v0.6.4

v0.6.4 - 2026-09-08

中文

国内 UDP 内核直连

• 新增「国内 UDP 直连」能力（默认开启）：目的地为国内 IP 的 UDP 流量在 nftables 内核层直接放行，避免这些流量受代理核心 UDP 会话空闲超时影响，并减轻核心会话负担；不代表消除所有游戏断线原因。内置数据固定来自 CC0 授权的 ipverse RIR 委派快照（IPv4 5513 段 / IPv6 2033 段），支持运行时覆盖并提供可重复生成、逐行校验脚本。
• 设置页「系统管理 → UDP 直连」：新增总开关（即时热生效），原「游戏 UDP 直连端口」保留为补充覆盖（海外目标但需直连的场景，如自建语音服）。

DNS 上游现代化（forward 迁移 + 首次测速选优）

• MosDNS 上游从 aliapi 迁移到所用 MosDNS 分支内置的增强版 forward 插件，恢复常规 UDP/TCP 上游的兼容性，并支持逐上游超时和 SOCKS5 配置。forward 是内部转发插件，不是协议下拉框里的新协议。NXDOMAIN 等无地址回答可能等待其他并发上游结束；实际耗时取决于网络和超时配置，不承诺固定毫秒级返回。
• 国内默认池升级为跨供应商并发组合：阿里 UDP + 腾讯 UDP + 阿里 DoH（低延迟与加密兜底兼顾）；已有用户的上游配置原样保留、平滑兼容（裸 IP 自动补协议前缀，旧 aliapi 专用条目已不再支持并在保存时明确提示）。
• 新增 DNS 上游测速：安装向导"网络与 DNS"步骤内实测主流公共 DNS（UDP 与 IP 直连 DoH）+ 本网络网关/DHCP DNS，每候选 3 轮（含不存在域探测）自动剔除不可达者；推荐组合由纯延迟排序升级为「两条最快 UDP + 一条 DoH 加密兜底」，避免低延迟网关把加密上游挤出推荐；MosDNS 系统页新增同一测速面板，可随时重测并应用为国内上游。
• 上游编辑器移除 aliapi 协议选项；密钥字段的脱敏与保留机制不变。

工程修复

• 更新前端构建/CLI 链的 Browserslist、postcss-selector-parser、qs 及相关锁定依赖，修复依赖审计报告的安全问题。

• 修复 cloudflareredirect 包的 Windows 交叉编译：进程组设置按平台拆分（Setpgid）。

• 修复 smart 内核资源校验测试在部分文件系统上因 mtime 粒度不足产生的间歇性失败。

• 修复开发版本（如未注入版本号编译出的 0.1.0-dev）检查更新时的误导性提示：此前会谎报"已是最新版本"、更新状态甚至显示"更新完成"，而实际存在更新只是按保护策略禁用了自更新；现在会如实提示"检测到新版本 vX，当前为开发版本，已禁用在线更新"。

• 完成 PR #13 合入前安全审计加固：GitHub Release 元数据不再经过公共镜像，自更新包要求独立可信的 GitHub SHA-256 摘要并在安装前复验；修复 .lan/.local 子串误匹配、DNS 测速接受 SERVFAIL/REFUSED、用户自带 Mihomo secret 被覆盖、只读用户写入全局自定义 CSS、gzip 协商与关闭阶段子进程重启竞态。

• 本周期主体功能由 Timeink88 通过 PR #13 贡献，维护者在原 PR 分支完成安全、兼容性、测试与来源审计修复。

外观与皮肤系统

• 修复每次重启后外观被重置：登录 token 过期触发的会话清理不再连带删除主题/皮肤偏好，外观设置全量同步到后端 SQLite（重启/换浏览器/换设备均不丢）。
• 新增皮肤系统：琥珀暖白与经典玻璃两套，与明暗模式独立；设置页新增品牌主色调色盘（预设色板+取色器实时预览）。
• 默认皮肤保持经典玻璃（MSF 原生蓝）；选择琥珀暖白后，登录页动态波浪同步读取琥珀明暗色板，不再停留在经典蓝色。
• 调色工作台：主色全局化（侧栏/分段控件/图表五色/氛围光/文字选中色全部跟随主色）、氛围色相滑条、自定义 CSS 编辑器（模板一键填入、300ms 防抖实时预览、撤销预览）。

GitHub 下载可靠性与 Token

• GitHub Release 元数据始终通过 GitHub 官方 TLS 端点获取；资产下载只使用管理员主动填写的代理服务器或加速镜像源，系统不再内置、自动探测、排序或自动切换公共镜像。面板可按需检测当前手填的单一加速源，检测结果不改变线路；个人 Token 继续加密保存，资产仍需通过可信 SHA-256 校验。

性能优化（速赢包）

• 波浪背景优先使用 OffscreenCanvas Worker，把 WebGL 初始化与逐帧渲染移出 UI 主线程；全屏三角形不再触发通用渲染器的无关扩展查询。保留原着色器、皮肤色板、画质预算、隐藏暂停和静态模式；不支持或启动失败时回退主线程渲染，无 WebGL 时保留静态底色。

• 优化 Mihomo 首次加载：分离波浪与地球依赖、并行预载目标路由，首屏数据提交后再启动持久背景。代理节点先于辅助接口显示；概览图表延后初始化，地球/规则/订阅随视口加载，完整运行快照仅在展开高级信息后获取。

• 静态资源缓存分级：带哈希的构建产物一年 immutable，固定名资源一小时，index.html 保持即时刷新——面板二次打开不再全量重下。

• Mihomo 默认日志级别 info→warning（此前 info 级月均可写穿 1.2GB 磁盘）；msf 日志中 URL 的 token/secret 参数脱敏后再落盘；日志轮转按磁盘剩余空间自动分档；Go 运行时默认 512MiB 软内存上限（GOMEMLIMIT 环境变量可覆盖）。

• 接口响应"别名复制"收尾：/mihomo/rules、/logs/{service}、/mosdns/logs 等接口去掉前端从不读取的重复字段，响应体积下降 47%-80%。

DNS 稳定性

• 根除 AAAA 五秒黑洞：IPv6 数据面关闭时 AAAA 查询立即返回空应答（原实现送国外 DNS 直连，被墙网络下每次等满 5 秒超时）。
• 调整原 aliapi 上游路径，避免已观察到的裸 IP 查询挂起问题；国内默认使用 UDP 与 IP 直连 DoH 混合上游。Windows 搜索域（.lan/.local）本地拒答，并按域名边界匹配，避免误伤包含相同字样的公共域名。
• 修复本机 DNS 接管诊断误报：resolv.conf 指向本机 LAN 地址（旁路由常见）时不再误判为"未接管"。

运维基础设施

• Smart 核心资源缺失或校验失败不再崩溃循环，面板提供分步修复指引；mihomo 进程异常退出自动退避重启。
• mihomo external-controller 自动生成随机 secret（此前 9090 无认证暴露）；gzip 中间件（Content-Type 白名单，SSE/WebSocket 天然排除）；copytruncate 日志轮转；配置历史/审计日志/更新包保留清理；ExecStopPost 自动清理 nft 规则。
• 详见仓库内 KNOWN_ISSUES.md 的完整问题清单。

升级注意事项

• 国内 UDP 直连默认开启：若自定义了「国内 IP 的 UDP 走代理」规则（罕见，如国内中转），请在设置页关闭该开关。
• 旧配置中的 aliapi 专用上游（阿里私享 DoH API）不再受支持：保存时会被明确拒绝，请改用 udp/tcp/tls/https 形式的上游；普通公共 DNS 上游不受影响。
• Mihomo 控制器（:9090）默认启用随机 secret：配置已有自定义 secret 时优先使用；缺少该字段时由 MSF 生成并保存，后续重启复用；显式设置顶层 secret: "" 表示不要求 Mihomo 控制器认证，建议保持认证。默认配置已加入这三条注释。直连工具可从「Mihomo 概览」复制 secret；mihomo_controller_secret 是 MSF 内部设置，单独清空它不会删除配置文件已有的 secret。修改配置后需应用或重启 Mihomo，自动生成文件的手工修改可能被后续生成覆盖。
• Go 运行时默认 512MiB 软内存上限：这是垃圾回收的软目标，不是硬性进程内存限制，也不保证避免 OOM；Docker/K8s 部署可通过 GOMEMLIMIT 环境变量调整或置 -1 关闭。
• MosDNS 国内默认池为阿里 UDP + 腾讯 UDP + 阿里 IP 直连 DoH：已有自定义覆盖配置保留，可在面板 DNS 上游设置中编辑。并发使用 DoH 与明文 UDP 不代表所有查询都已加密。
• 性能范围：主内容优先加载与波浪 Worker 减少页面阻塞；不支持 Worker 时有兼容回退，地球等组件仍可能出现初始化长任务，不保证所有设备完全无卡顿。

English

Kernel-level CN UDP bypass

• New "CN UDP direct" capability (on by default): UDP traffic destined for
  CN IPs is released at the nftables kernel layer and never enters the proxy
  tunnel, avoiding proxy-core UDP idle-timeout effects for that traffic and
  reducing core session load; this does not eliminate every cause of game
  disconnects. The embedded snapshot is pinned to the CC0 ipverse
  RIR-delegation data (5513 v4 / 2033 v6), supports runtime overrides, and has
  a reproducible per-CIDR validation script.
• Settings → System → "UDP direct": a master toggle (hot-applied), with the
  previous game-UDP port list kept as a supplemental override for
  direct-but-overseas targets (e.g. self-hosted voice servers).

DNS upstream modernization (forward migration + first-run benchmark)

• Migrate aliapi upstreams to the enhanced forward plugin already included
  in the selected MosDNS fork, restoring ordinary UDP/TCP compatibility
  with per-upstream timeouts and SOCKS5 options. Forward is an internal
  plugin, not a new protocol in the editor. NXDOMAIN and other address-free
  responses may wait for concurrent upstreams; latency depends on the
  network and configured timeouts, with no fixed millisecond guarantee.
• The default domestic pool is now a cross-vendor concurrent mix (Ali UDP +
  Tencent UDP + Ali DoH). Existing overrides are preserved and migrated
  transparently (bare IPs gain protocol prefixes; legacy aliapi-only
  entries are rejected with an explicit message).
• New DNS upstream benchmark: the setup wizard's Network & DNS step now
  probes major public resolvers (UDP and IP-direct DoH) plus the local
  gateway/DHCP DNS — three rounds per candidate including an NXDOMAIN
  probe — drops unreachable candidates, and recommends a cross-vendor
  Top3 that can be applied in one click; the recommended mix is now
  "two fastest UDP + one DoH fallback" instead of pure latency ordering,
  so a fast gateway can no longer push the encrypted upstream out of the
  recommendation. The same panel is available on the MosDNS system page
  for re-benchmarking at any time.
• The upstream editor no longer offers the aliapi protocol; secret
  redaction and preservation for stored overrides is unchanged.

Engineering fixes

• Update Browserslist, postcss-selector-parser, qs and related lockfile dependencies in the frontend build/CLI toolchain to address reported security advisories.

• Windows cross-compilation of the cloudflareredirect package fixed:
  process-group setup split per platform (Setpgid).

• Fixed intermittent smart-core resource verification test failures caused
  by insufficient mtime granularity on some filesystems.

• Fixed misleading update-check results on development builds (e.g. the
  untagged "0.1.0-dev" from a plain go build): the check used to claim
  "already latest" (and the status card even showed "completed") while a
  newer release existed and self-update was merely held back by design.
  It now honestly reports "new version detected; self-update is disabled
  on development builds".

• Hardened PR #13 before integration: GitHub Release metadata never transits
  public mirrors; self-update requires an independently trusted GitHub SHA-256
  digest and re-verifies it before installation. Also fixed .lan/.local
  substring overmatching, DNS benchmarks accepting SERVFAIL/REFUSED, custom
  Mihomo secret precedence, viewer writes to global custom CSS, gzip content
  negotiation, and child restart races during shutdown.

• The cycle's primary implementation was contributed by
  Timeink88 in PR #13; maintainers completed
  the security, compatibility, test, and provenance hardening on that branch.

Appearance & skin system

• Fixed preferences being wiped on every restart: session cleanup triggered by token expiry no longer deletes appearance keys; appearance settings now fully synced to backend SQLite.
• Skin system: Amber (warm-white glass) and Classic glass skins, independent of light/dark mode; brand accent color picker with live preview.
• Classic glass (the original MSF blue) remains the default. Selecting Amber now also updates the login page's animated waves from the skin's light/dark palette.
• Color studio: globalized accent (sidebar/segments/chart palette/atmosphere/selection follow the accent), atmosphere hue slider, custom CSS editor with template fill, debounced live preview and undo.

GitHub download reliability & tokens

• GitHub Release metadata always comes from the official TLS endpoint. Asset downloads use only an administrator-supplied proxy or accelerator prefix; MSF no longer bundles, automatically probes, ranks, or switches public mirrors. The panel can explicitly test only the configured accelerator without changing routing. Personal tokens remain encrypted at rest, and assets still require a trusted SHA-256 digest.

Performance quick wins

• Prefer an OffscreenCanvas worker for wave initialization and rendering, keeping GPU setup off the UI thread and avoiding unrelated renderer extension discovery. Preserve the original shader, skin palette, pixel budgets, visibility pause and static mode; fall back to main-thread rendering when unsupported or startup fails, and retain the static surface without WebGL.

• Improve Mihomo cold loads: separate wave and globe dependencies, preload target route code alongside authentication, and start the persistent background after primary content. Publish proxy nodes before auxiliary requests; defer charts, load globe/rules/providers near the viewport, and fetch full runtime snapshots only when advanced details are opened.

• Tiered static caching: immutable for hashed bundles, one hour for fixed-name assets, index.html always fresh.

• Mihomo default log level info→warning; token/secret query params redacted from msf logs; log rotation tiered by free disk space; default 512MiB soft GOMEMLIMIT (env overridable).

• Dropped never-read response mirrors on /mihomo/rules, /logs/{service}, /mosdns/logs etc. (47%-80% smaller payloads).

DNS stability

• Killed the A...

v0.6.3

v0.6.3 - 2026-09-06

中文

大规模代理页面性能与加载优化

• 精简 Mihomo 代理接口响应，移除重复别名和默认原始响应，并支持 gzip；搜索结果会同步裁剪 provider 节点，减少冷加载传输与解析开销。
• 主界面和各功能页面改为按路由懒加载；EarthRenderer、YamlEditor 等重型模块仅在需要时加载，降低首次进入登录页和管理页面的脚本开销。
• Mihomo 代理节点列表采用视口级内容跳过和分批渲染，减少大量节点同时参与布局、绘制和 React 更新。
• Mihomo 概览中的图表改为接近视口时初始化，连接拓扑更新增加防抖和低优先级调度，连接历史按批次显示，改善持续刷新时的交互流畅度。
• 保留登录页外观质量、场景和用户选择的动态背景设置，默认使用“动态场景 + 平衡”效果档位。

English

Large proxy-page performance and loading improvements

• Reduced Mihomo proxy API responses by removing duplicate aliases and the default raw payload, added gzip support, and filtered provider nodes together with search results to lower cold-load transfer and parsing cost.
• Switched the main shell and feature pages to route-level lazy loading; heavy modules such as EarthRenderer and YamlEditor load only when needed, reducing initial script work.
• Added viewport-aware content skipping and batched rendering for Mihomo proxy nodes so large lists perform less layout, paint, and React work at once.
• Deferred Overview chart initialization near the viewport, debounced and deprioritized connection-topology updates, and batched connection-history rows to keep live refreshes interactive.
• Preserved login appearance, scene, and user-selected dynamic-background settings, with Dynamic scene + Balanced quality as the default.

v0.6.2

v0.6.2 - 2026-08-29

中文

Mihomo Smart 核心与配置流程完善

• 新增 Meta（官方稳定版）与 Smart（Alpha 核心）选择和切换，初始化页、配置管理、代理分组编辑与组件更新均可识别当前核心。
• Smart 核心支持 smart 代理分组编辑，并提供 LightGBM 模型与 ASN 数据的下载进度、取消和状态检查；Meta 核心会拒绝 Smart 专属字段和资源操作。
• 切换核心时先回到默认配置，保留用户配置以及已经下载的另一种核心，后续可直接切换回来；同时补全活动配置校验、启动失败回滚和旧版 Mihomo 二进制路径兼容。
• 修复默认配置修改后无法弹出“保存为用户配置”、Smart 字段保存后丢失、采样率默认值显示异常及设置页已开启拨钮颜色丢失等问题。
• 统一 GitHub 资源下载路径，改进 Smart 资源下载的超时、取消、轮询和摘要校验，减少重复读取与并发请求。
• 代理测速超时现在与前端设置同步，HTTP 链式代理不再被固定的 1500ms 前端等待提前判定为失败。
• 登录页更新公告升级为 v0.6.2 内容，并继续保留“本次关闭”和“不再显示”两种操作。

English

Mihomo Smart core and configuration workflow improvements

• Added Meta (official stable) and Smart (alpha) core selection and switching across setup, configuration management, proxy-group editing, and component updates.
• Added Smart proxy-group editing plus progress, cancellation, and state checks for LightGBM model and ASN data downloads. Meta rejects Smart-only fields and resource operations.
• Core switching now returns to the default configuration while preserving user configurations and both downloaded core binaries, allowing an immediate switch back later. Active-config validation, startup rollback, and legacy Mihomo binary-path compatibility were also added.
• Fixed saving default-config changes as a user configuration, Smart-field round trips, the sample-rate default display, and missing enabled colors on Settings toggles.
• Unified GitHub resource download routing and improved Smart download timeouts, cancellation, polling, and digest validation while reducing repeated reads and overlapping requests.
• Synchronized proxy-test waiting with the configured timeout so HTTP chained proxies are no longer marked failed by a fixed 1500 ms frontend cutoff.
• Refreshed the login announcement for v0.6.2 while retaining separate session-close and permanent-dismiss actions.

v0.6.1

v0.6.1 - 2026-08-25

中文

AI Agent、动态质量档位与登录更新公告

• 接入首版 AI Agent 管理能力，支持 OpenAI Responses、自定义 Skill 与管理员专属入口。
• 视觉质量的“平衡”和“减少效果”档位继续保留动态背景，通过降低像素预算、DPR、采样和玻璃成本改善性能；新初始化默认使用“动态场景 + 平衡”。
• 用户保存过的场景与质量参数在启动、刷新和升级后保持不变。
• “纯净中性”恢复 v0.4.7.5/v0.4.7.7 的静态背景特效，并同步应用到主页与登录页。
• 登录页增加可按会话关闭或永久隐藏的版本更新公告，介绍 Mihomo 配置恢复和 AI Agent 能力。

English

AI Agent, dynamic quality tiers, and login update announcement

• Added the first AI Agent management experience with OpenAI Responses, custom Skills, and an administrator-only entry point.
• Kept the background animated in the Balanced and Reduced Effects quality tiers while lowering pixel budgets, DPR, sampling, and glass cost; new installations now default to Dynamic scene + Balanced quality.
• Preserved user-selected scene and quality settings across startup, reloads, and upgrades.
• Restored the v0.4.7.5/v0.4.7.7 static background effect for the Neutral scene on both the main shell and login page.
• Added a versioned login update announcement that can be dismissed for the session or permanently hidden, covering Mihomo config recovery and the AI Agent.

v0.6.0

v0.6.0 - 2026-08-23

中文

独立界面、来源说明与发布基线

• 全面重做登录、初始化、主框架、导航、MosDNS、Mihomo、日志、配置和设置界面，统一页面标题、响应式布局、背景与动效，并针对长列表、图表和代理页面优化渲染性能。
• 增加 MosDNS 一键本地回环诊断，改善客户端模式选择、规则列表、配置编辑器、日志展示和 Mihomo 页面设置的使用体验。
• 将运行时模板目录从历史命名调整为中性的 runtime_templates，移除旧项目名兼容入口、已停用的 Mihomo 旧页面和未使用的第三方图标；保留运行所需的 MosDNS/Mihomo 配置与规则数据。
• 补全双语 README、第三方来源与许可证清单、UI 来源记录和品牌政策；MSF 自有 Mizar Logo 与动效继续作为项目标识，第三方组件和改编代码按各自许可证标注。
• 更新 Mihomo 默认路由与恢复逻辑，并保持 MosDNS、Mihomo、Zashboard 下载来源及摘要验证可审计。
• 将 Mizar 源文件、当前动效、QA 记录和正式导出统一整理到 logo_motion_mizar/，删除重复概念稿、旧版动效和过时 UI 验收资料；品牌生成脚本现在同步生成完整 SHA-256 清单。
• 按品牌、合规、Docker 和发布职责重组仓库脚本，删除未接入的前端页面、组件和 Hook，并清除 Go 后端不可达的旧诊断、下载、面板及更新辅助代码。
• 清理前端未使用依赖并显式声明直接依赖，发布候选的 npm audit 保持零已知漏洞。
• 本版本从同一个干净的 main tag 构建 Linux、Unraid、fnOS、macOS 和 GHCR 镜像；旧项目名兼容入口已经删除，依赖该入口的外部脚本需要改用 msf 命令和当前数据目录。

English

Independent UI, provenance, and release baseline

• Reworked the login, setup, application shell, navigation, MosDNS, Mihomo, logs, configuration, and settings interfaces with consistent page headers, responsive layouts, backgrounds, and motion, plus rendering improvements for long lists, charts, and proxy views.
• Added one-shot local-loop MosDNS diagnostics and refined client mode selection, rule lists, configuration editors, log presentation, and persistent Mihomo page preferences.
• Renamed the runtime template directory from its historical name to the neutral runtime_templates, removed legacy project-name compatibility entry points, retired Mihomo pages, and unused third-party icons while retaining the MosDNS and Mihomo configuration and rule data required at runtime.
• Expanded the bilingual README, third-party provenance and license notices, UI provenance record, and brand policy. MSF's Mizar logo and motion remain the project identity, while third-party components and adapted code are identified under their respective licenses.
• Refreshed default Mihomo routing and restore behavior while keeping MosDNS, Mihomo, and Zashboard download sources and digest verification auditable.
• Consolidated Mizar source artwork, current motion, QA records, and delivery exports under logo_motion_mizar/; removed duplicate concepts, retired motion work, and obsolete UI acceptance material; and made the brand generator refresh the complete SHA-256 manifest.
• Grouped repository scripts by brand, compliance, Docker, and release ownership; removed disconnected frontend pages, components, and hooks; and deleted unreachable legacy diagnostic, download, panel, and update helpers from the Go backend.
• Removed unused frontend dependencies, declared directly imported packages explicitly, and kept the release candidate at zero known npm audit vulnerabilities.
• Linux, Unraid, fnOS, macOS, and GHCR artifacts are built from the same clean main tag. Legacy project-name compatibility entry points have been removed; external scripts using them must switch to the msf command and current data directory.