m-ui v0.2.0

Highlights of v0.2.0

m-ui v0.2.0 is a major milestone release that completely transforms the visual identity, tactile feedback, and frontend architecture of m-ui. We have retired legacy Ant Design dependencies and introduced a full-fledged Apple SwiftUI & Liquid Glass design system powered by physical spring animations, SVG optical displacement refraction, tactile fluid switches, and refined ergonomics.

---

What's New & Key Improvements

1. Liquid Glass & SwiftUI Design System

• Total Ant Design Purge: Completely removed legacy ant-select.js and ant-theme.css, eliminating third-party UI overhead and reducing bundle size.
• Physical Optical Simulation (liquid-optics.js & liquid-optics.css):
  • Implemented dynamic normal-mapping distance fields and live SVG backdrop displacement filters simulating real optical refraction (Index of Refraction: 1.46).
  • Dynamic specular rim lighting that tracks cursor movement and pointer coordinates across navigation bars, floating menus, and active lenses.
  • Quiet, high-contrast card backdrops preserving optimal text legibility against custom vector ambient wallpapers (glass-wallpaper.svg).
  • Graceful accessibility fallbacks honoring prefers-reduced-motion and prefers-contrast.

2. Tactile Liquid Toggles & Draggable Segmented Tabs

• Modular Fluid Switches (liquid-toggle.js & liquid-toggle.css):
  • Re-engineered switches across Login, Panel Settings, dynamic Inbound/Client tables, and public subscription pages with tactile spring physics, elastic squeeze on press, and fluid thumb transitions.
• Jello-Elastic Draggable Segmented Tabs:
  • Introduced .liquid-pill-slider with Spring physics and drag tracking. The pill slider stretches and squashes (stretch/squash algorithm) elastically along the drag direction and snaps securely to the nearest option on release.
  • Added horizontal touch swipe gestures for navigating panel views on mobile devices.

3. Brand Identity & Asset Upgrades

• High-Resolution Vector / PNG Assets: Integrated the new official m-ui_logo.png and m-ui_logo_square.png into the sidebar, login screen, and browser icons.
• Optimized Media Delivery: Strengthened asset serving in the Go backend (internal/app/main.go) with caching headers, correct MIME types, and automated unit testing (TestMediaLogoServing).

4. Critical UI & Interaction Fixes

• Panel Settings Blank Container Fix: Removed duplicate card wrappers and bottom margins on .settings-pane, eliminating the unwanted empty space at the bottom of settings forms.
• Capsule Slider Centering: Corrected coordinate calculation by accounting for parent border widths (borderLeftWidth / borderTopWidth), ensuring pixel-perfect vertical and horizontal centering.
• Sidebar Collapse Button Distortion Fix: Fixed an issue where collapsing the sidebar distorted the toggle button into an oval; it now maintains a circular 38×38px geometry with centered chevron symbols.
• Inbounds Auto-Refresh Menu Visibility: Removed overflow: hidden on .inbounds-refresh, fixing a bug where the auto-refresh frequency dropdown menu was clipped and invisible.
• Native Tab Event Restoration: Ensured native button clicks and keyboard navigation (Arrow keys, Home/End) remain fully responsive.
• Fixed language translation issues: Previously, some text in certain windows would revert to Chinese after the panel restarted, even if a different interface language was selected. A translation function that activates upon opening the window has been added to ensure no untranslated text remains.

5. Architecture, Security & Test Coverage

• Public Subscription Endpoint Isolation: Embedded dedicated switch assets (liquid-toggle.css / liquid-toggle.js) for public subscription pages while strictly isolating internal panel endpoints (subscription.go & TestSubscriptionToggleAssetsOnBothListeners).
• Headless Test Suite: Added visual & functional browser fixtures (tests/liquid-optics.html, tests/liquid-toggle.html, tests/dynamic-modal-i18n.cjs) and architectural documentation (LIQUID-GLASS.md).
• All Go unit tests passed cleanly across Windows and Linux targets.

---

Detailed Changelog

• 5d78e09 feat(ui): add liquid optics, liquid toggle components, and update UI for v0.2.0
• b85ffbe fix(ui): fix inbounds-refresh overflow clipping auto-refresh-menu popup
• 0c05180 test: add TestMediaLogoServing unit test
• c5ff897 feat(ui): update sidebar and login logo to m-ui_logo.png
• 729cb0a fix(ui): fix tab capsule slider dragging not following mouse
• 6e52000 fix(ui): fix sidebar collapse button oval distortion and centering
• 0bcfbe0 fix(ui): fix settings bottom block, center capsule slider, and refine liquid glass aesthetics
• cc655a2 fix(ui): unify panel settings with mihomo grouped forms, restore native tab clicking, and remove progress bar scrollbar
• 689ba76 feat(ui): add draggable liquid glass slider, fix square corners, and enhance login glass
• 4aae1e7 feat(ui): complete SwiftUI & Liquid Glass redesign and purge Ant Design relics

---

v0.2.0 版本要点

m-ui v0.2.0 是一个具有里程碑意义的重大重构版本。本次更新对前端架构、视觉设计与触觉交互进行了全面升级：彻底剔除了历史遗留的 Ant Design 依赖，全面上线基于 Apple SwiftUI 规范与 Liquid Glass（液态玻璃） 的全新设计系统，引入光学物理折射滤镜、弹性阻尼滑块、流体触感开关以及全新品牌官方标识。

---

核心新特性与改动说明

1. 全新 Liquid Glass 液态玻璃与 SwiftUI 视觉系统

• 全面移除 Ant Design 遗留包：彻底移除 ant-select.js 与 ant-theme.css，摆脱老旧样式干扰，减小打包体积并提升运行流畅度。
• 光学法线模拟与实时折射（liquid-optics.js & liquid-optics.css）：
  • 基于圆角矩形距离场生成法线贴图，通过实时 SVG 背景位移滤镜精确模拟光线通过 1.46 折射率玻璃的边缘位移与色散折射。
  • 边缘高光轮廓跟随鼠标/触控指针实时计算入射角反射，带来逼真的光照流体质感。
  • 针对文字和主要数据卡片采用高对比半透毛玻璃材质，搭配全新矢量环境壁纸（glass-wallpaper.svg），兼具科技美感与文字可读性。
  • 内置无障碍降级保护，支持系统级 prefers-reduced-motion（减弱动态效果）与高对比度模式。

2. 流体质感开关与果冻弹性滑块

• 模块化液态开关组件（liquid-toggle.js & liquid-toggle.css）：
  • 全面重构登录页、面板设置、入站/客户端动态表格及公网订阅页的 Toggle 开关，提供 64×32 iOS 规范导轨、按压形变、阻尼反弹以及流畅滑动过渡。
• 可拖拽 Jello 果冻弹性分段胶囊滑块：
  • 选项卡分段控制器引入动态 .liquid-pill-slider，支持鼠标/手指直接拖拽，拖动过程中具备流体挤压/拉伸拉扯动效（Squash & Stretch），释放后弹性回弹对齐最近选项。
  • 移动端适配多视图横向滑动滑动手势。

3. 品牌形象与视觉资源升级

• 全新官方高清 Logo：侧边栏头部、收起悬浮态、登录卡片及网页 Favicon 全面采用全新超清 m-ui_logo.png 与 m-ui_logo_square.png。
• 静态资源分发与测试优化：在 Go 后端（internal/app/main.go）完善图片资源的 MIME 协议与缓存标头，并添加自动化单元测试 TestMediaLogoServing。

4. 交互细节与体验修复

• 修复 Panel Settings 底部多余空白卡片块：排查并移除了 .settings-pane 上多余的卡片边框背景及外边距，表单收发展现规整一体。
• 修复胶囊滑块偏心问题：在滑动位置计算中精确扣除容器边框偏移量（borderLeftWidth / borderTopWidth），彻底解决滑块向下/向右溢出、无法居中的问题。
• 修复侧边栏折叠按钮椭圆变形：固定收起状态按钮尺寸为正圆形（38×38px，border-radius: 50%），图标保持绝对居中。
• 修复 Inbounds 自动刷新浮窗无法呼出：移除了 .inbounds-refresh 上的截断规则（overflow: hidden），恢复自动刷新菜单（.auto-refresh-menu）的正常浮层弹出。
• 恢复原生选项卡点击与无障碍导航：支持键盘方向键与 Home/End 快速切换。
• 修复语言翻译问题：即便界面语言设置成其他语言，部分窗口中的一些文字仍然会在面板重启后显示成中文，已新增窗口打开时生效的翻译功能，不会出现残留未翻译的语句。

5. 架构解耦、安全隔离与测试覆盖

• 订阅接口资源安全隔离：在订阅独立端口提供公共开关样式（liquid-toggle.css / liquid-toggle.js），并严格屏蔽面板内部管理接口，新增 TestSubscriptionToggleAssetsOnBothListeners 自动化测试。
• 完备的自动化测试体系：新增无头测试夹具（tests/liquid-optics.html、tests/liquid-toggle.html）与设计架构文档（LIQUID-GLASS.md）。
• Go 单元测试全数通过，跨平台二进制产物（Windows / Linux）编译验证无误。

---

提交日志 (Git Log)

• 5d78e09 feat(ui): add liquid optics, liquid toggle components, and update UI for v0.2.0
• b85ffbe fix(ui): fix inbounds-refresh overflow clipping auto-refresh-menu popup
• 0c05180 test: add TestMediaLogoServing unit test
• c5ff897 feat(ui): update sidebar and login logo to m-ui_logo.png
• 729cb0a fix(ui): fix tab capsule slider dragging not following mouse
• 6e52000 fix(ui): fix sidebar collapse button oval distortion and centering
• 0bcfbe0 fix(ui): fix settings bottom block, center capsule slider, and refine liquid glass aesthetics
• cc655a2 fix(ui): unify panel settings with mihomo grouped forms, restore native tab clicking, and remove progress bar scrollbar
• 689ba76 feat(ui): add draggable liquid glass slider, fix square corners, and enhance login glass
• 4aae1e7 feat(ui): complete SwiftUI & Liquid Glass redesign and purge Ant Design relics

Full Changelog: v0.1.6...v0.2.0

m-ui v0.1.6

Highlights in v0.1.6

• Mihomo outbound adding form and YAML parser now supports proxy type Snell.
• Added interface language support for Traditional Chinese, Türkçe, Japanese, Ukrainian and Portuguese (Brazil).

---

v0.1.6 核心亮点

• Mihomo出站新增表单以及YAML解析器现在支持出站代理类型Snell。
• 界面语言已支持繁体中文，土耳其语，日本语，乌克兰语以及葡萄牙语（巴西）。

Full Changelog: v0.1.5...v0.1.6

m-ui v0.1.5

Highlights in v0.1.5

• Optimized the parsing of VLESS and VMESS links when adding outbound proxies in the Mihomo settings; m-ui has been tested and is now compatible with Mihomo version 1.19.31.
• Added interface language support for Russian, Persian, Vietnamese, and Spanish.

---

v0.1.5 核心亮点

• 已优化Mihomo设置中出站添加中对于VLESS和VMESS链接的解析，经测试目前m-ui已适配Mihomo 1.19.31版本。
• 界面语言已支持俄语，波斯语，越南语，西班牙语。

Full Changelog: v0.1.4...v0.1.5

m-ui v0.1.4

Highlights in v0.1.4

• VPNGate Managed Outbounds & AppArmor Support: Full lifecycle management of SoftEther VPNGate connections, including automated DHCP lease configuration, isolated routing tables, and seamless AppArmor profile adjustments on confined Linux hosts.
• Ant Design Combobox Enhancements: Replaced native browser datalists in VPNGate dialogs with modern, keyboard-friendly Ant Design Select comboboxes supporting both dropdown selection and custom typing.
• Inbound Username-Centric Refactoring: Client cards and inbound tables now prominently display and prioritize Username (which carries operational and routing significance in Mihomo) over Email.
• Streamlined Username Dropdown: Fixed drawer suggestion menu alignment to pixel-match the input box, and restructured candidate suggestions to always display all existing usernames in the panel without keyword filtering hurdles.
• Multi-Control Pairing Flexibility: Support for user-defined pairing tokens (16–32 lowercase alphanumeric characters).

---

What's New & Improvements

1. VPNGate Outbound Integration & AppArmor Compatibility

• VPNGate Managed Outbound: Direct integration with SoftEther VPN Client to fetch public VPNGate nodes with automated connection, lease management, and IPinfo-backed ISP/ASN resolution.
• AppArmor DHCP Auto-Configuration: On Linux systems with AppArmor enforcing dhclient restrictions, m-ui automatically configures the local inclusion rule (<local/sbin.dhclient> or <local/usr.sbin.dhclient>) for VPNGate virtual interfaces (vpn_vpn0 – vpn_vpn9), reloads the policy via apparmor_parser, and maintains .m-ui-vpngate.bak backups for safe rollback.
• Robust Route & Interface Management: Improved timing during connection initialization, fixed route table ownership, and ensured clean virtual NIC teardown on stop or crash.
• Ant Select Combobox: VPNGate Country (JP/KR presets) and ISP/ASN keyword selectors upgraded to sleek Ant Design-styled comboboxes that allow typing custom inputs without browser autocomplete interference.

2. Inbound & Client Management

• Username First: Main inbounds table and drawer client tables now display Username instead of Email (client.name), reflecting Mihomo's actual credential and routing architecture.
• Aligned Username Suggestion Menu: Restructured the suggestion dropdown inside the Add Inbound drawer to align precisely with the input box rather than stretching across the 200px label column.
• Complete Username Candidates: When focusing or clicking the Username input, the dropdown always lists all existing usernames across the panel without filtering them out based on newly generated random prefixes, making multi-inbound subscription aggregation effortless.

3. Multi-Control & Panel UI Polish

• Custom Pairing Token: Users can now manually enter custom pairing tokens (16–32 lowercase alphanumeric characters) or generate new 16-character tokens.
• General Actions Menu: Aligned menu icons and labels cleanly, and moved "Delete Depleted Clients" to the bottom of the actions list to prevent accidental clicks.
• Card & Chart Layout Fixes: Preserved collapsed/expanded states for client cards across tab re-renders and eliminated rendering artifacts in gauges and charts.
• Community Links: Added links to the official Telegram channel in the documentation.

---

v0.1.4 核心亮点

• VPNGate 托管出站与 AppArmor 自动适配：原生支持 SoftEther VPNGate 节点生命周期管理，具备自动化 DHCP 租约分配、独立路由表维护，并支持在 AppArmor 受限的 Linux 主机上自动补全 dhclient 策略规则与安全回滚。
• Ant Design Combobox 选单升级：VPNGate 弹窗彻底告别原生浏览器的粗糙 datalist，采用与面板整体风格一致的 Ant Design Combobox 组合输入框，既支持下拉选择又支持自由输入。
• 入站客户端以 Username 为核心：入站展开列表及相关预览全面调整为优先显示在 Mihomo 路由与认证中具备实际意义的 Username，替代原先无实质作用的 Email 占位。
• Username 下拉选单重构：修复抽屉中建议菜单过宽的布局问题，实现下拉框与输入框像素级对齐，且进入添加入站时永远完整展示面板内已有 Username，方便跨入站聚合订阅。
• Multi-control 配对 Token 支持自定义：支持用户手动输入 16–32 位小写字母与数字混合的 Token，同时保留自动生成功能。

---

详细更新内容

1. VPNGate 托管出站与 AppArmor 深度兼容

• 一键 VPNGate 托管出站：内置 SoftEther VPN Client 环境检测与安装引导，支持自动发现目标国家（JP/KR 等）公网节点，结合 IPinfo 智能匹配运营商并分配独立出站网卡与路由表。
• AppArmor DHCP 策略自动修复：针对 Ubuntu/Debian 等开启 AppArmor 强制策略的环境，m-ui 在申请 DHCP 租约前会自动检查 dhclient 策略，自动在本地规则扩展点（local/sbin.dhclient 或 local/usr.sbin.dhclient）为实际数据目录下的虚拟网卡（vpn_vpn0 ~ vpn_vpn9）写入所需权限，并调用 apparmor_parser 热加载；修改前自动生成 .m-ui-vpngate.bak 隐藏备份并在失败时自动回滚。
• 生命周期与路由修复：优化握手连接时序与路由表解析，完善网卡清理逻辑，确保节点启停与进程退出时网络状态干净释放。
• 全新下拉选择体验：国家代码与 ISP/ASN 关键词下拉选单升级为可输入的 Ant Design Select Combobox，告别原生浏览器的自动填充样式干扰。

2. 入站与客户端管理优化

• Username 优先展示：主入站列表折叠详情页、编辑抽屉只读客户端列表、二维码分享标题中的客户端标识由原先的 Email 改为 Username（当 Username 为空时回退为 Email），符合 Mihomo 订阅与分流规范。
• Username 下拉选单对齐优化：通过独立的 .username-control 容器隔离 CSS Grid 网格布局，使下拉菜单严格贴合 Username 输入框宽度，解决此前跨越 200px 标签导致过宽且不对齐的问题。
• 候选列表全集展示：去除了根据随机生成初始值过滤候选词的逻辑，且草稿数据不再混入候选池。点击 Username 输入框即可直接查阅面板中全部已存在的 Username，支持一键点击选中加入聚合订阅，亦可自由键入全新用户名。

3. 多面板联机与面板界面打磨

• 自定义配对 Token：Multi-control 配对 Token 现支持用户手动输入 16–32 位小写字母与数字，方便多机统一规划与记忆。
• 入站通用操作选单优化：重新排版入站页的 General Actions 下拉操作，文字与图标精准垂直居中，并将高危操作“删除已耗尽客户端”下移至末尾，避免误触。
• 客户端卡片与仪表盘渲染修复：入站抽屉 Client 卡片默认收起并记忆展开状态；修复图表与仪表盘上的多余端点等小渲染瑕疵。
• 文档完善：README 新增官方 Telegram 频道链接与 VPNGate AppArmor 机制说明。

Full Changelog: v0.1.3...v0.1.4

m-ui v0.1.4-rc.4

In v0.1.4-rc.3, the DHCP script failed to receive routing parameters and exited prematurely, leaving the network interface without an IPv4 configuration. This has now been resolved by correctly passing parameters via dhclient -e and adding failure diagnostics.

---

在 v0.1.4-rc.3 中，DHCP 脚本没有收到路由参数，提前退出，导致网卡未配置 IPv4。现已通过 dhclient -e 正确传递参数，并补充失败诊断。

Full Changelog: v0.1.4-rc.3...v0.1.4-rc.4

m-ui v0.1.4-rc.3

vpngate.go：

• 不再依赖 ip -N 的数字化输出。
• 兼容已存在的 7 default proto 242 metric 42760 路由。
• 新增 SoftEther 账户连接状态识别。

vpngate_linux.go：

• AccountConnect 后等待 AccountStatusGet 确认连接建立。
• DHCP 改为前台单次获取：dhclient -4 -1 -v。
• 获取前清理旧租约、旧 PID 和旧 IPv4 地址。
• 获取后等待内核确认 IPv4 已写入。
• DHCP hook 失败会返回错误，不再静默吞掉。
• 路由表读取改为标准的 ip route show。

vpngate_test.go：

• 增加 7 default proto 242 回归测试。
• 增加 SoftEther Connected、Connection Completed、Session Established 等状态测试。

i18n.go：

• 新增 DHCP、SoftEther 连接失败等错误的英文翻译。

---

vpngate.go:

• Removed reliance on the numeric output of ip -N.
• Added compatibility with existing 7 default proto 242 metric 42760 routes.
• Added detection of SoftEther account connection status.

vpngate_linux.go:

• Wait for AccountStatusGet to confirm connection establishment after AccountConnect.
• Switched DHCP to a single-shot foreground execution: dhclient -4 -1 -v.
• Clean up old leases, PIDs, and IPv4 addresses before acquisition.
• Wait for kernel confirmation that the IPv4 address has been applied after acquisition.
• Return errors on DHCP hook failure instead of silently suppressing them.
• Switched routing table reading to the standard ip route show command.

vpngate_test.go:

• Added regression test for the 7 default proto 242 route.
• Added tests for SoftEther states such as "Connected," "Connection Completed," and "Session Established."

i18n.go:

• Added English translations for errors related to DHCP and SoftEther connection failures.

Full Changelog: v0.1.4-rc.2...v0.1.4-rc.3

m-ui v0.1.4-rc.2

Highlights

• Fixed VPNGate route ownership detection on Linux. Routes created by v0.1.4-rc.1 with protocol number 186 may be displayed by iproute2 as proto bgp; m-ui now recognizes both forms and safely migrates them to the private protocol number 242.
• Made route matching more precise by validating the route protocol, interface, and metric. This prevents m-ui from treating unrelated routes as VPNGate-managed routes while retaining the fail-closed routing guard.
• Added a dedicated Uninstall NIC action for saved VPNGate outbounds. Removal is staged in the settings draft and runs after Save, following the normal dependency checks.
• Improved VPNGate cleanup: m-ui disconnects the session, deletes the SoftEther account, disables and removes the virtual adapter, removes only the rules and routes owned by that slot, and clears its runtime directory.
• Added backend and browser coverage for legacy route formats and the VPNGate NIC uninstall flow.

Upgrade notes

This release is recommended for anyone testing VPNGate with v0.1.4-rc.1, especially if a slot reports that its routing table is already occupied or if a VPNGate virtual adapter cannot be removed cleanly.

No manual route migration is required. When m-ui manages the affected slot, it recognizes the legacy proto 186 / proto bgp routes and replaces or removes only the routes that match the VPNGate ownership markers.

Validation

• go test ./...
• go vet ./...

---

主要更新

• 修复 Linux 上 VPNGate 路由归属识别。v0.1.4-rc.1 使用协议号 186 创建的路由，可能被 iproute2 显示为 proto bgp；现在 m-ui 能同时识别这两种形式，并安全迁移到私有协议号 242。
• 更精确地校验路由协议、网卡接口和 metric，避免把其他程序创建的路由误判为 VPNGate 路由，同时保留断线时阻止流量泄漏的 fail-closed 路由保护。
• 为已保存的 VPNGate 出站增加专用的 卸载网卡 操作。卸载会先加入设置草稿，并在点击 Save 后执行，同时沿用现有的依赖检查流程。
• 改进 VPNGate 清理流程：m-ui 会断开连接、删除 SoftEther 账户、禁用并删除虚拟网卡，只移除该槽位拥有的规则与路由，最后清理对应的运行目录。
• 增加后端及浏览器测试，覆盖旧版路由格式和 VPNGate 网卡卸载流程。

升级说明

建议所有正在测试 v0.1.4-rc.1 VPNGate 功能的用户升级，特别是遇到“路由表已被占用”或 VPNGate 虚拟网卡无法完整删除的情况。

无需手动迁移路由。m-ui 管理相关槽位时，会识别旧版 proto 186 / proto bgp 路由，并且只替换或删除符合 VPNGate 归属标记的路由。

验证

• go test ./...
• go vet ./...

Full Changelog: v0.1.4-rc.1...v0.1.4-rc.2

m-ui v0.1.4-rc.1

This is the first release candidate for m-ui 0.1.4. It introduces managed VPNGate outbounds, isolated policy routing, secure SoftEther VPN Client lifecycle management, ASN-based ISP selection, and related panel improvements.

Preview release: VPNGate depends on a real Linux environment, SoftEther VPN Client, TUN/TAP, DHCP, and policy routing. Test this release on an isolated server before using it for important traffic.

Highlights

Managed VPNGate outbounds

• Added a dedicated VPNGate entry next to WARP on the Outbounds page.
• Added ISP presets for Japan and South Korea.
• Added support for two-letter uppercase country codes for other countries.
• Added support for custom ASN or ISP name keywords.
• Added strict VPNGate NIC slot selection from 0 to 9.
• Added live display of connection state, current node, actual ASN/ISP, fallback state, and recent errors.

Per-slot network isolation

• SoftEther adapter names: vpn0 through vpn9.
• Linux interface names: vpn_vpn0 through vpn_vpn9.
• Routing tables and socket marks: 100 through 109.
• Added independent DHCP configuration, lease, PID, and hook files for each slot.
• Added per-slot policy-routing rules and resource ownership checks.
• Added fail-closed routing protection so disconnected VPNGate traffic does not fall back to the server's default route.
• The feature does not modify the main routing table or /etc/resolv.conf.

SoftEther VPN Client management

• Added installation of the pinned official SoftEther VPN Client release.
• The installer supports Linux amd64 and arm64.
• Added dependency, root permission, and /dev/net/tun checks.
• Added bounded download, archive validation, extraction, build, and atomic installation stages.
• Preserved the upstream license and important notices with the installed client.
• The panel does not install system packages or create a systemd service.
• The client runs as an m-ui-managed foreground service.
• Remote client management is disabled and protected with a private control credential.
• Existing unmanaged VPN Client processes and conflicting adapters, accounts, routes, or rules are never taken over.

Node discovery and automatic maintenance

• Added parsing and validation of the official VPNGate node list.
• Only validated public IPv4 endpoints, ports, and country codes are used.
• Added bounded TCP candidate probing before ASN queries.
• Added IPinfo ASN lookups with caching, request coalescing, throttling, and cooldown handling.
• Without a token, ip-api is used only after IPinfo explicitly reports quota exhaustion.
• With a token, queries are sent only to IPinfo.
• Added exclusion of AS36599 nodes.
• Added ISP alias matching for the Japanese and Korean presets.
• SoftBank candidates prefer Tokyo when region information is available.
• When the selected ISP is unavailable, the task may use a clearly marked same-country fallback; it never falls back to another country.
• Added periodic HTTPS health checks, current-node soft reconnect, replacement-node selection, bounded retry, and cancellation.

Panel settings and secret handling

• Added an IPinfo Token field to Panel Settings.
• Added explicit update, preserve, and clear semantics.
• Added an “already set” indicator without returning the saved token to the browser.
• The token is excluded from normal state responses and logs.
• Invalid token values from settings, legacy state, or backups are rejected or safely cleared.

Configuration, backup, and lifecycle integration

• VPNGate metadata is stored with the existing Outbounds model and state.json.
• Managed VPNGate outbounds are rendered to Mihomo as direct proxies bound to the correct interface and routing mark.
• Managed interface, mark, IP version, and dialer settings cannot be bypassed through YAML editing.
• Duplicate VPNGate slots are rejected.
• Unsaved drafts do not create system interfaces.
• Saved configurations start or update maintenance tasks in the background.
• Deleting a saved outbound cleans only resources owned by that slot.
• Startup, installation completion, backup restore, panel shutdown, and interrupted installation are handled explicitly.
• Unsupported, uninstalled, or conflicting VPNGate outbounds report an error instead of silently becoming an unbound DIRECT route.

Interface and tests

• Added Chinese and English interface text.
• Added responsive narrow-screen and dark-mode support for the VPNGate modal.
• Added focused unit tests for configuration validation, persistence, secret masking, node parsing, ASN provider behavior, fallback selection, reconnection, and archive safety.
• Added a browser end-to-end test covering modal linkage, country/ISP rules, slots 0 and 9, draft/save/edit/delete, managed configuration output, IPinfo Token handling, dark mode, and narrow layouts.

Downloads

Linux:

• m-ui-linux-386.tar.gz
• m-ui-linux-amd64.tar.gz
• m-ui-linux-arm64.tar.gz
• m-ui-linux-armv5.tar.gz
• m-ui-linux-armv6.tar.gz
• m-ui-linux-armv7.tar.gz
• m-ui-linux-s390x.tar.gz

Windows:

• m-ui-windows-amd64.zip

Usage

After installation or upgrade, verify the version:

m-ui version

Expected output:

v0.1.4-rc.1

To add a VPNGate outbound:

1. Open Mihomo → Outbounds.
2. Select VPNGate.
3. On a supported Linux server, select Install and review the included SoftEther license.
4. Choose a country, ISP, and NIC slot.
5. Select Add to Draft.
6. Return to the Outbounds page and select Save.

Known limitations

• VPNGate outbounds are currently supported only on Linux servers.
• Automatic SoftEther installation currently supports Linux amd64 and arm64 only.
• Root access, /dev/net/tun, make, gcc, binutils, iproute2, and dhclient are required.
• The free ip-api fallback is HTTP-only and restricted to non-commercial use.
• VPNGate uses public volunteer nodes; stability, speed, exit ASN, and availability are not guaranteed.
• Unit tests, race tests, cross-compilation, and browser validation have passed on Windows. Real Linux dialing, TUN/TAP, DHCP, and policy-routing behavior still require validation in an isolated Linux environment.
• This pre-release does not update the Docker latest tag.

---

这是 m-ui 0.1.4 的首个候选发布版本，主要加入受管的 VPNGate 出站、独立策略路由、安全的 SoftEther VPN Client 生命周期管理、基于 ASN 的运营商选择及相关面板改进。

预览版本： VPNGate 依赖真实 Linux 环境、SoftEther VPN Client、TUN/TAP、DHCP 和策略路由。用于重要流量前，请先在隔离服务器中测试本版本。

主要更新

受管 VPNGate 出站

• 在 Outbounds 页面的 WARP 右侧新增独立 VPNGate 入口。
• 新增日本和韩国运营商预设。
• 其他国家支持输入两位大写国家代码。
• 支持自定义 ASN 或运营商名称关键词。
• VPNGate 网卡槽位严格限制为 0 至 9。
• 支持显示连接状态、当前节点、实际 ASN/运营商、兜底状态和最近错误。

每槽位网络隔离

• SoftEther 网卡内部名：vpn0 至 vpn9。
• Linux 接口名：vpn_vpn0 至 vpn_vpn9。
• 路由表及 socket mark：100 至 109。
• 每个槽位使用独立的 DHCP 配置、租约、PID 和 hook 文件。
• 新增每槽位策略路由规则及资源所有权检查。
• 新增断线不可达保护，避免 VPNGate 流量回落至服务器默认出口。
• 本功能不会修改主路由表或 /etc/resolv.conf。

SoftEther VPN Client 管理

• 支持安装固定版本的 SoftEther 官方 VPN Client。
• 安装器支持 Linux amd64 和 arm64。
• 新增依赖、root 权限和 /dev/net/tun 检查。
• 下载、压缩包检查、解压、编译和原子安装均设置安全边界。
• 安装时保留上游许可证和重要说明文件。
• 面板不会自动安装系统软件包，也不会创建 systemd 服务。
• VPN Client 以前台服务方式由 m-ui 管理。
• 关闭远程客户端管理，并使用私有控制凭据保护。
• 不接管现有的非 m-ui VPN Client 进程，也不接管冲突的网卡、账户、路由或规则。

节点发现与自动维护

• 新增 VPNGate 官方节点列表解析与校验。
• 只使用经过验证的公网 IPv4、端口和国家代码。
• ASN 查询前先执行有界 TCP 候选节点探测。
• 新增 IPinfo ASN 查询缓存、并发合并、限速和冷却处理。
• 未配置 Token 时，只有 IPinfo 明确返回额度耗尽后才使用 ip-api。
• 配置 Token 后，查询只发送至 IPinfo。
• 排除 AS36599 节点。
• 为日本和韩国预设补充运营商 ASN 名称别名。
• 有地区信息时，SoftBank 候选优先选择东京节点。
• 目标运营商不可用时，可以使用明确标记的同国兜底节点，但不会跨国兜底。
• 新增定时 HTTPS 健康检查、当前节点软重连、替代节点选择、有界重试和任务取消。

面板设置与敏感信息处理

• Panel Settings 新增 IPinfo Token 字段。
• 支持明确的更新、保留和清除语义。
• 新增“已设置”提示，但不会将保存的 Token 返回浏览器。
• 普通状态响应和日志不会回显 Token。
• 设置、旧版状态或备份中的无效 Token 会被拒绝或安全清除。

配置、备份与生命周期接入

• VPNGate 元数据随现有 Outbounds 模型及 state.json 保存。
• 受管 VPNGate 出站会生成绑定对应接口及 routing mark 的 Mihomo direct 代理。
• 不能通过 YAML 编辑绕过受管接口、mark、IP 版本或拨号设置。
• 拒绝重复的 VPNGate 槽位。
• 未保存的草稿不会创建系统网卡。
• 保存后在后台启动或更新维护任务。
• 删除已保存出站时，只清理由该槽位拥有的资源。
• 已处理面板启动、安装完成、备份恢复、面板退出和安装中断等生命周期。
• 平台不支持、客户端未安装或资源冲突时，会明确报告错误，不会静默变成未绑定的 DIRECT 出口。

界面与测试

• 新增中英文界面文案。
• VPNGate 弹窗支持窄屏响应式布局和深色模式。
• 新增配置校验、持久化、敏感信息脱敏、节点解析、ASN 服务行为、兜底选择、重连和压缩包安全等专项单元测试。
• 新增浏览器端到端测试，覆盖弹窗入口、国家/运营商规则、槽位 0 和 9、草稿/保存/编辑/删除、受管配置输出、IPinfo Token、深色模式和窄屏布局。

下载文件

Linux：

• m-ui-linux-386.tar.gz
• m-ui-linux-amd64.tar.gz
• m-ui-linux-arm64.tar.gz
• m-ui-linux-armv5.tar.gz
• m-ui-linux-armv6.tar.gz
• m-ui-linux-armv7.tar.gz
• m-ui-linux-s390x.tar.gz

Windows：

• m-ui-windows-amd64.zip

使用方法

安装或升级后，运行以下命令确认版本：

m-ui version

预期输出：

v0.1.4-rc.1

添加 VPNGate 出站：

1. 打开 Mihomo → Outbounds。
2. 选择 VPNGate。
3. 在支持的 Linux 服务器上选择 Install，并阅读随附的 SoftEther 许可证。
4. 选择国家、运营商和网卡槽位。
5. 选择 Add to Draft。
6. 返回 Outbounds 页面并选择 Save。

已知限制

• VPNGate 出站目前只支持 Linux 服务器。
• SoftEther 自动安装目前只支持 Linux amd64 和 arm64。
• 需要 root 权限、/dev/net/tun、make、gcc、binutils、iproute2 和 dhclient。
• 免费 ip-api 备用接口仅支持 HTTP，并限制为非商业用途。
• VPNGate 使用公开志愿者节点，不保证稳定性、速度、出口 ASN 或可用性。
• 本版本已在 Windows 上通过单元测试、race 测试、交叉编译和浏览器验收；真实 Linux 拨号、TUN/TAP、DHCP 和策略路由行为仍需在隔离 Linux 环境中验证。
• 本预发布版本不会更新 Docker latest 标签。

Full Changelog: v0.1.3...v0.1.4-rc.1

m-ui v0.1.3

完整备份与恢复

面板的备份此前只有 state.json 真正生效：导出时写进 ZIP 的 config.yaml 在恢复时会被直接跳过，manifest.json 的 format 字段从未被读取，而 Multi-control 身份和跨面板订阅缓存根本没有被打包 —— 换机恢复后所有联机链路都会静默失效。

现在备份包为 manifest format 2，包含：

文件	内容
state.json	面板设置、入口、客户端、WARP 账户
config.yaml	生成的 Mihomo 配置
multi-control.json	Multi-control 身份、对端列表、配对令牌
cross-panel-subscriptions.json	跨面板订阅缓存
manifest.json	版本号与实际打包的 contents 列表

Multi-control 身份恢复需要显式勾选。 默认不勾选时，本机 peerID 和私钥保持不变，只合并对端列表、屏蔽列表和配对令牌；只有整机迁移才勾选它 —— 否则同一份备份在两台机器上还原会产生两个相同的 peerID，在 mesh 中互相顶掉。

先全部校验、再写盘。 任何一节数据不合法（伪造的身份签名、被改名的缓存节点）都会在 state.json 落盘之前被整体拒绝。state 写入之后各分节失败只降级为警告并逐条回显，用户能确切知道哪部分没有恢复。

TLS 证书不打包。 恢复后若配置的证书路径缺失或不可用，会明确提示，不再静默回落 HTTP —— 请用 m-ui ssl 重新签发。

旧备份仍可导入：format 1 或缺少 manifest 的包按「仅 state」处理；format 高于 2 会明确报错而不是错误解析。

更新前自动快照数据目录

install.sh 升级时只替换两个二进制，本身已经是非破坏性的，但对「新版本在字段迁移时写坏 state.json」这种情况没有兜底 —— 失败时旧二进制会被还原，被改写的 state 文件不会。

现在会在服务停止之后、替换任何文件之前，对不可再生的文件打一个 tar.gz 快照。Geo 数据库、cache.db 和日志被排除在外（体积大且可重新下载），因此一个快照通常只有几 KB。归档以 .partial 构建后重命名，中断的运行不会留下看起来可用的截断文件；快照失败只告警、不中止一次本来正常的升级。

新增 --no-backup 和 --backup-keep N（1–50，默认保留 3 份）。

修复

• 首页 m-ui 卡片的版本号是一段写死的静态 HTML，无论运行的是哪个二进制都显示 v0.1.0。现在改为读取状态接口已经返回的真实版本。

---

Complete backup and restore

Only state.json ever actually round-tripped: config.yaml was written into the archive on export and skipped on restore, manifest.json's format field was never read, and the Multi-control identity and the cross-panel subscription cache were not packaged at all — restoring a backup on a new machine silently broke every mesh link.

Archives are now manifest format 2 and carry:

File	Contents
state.json	Panel settings, inbounds, clients, WARP account
config.yaml	The generated Mihomo configuration
multi-control.json	Multi-control identity, peer list, pairing token
cross-panel-subscriptions.json	Cross-panel subscription cache
manifest.json	Format version and the list of entries actually packed

Restoring the Multi-control identity is opt-in. Left unchecked, the local peer ID and private key are kept and only the peer list, the blocked list and the pairing token are merged. Check it only when migrating a whole server — otherwise the same backup restored on two machines produces two panels claiming one peer ID, which conflict on the mesh.

Everything is validated before anything is written. A forged identity signature or a renamed cached node is rejected as a whole, before state.json lands. Once state has been written, per-section failures degrade to individually reported warnings, so it is always clear what did and did not restore.

TLS material is deliberately not packaged. A missing or invalid certificate path after a restore is surfaced as a warning instead of a silent fallback to HTTP; reissue with m-ui ssl.

Older archives still import: format 1 or a missing manifest restores as state-only, and a format newer than 2 is rejected with a clear message rather than misparsed.

Data directory snapshot before an update

install.sh replaced only the two binaries on upgrade, so an update was already non-destructive — but it offered no safety net for a new build damaging state.json during a field migration: the old binaries are restored on failure, a rewritten state file is not.

A tar.gz snapshot of the unrecoverable files is now taken after the service is stopped and before anything is replaced. Geo databases, cache.db and logs are excluded — large and re-downloadable — which keeps a snapshot at a few KB. The archive is built as .partial and renamed, so an interrupted run cannot leave a truncated file that later looks usable. Snapshot failure warns and continues rather than aborting an otherwise fine update.

Adds --no-backup and --backup-keep N (1–50, default 3).

Fixes

• The dashboard's m-ui version tag was hardcoded HTML and reported v0.1.0 regardless of which binary was running. It now reads the version the state API already returns.

Full Changelog: v0.1.2...v0.1.3

m-ui v0.1.2

新功能

• Inbound YAML 导入：General Actions → Import an Inbound 改为弹窗输入 YAML，不再是早期的 JSON 形式。
  • 支持单个 listener 对象、单项数组，以及带 listeners: 顶层键的单项数组。
  • 支持 users: 多客户端格式（与面板自身导出的格式一致）。
  • 可解析 VLESS + Reality 等常见配置。
  • 表单暂未识别的高级字段会原样保留在 YAML 中，不会丢失。
  • 每次导入一个 Inbound。
• 端口自动分配：每次打开 Add Inbound 会从后端获取一个随机的、未被占用的五位端口，自动避开已有 Inbound、面板端口、Mihomo API 端口、订阅端口以及系统实际占用的 TCP/UDP 端口。
• Mihomo 自动启动：m-ui 启动后会自动测试并拉起 Mihomo 内核，安装完成或服务器重启后无需再手动点击启动。若自动启动失败，面板依然可用，错误会写入运行日志。

变更

• 新安装不再默认创建 12080 Mixed 入站。
• Docker 部署支持：镜像内含 m-ui 与经过 SHA-256 校验的 Mihomo 1.19.30，Compose 在 Linux 上使用 host 网络与持久化数据卷。
• 打 tag 时自动构建并推送 GHCR 镜像。
• GitHub Release 现在会附带 m-ui-windows-amd64.zip（内部仅 m-ui.exe）。

修复

• 修复 TLS 证书菜单中的 unbound variable 报错。
• 参考 3x-ui 改为无需邮箱的 acme.sh 安装流程，并直接显示真实安装输出，便于排查失败原因。

升级提示

• 旧版本已存在的 12080 Mixed 入站不会被自动删除，如不需要请手动删除。
• 首次生成 GHCR Package 后，需在 GitHub Package 设置里把容器可见性确认为 Public，否则匿名 docker pull 会失败。

Docker 快速开始

docker run -d --name m-ui --restart unless-stopped \
  --network host \
  -v m-ui-data:/etc/m-ui \
  ghcr.io/romanovcaesar/m-ui:v0.1.2

---

Added

• Inbound YAML import: General Actions → Import an Inbound now opens a dialog that accepts YAML instead of the old JSON flow.
  • Accepts a single listener object, a single-item array, or a single-item array under a top-level listeners: key.
  • Supports the multi-client users: format.
  • Parses common setups such as VLESS + Reality.
  • Advanced fields the form does not yet model are preserved verbatim.
  • One inbound per import.
• Automatic port selection: Add Inbound now requests a random unused 5-digit port from the backend, skipping existing inbounds, the panel port, the Mihomo API port, the subscription port, and ports actually in use on the host.
• Mihomo starts with m-ui: the core is tested and launched automatically on panel startup, so a fresh install or a server reboot no longer needs a manual start. If startup fails, the panel stays usable and the error is recorded in the run log.

Changed

• Fresh installs no longer create the default 12080 Mixed inbound.
• Docker deployment: the image bundles m-ui plus SHA-256 verified Mihomo 1.19.30; Compose uses host networking on Linux with a persistent data volume.
• Tagged pushes now build and publish GHCR images automatically.
• GitHub Releases now include m-ui-windows-amd64.zip containing only m-ui.exe.

Fixed

• Fixed an unbound variable failure in the TLS certificate menu.
• Reworked acme.sh installation to match 3x-ui's email-free flow and surface the real installer output.

Upgrade notes

• An existing 12080 Mixed inbound is not removed automatically; delete it manually if unwanted.
• After the first GHCR package is created, set the container visibility to Public in GitHub package settings for anonymous pulls to work.

Assets

• m-ui-linux-386.tar.gz
• m-ui-linux-amd64.tar.gz
• m-ui-linux-arm64.tar.gz
• m-ui-linux-armv5.tar.gz
• m-ui-linux-armv6.tar.gz
• m-ui-linux-armv7.tar.gz
• m-ui-linux-s390x.tar.gz
• m-ui-windows-amd64.zip

Container images

• ghcr.io/romanovcaesar/m-ui:v0.1.2
• ghcr.io/romanovcaesar/m-ui:0.1.2
• ghcr.io/romanovcaesar/m-ui:0.1
• ghcr.io/romanovcaesar/m-ui:latest

Full Changelog: v0.1.1...v0.1.2