      });
+
+      test(
+        'keeps suspended startup local until the listener resumes',
+        () async {
+          final container = ProviderContainer(
+            overrides: [
+              initProvider.overrideWithBuild((_, _) => true),
+              suspendProvider.overrideWithValue(true),
+              commonActionProvider.overrideWith(_RaceCommonAction.new),
+              setupActionProvider.overrideWith(_RaceSetupAction.new),
+            ],
+          );
+          addTearDown(container.dispose);
+          final action =
+              container.read(setupActionProvider.notifier) as _RaceSetupAction;
+
+          await action.setRunning(true);
+
+          expect(action.transitions, isEmpty);
+          expect(container.read(isStartProvider), isTrue);
+          expect(action.applyProfileDebounceCount, 1);
+
+          await action.setRunning(false);
+          expect(action.transitions, [false]);
+        },
+      );
+    });
+
+    test(
+      'restarts core after newly granting admin during config update',
+      () async {
+        late _AuthorizationSetupAction setupAction;
+        late _RestartRecordingCoreAction coreAction;
+        final container = ProviderContainer(
+          overrides: [
+            setupActionProvider.overrideWith(() {
+              setupAction = _AuthorizationSetupAction([AuthorizeCode.success]);
+              return setupAction;
+            }),
+            coreActionProvider.overrideWith(() {
+              coreAction = _RestartRecordingCoreAction();
+              return coreAction;
+            }),
+          ],
+        );
+        addTearDown(container.dispose);
+        container
+            .read(patchClashConfigProvider.notifier)
+            .update((state) => state.copyWith.tun(enable: true));
+        container.read(setupActionProvider);
+        container.read(coreActionProvider);
+
+        await setupAction.updateConfig();
+
+        expect(setupAction.authorizationRequestCount, 1);
+        expect(
+          container.read(authorizedTunEnableProvider),
+          TunAuthorizationState.authorized,
+        );
+        expect(coreAction.restartCount, 1);
+      },
+    );
+
+    test('retries admin authorization after a failed attempt', () async {
+      late _AuthorizationSetupAction setupAction;
+      final container = ProviderContainer(
+        overrides: [
+          setupActionProvider.overrideWith(() {
+            setupAction = _AuthorizationSetupAction([
+              AuthorizeCode.error,
+              AuthorizeCode.success,
+            ]);
+            return setupAction;
+          }),
+        ],
+      );
+      addTearDown(container.dispose);
+      container.read(setupActionProvider);
+
+      expect(await setupAction.requestAdmin(true), isTrue);
+      expect(
+        container.read(authorizedTunEnableProvider),
+        TunAuthorizationState.unauthorized,
+      );
+
+      expect(await setupAction.requestAdmin(true), isFalse);
+      expect(setupAction.authorizationRequestCount, 2);
+      expect(
+        container.read(authorizedTunEnableProvider),
+        TunAuthorizationState.authorized,
+      );
+    });
   });
 }
 
@@ -82,4 +538,132 @@ class _TestProfiles extends Profiles {
     }
     state = next;
   }
+
+  @override
+  Future<void> del(int id) async {
+    state = state.where((profile) => profile.id != id).toList();
+  }
+
+  @override
+  void reorder(List<Profile> profiles) {
+    state = List.of(profiles);
+  }
+}
+
+class _TestCoreAction extends CoreAction {
+  int lifecycleRestartCount = 0;
+  Completer<CoreLifecycleResult>? restartCompleter;
+
+  @override
+  Future<void> initCore() async {}
+
+  @override
+  Future<CoreLifecycleResult> restartLifecycle() {
+    lifecycleRestartCount++;
+    return restartCompleter?.future ?? Future.value(_restartResult);
+  }
+}
+
+class _TestSetupAction extends SetupAction {
+  int setRunningCount = 0;
+  int applyProfileCount = 0;
+  Completer<void>? firstApplyStarted;
+  Completer<void>? firstApplyCompleter;
+
+  @override
+  Future<void> setRunning(bool running, {bool initialize = false}) async {
+    setRunningCount++;
+  }
+
+  @override
+  Future<void> applyProfile({
+    bool silence = false,
+    bool force = false,
+    Future<void> Function()? preloadInvoke,
+  }) async {
+    applyProfileCount++;
+    if (applyProfileCount == 1) {
+      firstApplyStarted?.complete();
+      await firstApplyCompleter?.future;
+    }
+  }
+}
+
+const _restartResult = CoreLifecycleResult(
+  revision: 1,
+  outcome: CoreLifecycleOutcome.applied,
+);
+
+class _RestartRecordingCoreAction extends CoreAction {
+  int restartCount = 0;
+
+  @override
+  Future<void> restartCore([bool start = false]) async {
+    restartCount++;
+  }
+}
+
+class _AuthorizationSetupAction extends SetupAction {
+  final List<AuthorizeCode> authorizationResults;
+  int authorizationRequestCount = 0;
+
+  _AuthorizationSetupAction(this.authorizationResults);
+
+  @override
+  Future<AuthorizeCode> authorizeCore() async {
+    return authorizationResults[authorizationRequestCount++];
+  }
+}
+
+class _RaceSetupAction extends SetupAction {
+  int applyProfileDebounceCount = 0;
+  int resetCoreTrafficCount = 0;
+  final transitions = <bool>[];
+  Completer<bool>? startCompleter;
+  Completer<bool>? stopCompleter;
+
+  @override
+  void applyProfileDebounce({bool silence = false, bool force = false}) {
+    applyProfileDebounceCount++;
+  }
+
+  @override
+  Future<bool> setCoreRunning(bool running) async {
+    transitions.add(running);
+    return running
+        ? await startCompleter?.future ?? true
+        : await stopCompleter?.future ?? true;
+  }
+
+  @override
+  void resetCoreTraffic() {
+    resetCoreTrafficCount++;
+  }
+}
+
+class _InitializingSetupAction extends _RaceSetupAction {
+  final _initializationCompleter = Completer<void>();
+
+  void continueInitialization() {
+    _initializationCompleter.complete();
+  }
+
+  @override
+  Future<void> applyProfile({
+    bool silence = false,
+    bool force = false,
+    Future<void> Function()? preloadInvoke,
+  }) async {
+    await _initializationCompleter.future;
+    await preloadInvoke?.call();
+  }
+}
+
+class _RaceCommonAction extends CommonAction {
+  int updateTrafficCount = 0;
+
+  @override
+  Future<void> updateTraffic() async {
+    updateTrafficCount++;
+  }
 }
diff --git a/test/providers/app_test.dart b/test/providers/app_test.dart
index 6e052d8c25..2d11f89b3d 100644
--- a/test/providers/app_test.dart
+++ b/test/providers/app_test.dart
@@ -22,14 +22,26 @@ void main() {
     container.dispose();
   });
 
-  group('RealTunEnable provider', () {
-    test('default is false', () {
-      expect(container.read(realTunEnableProvider), false);
+  group('AuthorizedTunEnable provider', () {
+    test('default is none', () {
+      expect(
+        container.read(authorizedTunEnableProvider),
+        TunAuthorizationState.none,
+      );
     });
 
-    test('can update to true', () {
-      container.read(realTunEnableProvider.notifier).update((_) => true);
-      expect(container.read(realTunEnableProvider), true);
+    test('can store authorized and unauthorized results', () {
+      final notifier = container.read(authorizedTunEnableProvider.notifier);
+      notifier.update((_) => TunAuthorizationState.authorized);
+      expect(
+        container.read(authorizedTunEnableProvider),
+        TunAuthorizationState.authorized,
+      );
+      notifier.update((_) => TunAuthorizationState.unauthorized);
+      expect(
+        container.read(authorizedTunEnableProvider),
+        TunAuthorizationState.unauthorized,
+      );
     });
   });
 
diff --git a/test/providers/config_test.dart b/test/providers/config_test.dart
index 5687d27e83..9fb01e11de 100644
--- a/test/providers/config_test.dart
+++ b/test/providers/config_test.dart
@@ -115,12 +115,13 @@ void main() {
       const davProps = DAVProps(
         uri: 'https://dav.example.com',
         user: 'user',
-        password: 'password',
+        password: 'secret',
       );
 
       container.read(davSettingProvider.notifier).update((_) => davProps);
 
       expect(container.read(davSettingProvider), davProps);
+      expect(container.read(configProvider).davProps?.password, 'secret');
     });
   });
 
@@ -193,6 +194,103 @@ void main() {
     });
   });
 
+  group('TailscaleSetting provider', () {
+    test('default is disabled with no nodes', () {
+      final value = container.read(tailscaleSettingProvider);
+      expect(value.enable, false);
+      expect(value.proxies, isEmpty);
+    });
+
+    test('setEnable toggles the feature without touching nodes', () {
+      final notifier = container.read(tailscaleSettingProvider.notifier);
+      notifier.addOrUpdate(const TailscaleProxy(name: 'ts-node'));
+      notifier.setEnable(true);
+      final value = container.read(tailscaleSettingProvider);
+      expect(value.enable, true);
+      expect(value.proxies.length, 1);
+    });
+
+    test('setBypassTraffic toggles bypass independently of enable', () {
+      final notifier = container.read(tailscaleSettingProvider.notifier);
+      notifier.setBypassTraffic(true);
+      final value = container.read(tailscaleSettingProvider);
+      expect(value.bypassTraffic, true);
+      expect(value.enable, false);
+    });
+
+    test('setBypassTraffic adds and removes DNS fake-ip filters', () {
+      final notifier = container.read(tailscaleSettingProvider.notifier);
+      notifier.setBypassTraffic(true);
+      expect(
+        container.read(patchClashConfigProvider).dns.fakeIpFilter,
+        containsAll(tailscaleFakeIpFilters),
+      );
+
+      notifier.setBypassTraffic(false);
+      final filters = container.read(patchClashConfigProvider).dns.fakeIpFilter;
+      for (final filter in tailscaleFakeIpFilters) {
+        expect(filters, isNot(contains(filter)));
+      }
+    });
+
+    test('setBypassTraffic preserves unrelated fake-ip filters', () {
+      container
+          .read(patchClashConfigProvider.notifier)
+          .update(
+            (state) => state.copyWith.dns(
+              fakeIpFilter: ['*.lan', 'custom.example'],
+            ),
+          );
+      final notifier = container.read(tailscaleSettingProvider.notifier);
+      notifier.setBypassTraffic(true);
+      notifier.setBypassTraffic(false);
+      expect(
+        container.read(patchClashConfigProvider).dns.fakeIpFilter,
+        ['*.lan', 'custom.example'],
+      );
+    });
+
+    test('addOrUpdate appends a new node', () {
+      container
+          .read(tailscaleSettingProvider.notifier)
+          .addOrUpdate(const TailscaleProxy(name: 'ts-node'));
+      final value = container.read(tailscaleSettingProvider);
+      expect(value.proxies.length, 1);
+      expect(value.proxies.first.name, 'ts-node');
+    });
+
+    test('addOrUpdate replaces a node with the same name', () {
+      final notifier = container.read(tailscaleSettingProvider.notifier);
+      notifier.addOrUpdate(const TailscaleProxy(name: 'ts-node'));
+      notifier.addOrUpdate(
+        const TailscaleProxy(name: 'ts-node', authKey: 'new-key'),
+      );
+      final value = container.read(tailscaleSettingProvider);
+      expect(value.proxies.length, 1);
+      expect(value.proxies.first.authKey, 'new-key');
+    });
+
+    test('addOrUpdate renames without duplicating', () {
+      final notifier = container.read(tailscaleSettingProvider.notifier);
+      notifier.addOrUpdate(const TailscaleProxy(name: 'old-name'));
+      notifier.addOrUpdate(
+        const TailscaleProxy(name: 'new-name', authKey: 'key'),
+        previousName: 'old-name',
+      );
+      final value = container.read(tailscaleSettingProvider);
+      expect(value.proxies.length, 1);
+      expect(value.proxies.first.name, 'new-name');
+      expect(value.proxies.first.authKey, 'key');
+    });
+
+    test('remove deletes a node by name', () {
+      final notifier = container.read(tailscaleSettingProvider.notifier);
+      notifier.addOrUpdate(const TailscaleProxy(name: 'ts-node'));
+      notifier.remove('ts-node');
+      expect(container.read(tailscaleSettingProvider).proxies, isEmpty);
+    });
+  });
+
   group('configProvider (composite)', () {
     test('composes all sub-providers with defaults', () {
       final config = container.read(configProvider);
@@ -205,6 +303,8 @@ void main() {
       expect(config.hotKeyActions, isEmpty);
       expect(config.patchClashConfig, const PatchClashConfig());
       expect(config.excludeSSIDs, isEmpty);
+      expect(config.tailscaleProps.enable, false);
+      expect(config.tailscaleProps.proxies, isEmpty);
     });
 
     test('reflects updated sub-provider values', () {
@@ -233,7 +333,7 @@ void main() {
         overrideDns: true,
       );
       final overrides = buildConfigOverrides(config);
-      expect(overrides.length, 12);
+      expect(overrides.length, 13);
 
       final overrideContainer = ProviderContainer(overrides: overrides);
       addTearDown(overrideContainer.dispose);
diff --git a/test/providers/permission_test.dart b/test/providers/permission_test.dart
new file mode 100644
index 0000000000..c87511018f
--- /dev/null
+++ b/test/providers/permission_test.dart
@@ -0,0 +1,93 @@
+import 'package:fl_clash/common/permission.dart';
+import 'package:fl_clash/providers/app.dart';
+import 'package:fl_clash/providers/config.dart';
+import 'package:fl_clash/state.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:riverpod/riverpod.dart';
+import 'package:wifi_ssid/wifi_ssid.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  const channel = MethodChannel('wifi_ssid');
+  late ProviderContainer container;
+
+  setUp(() {
+    container = ProviderContainer(
+      overrides: [
+        excludeSSIDsProvider.overrideWithValue(const ['Office Wi-Fi']),
+      ],
+    );
+    globalState.container = container;
+  });
+
+  tearDown(() async {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, null);
+    container.dispose();
+  });
+
+  test('maps permission results to the correct UI follow-up', () {
+    expect(
+      getLocationPermissionFollowUp(WifiSsidPermission.granted),
+      LocationPermissionFollowUp.none,
+    );
+    expect(
+      getLocationPermissionFollowUp(WifiSsidPermission.denied),
+      LocationPermissionFollowUp.showDeniedMessage,
+    );
+    expect(
+      getLocationPermissionFollowUp(WifiSsidPermission.permanentlyDenied),
+      LocationPermissionFollowUp.openSettings,
+    );
+  });
+
+  test(
+    'refreshes current SSID immediately after permission is granted',
+    () async {
+      final calls = <String>[];
+      TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+          .setMockMethodCallHandler(channel, (call) async {
+            calls.add(call.method);
+            return switch (call.method) {
+              'checkPermission' => 1,
+              'requestPermission' => 0,
+              'getSsid' => 'Office Wi-Fi',
+              _ => null,
+            };
+          });
+
+      await Permissions.test(
+        supportsLocationPermissions: true,
+      ).checkLocationPermissions();
+
+      expect(calls, ['checkPermission', 'requestPermission', 'getSsid']);
+      expect(
+        container.read(locationPermissionsProvider),
+        WifiSsidPermission.granted,
+      );
+      expect(container.read(currentSSIDProvider), 'Office Wi-Fi');
+    },
+  );
+
+  test('does not read SSID when permission remains denied', () async {
+    final calls = <String>[];
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, (call) async {
+          calls.add(call.method);
+          return 1;
+        });
+
+    await Permissions.test(
+      supportsLocationPermissions: true,
+    ).checkLocationPermissions();
+
+    expect(calls, ['checkPermission', 'requestPermission']);
+    expect(
+      container.read(locationPermissionsProvider),
+      WifiSsidPermission.denied,
+    );
+    expect(container.read(currentSSIDProvider), isNull);
+  });
+}
diff --git a/test/providers/state_derived_test.dart b/test/providers/state_derived_test.dart
new file mode 100644
index 0000000000..844c6ff8ca
--- /dev/null
+++ b/test/providers/state_derived_test.dart
@@ -0,0 +1,388 @@
+import 'package:fl_clash/common/constant.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:fl_clash/providers/app.dart';
+import 'package:fl_clash/providers/config.dart';
+import 'package:fl_clash/providers/database.dart';
+import 'package:fl_clash/providers/state.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:riverpod/riverpod.dart';
+
+void main() {
+  late ProviderContainer container;
+
+  setUp(() {
+    container = ProviderContainer(
+      overrides: [profilesProvider.overrideWith(_TestProfiles.new)],
+    );
+  });
+
+  tearDown(() {
+    container.dispose();
+  });
+
+  test('group derivation sanitizes runtime state and respects clash mode', () {
+    final groups = [
+      const Group(
+        name: 'Visible',
+        type: GroupType.Selector,
+        now: 'Selected',
+        hidden: false,
+        all: [Proxy(name: 'Selected', type: 'Direct', now: 'runtime')],
+      ),
+      const Group(name: 'Hidden', type: GroupType.Selector, hidden: true),
+      Group(name: GroupName.GLOBAL.name, type: GroupType.Selector),
+    ];
+    container.read(groupsProvider.notifier).update((_) => groups);
+    container
+        .read(patchClashConfigProvider.notifier)
+        .update((state) => state.copyWith(mode: Mode.rule));
+
+    final ruleGroups = container.read(currentGroupsStateProvider).value;
+    expect(ruleGroups.map((group) => group.name), ['Visible']);
+    expect(ruleGroups.single.now, isEmpty);
+    expect(ruleGroups.single.all.single.now, isEmpty);
+
+    container
+        .read(patchClashConfigProvider.notifier)
+        .update((state) => state.copyWith(mode: Mode.global));
+    expect(container.read(currentGroupsStateProvider).value, hasLength(3));
+
+    container
+        .read(patchClashConfigProvider.notifier)
+        .update((state) => state.copyWith(mode: Mode.direct));
+    expect(container.read(currentGroupsStateProvider).value, isEmpty);
+  });
+
+  test('navigation providers select items for width and current page', () {
+    container
+        .read(viewSizeProvider.notifier)
+        .update((_) => Size(maxMobileWidth.toDouble(), 800));
+    final mobile = container.read(currentNavigationItemsStateProvider).value;
+    expect(
+      mobile.map((item) => item.label),
+      containsAll([PageLabel.dashboard, PageLabel.profiles, PageLabel.tools]),
+    );
+    expect(
+      mobile.map((item) => item.label),
+      isNot(contains(PageLabel.connections)),
+    );
+
+    container
+        .read(viewSizeProvider.notifier)
+        .update((_) => const Size(1200, 800));
+    container
+        .read(currentPageLabelProvider.notifier)
+        .toPage(PageLabel.connections);
+    final desktop = container.read(navigationStateProvider);
+    expect(desktop.viewMode, ViewMode.desktop);
+    expect(desktop.currentIndex, greaterThan(0));
+    expect(
+      desktop.navigationItems[desktop.currentIndex].label,
+      PageLabel.connections,
+    );
+
+    container
+        .read(currentPageLabelProvider.notifier)
+        .toPage(PageLabel.resources);
+    expect(container.read(navigationStateProvider).currentIndex, 0);
+  });
+
+  test('layout and page state providers compose their dependencies', () {
+    final profile = Profile.normal(label: 'Primary');
+    _profiles(container).replace([profile]);
+    container.read(currentProfileIdProvider.notifier).update((_) => profile.id);
+    container
+        .read(viewSizeProvider.notifier)
+        .update((_) => const Size(1000, 800));
+    container.read(sideWidthProvider.notifier).update((_) => 200);
+
+    expect(container.read(contentWidthProvider), 800);
+    final profiles = container.read(profilesStateProvider);
+    expect(profiles.profiles.single.label, 'Primary');
+    expect(profiles.currentProfileId, profile.id);
+    expect(profiles.columns, greaterThan(0));
+
+    final dashboard = container.read(dashboardStateProvider);
+    expect(dashboard.contentWidth, 800);
+    expect(dashboard.dashboardWidgets, isNotEmpty);
+
+    final actions = container.read(proxiesActionsStateProvider);
+    expect(actions.pageLabel, PageLabel.dashboard);
+    expect(actions.hasProviders, isFalse);
+    expect(actions.type, ProxiesType.tab);
+  });
+
+  test(
+    'proxy list and tab providers filter groups and preserve selections',
+    () {
+      final profile = Profile.normal().copyWith(
+        currentGroupName: 'Group B',
+        unfoldSet: {'Group A'},
+      );
+      final groups = [
+        const Group(
+          name: 'Group A',
+          type: GroupType.Selector,
+          hidden: false,
+          all: [
+            Proxy(name: 'Alpha', type: 'Direct'),
+            Proxy(name: 'Beta', type: 'Direct'),
+          ],
+        ),
+        const Group(
+          name: 'Group B',
+          type: GroupType.URLTest,
+          hidden: false,
+          testUrl: 'https://group.test',
+          all: [Proxy(name: 'Gamma', type: 'Direct')],
+        ),
+      ];
+      _profiles(container).replace([profile]);
+      container
+          .read(currentProfileIdProvider.notifier)
+          .update((_) => profile.id);
+      container.read(groupsProvider.notifier).update((_) => groups);
+      container
+          .read(patchClashConfigProvider.notifier)
+          .update((state) => state.copyWith(mode: Mode.rule));
+      container
+          .read(viewSizeProvider.notifier)
+          .update((_) => const Size(900, 800));
+
+      expect(container.read(filterGroupsStateProvider('')).value, hasLength(2));
+      final filtered = container.read(filterGroupsStateProvider('ALP')).value;
+      expect(filtered, hasLength(1));
+      expect(filtered.single.all.single.name, 'Alpha');
+
+      container
+          .read(queryProvider(QueryTag.proxies).notifier)
+          .update((_) => 'ga');
+      final list = container.read(proxiesListStateProvider);
+      expect(list.groups.single.name, 'Group B');
+      expect(list.currentUnfoldSet, {'Group A'});
+
+      final tab = container.read(proxiesTabStateProvider);
+      expect(tab.currentGroupName, 'Group B');
+      expect(tab.groups.single.all.single.name, 'Gamma');
+      final controller = container.read(proxiesTabControllerStateProvider);
+      expect(controller.a, ['Group B']);
+      expect(controller.b, 'Group B');
+
+      final selector = container.read(
+        proxyGroupSelectorStateProvider('Group A', 'be'),
+      );
+      expect(selector.proxies.single.name, 'Beta');
+      expect(selector.groupType, GroupType.Selector);
+      expect(selector.columns, greaterThanOrEqualTo(2));
+
+      final missing = container.read(
+        proxyGroupSelectorStateProvider('Missing', ''),
+      );
+      expect(missing.proxies, isEmpty);
+      expect(missing.groupType, GroupType.Selector);
+    },
+  );
+
+  test('runtime, VPN, tray, and DNS states follow live state', () {
+    container
+        .read(runTimeProvider.notifier)
+        .update((_) => DateTime(2026).millisecondsSinceEpoch);
+    container
+        .read(networkSettingProvider.notifier)
+        .update(
+          (state) => state.copyWith(
+            systemProxy: false,
+            bypassDomain: const ['localhost'],
+            autoSetSystemDns: true,
+          ),
+        );
+    container
+        .read(patchClashConfigProvider.notifier)
+        .update(
+          (state) => state.copyWith(
+            mixedPort: 8899,
+            mode: Mode.global,
+            tun: state.tun.copyWith(enable: true),
+          ),
+        );
+    expect(container.read(autoSetSystemDnsStateProvider).a, isFalse);
+
+    container
+        .read(authorizedTunEnableProvider.notifier)
+        .update((_) => TunAuthorizationState.authorized);
+
+    final proxy = container.read(proxyStateProvider);
+    expect(proxy.isStart, isTrue);
+    expect(proxy.systemProxy, isFalse);
+    expect(proxy.bassDomain, ['localhost']);
+    expect(proxy.port, 8899);
+    expect(container.read(isStartProvider), isTrue);
+
+    final tray = container.read(trayStateProvider);
+    expect(tray.mode, Mode.global);
+    expect(tray.port, 8899);
+    expect(tray.tunEnable, isTrue);
+    expect(tray.isStart, isTrue);
+
+    final vpn = container.read(vpnStateProvider);
+    expect(vpn.stack, container.read(patchClashConfigProvider).tun.stack);
+    expect(vpn.vpnProps, container.read(vpnSettingProvider));
+
+    final dns = container.read(autoSetSystemDnsStateProvider);
+    expect(dns.a, isTrue);
+    expect(dns.b, isTrue);
+
+    container
+        .read(authorizedTunEnableProvider.notifier)
+        .update((_) => TunAuthorizationState.unauthorized);
+    expect(container.read(autoSetSystemDnsStateProvider).a, isFalse);
+
+    container.read(excludeSSIDsProvider.notifier).update((_) => ['Office']);
+    container.read(currentSSIDProvider.notifier).update((_) => 'Office');
+    expect(container.read(suspendProvider), isTrue);
+    expect(container.read(proxyStateProvider).isStart, isFalse);
+  });
+
+  test('selection and delay providers resolve groups and profile state', () {
+    final profile = Profile.normal().copyWith(
+      selectedMap: {'Selector': 'Leaf'},
+      unfoldSet: {'Selector'},
+    );
+    const groups = [
+      Group(
+        name: 'Selector',
+        type: GroupType.Selector,
+        all: [Proxy(name: 'Leaf', type: 'Direct')],
+      ),
+    ];
+    _profiles(container).replace([profile]);
+    container.read(currentProfileIdProvider.notifier).update((_) => profile.id);
+    container.read(groupsProvider.notifier).update((_) => groups);
+    container
+        .read(delayDataSourceProvider.notifier)
+        .setDelay(
+          const Delay(
+            name: 'Leaf',
+            url: 'https://www.gstatic.com/generate_204',
+            value: 42,
+          ),
+        );
+
+    expect(container.read(selectedMapProvider), {'Selector': 'Leaf'});
+    expect(container.read(unfoldSetProvider), {'Selector'});
+    expect(container.read(proxyNameProvider('Selector')), 'Leaf');
+    expect(container.read(selectedProxyNameProvider('Selector')), 'Leaf');
+    expect(
+      container.read(realSelectedProxyStateProvider('Selector')).proxyName,
+      'Leaf',
+    );
+    expect(container.read(delayProvider(proxyName: 'Selector')), 42);
+    expect(
+      container.read(
+        proxyDescProvider(const Proxy(name: 'Selector', type: 'Selector')),
+      ),
+      'Selector(Leaf)',
+    );
+    expect(
+      container.read(
+        proxyDescProvider(const Proxy(name: 'Leaf', type: 'Direct')),
+      ),
+      'Direct',
+    );
+  });
+
+  test('theme and simple derived providers cover fallback branches', () {
+    expect(container.read(currentBrightnessProvider), Brightness.dark);
+    container
+        .read(systemBrightnessProvider.notifier)
+        .update((_) => Brightness.light);
+    container
+        .read(themeSettingProvider.notifier)
+        .update((state) => state.copyWith(themeMode: ThemeMode.system));
+    expect(container.read(currentBrightnessProvider), Brightness.light);
+
+    final fallback = container.read(
+      genColorSchemeProvider(Brightness.light, ignoreConfig: true),
+    );
+    expect(fallback.brightness, Brightness.light);
+    final explicit = container.read(
+      genColorSchemeProvider(Brightness.dark, color: Colors.purple),
+    );
+    expect(explicit.brightness, Brightness.dark);
+
+    expect(
+      container.read(realTestUrlProvider('https://custom.test')),
+      'https://custom.test',
+    );
+    expect(container.read(isCurrentPageProvider(PageLabel.dashboard)), isTrue);
+    expect(
+      container.read(
+        isCurrentPageProvider(
+          PageLabel.logs,
+          handler: (_, viewMode) => viewMode == ViewMode.mobile,
+        ),
+      ),
+      isTrue,
+    );
+  });
+
+  test('package, hotkey, profile, and overwrite providers expose defaults', () {
+    const package = Package(
+      packageName: 'app.example',
+      label: 'Example',
+      system: false,
+      internet: true,
+      lastUpdateTime: 1,
+    );
+    container.read(packagesProvider.notifier).update((_) => [package]);
+    final packageList = container.read(packageListSelectorStateProvider);
+    expect(packageList.packages, [package]);
+    expect(
+      packageList.accessControlProps,
+      container.read(vpnSettingProvider).accessControlProps,
+    );
+
+    const action = HotKeyAction(
+      action: HotAction.start,
+      key: 1,
+      modifiers: {KeyboardModifier.control},
+    );
+    container.read(hotKeyActionsProvider.notifier).update((_) => [action]);
+    expect(container.read(getHotKeyActionProvider(HotAction.start)), action);
+    expect(
+      container.read(getHotKeyActionProvider(HotAction.tun)).action,
+      HotAction.tun,
+    );
+
+    final profile = Profile.normal().copyWith(
+      overwriteType: OverwriteType.custom,
+    );
+    _profiles(container).replace([profile]);
+    expect(container.read(profileProvider(profile.id)), profile);
+    expect(
+      container.read(overwriteTypeProvider(profile.id)),
+      OverwriteType.custom,
+    );
+    expect(container.read(overwriteTypeProvider(-1)), OverwriteType.standard);
+
+    expect(
+      container.read(accessControlStateProvider),
+      const AccessControlProps(),
+    );
+  });
+}
+
+_TestProfiles _profiles(ProviderContainer container) {
+  return container.read(profilesProvider.notifier) as _TestProfiles;
+}
+
+class _TestProfiles extends Profiles {
+  @override
+  List<Profile> build() => [];
+
+  void replace(List<Profile> profiles) {
+    state = profiles;
+  }
+}
diff --git a/test/providers/system_action_test.dart b/test/providers/system_action_test.dart
new file mode 100644
index 0000000000..6c5571b6fe
--- /dev/null
+++ b/test/providers/system_action_test.dart
@@ -0,0 +1,75 @@
+import 'dart:async';
+
+import 'package:fl_clash/providers/actions/system_exit.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('coalesces repeated exit requests and runs cleanup once', () async {
+    final closeCoreCompleter = Completer<void>();
+    final calls = <String>[];
+    final coordinator = SystemExitCoordinator(
+      watchdogDuration: const Duration(hours: 1),
+      closeWindow: () async => calls.add('window'),
+      closeCore: () async {
+        calls.add('core');
+        await closeCoreCompleter.future;
+      },
+      exitApplication: () async => calls.add('exit'),
+    );
+
+    final first = coordinator.exit(cleanup: () async => calls.add('cleanup'));
+    final second = coordinator.exit(
+      cleanup: () async => calls.add('unexpected cleanup'),
+    );
+    await Future<void>.delayed(Duration.zero);
+
+    expect(identical(first, second), isTrue);
+    expect(calls, ['cleanup', 'window', 'core']);
+
+    closeCoreCompleter.complete();
+    await Future.wait([first, second]);
+
+    expect(calls, ['cleanup', 'window', 'core', 'exit']);
+  });
+
+  test('watchdog and normal completion share one application exit', () async {
+    final closeCoreCompleter = Completer<void>();
+    var exitCount = 0;
+    final coordinator = SystemExitCoordinator(
+      watchdogDuration: const Duration(milliseconds: 1),
+      closeWindow: () async {},
+      closeCore: () => closeCoreCompleter.future,
+      exitApplication: () async => exitCount++,
+    );
+
+    final operation = coordinator.exit(cleanup: () async {});
+    await Future<void>.delayed(const Duration(milliseconds: 10));
+
+    expect(exitCount, 1);
+    closeCoreCompleter.complete();
+    await operation;
+    expect(exitCount, 1);
+  });
+
+  test('cleanup failure does not skip window or Core shutdown', () async {
+    final calls = <String>[];
+    final coordinator = SystemExitCoordinator(
+      watchdogDuration: const Duration(hours: 1),
+      closeWindow: () async => calls.add('window'),
+      closeCore: () async => calls.add('core'),
+      exitApplication: () async => calls.add('exit'),
+    );
+
+    await expectLater(
+      coordinator.exit(
+        cleanup: () async {
+          calls.add('cleanup');
+          throw StateError('cleanup failed');
+        },
+      ),
+      throwsStateError,
+    );
+
+    expect(calls, ['cleanup', 'window', 'core', 'exit']);
+  });
+}
diff --git a/test/setup_test.dart b/test/setup_test.dart
index 1f91f6f903..e787e8185e 100644
--- a/test/setup_test.dart
+++ b/test/setup_test.dart
@@ -11,6 +11,20 @@ void main() {
       expect(results.rest, ['android']);
     });
 
+    test('accepts dev application environment', () {
+      final results = setup.createSetupArgParser().parse([
+        'android',
+        '--env',
+        'dev',
+      ]);
+
+      expect(results['env'], 'dev');
+    });
+
+    test('Flutter build environment does not depend on Core SHA256', () {
+      expect(setup.createBuildEnvironment('dev'), {'APP_ENV': 'dev'});
+    });
+
     test('omits verbose from flutter build args by default', () {
       final args = setup.createFlutterBuildArgs(
         platform: 'android',
diff --git a/test/state_test.dart b/test/state_test.dart
new file mode 100644
index 0000000000..251055a5c0
--- /dev/null
+++ b/test/state_test.dart
@@ -0,0 +1,10 @@
+import 'package:fl_clash/common/constant.dart';
+import 'package:fl_clash/state.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('GlobalState exposes a fallback accent color before plugin startup', () {
+    expect(GlobalState().accentColor, const Color(defaultPrimaryColor));
+  });
+}
diff --git a/test/widgets/animated_visibility_test.dart b/test/widgets/animated_visibility_test.dart
new file mode 100644
index 0000000000..0029313fb7
--- /dev/null
+++ b/test/widgets/animated_visibility_test.dart
@@ -0,0 +1,433 @@
+import 'package:fl_clash/widgets/animated_visibility.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('releases horizontal layout space throughout the exit', (
+    tester,
+  ) async {
+    final visibilityKey = GlobalKey();
+    final contentKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                key: visibilityKey,
+                visible: visible,
+                child: const SizedBox(width: 180, height: 80),
+              ),
+              Expanded(child: SizedBox(key: contentKey)),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+    expect(tester.getSize(find.byKey(contentKey)).width, 620);
+
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 150));
+
+    final midTransitionWidth = tester.getSize(find.byKey(visibilityKey)).width;
+    final midContentWidth = tester.getSize(find.byKey(contentKey)).width;
+    expect(midTransitionWidth, allOf(greaterThan(0), lessThan(180)));
+    expect(midContentWidth, allOf(greaterThan(620), lessThan(800)));
+
+    await tester.pump(const Duration(milliseconds: 149));
+    final nearEndContentWidth = tester.getSize(find.byKey(contentKey)).width;
+    expect(tester.getSize(find.byKey(visibilityKey)).width, greaterThan(0));
+
+    await tester.pump(const Duration(milliseconds: 2));
+
+    expect(tester.getSize(find.byKey(visibilityKey)).width, 0);
+    expect(tester.getSize(find.byKey(contentKey)).width, 800);
+    expect(800 - nearEndContentWidth, lessThan(5));
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('releases vertical layout space throughout the exit', (
+    tester,
+  ) async {
+    final visibilityKey = GlobalKey();
+    final contentKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Column(
+            children: [
+              Expanded(child: SizedBox(key: contentKey)),
+              AnimatedVisibility.bottomNavigation(
+                key: visibilityKey,
+                visible: visible,
+                child: const SizedBox(width: 180, height: 80),
+              ),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+    expect(tester.getSize(find.byKey(contentKey)).height, 520);
+
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 150));
+
+    final midTransitionHeight = tester
+        .getSize(find.byKey(visibilityKey))
+        .height;
+    final midContentHeight = tester.getSize(find.byKey(contentKey)).height;
+    expect(midTransitionHeight, allOf(greaterThan(0), lessThan(80)));
+    expect(midContentHeight, allOf(greaterThan(520), lessThan(600)));
+
+    await tester.pump(const Duration(milliseconds: 149));
+    final nearEndContentHeight = tester.getSize(find.byKey(contentKey)).height;
+
+    await tester.pump(const Duration(milliseconds: 2));
+
+    expect(tester.getSize(find.byKey(visibilityKey)).height, 0);
+    expect(tester.getSize(find.byKey(contentKey)).height, 600);
+    expect(600 - nearEndContentHeight, lessThan(5));
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('shows initially visible content without a transition', (
+    tester,
+  ) async {
+    final contentKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                visible: visible,
+                child: SizedBox(key: contentKey, width: 180, height: 80),
+              ),
+              const Expanded(child: SizedBox()),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+
+    expect(tester.getTopLeft(find.byKey(contentKey)), Offset.zero);
+  });
+
+  testWidgets('fades and slides content while entering', (tester) async {
+    final visibilityKey = GlobalKey();
+    final contentKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                key: visibilityKey,
+                visible: visible,
+                child: SizedBox(key: contentKey, width: 180, height: 80),
+              ),
+              const Expanded(child: SizedBox()),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(false));
+    await tester.pumpWidget(buildApp(true));
+    await tester.pump(const Duration(milliseconds: 150));
+
+    final fadeTransition = find.descendant(
+      of: find.byKey(visibilityKey),
+      matching: find.byType(FadeTransition),
+    );
+    expect(fadeTransition, findsOneWidget);
+    expect(
+      tester.widget<FadeTransition>(fadeTransition).opacity.value,
+      allOf(greaterThan(0), lessThan(1)),
+    );
+    expect(tester.getTopLeft(find.byKey(contentKey)).dx, lessThan(0));
+  });
+
+  testWidgets('fades content while exiting', (tester) async {
+    final visibilityKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                key: visibilityKey,
+                visible: visible,
+                child: const SizedBox(width: 180, height: 80),
+              ),
+              const Expanded(child: SizedBox()),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 150));
+
+    final fadeTransition = find.descendant(
+      of: find.byKey(visibilityKey),
+      matching: find.byType(FadeTransition),
+    );
+    expect(fadeTransition, findsOneWidget);
+    expect(
+      tester.widget<FadeTransition>(fadeTransition).opacity.value,
+      allOf(greaterThan(0), lessThan(1)),
+    );
+  });
+
+  testWidgets('decelerates entry and accelerates exit', (tester) async {
+    final visibilityKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                key: visibilityKey,
+                visible: visible,
+                child: const SizedBox(width: 180, height: 80),
+              ),
+              const Expanded(child: SizedBox()),
+            ],
+          ),
+        ),
+      );
+    }
+
+    double opacity() {
+      final fadeTransition = find.descendant(
+        of: find.byKey(visibilityKey),
+        matching: find.byType(FadeTransition),
+      );
+      return tester.widget<FadeTransition>(fadeTransition).opacity.value;
+    }
+
+    await tester.pumpWidget(buildApp(false));
+    await tester.pumpWidget(buildApp(true));
+    await tester.pump(const Duration(milliseconds: 75));
+    expect(opacity(), greaterThan(0.6));
+
+    await tester.pump(const Duration(milliseconds: 225));
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 75));
+    expect(opacity(), greaterThan(0.75));
+
+    await tester.pump(const Duration(milliseconds: 150));
+    expect(opacity(), greaterThan(0.5));
+
+    await tester.pump(const Duration(milliseconds: 74));
+    expect(opacity(), lessThan(0.1));
+  });
+
+  testWidgets('horizontal content exits from right to left', (tester) async {
+    final contentKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                visible: visible,
+                child: SizedBox(key: contentKey, width: 180, height: 80),
+              ),
+              const Expanded(child: SizedBox()),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+    final visiblePosition = tester.getTopLeft(find.byKey(contentKey));
+
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 150));
+
+    final exitingPosition = tester.getTopLeft(find.byKey(contentKey));
+    expect(exitingPosition.dx, lessThan(visiblePosition.dx - 25));
+    expect(exitingPosition.dy, closeTo(visiblePosition.dy, 0.01));
+  });
+
+  testWidgets('bottom navigation remains visible while moving down', (
+    tester,
+  ) async {
+    final contentKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Column(
+            children: [
+              const Expanded(child: SizedBox()),
+              AnimatedVisibility.bottomNavigation(
+                visible: visible,
+                child: SizedBox(key: contentKey, width: 180, height: 80),
+              ),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+    final visiblePosition = tester.getTopLeft(find.byKey(contentKey));
+
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 250));
+
+    final exitingPosition = tester.getTopLeft(find.byKey(contentKey));
+    expect(exitingPosition.dx, closeTo(visiblePosition.dx, 0.01));
+    expect(exitingPosition.dy, greaterThan(visiblePosition.dy + 20));
+    expect(exitingPosition.dy, lessThan(600));
+  });
+
+  testWidgets('horizontal transition clips without narrowing its child', (
+    tester,
+  ) async {
+    final visibilityKey = GlobalKey();
+    final contentKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                key: visibilityKey,
+                visible: visible,
+                child: SizedBox(
+                  key: contentKey,
+                  width: 180,
+                  child: const ListTile(
+                    contentPadding: EdgeInsets.symmetric(horizontal: 16),
+                    leading: SizedBox(width: 80),
+                    title: Text('Title'),
+                  ),
+                ),
+              ),
+              const Expanded(child: SizedBox()),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+    expect(tester.takeException(), isNull);
+
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 150));
+
+    expect(
+      tester.getSize(find.byKey(visibilityKey)).width,
+      allOf(greaterThan(0), lessThan(180)),
+    );
+    expect(tester.getSize(find.byKey(contentKey)).width, 180);
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('rapid reversals never exceed the visible child width', (
+    tester,
+  ) async {
+    final visibilityKey = GlobalKey();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                key: visibilityKey,
+                visible: visible,
+                child: const SizedBox(width: 180),
+              ),
+              const Expanded(child: SizedBox()),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+    expect(tester.getSize(find.byKey(visibilityKey)).width, 180);
+
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 60));
+    await tester.pumpWidget(buildApp(true));
+    await tester.pump(const Duration(milliseconds: 60));
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 60));
+
+    expect(
+      tester.getSize(find.byKey(visibilityKey)).width,
+      lessThanOrEqualTo(180),
+    );
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('rapid reversal keeps a single child subtree', (tester) async {
+    final contentKey = GlobalKey<_StatefulContentState>();
+
+    Widget buildApp(bool visible) {
+      return MaterialApp(
+        home: Scaffold(
+          body: Row(
+            children: [
+              AnimatedVisibility.sidebar(
+                visible: visible,
+                child: _StatefulContent(key: contentKey),
+              ),
+              const Expanded(child: SizedBox()),
+            ],
+          ),
+        ),
+      );
+    }
+
+    await tester.pumpWidget(buildApp(true));
+    final initialState = contentKey.currentState;
+    await tester.pumpWidget(buildApp(false));
+    await tester.pump(const Duration(milliseconds: 60));
+    await tester.pumpWidget(buildApp(true));
+    await tester.pump();
+
+    expect(find.byKey(contentKey), findsOneWidget);
+    expect(contentKey.currentState, same(initialState));
+    expect(tester.takeException(), isNull);
+  });
+}
+
+class _StatefulContent extends StatefulWidget {
+  const _StatefulContent({super.key});
+
+  @override
+  State<_StatefulContent> createState() => _StatefulContentState();
+}
+
+class _StatefulContentState extends State<_StatefulContent> {
+  @override
+  Widget build(BuildContext context) {
+    return const SizedBox(width: 180);
+  }
+}
diff --git a/test/widgets/core_status_button_test.dart b/test/widgets/core_status_button_test.dart
new file mode 100644
index 0000000000..8cb207263b
--- /dev/null
+++ b/test/widgets/core_status_button_test.dart
@@ -0,0 +1,187 @@
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/providers/providers.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/views/dashboard/widgets/core_status_button.dart';
+import 'package:fl_clash/widgets/widgets.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets(
+    'holds connecting for the minimum duration after a fast restart',
+    (tester) async {
+      final container = ProviderContainer();
+      addTearDown(container.dispose);
+      globalState.container = container;
+      container.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+
+      await tester.pumpWidget(
+        UncontrolledProviderScope(
+          container: container,
+          child: const _TestApp(child: CoreStatusButton()),
+        ),
+      );
+      await tester.pump();
+
+      expect(find.byIcon(Icons.check), findsOneWidget);
+      expect(find.byType(CommonCircleLoading), findsNothing);
+
+      container.read(coreStatusProvider.notifier).value = CoreStatus.connecting;
+      await tester.pump();
+      await tester.pump(const Duration(milliseconds: 400));
+      expect(find.byType(CommonCircleLoading), findsOneWidget);
+      expect(find.byIcon(Icons.check), findsNothing);
+
+      container.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+      await tester.pump();
+      expect(find.byType(CommonCircleLoading), findsOneWidget);
+      expect(find.byIcon(Icons.check), findsNothing);
+
+      await tester.pump(const Duration(milliseconds: 199));
+      expect(find.byType(CommonCircleLoading), findsOneWidget);
+
+      await tester.pump(const Duration(milliseconds: 1));
+      await tester.pump(const Duration(milliseconds: 400));
+      expect(find.byIcon(Icons.check), findsOneWidget);
+      expect(find.byType(CommonCircleLoading), findsNothing);
+
+      await tester.pump(const Duration(seconds: 1));
+      expect(find.byIcon(Icons.check), findsOneWidget);
+    },
+  );
+
+  testWidgets(
+    'shows disconnected immediately when restart fails during the hold',
+    (tester) async {
+      final container = ProviderContainer();
+      addTearDown(container.dispose);
+      globalState.container = container;
+      container.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+
+      await tester.pumpWidget(
+        UncontrolledProviderScope(
+          container: container,
+          child: const _TestApp(child: CoreStatusButton()),
+        ),
+      );
+      await tester.pump();
+
+      container.read(coreStatusProvider.notifier).value = CoreStatus.connecting;
+      await tester.pump();
+      await tester.pump(const Duration(milliseconds: 400));
+      expect(find.byType(CommonCircleLoading), findsOneWidget);
+
+      container.read(coreStatusProvider.notifier).value =
+          CoreStatus.disconnected;
+      await tester.pump();
+      expect(find.byIcon(Icons.restart_alt_sharp), findsOneWidget);
+
+      await tester.pump(const Duration(milliseconds: 400));
+      expect(find.byIcon(Icons.restart_alt_sharp), findsOneWidget);
+      expect(find.byType(CommonCircleLoading), findsNothing);
+
+      await tester.pump(const Duration(seconds: 1));
+      expect(find.byIcon(Icons.restart_alt_sharp), findsOneWidget);
+      expect(find.byType(CommonCircleLoading), findsNothing);
+    },
+  );
+
+  testWidgets('does not clip a connecting state longer than the hold', (
+    tester,
+  ) async {
+    final container = ProviderContainer();
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(child: CoreStatusButton()),
+      ),
+    );
+    await tester.pump();
+
+    container.read(coreStatusProvider.notifier).value = CoreStatus.connecting;
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 700));
+    expect(find.byType(CommonCircleLoading), findsOneWidget);
+
+    container.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 400));
+    expect(find.byIcon(Icons.check), findsOneWidget);
+    expect(find.byType(CommonCircleLoading), findsNothing);
+
+    await tester.pump(const Duration(seconds: 1));
+    expect(find.byIcon(Icons.check), findsOneWidget);
+  });
+
+  testWidgets('holds connecting when restarting from disconnected', (
+    tester,
+  ) async {
+    final container = ProviderContainer();
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container.read(coreStatusProvider.notifier).value = CoreStatus.disconnected;
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(child: CoreStatusButton()),
+      ),
+    );
+    await tester.pump();
+
+    expect(find.byIcon(Icons.restart_alt_sharp), findsOneWidget);
+
+    container.read(coreStatusProvider.notifier).value = CoreStatus.connecting;
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 400));
+    expect(find.byType(CommonCircleLoading), findsOneWidget);
+    expect(find.byIcon(Icons.restart_alt_sharp), findsNothing);
+
+    container.read(coreStatusProvider.notifier).value = CoreStatus.connected;
+    await tester.pump();
+    expect(find.byType(CommonCircleLoading), findsOneWidget);
+
+    await tester.pump(const Duration(milliseconds: 199));
+    expect(find.byType(CommonCircleLoading), findsOneWidget);
+
+    await tester.pump(const Duration(milliseconds: 1));
+    await tester.pump(const Duration(milliseconds: 400));
+    expect(find.byIcon(Icons.check), findsOneWidget);
+    expect(find.byType(CommonCircleLoading), findsNothing);
+
+    await tester.pump(const Duration(seconds: 1));
+    expect(find.byIcon(Icons.check), findsOneWidget);
+  });
+}
+
+class _TestApp extends StatelessWidget {
+  final Widget child;
+
+  const _TestApp({required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      localizationsDelegates: const [
+        AppLocalizations.delegate,
+        GlobalMaterialLocalizations.delegate,
+        GlobalCupertinoLocalizations.delegate,
+        GlobalWidgetsLocalizations.delegate,
+      ],
+      supportedLocales: AppLocalizations.delegate.supportedLocales,
+      builder: (context, child) {
+        globalState.measure = Measure.of(context, 1);
+        return child!;
+      },
+      home: Scaffold(body: Center(child: child)),
+    );
+  }
+}
diff --git a/test/widgets/dashboard_layout_test.dart b/test/widgets/dashboard_layout_test.dart
new file mode 100644
index 0000000000..5d4bc63a1c
--- /dev/null
+++ b/test/widgets/dashboard_layout_test.dart
@@ -0,0 +1,73 @@
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/common/theme.dart';
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:fl_clash/providers/state.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/views/dashboard/dashboard.dart';
+import 'package:fl_clash/widgets/grid.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('dashboard limits a wide grid to 12 centered columns', (
+    tester,
+  ) async {
+    tester.view.physicalSize = const Size(1600, 1000);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.resetPhysicalSize);
+    addTearDown(tester.view.resetDevicePixelRatio);
+
+    final container = ProviderContainer(
+      overrides: [
+        dashboardStateProvider.overrideWithValue(
+          const DashboardState(dashboardWidgets: [], contentWidth: 1600),
+        ),
+      ],
+    );
+    addTearDown(container.dispose);
+    globalState.container = container;
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(child: DashboardView()),
+      ),
+    );
+    await tester.pump();
+
+    final grid = find.byType(Grid);
+    expect(tester.widget<Grid>(grid).crossAxisCount, 12);
+    expect(tester.getSize(grid).width, 840);
+    expect(tester.getTopLeft(grid).dx, 380);
+    expect(tester.takeException(), null);
+  });
+}
+
+class _TestApp extends StatelessWidget {
+  final Widget child;
+
+  const _TestApp({required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      navigatorKey: globalState.navigatorKey,
+      localizationsDelegates: const [
+        AppLocalizations.delegate,
+        GlobalMaterialLocalizations.delegate,
+        GlobalCupertinoLocalizations.delegate,
+        GlobalWidgetsLocalizations.delegate,
+      ],
+      supportedLocales: AppLocalizations.delegate.supportedLocales,
+      builder: (context, child) {
+        globalState.measure = Measure.of(context, 1);
+        globalState.theme = CommonTheme.of(context, 1);
+        return child!;
+      },
+      home: child,
+    );
+  }
+}
diff --git a/test/widgets/developer_test.dart b/test/widgets/developer_test.dart
new file mode 100644
index 0000000000..e6300e8f12
--- /dev/null
+++ b/test/widgets/developer_test.dart
@@ -0,0 +1,31 @@
+import 'package:fl_clash/state.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  group('crash test availability', () {
+    test('is enabled for debug builds', () {
+      expect(
+        GlobalState.canCrashCoreFor(isDebug: true, appEnv: 'stable'),
+        isTrue,
+      );
+    });
+
+    test('is enabled for dev builds', () {
+      expect(
+        GlobalState.canCrashCoreFor(isDebug: false, appEnv: 'dev'),
+        isTrue,
+      );
+    });
+
+    test('is disabled for pre and stable release builds', () {
+      expect(
+        GlobalState.canCrashCoreFor(isDebug: false, appEnv: 'pre'),
+        isFalse,
+      );
+      expect(
+        GlobalState.canCrashCoreFor(isDebug: false, appEnv: 'stable'),
+        isFalse,
+      );
+    });
+  });
+}
diff --git a/test/widgets/input_test.dart b/test/widgets/input_test.dart
index 4768d34b21..85e52fcac8 100644
--- a/test/widgets/input_test.dart
+++ b/test/widgets/input_test.dart
@@ -1,5 +1,9 @@
+import 'dart:ui' as ui;
+
+import 'package:fl_clash/common/common.dart';
 import 'package:fl_clash/common/theme.dart';
 import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/models/common.dart';
 import 'package:fl_clash/providers/app.dart';
 import 'package:fl_clash/state.dart';
 import 'package:fl_clash/widgets/widgets.dart';
@@ -9,6 +13,68 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_test/flutter_test.dart';
 
 void main() {
+  testWidgets('ListItem.toggle toggles when tapping the row', (tester) async {
+    bool? changedValue;
+
+    await tester.pumpWidget(
+      _TestApp(
+        child: Scaffold(
+          body: ListItem.toggle(
+            title: const Text('Enabled'),
+            value: false,
+            onChanged: (value) {
+              changedValue = value;
+            },
+          ),
+        ),
+      ),
+    );
+
+    await tester.tap(find.text('Enabled'));
+
+    expect(changedValue, isTrue);
+  });
+
+  testWidgets('ListItem.toggle is disabled without onChanged', (tester) async {
+    await tester.pumpWidget(
+      _TestApp(
+        child: Scaffold(
+          body: ListItem.toggle(title: const Text('Disabled'), value: false),
+        ),
+      ),
+    );
+
+    final tile = tester.widget<ListTile>(find.byType(ListTile));
+    final control = tester.widget<Switch>(find.byType(Switch));
+
+    expect(tile.onTap, isNull);
+    expect(control.onChanged, isNull);
+
+    await tester.tap(find.text('Disabled'));
+    await tester.pump();
+  });
+
+  testWidgets('ListItem.checkbox toggles when tapping the row', (tester) async {
+    bool? changedValue;
+
+    await tester.pumpWidget(
+      _TestApp(
+        child: Scaffold(
+          body: ListItem.checkbox(
+            title: const Text('Selected'),
+            onChanged: (value) {
+              changedValue = value;
+            },
+          ),
+        ),
+      ),
+    );
+
+    await tester.tap(find.text('Selected'));
+
+    expect(changedValue, isTrue);
+  });
+
   testWidgets('ListItem.input limits dialog text by maxLength', (tester) async {
     String? changedValue;
 
@@ -21,14 +87,12 @@ void main() {
           child: Scaffold(
             body: ListItem.input(
               title: const Text('Port'),
-              delegate: InputDelegate(
-                title: 'Port',
-                value: '',
-                maxLength: 5,
-                onChanged: (value) {
-                  changedValue = value;
-                },
-              ),
+              dialogTitle: 'Port',
+              value: '',
+              maxLength: 5,
+              onChanged: (value) {
+                changedValue = value;
+              },
             ),
           ),
         ),
@@ -75,12 +139,274 @@ void main() {
     expect(_top(tester, 'b'), lessThan(_top(tester, 'c')));
     expect(_top(tester, 'c'), lessThan(_top(tester, 'a')));
   });
+
+  testWidgets('OptionsDialog returns the tapped option', (tester) async {
+    String? selected;
+
+    await tester.pumpWidget(
+      _TestApp(
+        child: Builder(
+          builder: (context) {
+            return FilledButton(
+              onPressed: () async {
+                selected = await showDialog<String>(
+                  context: context,
+                  builder: (_) => const OptionsDialog<String>(
+                    title: 'Options',
+                    options: ['One', 'Two'],
+                    value: 'One',
+                    textBuilder: _optionText,
+                  ),
+                );
+              },
+              child: const Text('Open'),
+            );
+          },
+        ),
+      ),
+    );
+
+    await tester.tap(find.text('Open'));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Two'));
+    await tester.pumpAndSettle();
+
+    expect(selected, 'Two');
+  });
+
+  testWidgets('InputDialog validates, submits, and resets values', (
+    tester,
+  ) async {
+    String? result;
+
+    await tester.pumpWidget(
+      _TestApp(
+        child: Builder(
+          builder: (context) {
+            return FilledButton(
+              onPressed: () async {
+                result = await showDialog<String>(
+                  context: context,
+                  builder: (_) => InputDialog(
+                    title: 'Value',
+                    value: 'changed',
+                    resetValue: 'default',
+                    labelText: 'Value',
+                    suffixText: 'unit',
+                    hintText: 'hint',
+                    validator: (value) => value == 'valid' ? null : 'Invalid',
+                  ),
+                );
+              },
+              child: const Text('Open'),
+            );
+          },
+        ),
+      ),
+    );
+
+    await tester.tap(find.text('Open'));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Submit'));
+    await tester.pump();
+    expect(find.text('Invalid'), findsOneWidget);
+
+    await tester.enterText(find.byType(TextFormField), 'valid');
+    await tester.testTextInput.receiveAction(TextInputAction.done);
+    await tester.pumpAndSettle();
+    expect(result, 'valid');
+
+    await tester.tap(find.text('Open'));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Reset'));
+    await tester.pumpAndSettle();
+    expect(result, 'default');
+  });
+
+  testWidgets('AddDialog returns scalar and map values', (tester) async {
+    Object? result;
+
+    await tester.pumpWidget(
+      _TestApp(
+        child: Builder(
+          builder: (context) {
+            return Column(
+              children: [
+                FilledButton(
+                  onPressed: () async {
+                    result = await showDialog<String>(
+                      context: context,
+                      builder: (_) => const AddDialog(
+                        title: 'Scalar',
+                        valueField: Field(label: 'Value', value: ''),
+                        valueMaxLength: 4,
+                      ),
+                    );
+                  },
+                  child: const Text('Scalar'),
+                ),
+                FilledButton(
+                  onPressed: () async {
+                    result = await showDialog<MapEntry<String, String>>(
+                      context: context,
+                      builder: (_) => const AddDialog(
+                        title: 'Pair',
+                        keyField: Field(label: 'Key', value: ''),
+                        valueField: Field(label: 'Value', value: ''),
+                        keyMaxLength: 3,
+                        valueMaxLength: 4,
+                      ),
+                    );
+                  },
+                  child: const Text('Pair'),
+                ),
+              ],
+            );
+          },
+        ),
+      ),
+    );
+
+    await tester.tap(find.text('Scalar'));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Confirm'));
+    await tester.pump();
+    expect(find.byType(AddDialog), findsOneWidget);
+    await tester.enterText(find.byType(TextFormField), 'value');
+    await tester.tap(find.text('Confirm'));
+    await tester.pumpAndSettle();
+    expect(result, 'valu');
+
+    await tester.tap(find.text('Pair'));
+    await tester.pumpAndSettle();
+    final fields = find.byType(TextFormField);
+    await tester.enterText(fields.first, 'key1');
+    await tester.enterText(fields.last, 'value');
+    await tester.tap(find.text('Confirm'));
+    await tester.pumpAndSettle();
+    expect((result! as MapEntry<String, String>).key, 'key');
+    expect((result! as MapEntry<String, String>).value, 'valu');
+  });
+
+  testWidgets('ListInputPage adds, edits, selects, and deletes items', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      const ProviderScope(
+        child: _TestApp(
+          child: ListInputPage(
+            title: 'Items',
+            items: ['a', 'b'],
+            titleBuilder: _textBuilder,
+            subtitleBuilder: _textBuilder,
+            leadingBuilder: _textBuilder,
+            itemMaxLength: 4,
+          ),
+        ),
+      ),
+    );
+
+    await tester.tap(find.text('Add'));
+    await tester.pumpAndSettle();
+    await tester.enterText(find.byType(TextFormField), 'c');
+    await tester.tap(find.text('Confirm'));
+    await tester.pumpAndSettle();
+    expect(find.text('c'), findsNWidgets(3));
+
+    await tester.tap(find.text('c').first);
+    await tester.pumpAndSettle();
+    await tester.enterText(find.byType(TextFormField), 'd');
+    await tester.tap(find.text('Confirm'));
+    await tester.pumpAndSettle();
+    expect(find.text('d'), findsNWidgets(3));
+
+    await tester.tap(find.byType(Checkbox).first);
+    await tester.pump();
+    expect(find.byIcon(Icons.delete), findsOneWidget);
+    await tester.tap(find.text('Select all'));
+    await tester.pump();
+    await tester.tap(find.byIcon(Icons.delete));
+    await tester.pump();
+    expect(find.text('No data'), findsOneWidget);
+  });
+
+  testWidgets('MapInputPage adds, reorders, selects, and deletes entries', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      const ProviderScope(
+        child: _TestApp(
+          child: MapInputPage(
+            title: 'Map',
+            map: {'a': '1', 'b': '2'},
+            titleBuilder: _entryTitle,
+            subtitleBuilder: _entrySubtitle,
+            leadingBuilder: _entryTitle,
+            keyMaxLength: 4,
+            valueMaxLength: 4,
+          ),
+        ),
+      ),
+    );
+
+    final listView = tester.widget<ReorderableListView>(
+      find.byType(ReorderableListView),
+    );
+    listView.onReorderItem!(0, 1);
+    await tester.pump();
+    expect(
+      tester.getTopLeft(find.text('b').first).dy,
+      lessThan(tester.getTopLeft(find.text('a').first).dy),
+    );
+
+    await tester.tap(find.text('Add'));
+    await tester.pumpAndSettle();
+    final fields = find.byType(TextFormField);
+    await tester.enterText(fields.first, 'c');
+    await tester.enterText(fields.last, '3');
+    await tester.tap(find.text('Confirm'));
+    await tester.pumpAndSettle();
+    expect(find.text('c'), findsNWidgets(2));
+
+    await tester.tap(find.byType(Checkbox).first);
+    await tester.pump();
+    await tester.tap(find.text('Select all'));
+    await tester.pump();
+    await tester.tap(find.byIcon(Icons.delete));
+    await tester.pump();
+    expect(find.text('No data'), findsOneWidget);
+  });
+
+  test('NoInputBorder implements border geometry and interior painting', () {
+    const border = NoInputBorder();
+    const rect = Rect.fromLTWH(1, 2, 30, 40);
+
+    expect(border.copyWith(), isA<NoInputBorder>());
+    expect(border.scale(2), isA<NoInputBorder>());
+    expect(border.isOutline, isFalse);
+    expect(border.dimensions, EdgeInsets.zero);
+    expect(border.preferPaintInterior, isTrue);
+    expect(border.getInnerPath(rect).getBounds(), rect);
+    expect(border.getOuterPath(rect).getBounds(), rect);
+
+    final recorder = ui.PictureRecorder();
+    final canvas = Canvas(recorder);
+    border.paintInterior(canvas, rect, Paint()..color = Colors.red);
+    border.paint(canvas, rect);
+    recorder.endRecording();
+  });
 }
 
+String _optionText(String value) => value;
+
 Widget _textBuilder(String value) {
   return Text(value);
 }
 
+Widget _entryTitle(MapEntry<String, String> value) => Text(value.key);
+
+Widget _entrySubtitle(MapEntry<String, String> value) => Text(value.value);
+
 double _top(WidgetTester tester, String text) {
   return tester.getTopLeft(find.text(text)).dy;
 }
@@ -92,20 +418,26 @@ class _TestApp extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return MaterialApp(
-      navigatorKey: globalState.navigatorKey,
-      localizationsDelegates: const [
-        AppLocalizations.delegate,
-        GlobalMaterialLocalizations.delegate,
-        GlobalCupertinoLocalizations.delegate,
-        GlobalWidgetsLocalizations.delegate,
+    return ProviderScope(
+      overrides: [
+        viewSizeProvider.overrideWithBuild((_, _) => const Size(1200, 1000)),
       ],
-      supportedLocales: AppLocalizations.delegate.supportedLocales,
-      builder: (context, child) {
-        globalState.theme = CommonTheme.of(context, 1);
-        return child!;
-      },
-      home: child,
+      child: MaterialApp(
+        navigatorKey: globalState.navigatorKey,
+        localizationsDelegates: const [
+          AppLocalizations.delegate,
+          GlobalMaterialLocalizations.delegate,
+          GlobalCupertinoLocalizations.delegate,
+          GlobalWidgetsLocalizations.delegate,
+        ],
+        supportedLocales: AppLocalizations.delegate.supportedLocales,
+        builder: (context, child) {
+          globalState.measure = Measure.of(context, 1);
+          globalState.theme = CommonTheme.of(context, 1);
+          return child!;
+        },
+        home: child,
+      ),
     );
   }
 }
diff --git a/test/widgets/loading_test.dart b/test/widgets/loading_test.dart
index 7768f989d4..c779653940 100644
--- a/test/widgets/loading_test.dart
+++ b/test/widgets/loading_test.dart
@@ -3,6 +3,19 @@ import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';
 
 void main() {
+  testWidgets('CommonCircleLoading uses the M3E default size', (tester) async {
+    await tester.pumpWidget(
+      const MaterialApp(home: Center(child: CommonCircleLoading())),
+    );
+
+    final customPaint = find.descendant(
+      of: find.byType(CommonCircleLoading),
+      matching: find.byType(CustomPaint),
+    );
+
+    expect(tester.getSize(customPaint), const Size.square(48));
+  });
+
   testWidgets('CommonCircleLoading shrink-wraps when constraints are loose', (
     tester,
   ) async {
@@ -44,4 +57,96 @@ void main() {
 
     expect(tester.getSize(customPaint), const Size.square(32));
   });
+
+  testWidgets('CommonCircleLoading continuously rotates and morphs', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      const MaterialApp(
+        home: Center(
+          child: SizedBox.square(dimension: 48, child: CommonCircleLoading()),
+        ),
+      ),
+    );
+
+    final loading = find.byType(CommonCircleLoading);
+    final transform = find.descendant(
+      of: loading,
+      matching: find.byType(Transform),
+    );
+    final customPaint = find.descendant(
+      of: loading,
+      matching: find.byType(CustomPaint),
+    );
+    final initialTransform = tester.widget<Transform>(transform).transform;
+    final initialPainter = tester.widget<CustomPaint>(customPaint).painter!;
+
+    await tester.pump(const Duration(milliseconds: 325));
+
+    final animatedTransform = tester.widget<Transform>(transform).transform;
+    final animatedPainter = tester.widget<CustomPaint>(customPaint).painter!;
+
+    expect(animatedTransform.storage, isNot(equals(initialTransform.storage)));
+    expect(animatedPainter.shouldRepaint(initialPainter), isTrue);
+
+    for (var i = 0; i < 7; i++) {
+      await tester.pump(const Duration(milliseconds: 650));
+    }
+
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('CommonCircleLoading exposes optional loading semantics', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      const MaterialApp(
+        home: CommonCircleLoading(
+          semanticLabel: 'Loading profiles',
+          semanticValue: 'In progress',
+        ),
+      ),
+    );
+
+    expect(find.bySemanticsLabel('Loading profiles'), findsOneWidget);
+  });
+
+  testWidgets('CommonCircleLoading supports the contained M3E API variant', (
+    tester,
+  ) async {
+    final colorScheme = ColorScheme.fromSeed(seedColor: Colors.blue);
+    await tester.pumpWidget(
+      MaterialApp(
+        theme: ThemeData(colorScheme: colorScheme),
+        home: Center(
+          child: CommonCircleLoading(
+            variant: LoadingIndicatorM3EVariant.contained,
+            constraints: const BoxConstraints.tightFor(width: 32, height: 32),
+            padding: const EdgeInsets.all(4),
+            polygons: const [StarBorder(points: 6), StarBorder(points: 8)],
+          ),
+        ),
+      ),
+    );
+
+    final decoratedBox = tester.widget<DecoratedBox>(
+      find.descendant(
+        of: find.byType(CommonCircleLoading),
+        matching: find.byType(DecoratedBox),
+      ),
+    );
+    final decoration = decoratedBox.decoration as BoxDecoration;
+    final customPaint = find.descendant(
+      of: find.byType(CommonCircleLoading),
+      matching: find.byType(CustomPaint),
+    );
+
+    expect(decoration.color, colorScheme.primaryContainer);
+    expect(decoration.borderRadius, BorderRadius.circular(999));
+    expect(tester.getSize(customPaint), const Size.square(32));
+    expect(
+      tester.getSize(find.byType(CommonCircleLoading)),
+      const Size.square(40),
+    );
+  });
 }
diff --git a/test/widgets/memory_info_test.dart b/test/widgets/memory_info_test.dart
new file mode 100644
index 0000000000..87d9f4e438
--- /dev/null
+++ b/test/widgets/memory_info_test.dart
@@ -0,0 +1,115 @@
+import 'dart:async';
+
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/common/theme.dart';
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/views/dashboard/widgets/memory_info.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('MemoryInfo refreshes only while the app is resumed', (
+    tester,
+  ) async {
+    var readCount = 0;
+
+    Future<num> readMemory() async {
+      readCount++;
+      return readCount;
+    }
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.paused);
+    await tester.pumpWidget(
+      _TestApp(child: MemoryInfo(memoryReader: readMemory)),
+    );
+    await tester.pump();
+
+    expect(readCount, 0);
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.resumed);
+    await tester.pump();
+
+    expect(readCount, 1);
+
+    await tester.pump(const Duration(seconds: 2));
+    await tester.pump();
+
+    expect(readCount, 2);
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.paused);
+    await tester.pump(const Duration(seconds: 4));
+
+    expect(readCount, 2);
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.resumed);
+    await tester.pump();
+
+    expect(readCount, 3);
+
+    await tester.pumpWidget(const SizedBox.shrink());
+  });
+
+  testWidgets('MemoryInfo ignores a request completed in the background', (
+    tester,
+  ) async {
+    final requests = <Completer<num>>[];
+
+    Future<num> readMemory() {
+      final request = Completer<num>();
+      requests.add(request);
+      return request.future;
+    }
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.resumed);
+    await tester.pumpWidget(
+      _TestApp(child: MemoryInfo(memoryReader: readMemory)),
+    );
+    await tester.pump();
+
+    expect(requests, hasLength(1));
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.paused);
+    requests.first.complete(1);
+    await tester.pump();
+    await tester.pump(const Duration(seconds: 2));
+
+    expect(requests, hasLength(1));
+
+    tester.binding.handleAppLifecycleStateChanged(AppLifecycleState.resumed);
+    await tester.pump();
+
+    expect(requests, hasLength(2));
+
+    requests.last.complete(2);
+    await tester.pump();
+    await tester.pumpWidget(const SizedBox.shrink());
+  });
+}
+
+class _TestApp extends StatelessWidget {
+  final Widget child;
+
+  const _TestApp({required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      navigatorKey: globalState.navigatorKey,
+      localizationsDelegates: const [
+        AppLocalizations.delegate,
+        GlobalMaterialLocalizations.delegate,
+        GlobalCupertinoLocalizations.delegate,
+        GlobalWidgetsLocalizations.delegate,
+      ],
+      supportedLocales: AppLocalizations.delegate.supportedLocales,
+      builder: (context, child) {
+        globalState.measure = Measure.of(context, 1);
+        globalState.theme = CommonTheme.of(context, 1);
+        return child!;
+      },
+      home: Scaffold(body: child),
+    );
+  }
+}
diff --git a/test/widgets/open_container_test.dart b/test/widgets/open_container_test.dart
new file mode 100644
index 0000000000..709da4385c
--- /dev/null
+++ b/test/widgets/open_container_test.dart
@@ -0,0 +1,108 @@
+import 'package:fl_clash/widgets/open_container.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('OpenContainer opens, closes, and returns a value', (
+    tester,
+  ) async {
+    String? result;
+
+    await tester.pumpWidget(
+      MaterialApp(
+        home: Scaffold(
+          body: Center(
+            child: SizedBox(
+              width: 160,
+              height: 80,
+              child: OpenContainer<String>(
+                middleColor: Colors.orange,
+                routeSettings: const RouteSettings(name: 'details'),
+                transitionDuration: const Duration(milliseconds: 200),
+                closedBuilder: (_, open) {
+                  return FilledButton(
+                    onPressed: open,
+                    child: const Text('Closed'),
+                  );
+                },
+                openBuilder: (_, close) {
+                  return Center(
+                    child: FilledButton(
+                      onPressed: () => close(returnValue: 'done'),
+                      child: const Text('Close'),
+                    ),
+                  );
+                },
+                onClosed: (value) {
+                  result = value;
+                },
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+
+    await tester.tap(find.text('Closed'));
+    await tester.pump(const Duration(milliseconds: 80));
+    expect(find.text('Close'), findsOneWidget);
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.text('Close'));
+    await tester.pump(const Duration(milliseconds: 80));
+    await tester.pumpAndSettle();
+
+    expect(result, 'done');
+    expect(find.text('Closed'), findsOneWidget);
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets(
+    'fadeThrough opens by callback and supports interrupted reverse',
+    (tester) async {
+      String? result = 'unchanged';
+
+      await tester.pumpWidget(
+        MaterialApp(
+          home: Scaffold(
+            body: Align(
+              alignment: Alignment.topLeft,
+              child: OpenContainer<String>(
+                tappable: false,
+                useRootNavigator: true,
+                transitionType: ContainerTransitionType.fadeThrough,
+                transitionDuration: const Duration(milliseconds: 300),
+                closedBuilder: (_, open) {
+                  return TextButton(
+                    onPressed: open,
+                    child: const Text('Open manually'),
+                  );
+                },
+                openBuilder: (_, close) {
+                  return TextButton(
+                    onPressed: () => close(),
+                    child: const Text('Reverse now'),
+                  );
+                },
+                onClosed: (value) {
+                  result = value;
+                },
+              ),
+            ),
+          ),
+        ),
+      );
+
+      await tester.tap(find.text('Open manually'));
+      await tester.pump(const Duration(milliseconds: 100));
+      await tester.tap(find.text('Reverse now'));
+      await tester.pump(const Duration(milliseconds: 50));
+      await tester.pumpAndSettle();
+      await tester.pump();
+
+      expect(result, isNull);
+      expect(find.text('Reverse now'), findsNothing);
+      expect(tester.takeException(), isNull);
+    },
+  );
+}
diff --git a/test/widgets/palette_test.dart b/test/widgets/palette_test.dart
new file mode 100644
index 0000000000..962b0168c2
--- /dev/null
+++ b/test/widgets/palette_test.dart
@@ -0,0 +1,98 @@
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/common/theme.dart';
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/widgets/palette.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('Palette updates color from hue, chroma, and tone controls', (
+    tester,
+  ) async {
+    final controller = ValueNotifier<Color>(Colors.blue);
+    addTearDown(controller.dispose);
+
+    await tester.pumpWidget(
+      _TestApp(
+        child: Scaffold(
+          body: SingleChildScrollView(
+            child: SizedBox(width: 700, child: Palette(controller: controller)),
+          ),
+        ),
+      ),
+    );
+    await tester.pump();
+
+    expect(find.byType(Slider), findsNWidgets(2));
+    expect(find.text('Preview'), findsOneWidget);
+    expect(find.text('Primary'), findsOneWidget);
+    expect(find.text('100'), findsOneWidget);
+
+    final initial = controller.value;
+    tester.widget<Slider>(find.byType(Slider).first).onChanged!(180);
+    await tester.pump();
+    expect(controller.value, isNot(initial));
+
+    final hueColor = controller.value;
+    tester.widget<Slider>(find.byType(Slider).last).onChanged!(8);
+    await tester.pump();
+    expect(controller.value, isNot(hueColor));
+
+    await tester.tap(find.text('0'));
+    await tester.pump();
+    expect(controller.value.computeLuminance(), lessThan(0.01));
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('Palette lays out narrow tone and preview grids', (tester) async {
+    final controller = ValueNotifier<Color>(Colors.white);
+    addTearDown(controller.dispose);
+
+    await tester.pumpWidget(
+      _TestApp(
+        child: Scaffold(
+          body: SingleChildScrollView(
+            child: SizedBox(width: 32, child: Palette(controller: controller)),
+          ),
+        ),
+      ),
+    );
+    await tester.pump();
+
+    expect(find.text('0'), findsOneWidget);
+    expect(find.text('100'), findsOneWidget);
+    expect(find.text('Primary'), findsOneWidget);
+    expect(tester.takeException(), isNull);
+  });
+}
+
+class _TestApp extends StatelessWidget {
+  const _TestApp({required this.child});
+
+  final Widget child;
+
+  @override
+  Widget build(BuildContext context) {
+    return ProviderScope(
+      child: MaterialApp(
+        navigatorKey: globalState.navigatorKey,
+        localizationsDelegates: const [
+          AppLocalizations.delegate,
+          GlobalMaterialLocalizations.delegate,
+          GlobalCupertinoLocalizations.delegate,
+          GlobalWidgetsLocalizations.delegate,
+        ],
+        supportedLocales: AppLocalizations.delegate.supportedLocales,
+        builder: (context, child) {
+          globalState.theme = CommonTheme.of(context, 1);
+          globalState.measure = Measure.of(context, 1);
+          return child!;
+        },
+        home: child,
+      ),
+    );
+  }
+}
diff --git a/test/widgets/proxies_tab_test.dart b/test/widgets/proxies_tab_test.dart
new file mode 100644
index 0000000000..3a8c13564a
--- /dev/null
+++ b/test/widgets/proxies_tab_test.dart
@@ -0,0 +1,124 @@
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/common/theme.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:fl_clash/providers/config.dart';
+import 'package:fl_clash/providers/database.dart';
+import 'package:fl_clash/providers/state.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/views/proxies/tab.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  late ProviderContainer globalContainer;
+  late ProviderSubscription<Profile?> currentProfileSubscription;
+
+  setUp(() {
+    final profile = Profile.normal().copyWith(currentGroupName: 'B');
+    globalContainer = ProviderContainer(
+      overrides: [
+        currentProfileIdProvider.overrideWithBuild((_, _) => profile.id),
+        profilesProvider.overrideWith(() => _TestProfiles([profile])),
+        currentGroupsStateProvider.overrideWithValue(
+          GroupsState(value: [_group('A'), _group('B'), _group('C')]),
+        ),
+      ],
+    );
+    globalState.container = globalContainer;
+    currentProfileSubscription = globalContainer.listen(
+      currentProfileProvider,
+      (_, _) {},
+    );
+  });
+
+  tearDown(() {
+    currentProfileSubscription.close();
+    globalContainer.dispose();
+  });
+
+  testWidgets('current group follows the rendered tab list', (tester) async {
+    final key = GlobalKey<ProxiesTabViewState>();
+    final renderedGroups = [_group('B'), _group('C')];
+
+    await tester.pumpWidget(
+      ProviderScope(
+        overrides: [
+          proxiesTabStateProvider.overrideWithValue(
+            ProxiesTabState(
+              groups: renderedGroups,
+              currentGroupName: 'B',
+              proxyCardType: ProxyCardType.expand,
+              columns: 2,
+            ),
+          ),
+        ],
+        child: _TestApp(child: ProxiesTabView(key: key)),
+      ),
+    );
+    await tester.pump();
+
+    expect(key.currentState?.currentGroup?.name, 'B');
+
+    final tabBar = tester.widget<TabBar>(find.byType(TabBar));
+    tabBar.controller?.animateTo(1);
+    await tester.pumpAndSettle();
+
+    expect(key.currentState?.currentGroup?.name, 'C');
+    expect(globalContainer.read(currentProfileProvider)?.currentGroupName, 'C');
+  });
+}
+
+Group _group(String name) {
+  return Group(type: GroupType.Selector, name: name);
+}
+
+class _TestProfiles extends Profiles {
+  final List<Profile> initial;
+
+  _TestProfiles(this.initial);
+
+  @override
+  List<Profile> build() => initial;
+
+  @override
+  void put(Profile profile) {
+    final next = List<Profile>.from(state);
+    final index = next.indexWhere((item) => item.id == profile.id);
+    if (index == -1) {
+      next.add(profile);
+    } else {
+      next[index] = profile;
+    }
+    state = next;
+  }
+}
+
+class _TestApp extends StatelessWidget {
+  final Widget child;
+
+  const _TestApp({required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      navigatorKey: globalState.navigatorKey,
+      localizationsDelegates: const [
+        AppLocalizations.delegate,
+        GlobalMaterialLocalizations.delegate,
+        GlobalCupertinoLocalizations.delegate,
+        GlobalWidgetsLocalizations.delegate,
+      ],
+      supportedLocales: AppLocalizations.delegate.supportedLocales,
+      builder: (context, child) {
+        globalState.measure = Measure.of(context, 1);
+        globalState.theme = CommonTheme.of(context, 1);
+        return child!;
+      },
+      home: Scaffold(body: child),
+    );
+  }
+}
diff --git a/test/widgets/side_sheet_test.dart b/test/widgets/side_sheet_test.dart
new file mode 100644
index 0000000000..568a1a4d58
--- /dev/null
+++ b/test/widgets/side_sheet_test.dart
@@ -0,0 +1,155 @@
+import 'package:fl_clash/widgets/side_sheet.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('SideSheet applies defaults and custom presentation values', (
+    tester,
+  ) async {
+    final controller = SideSheet.createAnimationController(tester);
+    addTearDown(controller.dispose);
+    var closed = false;
+
+    await tester.pumpWidget(
+      MaterialApp(
+        home: Scaffold(
+          body: SideSheet(
+            animationController: controller,
+            onClosing: () {
+              closed = true;
+            },
+            enableDrag: false,
+            showDragHandle: true,
+            backgroundColor: Colors.red,
+            shadowColor: Colors.blue,
+            elevation: 4,
+            shape: const RoundedRectangleBorder(),
+            clipBehavior: Clip.hardEdge,
+            constraints: const BoxConstraints(minWidth: 240, maxWidth: 240),
+            builder: (_) => const Text('Content'),
+          ),
+        ),
+      ),
+    );
+
+    final material = tester.widget<Material>(
+      find
+          .ancestor(of: find.text('Content'), matching: find.byType(Material))
+          .first,
+    );
+    expect(material.color, Colors.red);
+    expect(material.shadowColor, Colors.blue);
+    expect(material.elevation, 4);
+    expect(tester.getSize(find.byType(SideSheet)).width, 240);
+    expect(controller.duration, const Duration(milliseconds: 300));
+    expect(controller.reverseDuration, const Duration(milliseconds: 200));
+    expect(closed, isFalse);
+  });
+
+  testWidgets(
+    'modal side sheet animates, returns a value, and uses a barrier',
+    (tester) async {
+      String? result;
+
+      await tester.pumpWidget(
+        MaterialApp(
+          home: Scaffold(
+            body: Builder(
+              builder: (context) {
+                return FilledButton(
+                  onPressed: () async {
+                    result = await showModalSideSheet<String>(
+                      context: context,
+                      useSafeArea: true,
+                      isScrollControlled: true,
+                      barrierColor: Colors.black45,
+                      backgroundColor: Colors.green,
+                      elevation: 3,
+                      shape: const RoundedRectangleBorder(),
+                      clipBehavior: Clip.antiAlias,
+                      constraints: const BoxConstraints(maxWidth: 280),
+                      routeSettings: const RouteSettings(name: 'side-sheet'),
+                      anchorPoint: Offset.zero,
+                      builder: (context) {
+                        return SizedBox(
+                          width: 280,
+                          child: TextButton(
+                            onPressed: () => Navigator.pop(context, 'done'),
+                            child: const Text('Close sheet'),
+                          ),
+                        );
+                      },
+                    );
+                  },
+                  child: const Text('Open sheet'),
+                );
+              },
+            ),
+          ),
+        ),
+      );
+
+      await tester.tap(find.text('Open sheet'));
+      await tester.pump(const Duration(milliseconds: 100));
+      expect(find.byType(SideSheet), findsOneWidget);
+      expect(find.byType(AnimatedModalBarrier), findsOneWidget);
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.text('Close sheet'));
+      await tester.pumpAndSettle();
+
+      expect(result, 'done');
+      expect(find.byType(SideSheet), findsNothing);
+      expect(tester.takeException(), isNull);
+    },
+  );
+
+  testWidgets(
+    'transparent modal side sheet uses supplied controller and dismisses',
+    (tester) async {
+      final controller = AnimationController(
+        vsync: tester,
+        duration: const Duration(milliseconds: 20),
+        reverseDuration: const Duration(milliseconds: 20),
+      );
+      addTearDown(controller.dispose);
+      var completed = false;
+
+      await tester.pumpWidget(
+        MaterialApp(
+          theme: ThemeData(platform: TargetPlatform.iOS),
+          home: Scaffold(
+            body: Builder(
+              builder: (context) {
+                return FilledButton(
+                  onPressed: () async {
+                    await showModalSideSheet<void>(
+                      context: context,
+                      barrierColor: Colors.transparent,
+                      transitionAnimationController: controller,
+                      builder: (_) =>
+                          const SizedBox(width: 200, child: Text('Dismiss me')),
+                    );
+                    completed = true;
+                  },
+                  child: const Text('Open transparent'),
+                );
+              },
+            ),
+          ),
+        ),
+      );
+
+      await tester.tap(find.text('Open transparent'));
+      await tester.pumpAndSettle();
+      expect(find.byType(ModalBarrier), findsWidgets);
+
+      await tester.tapAt(const Offset(20, 300));
+      await tester.pumpAndSettle();
+
+      expect(completed, isTrue);
+      expect(find.text('Dismiss me'), findsNothing);
+      expect(tester.takeException(), isNull);
+    },
+  );
+}
diff --git a/test/widgets/start_button_test.dart b/test/widgets/start_button_test.dart
new file mode 100644
index 0000000000..865baa1038
--- /dev/null
+++ b/test/widgets/start_button_test.dart
@@ -0,0 +1,247 @@
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:fl_clash/providers/providers.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/views/dashboard/widgets/start_button.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('RunTimeText emphasizes the hundreds hour digit', (tester) async {
+    const colorScheme = ColorScheme.light(
+      primary: Color(0xFF6750A4),
+      onPrimaryContainer: Color(0xFF21005D),
+    );
+    await tester.pumpWidget(
+      MaterialApp(
+        theme: ThemeData(colorScheme: colorScheme),
+        home: const RunTimeText(timeStamp: 100 * 60 * 60 * 1000),
+      ),
+    );
+
+    final text = tester.widget<Text>(
+      find.descendant(
+        of: find.byType(RunTimeText),
+        matching: find.byType(Text),
+      ),
+    );
+    final span = text.textSpan! as TextSpan;
+
+    expect(span.toPlainText(), '100:00:00');
+    expect(span.text, '1');
+    expect(span.style?.color, colorScheme.primary);
+    expect(span.style?.fontWeight, FontWeight.w600);
+    expect(span.children, hasLength(1));
+    expect(
+      (span.children!.single as TextSpan).style?.color,
+      colorScheme.onPrimaryContainer,
+    );
+  });
+
+  testWidgets('RunTimeText uses one color below 100 hours', (tester) async {
+    const colorScheme = ColorScheme.light(
+      primary: Color(0xFF6750A4),
+      onPrimaryContainer: Color(0xFF21005D),
+    );
+    await tester.pumpWidget(
+      MaterialApp(
+        theme: ThemeData(colorScheme: colorScheme),
+        home: const RunTimeText(timeStamp: 99 * 60 * 60 * 1000),
+      ),
+    );
+
+    final text = tester.widget<Text>(
+      find.descendant(
+        of: find.byType(RunTimeText),
+        matching: find.byType(Text),
+      ),
+    );
+
+    expect(text.data, '99:00:00');
+    expect(text.style?.color, colorScheme.onPrimaryContainer);
+  });
+
+  testWidgets('StartButton animates its width when hours reach three digits', (
+    tester,
+  ) async {
+    final container = ProviderContainer(
+      overrides: [
+        profilesProvider.overrideWithValue([
+          const Profile(id: 1, autoUpdateDuration: Duration.zero),
+        ]),
+        suspendProvider.overrideWithValue(false),
+      ],
+    );
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container.read(runTimeProvider.notifier).value = 99 * 60 * 60 * 1000;
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(child: StartButton()),
+      ),
+    );
+    await tester.pump();
+
+    final button = find.byType(FloatingActionButton);
+    expect(tester.getSize(button).height, 56);
+    final twoDigitWidth = tester.getSize(button).width;
+
+    container.read(runTimeProvider.notifier).value = 100 * 60 * 60 * 1000;
+    await tester.pump();
+    expect(tester.getSize(button).width, twoDigitWidth);
+
+    await tester.pump(const Duration(milliseconds: 100));
+    final animatedWidth = tester.getSize(button).width;
+    expect(animatedWidth, greaterThan(twoDigitWidth));
+
+    await tester.pumpAndSettle();
+    expect(tester.getSize(button).width, greaterThan(animatedWidth));
+  });
+
+  testWidgets('StartButton resets its text after the close animation', (
+    tester,
+  ) async {
+    final container = ProviderContainer(
+      overrides: [
+        profilesProvider.overrideWithValue([
+          const Profile(id: 1, autoUpdateDuration: Duration.zero),
+        ]),
+        suspendProvider.overrideWithValue(false),
+      ],
+    );
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container.read(runTimeProvider.notifier).value = const Duration(
+      hours: 100,
+      minutes: 2,
+      seconds: 3,
+    ).inMilliseconds;
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(child: StartButton()),
+      ),
+    );
+    await tester.pump();
+
+    final button = find.byType(FloatingActionButton);
+    String runTimeText() {
+      final text = tester.widget<Text>(
+        find.descendant(
+          of: find.byType(RunTimeText),
+          matching: find.byType(Text),
+        ),
+      );
+      return text.data ?? text.textSpan!.toPlainText();
+    }
+
+    final expandedTextWidth = tester
+        .widget<AnimatedContainer>(find.byType(AnimatedContainer))
+        .constraints
+        ?.maxWidth;
+    final expandedButtonWidth = tester.getSize(button).width;
+    expect(runTimeText(), '100:02:03');
+
+    container.read(runTimeProvider.notifier).value = null;
+    await tester.pump();
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 100));
+
+    expect(tester.getSize(button).width, greaterThan(expandedButtonWidth));
+    expect(
+      tester
+          .widget<AnimatedContainer>(find.byType(AnimatedContainer))
+          .constraints
+          ?.maxWidth,
+      expandedTextWidth,
+    );
+    expect(runTimeText(), '100:02:03');
+
+    await tester.pump(const Duration(milliseconds: 100));
+
+    expect(tester.getSize(button).width, 56);
+    expect(runTimeText(), '100:02:03');
+
+    await tester.pumpAndSettle();
+
+    expect(tester.getSize(button).width, 56);
+    expect(runTimeText(), '00:00:00');
+  });
+
+  testWidgets('dispatches each toggle through the shared running state', (
+    tester,
+  ) async {
+    final container = ProviderContainer(
+      overrides: [
+        initProvider.overrideWithBuild((_, _) => true),
+        profilesProvider.overrideWithValue([
+          const Profile(id: 1, autoUpdateDuration: Duration.zero),
+        ]),
+        setupActionProvider.overrideWith(_RecordingSetupAction.new),
+      ],
+    );
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container.read(runTimeProvider.notifier).value = 1;
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(child: StartButton()),
+      ),
+    );
+
+    final action =
+        container.read(setupActionProvider.notifier) as _RecordingSetupAction;
+    final button = find.byType(FloatingActionButton);
+
+    await tester.tap(button);
+    expect(action.requests, [false]);
+    expect(container.read(isStartProvider), isFalse);
+
+    await tester.tap(button);
+    expect(action.requests, [false, true]);
+    expect(container.read(isStartProvider), isTrue);
+  });
+}
+
+class _RecordingSetupAction extends SetupAction {
+  final requests = <bool>[];
+
+  @override
+  Future<void> setRunning(bool running, {bool initialize = false}) {
+    requests.add(running);
+    ref.read(runTimeProvider.notifier).value = running ? 1 : null;
+    return Future.value();
+  }
+}
+
+class _TestApp extends StatelessWidget {
+  final Widget child;
+
+  const _TestApp({required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      localizationsDelegates: const [
+        AppLocalizations.delegate,
+        GlobalMaterialLocalizations.delegate,
+        GlobalCupertinoLocalizations.delegate,
+        GlobalWidgetsLocalizations.delegate,
+      ],
+      supportedLocales: AppLocalizations.delegate.supportedLocales,
+      builder: (context, child) {
+        globalState.measure = Measure.of(context, 1);
+        return child!;
+      },
+      home: Scaffold(floatingActionButton: child),
+    );
+  }
+}
diff --git a/test/widgets/super_grid_test.dart b/test/widgets/super_grid_test.dart
new file mode 100644
index 0000000000..db30549a73
--- /dev/null
+++ b/test/widgets/super_grid_test.dart
@@ -0,0 +1,152 @@
+import 'package:fl_clash/widgets/grid.dart';
+import 'package:fl_clash/widgets/super_grid.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+GridItem _item(String label, {int crossAxisCellCount = 2}) {
+  return GridItem(
+    crossAxisCellCount: crossAxisCellCount,
+    mainAxisCellCount: 1,
+    child: SizedBox(
+      key: ValueKey(label),
+      height: 100,
+      child: ColoredBox(
+        color: Colors.blue,
+        child: Center(child: Text(label)),
+      ),
+    ),
+  );
+}
+
+void main() {
+  testWidgets('SuperGrid adds and deletes items while reporting updates', (
+    tester,
+  ) async {
+    final key = GlobalKey<SuperGridState>();
+    var updates = 0;
+
+    await tester.pumpWidget(
+      MaterialApp(
+        home: Scaffold(
+          body: SingleChildScrollView(
+            child: SuperGrid(
+              key: key,
+              crossAxisCount: 4,
+              crossAxisSpacing: 8,
+              mainAxisSpacing: 8,
+              onUpdate: () => updates++,
+              children: [_item('A'), _item('B'), _item('C')],
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pump();
+
+    expect(key.currentState!.length, 3);
+    expect(find.byIcon(Icons.close), findsNWidgets(3));
+
+    key.currentState!.handleAdd(_item('D', crossAxisCellCount: 4));
+    await tester.pump();
+    expect(key.currentState!.length, 4);
+    expect(find.byKey(const ValueKey('D')), findsOneWidget);
+
+    final deleteButton = tester.widget<IconButton>(
+      find.ancestor(
+        of: find.byIcon(Icons.close).at(1),
+        matching: find.byType(IconButton),
+      ),
+    );
+    deleteButton.onPressed!();
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 301));
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 421));
+    await tester.pump();
+    expect(key.currentState!.length, 3);
+    expect(find.byKey(const ValueKey('B')), findsNothing);
+    expect(updates, greaterThanOrEqualTo(2));
+    expect(tester.takeException(), null);
+  });
+
+  testWidgets('SuperGrid handles a desktop drag and keeps items mounted', (
+    tester,
+  ) async {
+    final key = GlobalKey<SuperGridState>();
+
+    await tester.pumpWidget(
+      MaterialApp(
+        home: Scaffold(
+          body: SingleChildScrollView(
+            child: SuperGrid(
+              key: key,
+              crossAxisCount: 4,
+              crossAxisSpacing: 8,
+              mainAxisSpacing: 8,
+              children: [_item('A'), _item('B'), _item('C'), _item('D')],
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pump();
+
+    final gesture = await tester.startGesture(
+      tester.getCenter(find.byKey(const ValueKey('A'))),
+    );
+    await tester.pump();
+    await gesture.moveBy(const Offset(10, 0));
+    await tester.pump();
+    await gesture.moveTo(tester.getCenter(find.byKey(const ValueKey('D'))));
+    await tester.pump(const Duration(milliseconds: 300));
+    await gesture.up();
+    await tester.pump(const Duration(seconds: 2));
+
+    expect(key.currentState!.length, 4);
+    for (final label in ['A', 'B', 'C', 'D']) {
+      expect(find.byKey(ValueKey(label)), findsOneWidget);
+    }
+    expect(tester.takeException(), null);
+  });
+
+  testWidgets('SuperGrid completes a pending drop when disposed', (
+    tester,
+  ) async {
+    final key = GlobalKey<SuperGridState>();
+
+    await tester.pumpWidget(
+      MaterialApp(
+        home: Scaffold(
+          body: SingleChildScrollView(
+            child: SuperGrid(
+              key: key,
+              crossAxisCount: 4,
+              crossAxisSpacing: 8,
+              mainAxisSpacing: 8,
+              children: [_item('A'), _item('B'), _item('C'), _item('D')],
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pump();
+
+    final gesture = await tester.startGesture(
+      tester.getCenter(find.byKey(const ValueKey('A'))),
+    );
+    await tester.pump();
+    await gesture.moveBy(const Offset(10, 0));
+    await tester.pump();
+    await gesture.moveTo(tester.getCenter(find.byKey(const ValueKey('D'))));
+    await tester.pump(const Duration(milliseconds: 300));
+    await gesture.up();
+    await tester.pump();
+
+    final transformCompleted = key.currentState!.isTransformCompleter;
+    await tester.pumpWidget(const MaterialApp(home: SizedBox.shrink()));
+
+    expect(await transformCompleted, isFalse);
+    await tester.pump(const Duration(seconds: 2));
+    expect(tester.takeException(), null);
+  });
+}
diff --git a/test/widgets/tab_test.dart b/test/widgets/tab_test.dart
new file mode 100644
index 0000000000..d6c87ad46f
--- /dev/null
+++ b/test/widgets/tab_test.dart
@@ -0,0 +1,173 @@
+import 'package:fl_clash/widgets/tab.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets(
+    'CommonTabBar selects enabled segments and ignores disabled ones',
+    (tester) async {
+      var selected = 0;
+      late StateSetter setState;
+
+      await tester.pumpWidget(
+        MaterialApp(
+          home: Scaffold(
+            body: Center(
+              child: StatefulBuilder(
+                builder: (context, setter) {
+                  setState = setter;
+                  return CommonTabBar<int>(
+                    groupValue: selected,
+                    disabledChildren: const {2},
+                    thumbColor: Colors.blue,
+                    backgroundColor: Colors.grey,
+                    children: const {
+                      0: Text('One'),
+                      1: Text('Two'),
+                      2: Text('Three'),
+                    },
+                    onValueChanged: (value) {
+                      setState(() => selected = value!);
+                    },
+                  );
+                },
+              ),
+            ),
+          ),
+        ),
+      );
+
+      expect(selected, 0);
+      await tester.tap(find.text('Two').first);
+      await tester.pump(const Duration(milliseconds: 500));
+      expect(selected, 1);
+
+      await tester.tap(find.text('Three').first);
+      await tester.pump();
+      expect(selected, 1);
+
+      setState(() => selected = 0);
+      await tester.pump();
+      expect(tester.takeException(), null);
+    },
+  );
+
+  testWidgets('CommonTabBar commits the pressed segment after a drag', (
+    tester,
+  ) async {
+    var selected = 1;
+
+    await tester.pumpWidget(
+      MaterialApp(
+        home: Scaffold(
+          body: Center(
+            child: StatefulBuilder(
+              builder: (context, setState) {
+                return CommonTabBar<int>(
+                  groupValue: selected,
+                  thumbColor: Colors.red,
+                  children: const {
+                    0: Text('First'),
+                    1: Text('Selected'),
+                    2: Text('Last'),
+                  },
+                  onValueChanged: (value) {
+                    setState(() => selected = value!);
+                  },
+                );
+              },
+            ),
+          ),
+        ),
+      ),
+    );
+
+    final gesture = await tester.startGesture(
+      tester.getCenter(
+        find
+            .ancestor(
+              of: find.text('First').first,
+              matching: find.byKey(const ValueKey<int>(0)),
+            )
+            .first,
+      ),
+    );
+    await tester.pump();
+    await gesture.moveBy(const Offset(10, 0));
+    await tester.pump();
+    await gesture.moveTo(
+      tester.getCenter(
+        find
+            .ancestor(
+              of: find.text('Last').first,
+              matching: find.byKey(const ValueKey<int>(2)),
+            )
+            .first,
+      ),
+    );
+    await tester.pump();
+    await gesture.up();
+    await tester.pump(const Duration(milliseconds: 500));
+
+    expect(selected, 0);
+    expect(tester.takeException(), null);
+  });
+
+  testWidgets('CommonTabBar lays out proportional RTL segments and updates', (
+    tester,
+  ) async {
+    var selected = 0;
+    var proportional = true;
+    var color = Colors.green;
+    late StateSetter setState;
+
+    await tester.pumpWidget(
+      MaterialApp(
+        home: Directionality(
+          textDirection: TextDirection.rtl,
+          child: Scaffold(
+            body: Center(
+              child: IntrinsicWidth(
+                child: IntrinsicHeight(
+                  child: StatefulBuilder(
+                    builder: (context, setter) {
+                      setState = setter;
+                      return CommonTabBar<int>(
+                        groupValue: selected,
+                        proportionalWidth: proportional,
+                        thumbColor: color,
+                        children: const {
+                          0: Text('Short'),
+                          1: Text('A much longer segment'),
+                          2: Text('End'),
+                        },
+                        onValueChanged: (value) {
+                          setState(() => selected = value!);
+                        },
+                      );
+                    },
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+
+    expect(
+      tester.getSize(find.byType(CommonTabBar<int>)).height,
+      greaterThan(0),
+    );
+    await tester.tap(find.text('End').first);
+    await tester.pump(const Duration(milliseconds: 500));
+    expect(selected, 2);
+
+    setState(() {
+      proportional = false;
+      color = Colors.purple;
+    });
+    await tester.pump();
+    expect(tester.takeException(), null);
+  });
+}
diff --git a/test/widgets/views_smoke_test.dart b/test/widgets/views_smoke_test.dart
new file mode 100644
index 0000000000..483dd2427d
--- /dev/null
+++ b/test/widgets/views_smoke_test.dart
@@ -0,0 +1,532 @@
+import 'package:fl_clash/common/common.dart';
+import 'package:fl_clash/common/theme.dart';
+import 'package:fl_clash/enum/enum.dart';
+import 'package:fl_clash/l10n/l10n.dart';
+import 'package:fl_clash/models/models.dart';
+import 'package:fl_clash/providers/app.dart';
+import 'package:fl_clash/providers/config.dart';
+import 'package:fl_clash/providers/database.dart';
+import 'package:fl_clash/providers/state.dart';
+import 'package:fl_clash/state.dart';
+import 'package:fl_clash/views/config/advanced.dart';
+import 'package:fl_clash/views/config/dns.dart';
+import 'package:fl_clash/views/config/general.dart';
+import 'package:fl_clash/views/config/network.dart';
+import 'package:fl_clash/views/config/on_demand.dart';
+import 'package:fl_clash/views/hotkey.dart';
+import 'package:fl_clash/views/profiles/overwrite/custom/groups.dart';
+import 'package:fl_clash/views/profiles/overwrite/custom/proxies.dart';
+import 'package:fl_clash/views/profiles/overwrite/custom/proxy_providers.dart';
+import 'package:fl_clash/views/profiles/overwrite/custom/rules.dart';
+import 'package:fl_clash/views/proxies/list.dart';
+import 'package:fl_clash/views/proxies/tab.dart';
+import 'package:fl_clash/views/theme.dart';
+import 'package:fl_clash/views/views.dart';
+import 'package:fl_clash/widgets/inherited.dart';
+import 'package:fl_clash/widgets/sheet.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:smooth_sheets/smooth_sheets.dart';
+
+void main() {
+  final cases = <String, Widget>{
+    'dashboard': const DashboardView(),
+    'proxies': const ProxiesView(),
+    'profiles': const ProfilesView(),
+    'requests': const RequestsView(),
+    'resources': const ResourcesView(),
+    'logs': const LogsView(),
+    'tools': const ToolsView(),
+    'basic config': const ConfigView(),
+    'dns config': const Scaffold(body: DnsListView()),
+    'network config': const Scaffold(body: NetworkListView()),
+    'advanced config': const AdvancedConfigView(),
+    'on demand config': const OnDemandView(),
+    'theme': const ThemeView(),
+    'application settings': const ApplicationSettingView(),
+    'backup and restore': const BackupAndRestore(),
+    'hotkeys': const HotKeyView(),
+    'access control': const AccessView(),
+  };
+
+  for (final entry in cases.entries) {
+    testWidgets('${entry.key} renders its default state', (tester) async {
+      tester.view.physicalSize = const Size(1400, 1000);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.resetPhysicalSize);
+      addTearDown(tester.view.resetDevicePixelRatio);
+
+      final container = ProviderContainer(
+        overrides: [profilesProvider.overrideWith(_TestProfiles.new)],
+      );
+      addTearDown(container.dispose);
+      globalState.container = container;
+
+      await tester.pumpWidget(
+        UncontrolledProviderScope(
+          container: container,
+          child: _TestApp(child: entry.value),
+        ),
+      );
+      await tester.pump();
+      if (entry.key == 'access control') {
+        await tester.pump(const Duration(milliseconds: 301));
+      }
+      final scrollables = find.byType(Scrollable);
+      if (scrollables.evaluate().isNotEmpty) {
+        for (var index = 0; index < 8; index++) {
+          await tester.drag(scrollables.first, const Offset(0, -700));
+          await tester.pump();
+        }
+      }
+
+      expect(find.byWidget(entry.value), findsOneWidget);
+      expect(tester.takeException(), null);
+
+      await tester.pumpWidget(const SizedBox.shrink());
+    });
+  }
+
+  final toolDestinations = <String, Type>{
+    'Theme': ThemeView,
+    'Backup and Restore': BackupAndRestore,
+    'Basic configuration': ConfigView,
+    'Advanced configuration': AdvancedConfigView,
+    'Application': ApplicationSettingView,
+  };
+
+  for (final entry in toolDestinations.entries) {
+    testWidgets('tools opens ${entry.key}', (tester) async {
+      tester.view.physicalSize = const Size(1400, 1000);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.resetPhysicalSize);
+      addTearDown(tester.view.resetDevicePixelRatio);
+
+      final container = ProviderContainer(
+        overrides: [profilesProvider.overrideWith(_TestProfiles.new)],
+      );
+      addTearDown(container.dispose);
+      globalState.container = container;
+      container
+          .read(viewSizeProvider.notifier)
+          .update((_) => const Size(1400, 1000));
+
+      await tester.pumpWidget(
+        UncontrolledProviderScope(
+          container: container,
+          child: const _TestApp(child: ToolsView()),
+        ),
+      );
+      await tester.pump();
+
+      final target = find.text(entry.key);
+      await tester.scrollUntilVisible(
+        target,
+        500,
+        scrollable: find.byType(Scrollable).first,
+      );
+      await tester.tap(target);
+      await tester.pumpAndSettle();
+
+      expect(find.byType(entry.value), findsOneWidget);
+      expect(tester.takeException(), null);
+    });
+  }
+
+  testWidgets('user agent dialog applies a preset', (tester) async {
+    tester.view.physicalSize = const Size(1000, 800);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.resetPhysicalSize);
+    addTearDown(tester.view.resetDevicePixelRatio);
+
+    final container = ProviderContainer(
+      overrides: [profilesProvider.overrideWith(_TestProfiles.new)],
+    );
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container
+        .read(viewSizeProvider.notifier)
+        .update((_) => const Size(1000, 800));
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: _TestApp(
+          child: Scaffold(body: ListView(children: const [UaItem()])),
+        ),
+      ),
+    );
+    await tester.pump();
+
+    await tester.tap(find.text('User-Agent'));
+    await tester.pumpAndSettle();
+    expect(find.text('clash-verge/v2.4.2'), findsOneWidget);
+
+    await tester.tap(find.text('clash-verge/v2.4.2'));
+    await tester.pumpAndSettle();
+
+    expect(
+      container.read(patchClashConfigProvider).globalUa,
+      'clash-verge/v2.4.2',
+    );
+    expect(tester.takeException(), null);
+  });
+
+  testWidgets('DNS mode options update the patch configuration', (
+    tester,
+  ) async {
+    tester.view.physicalSize = const Size(1000, 800);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.resetPhysicalSize);
+    addTearDown(tester.view.resetDevicePixelRatio);
+
+    final container = ProviderContainer(
+      overrides: [profilesProvider.overrideWith(_TestProfiles.new)],
+    );
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container
+        .read(viewSizeProvider.notifier)
+        .update((_) => const Size(1000, 800));
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(child: Scaffold(body: DnsModeItem())),
+      ),
+    );
+    await tester.pump();
+
+    await tester.tap(find.text('DNS mode'));
+    await tester.pumpAndSettle();
+    expect(find.text('fakeIp'), findsWidgets);
+
+    await tester.tap(find.text('fakeIp').last);
+    await tester.pumpAndSettle();
+
+    expect(
+      container.read(patchClashConfigProvider).dns.enhancedMode,
+      DnsMode.fakeIp,
+    );
+
+    final previousOverride = container.read(overrideDnsProvider);
+    final previousDns = container.read(patchClashConfigProvider).dns;
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(
+          child: Scaffold(
+            body: Column(
+              children: [
+                OverrideItem(),
+                StatusItem(),
+                PreferH3Item(),
+                IPv6Item(),
+              ],
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pump();
+    await tester.tap(find.text('Override Dns'));
+    await tester.pump();
+    await tester.tap(find.text('Status'));
+    await tester.pump();
+    await tester.tap(find.text('PreferH3'));
+    await tester.pump();
+    await tester.tap(find.text('IPv6'));
+    await tester.pump();
+
+    expect(container.read(overrideDnsProvider), !previousOverride);
+    expect(
+      container.read(patchClashConfigProvider).dns.enable,
+      !previousDns.enable,
+    );
+    expect(
+      container.read(patchClashConfigProvider).dns.preferH3,
+      !previousDns.preferH3,
+    );
+    expect(
+      container.read(patchClashConfigProvider).dns.ipv6,
+      !previousDns.ipv6,
+    );
+    expect(tester.takeException(), null);
+  });
+
+  testWidgets('proxies renders populated tab and list layouts', (tester) async {
+    tester.view.physicalSize = const Size(1400, 1000);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.resetPhysicalSize);
+    addTearDown(tester.view.resetDevicePixelRatio);
+
+    final profile = Profile.normal().copyWith(
+      currentGroupName: 'Selector',
+      selectedMap: {'Selector': 'Proxy 1'},
+      unfoldSet: {'Selector'},
+    );
+    final proxies = List.generate(
+      24,
+      (index) => Proxy(name: 'Proxy $index', type: 'Direct'),
+    );
+    final group = Group(
+      name: 'Selector',
+      type: GroupType.Selector,
+      hidden: false,
+      now: 'Proxy 1',
+      all: proxies,
+    );
+    final container = ProviderContainer(
+      overrides: [
+        profilesProvider.overrideWith(() => _TestProfiles([profile])),
+        currentProfileIdProvider.overrideWithBuild((_, _) => profile.id),
+        currentGroupsStateProvider.overrideWithValue(
+          GroupsState(value: [group]),
+        ),
+        groupsProvider.overrideWithValue([group]),
+      ],
+    );
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container
+        .read(viewSizeProvider.notifier)
+        .update((_) => const Size(1400, 1000));
+
+    await tester.pumpWidget(
+      UncontrolledProviderScope(
+        container: container,
+        child: const _TestApp(child: ProxiesView()),
+      ),
+    );
+    await tester.pump();
+
+    expect(container.read(proxiesTabStateProvider).groups, [group]);
+    expect(find.byType(ProxiesTabView), findsOneWidget);
+    expect(find.byType(ProxyGroupView), findsOneWidget);
+
+    container
+        .read(proxiesStyleSettingProvider.notifier)
+        .update((state) => state.copyWith(type: ProxiesType.list));
+    await tester.pump();
+    expect(find.byType(ProxiesListView), findsOneWidget);
+
+    final scrollables = find.byType(Scrollable);
+    for (var index = 0; index < 8; index++) {
+      await tester.drag(
+        scrollables.last,
+        const Offset(0, -700),
+        warnIfMissed: false,
+      );
+      await tester.pump();
+    }
+    expect(tester.takeException(), null);
+  });
+
+  testWidgets('custom overwrite editors render populated data', (tester) async {
+    tester.view.physicalSize = const Size(1400, 1000);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.resetPhysicalSize);
+    addTearDown(tester.view.resetDevicePixelRatio);
+
+    final profile = Profile.normal().copyWith(
+      overwriteType: OverwriteType.custom,
+    );
+    final proxyGroups = List.generate(
+      8,
+      (index) => ProxyGroup(
+        id: 100 + index,
+        profileId: profile.id,
+        name: 'Group $index',
+        type: GroupType.Selector,
+        proxies: const ['DIRECT'],
+      ),
+    );
+    final rules = List.generate(
+      12,
+      (index) => Rule(
+        id: 200 + index,
+        content: 'example$index.com',
+        ruleTarget: 'DIRECT',
+        order: index.toString(),
+      ),
+    );
+    final container = ProviderContainer(
+      overrides: [
+        profilesProvider.overrideWith(() => _TestProfiles([profile])),
+        currentProfileIdProvider.overrideWithBuild((_, _) => profile.id),
+        profileCustomRulesProvider.overrideWith2(
+          (_) => _TestProfileCustomRules(rules),
+        ),
+        proxyGroupsProvider.overrideWith2((_) => _TestProxyGroups(proxyGroups)),
+        proxyGroupProvider.overrideWithBuild((_, _) => proxyGroups.first),
+        clashConfigProvider(profile.id).overrideWithValue(
+          const AsyncData(
+            ClashConfig(
+              proxies: [Proxy(name: 'DIRECT', type: 'Direct')],
+              proxyProviders: ['provider'],
+            ),
+          ),
+        ),
+        customOverwriteDateProvider(profile.id).overrideWithValue(
+          CustomOverwriteDate(
+            proxies: const [Proxy(name: 'DIRECT', type: 'Direct')],
+            proxyGroups: proxyGroups,
+            proxyProviders: const {'provider'},
+            ruleTargets: {
+              ...RuleTarget.baseTargets,
+              ...proxyGroups.map((group) => group.name),
+            },
+          ),
+        ),
+      ],
+    );
+    addTearDown(container.dispose);
+    globalState.container = container;
+    container
+        .read(viewSizeProvider.notifier)
+        .update((_) => const Size(1400, 1000));
+
+    final views = <Widget>[
+      CustomRulesView(profile.id),
+      CustomProxyGroupsView(profile.id),
+      SheetProvider(
+        type: SheetType.page,
+        child: ProfileIdProvider(
+          profileId: profile.id,
+          child: const EditProxiesView(),
+        ),
+      ),
+      SheetProvider(
+        type: SheetType.page,
+        child: ProfileIdProvider(
+          profileId: profile.id,
+          child: const EditProxyProvidersView(),
+        ),
+      ),
+    ];
+
+    for (final view in views) {
+      await tester.pumpWidget(
+        UncontrolledProviderScope(
+          container: container,
+          child: _TestApp(child: view),
+        ),
+      );
+      await tester.pump();
+      expect(find.byWidget(view), findsOneWidget);
+      expect(tester.takeException(), null);
+
+      if (view is CustomRulesView) {
+        final list = tester.widget<ReorderableListView>(
+          find.byType(ReorderableListView),
+        );
+        list.onReorderItem!(0, 1);
+        await tester.pump();
+
+        await tester.tap(find.byType(Checkbox).first);
+        await tester.pump();
+        expect(find.text('Select all'), findsOneWidget);
+        await tester.tap(find.text('Select all'));
+        await tester.pump();
+        await tester.tap(find.text('Select all'));
+        await tester.pump();
+        expect(find.text('Add'), findsOneWidget);
+
+        container
+            .read(viewSizeProvider.notifier)
+            .update((_) => const Size(500, 1000));
+        await tester.tap(find.text('Add'));
+        await tester.pumpAndSettle();
+        expect(find.byType(SheetViewport), findsOneWidget);
+        globalState.navigatorKey.currentState!.pop();
+        await tester.pumpAndSettle();
+        container
+            .read(viewSizeProvider.notifier)
+            .update((_) => const Size(1400, 1000));
+      }
+
+      if (view is CustomProxyGroupsView) {
+        final list = tester.widget<ReorderableListView>(
+          find.byType(ReorderableListView),
+        );
+        list.onReorderItem!(0, 1);
+        await tester.pump();
+
+        container
+            .read(viewSizeProvider.notifier)
+            .update((_) => const Size(500, 1000));
+        await tester.tap(find.text('Add'));
+        await tester.pumpAndSettle();
+        expect(find.byType(SheetViewport), findsOneWidget);
+        globalState.navigatorKey.currentState!.pop();
+        await tester.pumpAndSettle();
+        container
+            .read(viewSizeProvider.notifier)
+            .update((_) => const Size(1400, 1000));
+      }
+    }
+
+    await tester.pumpWidget(const SizedBox.shrink());
+  });
+}
+
+class _TestProfiles extends Profiles {
+  final List<Profile> initial;
+
+  _TestProfiles([this.initial = const []]);
+
+  @override
+  List<Profile> build() => initial;
+}
+
+class _TestProfileCustomRules extends ProfileCustomRules {
+  final List<Rule> initial;
+
+  _TestProfileCustomRules(this.initial);
+
+  @override
+  Stream<List<Rule>> build(int profileId) => Stream.value(initial);
+
+  @override
+  void order(int oldIndex, int newIndex) {}
+}
+
+class _TestProxyGroups extends ProxyGroups {
+  final List<ProxyGroup> initial;
+
+  _TestProxyGroups(this.initial);
+
+  @override
+  Stream<List<ProxyGroup>> build(int profileId) => Stream.value(initial);
+
+  @override
+  void order(int oldIndex, int newIndex) {}
+}
+
+class _TestApp extends StatelessWidget {
+  final Widget child;
+
+  const _TestApp({required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      navigatorKey: globalState.navigatorKey,
+      localizationsDelegates: const [
+        AppLocalizations.delegate,
+        GlobalMaterialLocalizations.delegate,
+        GlobalCupertinoLocalizations.delegate,
+        GlobalWidgetsLocalizations.delegate,
+      ],
+      supportedLocales: AppLocalizations.delegate.supportedLocales,
+      builder: (context, child) {
+        globalState.measure = Measure.of(context, 1);
+        globalState.theme = CommonTheme.of(context, 1);
+        return child!;
+      },
+      home: child,
+    );
+  }
+}
diff --git a/windows/flutter/generated_plugin_registrant.cc b/windows/flutter/generated_plugin_registrant.cc
index d76c7492c1..75d193b1cc 100644
--- a/windows/flutter/generated_plugin_registrant.cc
+++ b/windows/flutter/generated_plugin_registrant.cc
@@ -14,7 +14,6 @@
 #include <hotkey_manager_windows/hotkey_manager_windows_plugin_c_api.h>
 #include <proxy/proxy_plugin_c_api.h>
 #include <screen_retriever_windows/screen_retriever_windows_plugin_c_api.h>
-#include <sqlite3_flutter_libs/sqlite3_flutter_libs_plugin.h>
 #include <tray_manager/tray_manager_plugin.h>
 #include <url_launcher_windows/url_launcher_windows.h>
 #include <wifi_ssid/wifi_ssid_plugin_c_api.h>
@@ -38,8 +37,6 @@ void RegisterPlugins(flutter::PluginRegistry* registry) {
       registry->GetRegistrarForPlugin("ProxyPluginCApi"));
   ScreenRetrieverWindowsPluginCApiRegisterWithRegistrar(
       registry->GetRegistrarForPlugin("ScreenRetrieverWindowsPluginCApi"));
-  Sqlite3FlutterLibsPluginRegisterWithRegistrar(
-      registry->GetRegistrarForPlugin("Sqlite3FlutterLibsPlugin"));
   TrayManagerPluginRegisterWithRegistrar(
       registry->GetRegistrarForPlugin("TrayManagerPlugin"));
   UrlLauncherWindowsRegisterWithRegistrar(
diff --git a/windows/flutter/generated_plugins.cmake b/windows/flutter/generated_plugins.cmake
index 3cfe7ec405..80d6198e77 100644
--- a/windows/flutter/generated_plugins.cmake
+++ b/windows/flutter/generated_plugins.cmake
@@ -11,7 +11,6 @@ list(APPEND FLUTTER_PLUGIN_LIST
   hotkey_manager_windows
   proxy
   screen_retriever_windows
-  sqlite3_flutter_libs
   tray_manager
   url_launcher_windows
   wifi_ssid
diff --git a/windows/packaging/exe/inno_setup.iss b/windows/packaging/exe/inno_setup.iss
index bbd56d04a0..8740ae00c7 100644
--- a/windows/packaging/exe/inno_setup.iss
+++ b/windows/packaging/exe/inno_setup.iss
@@ -33,8 +33,28 @@ begin
   end;
 end;
 
-function InitializeSetup(): Boolean;
+procedure UnregisterHelperService;
+var
+  HelperPath: String;
+  ResultCode: Integer;
+begin
+  HelperPath := ExpandConstant('{app}\\FlClashHelperService.exe');
+  if FileExists(HelperPath) then
+  begin
+    Exec(HelperPath, 'uninstall', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+  end;
+end;
+
+function PrepareToInstall(var NeedsRestart: Boolean): String;
+begin
+  UnregisterHelperService;
+  KillProcesses;
+  Result := '';
+end;
+
+function InitializeUninstall(): Boolean;
 begin
+  UnregisterHelperService;
   KillProcesses;
   Result := True;
 end;
@@ -80,4 +100,4 @@ Source: "{{SOURCE_DIR}}\\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdi
 Name: "{autoprograms}\\{{DISPLAY_NAME}}"; Filename: "{app}\\{{EXECUTABLE_NAME}}"
 Name: "{autodesktop}\\{{DISPLAY_NAME}}"; Filename: "{app}\\{{EXECUTABLE_NAME}}"; Tasks: desktopicon
 [Run]
-Filename: "{app}\\{{EXECUTABLE_NAME}}"; Description: "{cm:LaunchProgram,{{DISPLAY_NAME}}}"; Flags: {% if PRIVILEGES_REQUIRED == 'admin' %}runascurrentuser{% endif %} nowait postinstall skipifsilent
\ No newline at end of file
+Filename: "{app}\\{{EXECUTABLE_NAME}}"; Description: "{cm:LaunchProgram,{{DISPLAY_NAME}}}"; Flags: {% if PRIVILEGES_REQUIRED == 'admin' %}runascurrentuser{% endif %} nowait postinstall skipifsilent