release: Refactor release tracks for Linux packages and Docker

Support 4 release tracks instead of 2: - sing-box / latest (stable release) - sing-box-beta / latest-beta (stable pre-release) - sing-box-testing / latest-testing (testing branch) - sing-box-oldstable / latest-oldstable (oldstable branch) Track is detected via git branch --contains and git tag, replacing the old version-string hyphen check.
Bump version
2026-04-15 05:08:33 +10:00 · 2026-03-24 15:02:44 +08:00 · 2026-03-15 16:57:08 +08:00 · 2026-03-15 16:57:08 +08:00 · 2026-03-15 16:54:55 +08:00 · 2026-03-15 16:54:11 +08:00
668 changed files with 12972 additions and 66506 deletions
--- a/.fpm_openwrt
+++ b/.fpm_openwrt
@@ -14,7 +14,6 @@
 --depends kmod-inet-diag
 --depends kmod-tun
 --depends firewall4
--depends kmod-nft-queue

 --before-remove release/config/openwrt.prerm

--- a/.fpm_systemd
+++ b/.fpm_systemd
@@ -4,7 +4,6 @@
 --license GPL-3.0-or-later
 --description "The universal proxy platform."
 --url "https://sing-box.sagernet.org/"
--vendor SagerNet
 --maintainer "nekohasekai <contact-git@sekai.icu>"
 --deb-field "Bug: https://github.com/SagerNet/sing-box/issues"
 --no-deb-generate-changes
--- a/.github/CRONET_GO_VERSION
+++ b/.github/CRONET_GO_VERSION
@@ -1 +0,0 @@
-335e5bef5d88fc4474c9a70b865561f45a67de83
--- a/.github/build_alpine_apk.sh
+++ b/.github/build_alpine_apk.sh
@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-
-set -e -o pipefail
-
-ARCHITECTURE="$1"
-VERSION="$2"
-BINARY_PATH="$3"
-OUTPUT_PATH="$4"
-
-if [ -z "$ARCHITECTURE" ] || [ -z "$VERSION" ] || [ -z "$BINARY_PATH" ] || [ -z "$OUTPUT_PATH" ]; then
-  echo "Usage: $0 <architecture> <version> <binary_path> <output_path>"
-  exit 1
-fi
-
-PROJECT=$(cd "$(dirname "$0")/.."; pwd)
-
-# Convert version to APK format:
-#   1.13.0-beta.8  -> 1.13.0_beta8-r0
-#   1.13.0-rc.3    -> 1.13.0_rc3-r0
-#   1.13.0         -> 1.13.0-r0
-APK_VERSION=$(echo "$VERSION" | sed -E 's/-([a-z]+)\.([0-9]+)/_\1\2/')
-APK_VERSION="${APK_VERSION}-r0"
-
-ROOT_DIR=$(mktemp -d)
-trap 'rm -rf "$ROOT_DIR"' EXIT
-
-# Binary
-install -Dm755 "$BINARY_PATH" "$ROOT_DIR/usr/bin/sing-box"
-
-# Config files
-install -Dm644 "$PROJECT/release/config/config.json" "$ROOT_DIR/etc/sing-box/config.json"
-install -Dm755 "$PROJECT/release/config/sing-box.initd" "$ROOT_DIR/etc/init.d/sing-box"
-install -Dm644 "$PROJECT/release/config/sing-box.confd" "$ROOT_DIR/etc/conf.d/sing-box"
-
-# Service files
-install -Dm644 "$PROJECT/release/config/sing-box.service" "$ROOT_DIR/usr/lib/systemd/system/sing-box.service"
-install -Dm644 "$PROJECT/release/config/sing-box@.service" "$ROOT_DIR/usr/lib/systemd/system/sing-box@.service"
-
-# Completions
-install -Dm644 "$PROJECT/release/completions/sing-box.bash" "$ROOT_DIR/usr/share/bash-completion/completions/sing-box.bash"
-install -Dm644 "$PROJECT/release/completions/sing-box.fish" "$ROOT_DIR/usr/share/fish/vendor_completions.d/sing-box.fish"
-install -Dm644 "$PROJECT/release/completions/sing-box.zsh" "$ROOT_DIR/usr/share/zsh/site-functions/_sing-box"
-
-# License
-install -Dm644 "$PROJECT/LICENSE" "$ROOT_DIR/usr/share/licenses/sing-box/LICENSE"
-
-# APK metadata
-PACKAGES_DIR="$ROOT_DIR/lib/apk/packages"
-mkdir -p "$PACKAGES_DIR"
-
-# .conffiles
-cat > "$PACKAGES_DIR/.conffiles" <<'EOF'
-/etc/conf.d/sing-box
-/etc/init.d/sing-box
-/etc/sing-box/config.json
-EOF
-
-# .conffiles_static (sha256 checksums)
-while IFS= read -r conffile; do
-  sha256=$(sha256sum "$ROOT_DIR$conffile" | cut -d' ' -f1)
-  echo "$conffile $sha256"
-done < "$PACKAGES_DIR/.conffiles" > "$PACKAGES_DIR/.conffiles_static"
-
-# .list (all files, excluding lib/apk/packages/ metadata)
-(cd "$ROOT_DIR" && find . -type f -o -type l) \
-  | sed 's|^\./|/|' \
-  | grep -v '^/lib/apk/packages/' \
-  | sort > "$PACKAGES_DIR/.list"
-
-# Build APK
-apk mkpkg \
-  --info "name:sing-box" \
-  --info "version:${APK_VERSION}" \
-  --info "description:The universal proxy platform." \
-  --info "arch:${ARCHITECTURE}" \
-  --info "license:GPL-3.0-or-later with name use or association addition" \
-  --info "origin:sing-box" \
-  --info "url:https://sing-box.sagernet.org/" \
-  --info "maintainer:nekohasekai <contact-git@sekai.icu>" \
-  --files "$ROOT_DIR" \
-  --output "$OUTPUT_PATH"
--- a/.github/build_openwrt_apk.sh
+++ b/.github/build_openwrt_apk.sh
@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-
-set -e -o pipefail
-
-ARCHITECTURE="$1"
-VERSION="$2"
-BINARY_PATH="$3"
-OUTPUT_PATH="$4"
-
-if [ -z "$ARCHITECTURE" ] || [ -z "$VERSION" ] || [ -z "$BINARY_PATH" ] || [ -z "$OUTPUT_PATH" ]; then
-  echo "Usage: $0 <architecture> <version> <binary_path> <output_path>"
-  exit 1
-fi
-
-PROJECT=$(cd "$(dirname "$0")/.."; pwd)
-
-# Convert version to APK format:
-#   1.13.0-beta.8  -> 1.13.0_beta8-r0
-#   1.13.0-rc.3    -> 1.13.0_rc3-r0
-#   1.13.0         -> 1.13.0-r0
-APK_VERSION=$(echo "$VERSION" | sed -E 's/-([a-z]+)\.([0-9]+)/_\1\2/')
-APK_VERSION="${APK_VERSION}-r0"
-
-ROOT_DIR=$(mktemp -d)
-trap 'rm -rf "$ROOT_DIR"' EXIT
-
-# Binary
-install -Dm755 "$BINARY_PATH" "$ROOT_DIR/usr/bin/sing-box"
-
-# Config files
-install -Dm644 "$PROJECT/release/config/config.json" "$ROOT_DIR/etc/sing-box/config.json"
-install -Dm644 "$PROJECT/release/config/openwrt.conf" "$ROOT_DIR/etc/config/sing-box"
-install -Dm755 "$PROJECT/release/config/openwrt.init" "$ROOT_DIR/etc/init.d/sing-box"
-install -Dm644 "$PROJECT/release/config/openwrt.keep" "$ROOT_DIR/lib/upgrade/keep.d/sing-box"
-
-# Completions
-install -Dm644 "$PROJECT/release/completions/sing-box.bash" "$ROOT_DIR/usr/share/bash-completion/completions/sing-box.bash"
-install -Dm644 "$PROJECT/release/completions/sing-box.fish" "$ROOT_DIR/usr/share/fish/vendor_completions.d/sing-box.fish"
-install -Dm644 "$PROJECT/release/completions/sing-box.zsh" "$ROOT_DIR/usr/share/zsh/site-functions/_sing-box"
-
-# License
-install -Dm644 "$PROJECT/LICENSE" "$ROOT_DIR/usr/share/licenses/sing-box/LICENSE"
-
-# APK metadata
-PACKAGES_DIR="$ROOT_DIR/lib/apk/packages"
-mkdir -p "$PACKAGES_DIR"
-
-# .conffiles
-cat > "$PACKAGES_DIR/.conffiles" <<'EOF'
-/etc/config/sing-box
-/etc/sing-box/config.json
-EOF
-
-# .conffiles_static (sha256 checksums)
-while IFS= read -r conffile; do
-  sha256=$(sha256sum "$ROOT_DIR$conffile" | cut -d' ' -f1)
-  echo "$conffile $sha256"
-done < "$PACKAGES_DIR/.conffiles" > "$PACKAGES_DIR/.conffiles_static"
-
-# .list (all files, excluding lib/apk/packages/ metadata)
-(cd "$ROOT_DIR" && find . -type f -o -type l) \
-  | sed 's|^\./|/|' \
-  | grep -v '^/lib/apk/packages/' \
-  | sort > "$PACKAGES_DIR/.list"
-
-# Build APK
-apk mkpkg \
-  --info "name:sing-box" \
-  --info "version:${APK_VERSION}" \
-  --info "description:The universal proxy platform." \
-  --info "arch:${ARCHITECTURE}" \
-  --info "license:GPL-3.0-or-later" \
-  --info "origin:sing-box" \
-  --info "url:https://sing-box.sagernet.org/" \
-  --info "maintainer:nekohasekai <contact-git@sekai.icu>" \
-  --info "depends:ca-bundle kmod-inet-diag kmod-tun firewall4 kmod-nft-queue" \
-  --info "provider-priority:100" \
-  --script "pre-deinstall:${PROJECT}/release/config/openwrt.prerm" \
-  --files "$ROOT_DIR" \
-  --output "$OUTPUT_PATH"
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -6,7 +6,7 @@
    ":disableRateLimiting"
  ],
  "baseBranches": [
-    "unstable"
+    "dev-next"
  ],
  "golang": {
    "enabled": false
--- a/.github/setup_go_for_macos1013.sh
+++ b/.github/setup_go_for_macos1013.sh
@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-VERSION="1.25.8"
-PATCH_COMMITS=(
-  "afe69d3cec1c6dcf0f1797b20546795730850070"
-  "1ed289b0cf87dc5aae9c6fe1aa5f200a83412938"
-)
-CURL_ARGS=(
-  -fL
-  --silent
-  --show-error
-)
-
-if [[ -n "${GITHUB_TOKEN:-}" ]]; then
-  CURL_ARGS+=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
-fi
-
-mkdir -p "$HOME/go"
-cd "$HOME/go"
-wget "https://dl.google.com/go/go${VERSION}.darwin-arm64.tar.gz"
-tar -xzf "go${VERSION}.darwin-arm64.tar.gz"
-#cp -a go go_bootstrap
-mv go go_osx
-cd go_osx
-
-# these patch URLs only work on golang1.25.x
-# that means after golang1.26 release it must be changed
-# see: https://github.com/SagerNet/go/commits/release-branch.go1.25/
-# revert:
-# 33d3f603c1: "cmd/link/internal/ld: use 12.0.0 OS/SDK versions for macOS linking"
-# 937368f84e: "crypto/x509: change how we retrieve chains on darwin"
-
-for patch_commit in "${PATCH_COMMITS[@]}"; do
-  curl "${CURL_ARGS[@]}" "https://github.com/SagerNet/go/commit/${patch_commit}.diff" | patch --verbose -p 1
-done
-
-# Rebuild is not needed: we build with CGO_ENABLED=1, so Apple's external
-# linker handles LC_BUILD_VERSION via MACOSX_DEPLOYMENT_TARGET, and the
-# stdlib (crypto/x509) is compiled from patched src automatically.
-#cd src
-#GOROOT_BOOTSTRAP="$HOME/go/go_bootstrap" ./make.bash
-#cd ../..
-#rm -rf go_bootstrap "go${VERSION}.darwin-arm64.tar.gz"
--- a/.github/update_cronet.sh
+++ b/.github/update_cronet.sh
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-set -e -o pipefail
-
-SCRIPT_DIR=$(dirname "$0")
-PROJECTS=$SCRIPT_DIR/../..
-
-git -C $PROJECTS/cronet-go fetch origin main
-git -C $PROJECTS/cronet-go fetch origin go
-go get -x github.com/sagernet/cronet-go/all@$(git -C $PROJECTS/cronet-go rev-parse origin/go)
-go get -x github.com/sagernet/cronet-go@$(git -C $PROJECTS/cronet-go rev-parse origin/go)
-go mod tidy
-git -C $PROJECTS/cronet-go rev-parse origin/go > "$SCRIPT_DIR/CRONET_GO_VERSION"
--- a/.github/update_cronet_dev.sh
+++ b/.github/update_cronet_dev.sh
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-set -e -o pipefail
-
-SCRIPT_DIR=$(dirname "$0")
-PROJECTS=$SCRIPT_DIR/../..
-
-git -C $PROJECTS/cronet-go fetch origin dev
-git -C $PROJECTS/cronet-go fetch origin go_dev
-go get -x github.com/sagernet/cronet-go/all@$(git -C $PROJECTS/cronet-go rev-parse origin/go_dev)
-go get -x github.com/sagernet/cronet-go@$(git -C $PROJECTS/cronet-go rev-parse origin/go_dev)
-go mod tidy
-git -C $PROJECTS/cronet-go rev-parse origin/dev > "$SCRIPT_DIR/CRONET_GO_VERSION"
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,9 +25,7 @@ on:
          - publish-android
  push:
    branches:
-      - stable
-      - testing
-      - unstable
+      - oldstable

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}-${{ inputs.build }}
@@ -70,61 +68,53 @@ jobs:
    strategy:
      matrix:
        include:
-          - { os: linux, arch: amd64, variant: purego, naive: true }
-          - { os: linux, arch: amd64, variant: glibc, naive: true }
-          - { os: linux, arch: amd64, variant: musl, naive: true, debian: amd64, rpm: x86_64, pacman: x86_64, alpine: x86_64, openwrt: "x86_64" }
-
-          - { os: linux, arch: arm64, variant: purego, naive: true }
-          - { os: linux, arch: arm64, variant: glibc, naive: true }
-          - { os: linux, arch: arm64, variant: musl, naive: true, debian: arm64, rpm: aarch64, pacman: aarch64, alpine: aarch64, openwrt: "aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic" }
-
-          - { os: linux, arch: "386", go386: sse2 }
-          - { os: linux, arch: "386", variant: glibc, naive: true, go386: sse2 }
-          - { os: linux, arch: "386", variant: musl, naive: true, go386: sse2, debian: i386, rpm: i386, alpine: x86, openwrt: "i386_pentium4" }
-
-          - { os: linux, arch: arm, goarm: "7" }
-          - { os: linux, arch: arm, variant: glibc, naive: true, goarm: "7" }
-          - { os: linux, arch: arm, variant: musl, naive: true, goarm: "7", debian: armhf, rpm: armv7hl, pacman: armv7hl, alpine: armv7, openwrt: "arm_cortex-a5_vfpv4 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 arm_cortex-a15_neon-vfpv4" }
-
-          - { os: linux, arch: mipsle, gomips: hardfloat, naive: true, variant: glibc }
-          - { os: linux, arch: mipsle, gomips: softfloat, naive: true, variant: musl, debian: mipsel, rpm: mipsel, openwrt: "mipsel_24kc mipsel_74kc mipsel_mips32" }
-          - { os: linux, arch: mips64le, gomips: hardfloat, naive: true, variant: glibc, debian: mips64el, rpm: mips64el }
-          - { os: linux, arch: riscv64, naive: true, variant: glibc }
-          - { os: linux, arch: riscv64, naive: true, variant: musl, debian: riscv64, rpm: riscv64, alpine: riscv64, openwrt: "riscv64_generic" }
-          - { os: linux, arch: loong64, naive: true, variant: glibc }
-          - { os: linux, arch: loong64, naive: true, variant: musl, debian: loongarch64, rpm: loongarch64, alpine: loongarch64, openwrt: "loongarch64_generic" }
-
+          - { os: linux, arch: amd64, debian: amd64, rpm: x86_64, pacman: x86_64, openwrt: "x86_64" }
+          - { os: linux, arch: "386", go386: sse2, debian: i386, rpm: i386, openwrt: "i386_pentium4" }
          - { os: linux, arch: "386", go386: softfloat, openwrt: "i386_pentium-mmx" }
+          - { os: linux, arch: arm64, debian: arm64, rpm: aarch64, pacman: aarch64, openwrt: "aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic" }
          - { os: linux, arch: arm, goarm: "5", openwrt: "arm_arm926ej-s arm_cortex-a7 arm_cortex-a9 arm_fa526 arm_xscale" }
          - { os: linux, arch: arm, goarm: "6", debian: armel, rpm: armv6hl, openwrt: "arm_arm1176jzf-s_vfp" }
+          - { os: linux, arch: arm, goarm: "7", debian: armhf, rpm: armv7hl, pacman: armv7hl, openwrt: "arm_cortex-a5_vfpv4 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 arm_cortex-a15_neon-vfpv4" }
          - { os: linux, arch: mips, gomips: softfloat, openwrt: "mips_24kc mips_4kec mips_mips32" }
-          - { os: linux, arch: mipsle, gomips: hardfloat, openwrt: "mipsel_24kc_24kf" }
-          - { os: linux, arch: mipsle, gomips: softfloat }
+          - { os: linux, arch: mipsle, gomips: hardfloat, debian: mipsel, rpm: mipsel, openwrt: "mipsel_24kc_24kf" }
+          - { os: linux, arch: mipsle, gomips: softfloat, openwrt: "mipsel_24kc mipsel_74kc mipsel_mips32" }
          - { os: linux, arch: mips64, gomips: softfloat, openwrt: "mips64_mips64r2 mips64_octeonplus" }
-          - { os: linux, arch: mips64le, gomips: hardfloat }
+          - { os: linux, arch: mips64le, gomips: hardfloat, debian: mips64el, rpm: mips64el }
          - { os: linux, arch: mips64le, gomips: softfloat, openwrt: "mips64el_mips64r2" }
          - { os: linux, arch: s390x, debian: s390x, rpm: s390x }
          - { os: linux, arch: ppc64le, debian: ppc64el, rpm: ppc64le }
-          - { os: linux, arch: riscv64 }
-          - { os: linux, arch: loong64 }
+          - { os: linux, arch: riscv64, debian: riscv64, rpm: riscv64, openwrt: "riscv64_generic" }
+          - { os: linux, arch: loong64, debian: loongarch64, rpm: loongarch64, openwrt: "loongarch64_generic" }

+          - { os: windows, arch: amd64 }
          - { os: windows, arch: amd64, legacy_win7: true, legacy_name: "windows-7" }
+          - { os: windows, arch: "386" }
          - { os: windows, arch: "386", legacy_win7: true, legacy_name: "windows-7" }
+          - { os: windows, arch: arm64 }

-          - { os: android, arch: arm64, ndk: "aarch64-linux-android23" }
-          - { os: android, arch: arm, ndk: "armv7a-linux-androideabi23" }
-          - { os: android, arch: amd64, ndk: "x86_64-linux-android23" }
-          - { os: android, arch: "386", ndk: "i686-linux-android23" }
+          - { os: darwin, arch: amd64 }
+          - { os: darwin, arch: arm64 }
+          - { os: darwin, arch: amd64, legacy_go124: true, legacy_name: "macos-11" }
+
+          - { os: android, arch: arm64, ndk: "aarch64-linux-android21" }
+          - { os: android, arch: arm, ndk: "armv7a-linux-androideabi21" }
+          - { os: android, arch: amd64, ndk: "x86_64-linux-android21" }
+          - { os: android, arch: "386", ndk: "i686-linux-android21" }
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
        with:
          fetch-depth: 0
      - name: Setup Go
-        if: ${{ ! matrix.legacy_win7 }}
+        if: ${{ ! (matrix.legacy_win7 || matrix.legacy_go124) }}
        uses: actions/setup-go@v5
        with:
          go-version: ~1.25.8
+      - name: Setup Go 1.24
+        if: matrix.legacy_go124
+        uses: actions/setup-go@v5
+        with:
+          go-version: ~1.24.10
      - name: Cache Go for Windows 7
        if: matrix.legacy_win7
        id: cache-go-for-windows7
@@ -132,11 +122,9 @@ jobs:
        with:
          path: |
            ~/go/go_win7
-          key: go_win7_1258
+          key: go_win7_1255
      - name: Setup Go for Windows 7
        if: matrix.legacy_win7 && steps.cache-go-for-windows7.outputs.cache-hit != 'true'
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
        run: |-
          .github/setup_go_for_windows7.sh
      - name: Setup Go for Windows 7
@@ -150,54 +138,6 @@ jobs:
        with:
          ndk-version: r28
          local-cache: true
-      - name: Clone cronet-go
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          CRONET_GO_VERSION=$(cat .github/CRONET_GO_VERSION)
-          git init ~/cronet-go
-          git -C ~/cronet-go remote add origin https://github.com/sagernet/cronet-go.git
-          git -C ~/cronet-go fetch --depth=1 origin "$CRONET_GO_VERSION"
-          git -C ~/cronet-go checkout FETCH_HEAD
-          git -C ~/cronet-go submodule update --init --recursive --depth=1
-      - name: Regenerate Debian keyring
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          rm -f ~/cronet-go/naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
-          cd ~/cronet-go
-          GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
-      - name: Cache Chromium toolchain
-        if: matrix.naive
-        id: cache-chromium-toolchain
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/cronet-go/naiveproxy/src/third_party/llvm-build/
-            ~/cronet-go/naiveproxy/src/gn/out/
-            ~/cronet-go/naiveproxy/src/chrome/build/pgo_profiles/
-            ~/cronet-go/naiveproxy/src/out/sysroot-build/
-          key: chromium-toolchain-${{ matrix.arch }}-${{ matrix.variant }}-${{ hashFiles('.github/CRONET_GO_VERSION') }}
-      - name: Download Chromium toolchain
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          cd ~/cronet-go
-          if [[ "${{ matrix.variant }}" == "musl" ]]; then
-            go run ./cmd/build-naive --target=linux/${{ matrix.arch }} --libc=musl download-toolchain
-          else
-            go run ./cmd/build-naive --target=linux/${{ matrix.arch }} download-toolchain
-          fi
-      - name: Set Chromium toolchain environment
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          cd ~/cronet-go
-          if [[ "${{ matrix.variant }}" == "musl" ]]; then
-            go run ./cmd/build-naive --target=linux/${{ matrix.arch }} --libc=musl env >> $GITHUB_ENV
-          else
-            go run ./cmd/build-naive --target=linux/${{ matrix.arch }} env >> $GITHUB_ENV
-          fi
      - name: Set tag
        run: |-
          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
@@ -205,83 +145,15 @@ jobs:
      - name: Set build tags
        run: |
          set -xeuo pipefail
-          if [[ "${{ matrix.naive }}" == "true" ]]; then
-            TAGS=$(cat release/DEFAULT_BUILD_TAGS)
-          else
-            TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS)
-          fi
-          if [[ "${{ matrix.variant }}" == "purego" ]]; then
-            TAGS="${TAGS},with_purego"
-          elif [[ "${{ matrix.variant }}" == "musl" ]]; then
-            TAGS="${TAGS},with_musl"
-          fi
+          TAGS='with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale'
          echo "BUILD_TAGS=${TAGS}" >> "${GITHUB_ENV}"
-      - name: Set shared ldflags
-        run: |
-          echo "LDFLAGS_SHARED=$(cat release/LDFLAGS)" >> "${GITHUB_ENV}"
-      - name: Build (purego)
-        if: matrix.variant == 'purego'
+      - name: Build
+        if: matrix.os != 'android'
        run: |
          set -xeuo pipefail
          mkdir -p dist
          go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "0"
-          GOOS: ${{ matrix.os }}
-          GOARCH: ${{ matrix.arch }}
-          GO386: ${{ matrix.go386 }}
-          GOARM: ${{ matrix.goarm }}
-          GOMIPS: ${{ matrix.gomips }}
-          GOMIPS64: ${{ matrix.gomips }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Extract libcronet.so
-        if: matrix.variant == 'purego' && matrix.naive
-        run: |
-          cd ~/cronet-go
-          CGO_ENABLED=0 go run -v ./cmd/build-naive extract-lib --target ${{ matrix.os }}/${{ matrix.arch }} -o $GITHUB_WORKSPACE/dist
-      - name: Build (glibc)
-        if: matrix.variant == 'glibc'
-        run: |
-          set -xeuo pipefail
-          mkdir -p dist
-          go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "1"
-          GOOS: linux
-          GOARCH: ${{ matrix.arch }}
-          GO386: ${{ matrix.go386 }}
-          GOARM: ${{ matrix.goarm }}
-          GOMIPS: ${{ matrix.gomips }}
-          GOMIPS64: ${{ matrix.gomips }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build (musl)
-        if: matrix.variant == 'musl'
-        run: |
-          set -xeuo pipefail
-          mkdir -p dist
-          go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "1"
-          GOOS: linux
-          GOARCH: ${{ matrix.arch }}
-          GO386: ${{ matrix.go386 }}
-          GOARM: ${{ matrix.goarm }}
-          GOMIPS: ${{ matrix.gomips }}
-          GOMIPS64: ${{ matrix.gomips }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build (non-variant)
-        if: matrix.os != 'android' && matrix.variant == ''
-        run: |
-          set -xeuo pipefail
-          mkdir -p dist
-          go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
+          -ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' \
          ./cmd/sing-box
        env:
          CGO_ENABLED: "0"
@@ -301,7 +173,7 @@ jobs:
          export CXX="${CC}++"
          mkdir -p dist
          GOOS=$BUILD_GOOS GOARCH=$BUILD_GOARCH build go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
+          -ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' \
          ./cmd/sing-box
        env:
          CGO_ENABLED: "1"
@@ -320,11 +192,6 @@ jobs:
          elif [[ -n "${{ matrix.legacy_name }}" ]]; then
            DIR_NAME="${DIR_NAME}-legacy-${{ matrix.legacy_name }}"
          fi
-          if [[ "${{ matrix.variant }}" == "glibc" ]]; then
-            DIR_NAME="${DIR_NAME}-glibc"
-          elif [[ "${{ matrix.variant }}" == "musl" ]]; then
-            DIR_NAME="${DIR_NAME}-musl"
-          fi
          echo "DIR_NAME=${DIR_NAME}" >> "${GITHUB_ENV}"
          PKG_VERSION="${{ needs.calculate_version.outputs.version }}"
          PKG_VERSION="${PKG_VERSION//-/\~}"
@@ -396,30 +263,6 @@ jobs:
            .github/deb2ipk.sh "$architecture" "dist/openwrt.deb" "dist/sing-box_${{ needs.calculate_version.outputs.version }}_openwrt_${architecture}.ipk"
          done
          rm "dist/openwrt.deb"
-      - name: Install apk-tools
-        if: matrix.openwrt != '' || matrix.alpine != ''
-        run: |-
-          docker run --rm -v /usr/local/bin:/mnt alpine:edge sh -c "apk add --no-cache apk-tools-static && cp /sbin/apk.static /mnt/apk && chmod +x /mnt/apk"
-      - name: Package OpenWrt APK
-        if: matrix.openwrt != ''
-        run: |-
-          set -xeuo pipefail
-          for architecture in ${{ matrix.openwrt }}; do
-            .github/build_openwrt_apk.sh \
-              "$architecture" \
-              "${{ needs.calculate_version.outputs.version }}" \
-              "dist/sing-box" \
-              "dist/sing-box_${{ needs.calculate_version.outputs.version }}_openwrt_${architecture}.apk"
-          done
-      - name: Package Alpine APK
-        if: matrix.alpine != ''
-        run: |-
-          set -xeuo pipefail
-          .github/build_alpine_apk.sh \
-            "${{ matrix.alpine }}" \
-            "${{ needs.calculate_version.outputs.version }}" \
-            "dist/sing-box" \
-            "dist/sing-box_${{ needs.calculate_version.outputs.version }}_linux_${{ matrix.alpine }}.apk"
      - name: Archive
        run: |
          set -xeuo pipefail
@@ -431,200 +274,15 @@ jobs:
            zip -r "${DIR_NAME}.zip" "${DIR_NAME}"
          else
            cp sing-box "${DIR_NAME}"
-            if [ -f libcronet.so ]; then
-              cp libcronet.so "${DIR_NAME}"
-            fi
            tar -czvf "${DIR_NAME}.tar.gz" "${DIR_NAME}"
          fi
          rm -r "${DIR_NAME}"
-      - name: Cleanup
-        run: rm -f dist/sing-box dist/libcronet.so
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: binary-${{ matrix.os }}_${{ matrix.arch }}${{ matrix.goarm && format('v{0}', matrix.goarm) }}${{ matrix.go386 && format('_{0}', matrix.go386) }}${{ matrix.gomips && format('_{0}', matrix.gomips) }}${{ matrix.legacy_name && format('-legacy-{0}', matrix.legacy_name) }}${{ matrix.variant && format('-{0}', matrix.variant) }}
-          path: "dist"
-  build_darwin:
-    name: Build Darwin binaries
-    if: github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Binary'
-    runs-on: macos-latest
-    needs:
-      - calculate_version
-    strategy:
-      matrix:
-        include:
-          - { arch: amd64 }
-          - { arch: arm64 }
-          - { arch: amd64, legacy_osx: true, legacy_name: "macos-10.13" }
-    steps:
-      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        if: ${{ ! matrix.legacy_osx }}
-        uses: actions/setup-go@v5
-        with:
-          go-version: ^1.25.3
-      - name: Cache Go for macOS 10.13
-        if: matrix.legacy_osx
-        id: cache-go-for-macos1013
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/go/go_osx
-          key: go_osx_1258
-      - name: Setup Go for macOS 10.13
-        if: matrix.legacy_osx && steps.cache-go-for-macos1013.outputs.cache-hit != 'true'
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |-
-          .github/setup_go_for_macos1013.sh
-      - name: Setup Go for macOS 10.13
-        if: matrix.legacy_osx
-        run: |-
-          echo "PATH=$HOME/go/go_osx/bin:$PATH" >> $GITHUB_ENV
-          echo "GOROOT=$HOME/go/go_osx" >> $GITHUB_ENV
-      - name: Set tag
-        run: |-
-          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
-          git tag v${{ needs.calculate_version.outputs.version }} -f
-      - name: Set build tags
-        run: |
-          set -xeuo pipefail
-          if [[ "${{ matrix.legacy_osx }}" != "true" ]]; then
-            TAGS=$(cat release/DEFAULT_BUILD_TAGS)
-          else
-            TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS)
-          fi
-          echo "BUILD_TAGS=${TAGS}" >> "${GITHUB_ENV}"
-      - name: Set shared ldflags
-        run: |
-          echo "LDFLAGS_SHARED=$(cat release/LDFLAGS)" >> "${GITHUB_ENV}"
-      - name: Build
-        run: |
-          set -xeuo pipefail
-          mkdir -p dist
-          go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "1"
-          GOOS: darwin
-          GOARCH: ${{ matrix.arch }}
-          MACOSX_DEPLOYMENT_TARGET: ${{ matrix.legacy_osx && '10.13' || '' }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Set name
-        run: |-
-          DIR_NAME="sing-box-${{ needs.calculate_version.outputs.version }}-darwin-${{ matrix.arch }}"
-          if [[ -n "${{ matrix.legacy_name }}" ]]; then
-            DIR_NAME="${DIR_NAME}-legacy-${{ matrix.legacy_name }}"
-          fi
-          echo "DIR_NAME=${DIR_NAME}" >> "${GITHUB_ENV}"
-      - name: Archive
-        run: |
-          set -xeuo pipefail
-          cd dist
-          mkdir -p "${DIR_NAME}"
-          cp ../LICENSE "${DIR_NAME}"
-          cp sing-box "${DIR_NAME}"
-          tar -czvf "${DIR_NAME}.tar.gz" "${DIR_NAME}"
-          rm -r "${DIR_NAME}"
      - name: Cleanup
        run: rm dist/sing-box
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
-          name: binary-darwin_${{ matrix.arch }}${{ matrix.legacy_name && format('-legacy-{0}', matrix.legacy_name) }}
-          path: "dist"
-  build_windows:
-    name: Build Windows binaries
-    if: github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Binary'
-    runs-on: windows-latest
-    needs:
-      - calculate_version
-    strategy:
-      matrix:
-        include:
-          - { arch: amd64, naive: true }
-          - { arch: "386" }
-          - { arch: arm64, naive: true }
-    steps:
-      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ^1.25.4
-      - name: Set tag
-        run: |-
-          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$env:GITHUB_ENV"
-          git tag v${{ needs.calculate_version.outputs.version }} -f
-      - name: Build
-        if: matrix.naive
-        run: |
-          $TAGS = Get-Content release/DEFAULT_BUILD_TAGS_WINDOWS
-          $LDFLAGS_SHARED = Get-Content release/LDFLAGS
-          mkdir -p dist
-          go build -v -trimpath -o dist/sing-box.exe -tags "$TAGS" `
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' $LDFLAGS_SHARED -s -w -buildid=" `
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "0"
-          GOOS: windows
-          GOARCH: ${{ matrix.arch }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build
-        if: ${{ !matrix.naive }}
-        run: |
-          $TAGS = Get-Content release/DEFAULT_BUILD_TAGS_OTHERS
-          $LDFLAGS_SHARED = Get-Content release/LDFLAGS
-          mkdir -p dist
-          go build -v -trimpath -o dist/sing-box.exe -tags "$TAGS" `
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' $LDFLAGS_SHARED -s -w -buildid=" `
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "0"
-          GOOS: windows
-          GOARCH: ${{ matrix.arch }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Extract libcronet.dll
-        if: matrix.naive
-        run: |
-          $CRONET_GO_VERSION = Get-Content .github/CRONET_GO_VERSION
-          $env:CGO_ENABLED = "0"
-          go run -v "github.com/sagernet/cronet-go/cmd/build-naive@$CRONET_GO_VERSION" extract-lib --target windows/${{ matrix.arch }} -o dist
-      - name: Archive
-        if: matrix.naive
-        run: |
-          $DIR_NAME = "sing-box-${{ needs.calculate_version.outputs.version }}-windows-${{ matrix.arch }}"
-          mkdir "dist/$DIR_NAME"
-          Copy-Item LICENSE "dist/$DIR_NAME"
-          Copy-Item "dist/sing-box.exe" "dist/$DIR_NAME"
-          Copy-Item "dist/libcronet.dll" "dist/$DIR_NAME"
-          Compress-Archive -Path "dist/$DIR_NAME" -DestinationPath "dist/$DIR_NAME.zip"
-          Remove-Item -Recurse "dist/$DIR_NAME"
-      - name: Archive
-        if: ${{ !matrix.naive }}
-        run: |
-          $DIR_NAME = "sing-box-${{ needs.calculate_version.outputs.version }}-windows-${{ matrix.arch }}"
-          mkdir "dist/$DIR_NAME"
-          Copy-Item LICENSE "dist/$DIR_NAME"
-          Copy-Item "dist/sing-box.exe" "dist/$DIR_NAME"
-          Compress-Archive -Path "dist/$DIR_NAME" -DestinationPath "dist/$DIR_NAME.zip"
-          Remove-Item -Recurse "dist/$DIR_NAME"
-      - name: Cleanup
-        if: matrix.naive
-        run: Remove-Item dist/sing-box.exe, dist/libcronet.dll
-      - name: Cleanup
-        if: ${{ !matrix.naive }}
-        run: Remove-Item dist/sing-box.exe
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: binary-windows_${{ matrix.arch }}
+          name: binary-${{ matrix.os }}_${{ matrix.arch }}${{ matrix.goarm && format('v{0}', matrix.goarm) }}${{ matrix.go386 && format('_{0}', matrix.go386) }}${{ matrix.gomips && format('_{0}', matrix.gomips) }}${{ matrix.legacy_name && format('-legacy-{0}', matrix.legacy_name) }}
          path: "dist"
  build_android:
    name: Build Android
@@ -689,9 +347,9 @@ jobs:
      - name: Build
        run: |-
          mkdir clients/android/app/libs
-          cp *.aar clients/android/app/libs
+          cp libbox.aar clients/android/app/libs
          cd clients/android
-          ./gradlew :app:assembleOtherRelease :app:assembleOtherLegacyRelease
+          ./gradlew :app:assemblePlayRelease :app:assembleOtherRelease
        env:
          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
@@ -699,18 +357,8 @@ jobs:
      - name: Prepare upload
        run: |-
          mkdir -p dist
-          #cp clients/android/app/build/outputs/apk/play/release/*.apk dist
-          cp clients/android/app/build/outputs/apk/other/release/*.apk dist
-          cp clients/android/app/build/outputs/apk/otherLegacy/release/*.apk dist
-          VERSION_CODE=$(grep VERSION_CODE clients/android/version.properties | cut -d= -f2)
-          VERSION_NAME=$(grep VERSION_NAME clients/android/version.properties | cut -d= -f2)
-          cat > dist/SFA-version-metadata.json << EOF
-          {
-            "version_code": ${VERSION_CODE},
-            "version_name": "${VERSION_NAME}"
-          }
-          EOF
-          cat dist/SFA-version-metadata.json
+          cp clients/android/app/build/outputs/apk/play/release/*.apk dist
+          cp clients/android/app/build/outputs/apk/other/release/*-universal.apk dist
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
@@ -772,7 +420,7 @@ jobs:
        run: |-
          go run -v ./cmd/internal/update_android_version --ci
          mkdir clients/android/app/libs
-          cp *.aar clients/android/app/libs
+          cp libbox.aar clients/android/app/libs
          cd clients/android
          echo -n "$SERVICE_ACCOUNT_CREDENTIALS" | base64 --decode > service-account-credentials.json
          ./gradlew :app:publishPlayReleaseBundle
@@ -784,7 +432,7 @@ jobs:
  build_apple:
    name: Build Apple clients
    runs-on: macos-26
-    if: false # github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'app-store' || inputs.build == 'iOS' || inputs.build == 'macOS' || inputs.build == 'tvOS' || inputs.build == 'macOS-standalone'
+    if: false
    needs:
      - calculate_version
    strategy:
@@ -949,7 +597,7 @@ jobs:
          		--app-drop-link 0 0 \
          		--skip-jenkins \
          	SFM.dmg "${{ matrix.export_path }}/SFM.app"
-          xcrun notarytool submit "SFM.dmg" --wait --keychain-profile "notarytool-password"
+          xcrun notarytool submit "SFM.dmg" --wait --keychain-profile "notarytool-password"          
          cd "${{ matrix.archive }}"
          zip -r SFM.dSYMs.zip dSYMs
          popd
@@ -970,8 +618,6 @@ jobs:
    needs:
      - calculate_version
      - build
-      - build_darwin
-      - build_windows
      - build_android
      - build_apple
    steps:
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,10 +1,6 @@
 name: Publish Docker Images

 on:
-  #push:
-  #  branches:
-  #    - stable
-  #    - testing
  release:
    types:
      - published
@@ -17,164 +13,20 @@ env:
  REGISTRY_IMAGE: ghcr.io/sagernet/sing-box

 jobs:
-  build_binary:
-    name: Build binary
+  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
-        include:
-          # Naive-enabled builds (musl)
-          - { arch: amd64, naive: true, docker_platform: "linux/amd64" }
-          - { arch: arm64, naive: true, docker_platform: "linux/arm64" }
-          - { arch: "386", naive: true, docker_platform: "linux/386" }
-          - { arch: arm, goarm: "7", naive: true, docker_platform: "linux/arm/v7" }
-          - { arch: mipsle, gomips: softfloat, naive: true, docker_platform: "linux/mipsle" }
-          - { arch: riscv64, naive: true, docker_platform: "linux/riscv64" }
-          - { arch: loong64, naive: true, docker_platform: "linux/loong64" }
-          # Non-naive builds
-          - { arch: arm, goarm: "6", docker_platform: "linux/arm/v6" }
-          - { arch: ppc64le, docker_platform: "linux/ppc64le" }
-          - { arch: s390x, docker_platform: "linux/s390x" }
-    steps:
-      - name: Get commit to build
-        id: ref
-        run: |-
-          if [[ -z "${{ github.event.inputs.tag }}" ]]; then
-            ref="${{ github.ref_name }}"
-          else
-            ref="${{ github.event.inputs.tag }}"
-          fi
-          echo "ref=$ref"
-          echo "ref=$ref" >> $GITHUB_OUTPUT
-      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-        with:
-          ref: ${{ steps.ref.outputs.ref }}
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ~1.25.8
-      - name: Clone cronet-go
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          CRONET_GO_VERSION=$(cat .github/CRONET_GO_VERSION)
-          git init ~/cronet-go
-          git -C ~/cronet-go remote add origin https://github.com/sagernet/cronet-go.git
-          git -C ~/cronet-go fetch --depth=1 origin "$CRONET_GO_VERSION"
-          git -C ~/cronet-go checkout FETCH_HEAD
-          git -C ~/cronet-go submodule update --init --recursive --depth=1
-      - name: Regenerate Debian keyring
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          rm -f ~/cronet-go/naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
-          cd ~/cronet-go
-          GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
-      - name: Cache Chromium toolchain
-        if: matrix.naive
-        id: cache-chromium-toolchain
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/cronet-go/naiveproxy/src/third_party/llvm-build/
-            ~/cronet-go/naiveproxy/src/gn/out/
-            ~/cronet-go/naiveproxy/src/chrome/build/pgo_profiles/
-            ~/cronet-go/naiveproxy/src/out/sysroot-build/
-          key: chromium-toolchain-${{ matrix.arch }}-musl-${{ hashFiles('.github/CRONET_GO_VERSION') }}
-      - name: Download Chromium toolchain
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          cd ~/cronet-go
-          go run ./cmd/build-naive --target=linux/${{ matrix.arch }} --libc=musl download-toolchain
-      - name: Set version
-        run: |
-          set -xeuo pipefail
-          VERSION=$(go run ./cmd/internal/read_tag)
-          echo "VERSION=${VERSION}" >> "${GITHUB_ENV}"
-      - name: Set Chromium toolchain environment
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          cd ~/cronet-go
-          go run ./cmd/build-naive --target=linux/${{ matrix.arch }} --libc=musl env >> $GITHUB_ENV
-      - name: Set build tags
-        run: |
-          set -xeuo pipefail
-          if [[ "${{ matrix.naive }}" == "true" ]]; then
-            TAGS="$(cat release/DEFAULT_BUILD_TAGS),with_musl"
-          else
-            TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS)
-          fi
-          echo "BUILD_TAGS=${TAGS}" >> "${GITHUB_ENV}"
-      - name: Set shared ldflags
-        run: |
-          echo "LDFLAGS_SHARED=$(cat release/LDFLAGS)" >> "${GITHUB_ENV}"
-      - name: Build (naive)
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          go build -v -trimpath -o sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${VERSION}' ${LDFLAGS_SHARED} -s -w -buildid=" \
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "1"
-          GOOS: linux
-          GOARCH: ${{ matrix.arch }}
-          GOARM: ${{ matrix.goarm }}
-          GOMIPS: ${{ matrix.gomips }}
-      - name: Build (non-naive)
-        if: ${{ ! matrix.naive }}
-        run: |
-          set -xeuo pipefail
-          go build -v -trimpath -o sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${VERSION}' ${LDFLAGS_SHARED} -s -w -buildid=" \
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "0"
-          GOOS: linux
-          GOARCH: ${{ matrix.arch }}
-          GOARM: ${{ matrix.goarm }}
-      - name: Prepare artifact
-        run: |
-          platform=${{ matrix.docker_platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-          # Rename binary to include arch info for Dockerfile.binary
-          BINARY_NAME="sing-box-${{ matrix.arch }}"
-          if [[ -n "${{ matrix.goarm }}" ]]; then
-            BINARY_NAME="${BINARY_NAME}v${{ matrix.goarm }}"
-          fi
-          mv sing-box "${BINARY_NAME}"
-          echo "BINARY_NAME=${BINARY_NAME}" >> $GITHUB_ENV
-      - name: Upload binary
-        uses: actions/upload-artifact@v4
-        with:
-          name: binary-${{ env.PLATFORM_PAIR }}
-          path: ${{ env.BINARY_NAME }}
-          if-no-files-found: error
-          retention-days: 1
-  build_docker:
-    name: Build Docker image
-    runs-on: ubuntu-latest
-    needs:
-      - build_binary
-    strategy:
-      fail-fast: true
-      matrix:
-        include:
-          - { platform: "linux/amd64" }
-          - { platform: "linux/arm/v6" }
-          - { platform: "linux/arm/v7" }
-          - { platform: "linux/arm64" }
-          - { platform: "linux/386" }
-          # mipsle: no base Docker image available for this platform
-          - { platform: "linux/ppc64le" }
-          - { platform: "linux/riscv64" }
-          - { platform: "linux/s390x" }
-          - { platform: "linux/loong64", base_image: "ghcr.io/loong64/alpine:edge" }
+        platform:
+          - linux/amd64
+          - linux/arm/v6
+          - linux/arm/v7
+          - linux/arm64
+          - linux/386
+          - linux/ppc64le
+          - linux/riscv64
+          - linux/s390x
    steps:
      - name: Get commit to build
        id: ref
@@ -195,16 +47,6 @@ jobs:
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-      - name: Download binary
-        uses: actions/download-artifact@v5
-        with:
-          name: binary-${{ env.PLATFORM_PAIR }}
-          path: .
-      - name: Prepare binary
-        run: |
-          # Find and make the binary executable
-          chmod +x sing-box-*
-          ls -la sing-box-*
      - name: Setup QEMU
        uses: docker/setup-qemu-action@v3
      - name: Setup Docker Buildx
@@ -226,9 +68,8 @@ jobs:
        with:
          platforms: ${{ matrix.platform }}
          context: .
-          file: Dockerfile.binary
          build-args: |
-            BASE_IMAGE=${{ matrix.base_image || 'alpine' }}
+            BUILDKIT_CONTEXT_KEEP_GIT_DIR=1
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
      - name: Export digest
@@ -244,10 +85,9 @@ jobs:
          if-no-files-found: error
          retention-days: 1
  merge:
-    if: github.event_name != 'push'
    runs-on: ubuntu-latest
    needs:
-      - build_docker
+      - build
    steps:
      - name: Get commit to build
        id: ref
@@ -281,7 +121,6 @@ jobs:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Create manifest list and push
-        if: github.event_name != 'push'
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
@@ -289,7 +128,6 @@ jobs:
            -t "${{ env.REGISTRY_IMAGE }}:${{ steps.ref.outputs.ref }}" \
            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
      - name: Inspect image
-        if: github.event_name != 'push'
        run: |
          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ env.DOCKER_TAG }}
          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.ref.outputs.ref }}
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -30,7 +30,7 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
-          go-version: ^1.25
+          go-version: ~1.24.10
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v8
        with:
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -1,10 +1,6 @@
 name: Build Linux Packages

 on:
-  #push:
-  #  branches:
-  #    - stable
-  #    - testing
  workflow_dispatch:
    inputs:
      version:
@@ -51,19 +47,17 @@ jobs:
    strategy:
      matrix:
        include:
-          # Naive-enabled builds (musl)
-          - { os: linux, arch: amd64, naive: true, debian: amd64, rpm: x86_64, pacman: x86_64 }
-          - { os: linux, arch: arm64, naive: true, debian: arm64, rpm: aarch64, pacman: aarch64 }
-          - { os: linux, arch: "386", naive: true, debian: i386, rpm: i386 }
-          - { os: linux, arch: arm, goarm: "7", naive: true, debian: armhf, rpm: armv7hl, pacman: armv7hl }
-          - { os: linux, arch: mipsle, gomips: softfloat, naive: true, debian: mipsel, rpm: mipsel }
-          - { os: linux, arch: riscv64, naive: true, debian: riscv64, rpm: riscv64 }
-          - { os: linux, arch: loong64, naive: true, debian: loongarch64, rpm: loongarch64 }
-          # Non-naive builds (unsupported architectures)
+          - { os: linux, arch: amd64, debian: amd64, rpm: x86_64, pacman: x86_64 }
+          - { os: linux, arch: "386", debian: i386, rpm: i386 }
          - { os: linux, arch: arm, goarm: "6", debian: armel, rpm: armv6hl }
+          - { os: linux, arch: arm, goarm: "7", debian: armhf, rpm: armv7hl, pacman: armv7hl }
+          - { os: linux, arch: arm64, debian: arm64, rpm: aarch64, pacman: aarch64 }
          - { os: linux, arch: mips64le, debian: mips64el, rpm: mips64el }
+          - { os: linux, arch: mipsle, debian: mipsel, rpm: mipsel }
          - { os: linux, arch: s390x, debian: s390x, rpm: s390x }
          - { os: linux, arch: ppc64le, debian: ppc64el, rpm: ppc64le }
+          - { os: linux, arch: riscv64, debian: riscv64, rpm: riscv64 }
+          - { os: linux, arch: loong64, debian: loongarch64, rpm: loongarch64 }
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
@@ -73,46 +67,12 @@ jobs:
        uses: actions/setup-go@v5
        with:
          go-version: ~1.25.8
-      - name: Clone cronet-go
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          CRONET_GO_VERSION=$(cat .github/CRONET_GO_VERSION)
-          git init ~/cronet-go
-          git -C ~/cronet-go remote add origin https://github.com/sagernet/cronet-go.git
-          git -C ~/cronet-go fetch --depth=1 origin "$CRONET_GO_VERSION"
-          git -C ~/cronet-go checkout FETCH_HEAD
-          git -C ~/cronet-go submodule update --init --recursive --depth=1
-      - name: Regenerate Debian keyring
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          rm -f ~/cronet-go/naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
-          cd ~/cronet-go
-          GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
-      - name: Cache Chromium toolchain
-        if: matrix.naive
-        id: cache-chromium-toolchain
-        uses: actions/cache@v4
+      - name: Setup Android NDK
+        if: matrix.os == 'android'
+        uses: nttld/setup-ndk@v1
        with:
-          path: |
-            ~/cronet-go/naiveproxy/src/third_party/llvm-build/
-            ~/cronet-go/naiveproxy/src/gn/out/
-            ~/cronet-go/naiveproxy/src/chrome/build/pgo_profiles/
-            ~/cronet-go/naiveproxy/src/out/sysroot-build/
-          key: chromium-toolchain-${{ matrix.arch }}-musl-${{ hashFiles('.github/CRONET_GO_VERSION') }}
-      - name: Download Chromium toolchain
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          cd ~/cronet-go
-          go run ./cmd/build-naive --target=linux/${{ matrix.arch }} --libc=musl download-toolchain
-      - name: Set Chromium toolchain environment
-        if: matrix.naive
-        run: |
-          set -xeuo pipefail
-          cd ~/cronet-go
-          go run ./cmd/build-naive --target=linux/${{ matrix.arch }} --libc=musl env >> $GITHUB_ENV
+          ndk-version: r28
+          local-cache: true
      - name: Set tag
        run: |-
          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
@@ -120,38 +80,14 @@ jobs:
      - name: Set build tags
        run: |
          set -xeuo pipefail
-          if [[ "${{ matrix.naive }}" == "true" ]]; then
-            TAGS="$(cat release/DEFAULT_BUILD_TAGS),with_musl"
-          else
-            TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS)
-          fi
+          TAGS='with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale'
          echo "BUILD_TAGS=${TAGS}" >> "${GITHUB_ENV}"
-      - name: Set shared ldflags
-        run: |
-          echo "LDFLAGS_SHARED=$(cat release/LDFLAGS)" >> "${GITHUB_ENV}"
-      - name: Build (naive)
-        if: matrix.naive
+      - name: Build
        run: |
          set -xeuo pipefail
          mkdir -p dist
          go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
-          ./cmd/sing-box
-        env:
-          CGO_ENABLED: "1"
-          GOOS: linux
-          GOARCH: ${{ matrix.arch }}
-          GOARM: ${{ matrix.goarm }}
-          GOMIPS: ${{ matrix.gomips }}
-          GOMIPS64: ${{ matrix.gomips }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build (non-naive)
-        if: ${{ ! matrix.naive }}
-        run: |
-          set -xeuo pipefail
-          mkdir -p dist
-          go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
-          -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
+          -ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' \
          ./cmd/sing-box
        env:
          CGO_ENABLED: "0"
@@ -238,6 +174,5 @@ jobs:
          path: dist
          merge-multiple: true
      - name: Publish packages
-        if: github.event_name != 'push'
        run: |-
          ls dist | xargs -I {} curl -F "package=@dist/{}" https://${{ secrets.FURY_TOKEN }}@push.fury.io/sagernet/
--- a/.gitignore
+++ b/.gitignore
@@ -12,9 +12,6 @@
 /*.jar
 /*.aar
 /*.xcframework/
-/experimental/libbox/*.aar
-/experimental/libbox/*.xcframework/
-/experimental/libbox/*.nupkg
 .DS_Store
 /config.d/
 /venv/
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.25"
+  go: "1.24"
  build-tags:
    - with_gvisor
    - with_quic
@@ -9,11 +9,6 @@ run:
    - with_utls
    - with_acme
    - with_clash_api
-    - with_tailscale
-    - with_ccm
-    - with_ocm
-    - badlinkname
-    - tfogo_checklinkname0
 linters:
  default: none
  enable:
--- a/.goreleaser.fury.yaml
+++ b/.goreleaser.fury.yaml
@@ -0,0 +1,103 @@
+project_name: sing-box
+builds:
+  - id: main
+    main: ./cmd/sing-box
+    flags:
+      - -v
+      - -trimpath
+    ldflags:
+      - -X github.com/sagernet/sing-box/constant.Version={{ .Version }}
+      - -s
+      - -buildid=
+    tags:
+      - with_gvisor
+      - with_quic
+      - with_dhcp
+      - with_wireguard
+      - with_utls
+      - with_acme
+      - with_clash_api
+      - with_tailscale
+    env:
+      - CGO_ENABLED=0
+    targets:
+      - linux_386
+      - linux_amd64_v1
+      - linux_arm64
+      - linux_arm_7
+      - linux_s390x
+      - linux_riscv64
+      - linux_mips64le
+    mod_timestamp: '{{ .CommitTimestamp }}'
+snapshot:
+  name_template: "{{ .Version }}.{{ .ShortCommit }}"
+nfpms:
+  - &template
+    id: package
+    package_name: sing-box
+    file_name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
+    builds:
+      - main
+    homepage: https://sing-box.sagernet.org/
+    maintainer: nekohasekai <contact-git@sekai.icu>
+    description: The universal proxy platform.
+    license: GPLv3 or later
+    formats:
+      - deb
+      - rpm
+    priority: extra
+    contents:
+      - src: release/config/config.json
+        dst: /etc/sing-box/config.json
+        type: "config|noreplace"
+
+      - src: release/config/sing-box.service
+        dst: /usr/lib/systemd/system/sing-box.service
+      - src: release/config/sing-box@.service
+        dst: /usr/lib/systemd/system/sing-box@.service
+      - src: release/config/sing-box.sysusers
+        dst: /usr/lib/sysusers.d/sing-box.conf
+      - src: release/config/sing-box.rules
+        dst: /usr/share/polkit-1/rules.d/sing-box.rules
+      - src: release/config/sing-box-split-dns.xml
+        dst: /usr/share/dbus-1/system.d/sing-box-split-dns.conf
+
+      - src: release/completions/sing-box.bash
+        dst: /usr/share/bash-completion/completions/sing-box.bash
+      - src: release/completions/sing-box.fish
+        dst: /usr/share/fish/vendor_completions.d/sing-box.fish
+      - src: release/completions/sing-box.zsh
+        dst: /usr/share/zsh/site-functions/_sing-box
+
+      - src: LICENSE
+        dst: /usr/share/licenses/sing-box/LICENSE
+    deb:
+      signature:
+        key_file: "{{ .Env.NFPM_KEY_PATH }}"
+      fields:
+        Bugs: https://github.com/SagerNet/sing-box/issues
+    rpm:
+      signature:
+        key_file: "{{ .Env.NFPM_KEY_PATH }}"
+    conflicts:
+      - sing-box-beta
+  - id: package_beta
+    <<: *template
+    package_name: sing-box-beta
+    file_name_template: '{{ .ProjectName }}-beta_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
+    formats:
+      - deb
+      - rpm
+    conflicts:
+      - sing-box
+release:
+  disable: true
+furies:
+  - account: sagernet
+    ids:
+      - package
+    disable: "{{ not (not .Prerelease) }}"
+  - account: sagernet
+    ids:
+      - package_beta
+    disable: "{{ not .Prerelease }}"
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -0,0 +1,213 @@
+version: 2
+project_name: sing-box
+builds:
+  - &template
+    id: main
+    main: ./cmd/sing-box
+    flags:
+      - -v
+      - -trimpath
+    ldflags:
+      - -X github.com/sagernet/sing-box/constant.Version={{ .Version }}
+      - -s
+      - -buildid=
+    tags:
+      - with_gvisor
+      - with_quic
+      - with_dhcp
+      - with_wireguard
+      - with_utls
+      - with_acme
+      - with_clash_api
+      - with_tailscale
+    env:
+      - CGO_ENABLED=0
+      - GOTOOLCHAIN=local
+    targets:
+      - linux_386
+      - linux_amd64_v1
+      - linux_arm64
+      - linux_arm_6
+      - linux_arm_7
+      - linux_s390x
+      - linux_riscv64
+      - linux_mips64le
+      - windows_amd64_v1
+      - windows_386
+      - windows_arm64
+      - darwin_amd64_v1
+      - darwin_arm64
+    mod_timestamp: '{{ .CommitTimestamp }}'
+  - id: legacy
+    <<: *template
+    tags:
+      - with_gvisor
+      - with_quic
+      - with_dhcp
+      - with_wireguard
+      - with_utls
+      - with_acme
+      - with_clash_api
+      - with_tailscale
+    env:
+      - CGO_ENABLED=0
+      - GOROOT={{ .Env.GOPATH }}/go_legacy
+    tool: "{{ .Env.GOPATH }}/go_legacy/bin/go"
+    targets:
+      - windows_amd64_v1
+      - windows_386
+  - id: android
+    <<: *template
+    env:
+      - CGO_ENABLED=1
+      - GOTOOLCHAIN=local
+    overrides:
+      - goos: android
+        goarch: arm
+        goarm: 7
+        env:
+          - CC=armv7a-linux-androideabi21-clang
+          - CXX=armv7a-linux-androideabi21-clang++
+      - goos: android
+        goarch: arm64
+        env:
+          - CC=aarch64-linux-android21-clang
+          - CXX=aarch64-linux-android21-clang++
+      - goos: android
+        goarch: 386
+        env:
+          - CC=i686-linux-android21-clang
+          - CXX=i686-linux-android21-clang++
+      - goos: android
+        goarch: amd64
+        goamd64: v1
+        env:
+          - CC=x86_64-linux-android21-clang
+          - CXX=x86_64-linux-android21-clang++
+    targets:
+      - android_arm_7
+      - android_arm64
+      - android_386
+      - android_amd64
+archives:
+  - &template
+    id: archive
+    builds:
+      - main
+      - android
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    wrap_in_directory: true
+    files:
+      - LICENSE
+    name_template: '{{ .ProjectName }}-{{ .Version }}-{{ .Os }}-{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ if and .Mips (not (eq .Mips "hardfloat")) }}_{{ .Mips }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
+  - id: archive-legacy
+    <<: *template
+    builds:
+      - legacy
+    name_template: '{{ .ProjectName }}-{{ .Version }}-{{ .Os }}-{{ .Arch }}-legacy'
+nfpms:
+  - id: package
+    package_name: sing-box
+    file_name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ if and .Mips (not (eq .Mips "hardfloat")) }}_{{ .Mips }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
+    builds:
+      - main
+    homepage: https://sing-box.sagernet.org/
+    maintainer: nekohasekai <contact-git@sekai.icu>
+    description: The universal proxy platform.
+    license: GPLv3 or later
+    formats:
+      - deb
+      - rpm
+      - archlinux
+#      - apk
+#      - ipk
+    priority: extra
+    contents:
+      - src: release/config/config.json
+        dst: /etc/sing-box/config.json
+        type: "config|noreplace"
+
+      - src: release/config/sing-box.service
+        dst: /usr/lib/systemd/system/sing-box.service
+      - src: release/config/sing-box@.service
+        dst: /usr/lib/systemd/system/sing-box@.service
+      - src: release/config/sing-box.sysusers
+        dst: /usr/lib/sysusers.d/sing-box.conf
+      - src: release/config/sing-box.rules
+        dst: /usr/share/polkit-1/rules.d/sing-box.rules
+      - src: release/config/sing-box-split-dns.xml
+        dst: /usr/share/dbus-1/system.d/sing-box-split-dns.conf
+
+      - src: release/completions/sing-box.bash
+        dst: /usr/share/bash-completion/completions/sing-box.bash
+      - src: release/completions/sing-box.fish
+        dst: /usr/share/fish/vendor_completions.d/sing-box.fish
+      - src: release/completions/sing-box.zsh
+        dst: /usr/share/zsh/site-functions/_sing-box
+
+      - src: LICENSE
+        dst: /usr/share/licenses/sing-box/LICENSE
+    deb:
+      signature:
+        key_file: "{{ .Env.NFPM_KEY_PATH }}"
+      fields:
+        Bugs: https://github.com/SagerNet/sing-box/issues
+    rpm:
+      signature:
+        key_file: "{{ .Env.NFPM_KEY_PATH }}"
+    overrides:
+      apk:
+        contents:
+          - src: release/config/config.json
+            dst: /etc/sing-box/config.json
+            type: config
+
+          - src: release/config/sing-box.initd
+            dst: /etc/init.d/sing-box
+
+          - src: release/completions/sing-box.bash
+            dst: /usr/share/bash-completion/completions/sing-box.bash
+          - src: release/completions/sing-box.fish
+            dst: /usr/share/fish/vendor_completions.d/sing-box.fish
+          - src: release/completions/sing-box.zsh
+            dst: /usr/share/zsh/site-functions/_sing-box
+
+          - src: LICENSE
+            dst: /usr/share/licenses/sing-box/LICENSE
+      ipk:
+        contents:
+          - src: release/config/config.json
+            dst: /etc/sing-box/config.json
+            type: config
+
+          - src: release/config/openwrt.init
+            dst: /etc/init.d/sing-box
+          - src: release/config/openwrt.conf
+            dst: /etc/config/sing-box
+source:
+  enabled: false
+  name_template: '{{ .ProjectName }}-{{ .Version }}.source'
+  prefix_template: '{{ .ProjectName }}-{{ .Version }}/'
+checksum:
+  disable: true
+  name_template: '{{ .ProjectName }}-{{ .Version }}.checksum'
+signs:
+  - artifacts: checksum
+release:
+  github:
+    owner: SagerNet
+    name: sing-box
+  draft: true
+  prerelease: auto
+  mode: replace
+  ids:
+    - archive
+    - package
+  skip_upload: true
+partial:
+  by: target
--- a/7
+++ b/7
@@ -12,11 +12,10 @@ RUN set -ex \
    && apk add git build-base \
    && export COMMIT=$(git rev-parse --short HEAD) \
    && export VERSION=$(go run ./cmd/internal/read_tag) \
-    && export TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS) \
-    && export LDFLAGS_SHARED=$(cat release/LDFLAGS) \
-    && go build -v -trimpath -tags "$TAGS" \
+    && go build -v -trimpath -tags \
+        "with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale" \
        -o /go/bin/sing-box \
-        -ldflags "-X \"github.com/sagernet/sing-box/constant.Version=$VERSION\" $LDFLAGS_SHARED -s -w -buildid=" \
+        -ldflags "-X \"github.com/sagernet/sing-box/constant.Version=$VERSION\" -s -w -buildid=" \
        ./cmd/sing-box
 FROM --platform=$TARGETPLATFORM alpine AS dist
 LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
--- a/Dockerfile.binary
+++ b/Dockerfile.binary
@@ -1,14 +0,0 @@
-ARG BASE_IMAGE=alpine
-FROM ${BASE_IMAGE}
-ARG TARGETARCH
-ARG TARGETVARIANT
-LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
-RUN set -ex \
-    && if command -v apk > /dev/null; then \
-        apk add --no-cache --upgrade bash tzdata ca-certificates nftables; \
-    else \
-        apt-get update && apt-get install -y --no-install-recommends bash tzdata ca-certificates nftables \
-        && rm -rf /var/lib/apt/lists/*; \
-    fi
-COPY sing-box-${TARGETARCH}${TARGETVARIANT} /usr/local/bin/sing-box
-ENTRYPOINT ["sing-box"]
--- a/116
+++ b/116
@@ -1,18 +1,15 @@
 NAME = sing-box
 COMMIT = $(shell git rev-parse --short HEAD)
-TAGS ?= $(shell cat release/DEFAULT_BUILD_TAGS_OTHERS)
+TAGS ?= with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale

 GOHOSTOS = $(shell go env GOHOSTOS)
 GOHOSTARCH = $(shell go env GOHOSTARCH)
 VERSION=$(shell CGO_ENABLED=0 GOOS=$(GOHOSTOS) GOARCH=$(GOHOSTARCH) go run github.com/sagernet/sing-box/cmd/internal/read_tag@latest)

-LDFLAGS_SHARED = $(shell cat release/LDFLAGS)
-PARAMS = -v -trimpath -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=$(VERSION)' $(LDFLAGS_SHARED) -s -w -buildid="
+PARAMS = -v -trimpath -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=$(VERSION)' -s -w -buildid="
 MAIN_PARAMS = $(PARAMS) -tags "$(TAGS)"
 MAIN = ./cmd/sing-box
 PREFIX ?= $(shell go env GOPATH)
-SING_FFI ?= sing-ffi
-LIBBOX_FFI_CONFIG ?= ./experimental/libbox/ffi.json

 .PHONY: test release docs build

@@ -40,9 +37,6 @@ fmt:
 	@gofmt -s -w .
 	@gci write --custom-order -s standard -s "prefix(github.com/sagernet/)" -s "default" .

-fmt_docs:
-	go run ./cmd/internal/format_docs
-
 fmt_install:
 	go install -v mvdan.cc/gofumpt@latest
 	go install -v github.com/daixiang0/gci@latest
@@ -92,12 +86,12 @@ update_android_version:
 	go run ./cmd/internal/update_android_version

 build_android:
-	cd ../sing-box-for-android && ./gradlew :app:clean :app:assembleOtherRelease :app:assembleOtherLegacyRelease && ./gradlew --stop
+	cd ../sing-box-for-android && ./gradlew :app:clean :app:assemblePlayRelease :app:assembleOtherRelease && ./gradlew --stop

 upload_android:
 	mkdir -p dist/release_android
-	cp ../sing-box-for-android/app/build/outputs/apk/other/release/*.apk dist/release_android
-	cp ../sing-box-for-android/app/build/outputs/apk/otherLegacy/release/*.apk dist/release_android
+	cp ../sing-box-for-android/app/build/outputs/apk/play/release/*.apk dist/release_android
+	cp ../sing-box-for-android/app/build/outputs/apk/other/release/*-universal.apk dist/release_android
 	ghr --replace --draft --prerelease -p 5 "v${VERSION}" dist/release_android
 	rm -rf dist/release_android

@@ -112,7 +106,7 @@ build_ios:
 	cd ../sing-box-for-apple && \
 	rm -rf build/SFI.xcarchive && \
 	xcodebuild clean -scheme SFI && \
-	xcodebuild archive -scheme SFI -configuration Release -destination 'generic/platform=iOS' -archivePath build/SFI.xcarchive -allowProvisioningUpdates | xcbeautify | grep -A 10 -e "Archive Succeeded" -e "ARCHIVE FAILED" -e "❌"
+	xcodebuild archive -scheme SFI -configuration Release -destination 'generic/platform=iOS' -archivePath build/SFI.xcarchive -allowProvisioningUpdates

 upload_ios_app_store:
 	cd ../sing-box-for-apple && \
@@ -133,7 +127,7 @@ release_ios: build_ios upload_ios_app_store
 build_macos:
 	cd ../sing-box-for-apple && \
 	rm -rf build/SFM.xcarchive && \
-	xcodebuild archive -scheme SFM -configuration Release -archivePath build/SFM.xcarchive -allowProvisioningUpdates | xcbeautify | grep -A 10 -e "Archive Succeeded" -e "ARCHIVE FAILED" -e "❌"
+	xcodebuild archive -scheme SFM -configuration Release -archivePath build/SFM.xcarchive -allowProvisioningUpdates

 upload_macos_app_store:
 	cd ../sing-box-for-apple && \
@@ -142,50 +136,54 @@ upload_macos_app_store:
 release_macos: build_macos upload_macos_app_store

 build_macos_standalone:
-	$(MAKE) -C ../sing-box-for-apple archive_macos_standalone
+	cd ../sing-box-for-apple && \
+	rm -rf build/SFM.System.xcarchive && \
+	xcodebuild archive -scheme SFM.System -configuration Release -archivePath build/SFM.System.xcarchive -allowProvisioningUpdates

 build_macos_dmg:
-	$(MAKE) -C ../sing-box-for-apple build_macos_dmg
-
-build_macos_pkg:
-	$(MAKE) -C ../sing-box-for-apple build_macos_pkg
+	rm -rf dist/SFM
+	mkdir -p dist/SFM
+	cd ../sing-box-for-apple && \
+	rm -rf build/SFM.System && \
+	rm -rf build/SFM.dmg && \
+	xcodebuild -exportArchive \
+		-archivePath "build/SFM.System.xcarchive" \
+		-exportOptionsPlist SFM.System/Export.plist -allowProvisioningUpdates \
+		-exportPath "build/SFM.System" && \
+	create-dmg \
+		--volname "sing-box" \
+		--volicon "build/SFM.System/SFM.app/Contents/Resources/AppIcon.icns" \
+		--icon "SFM.app" 0 0 \
+ 		--hide-extension "SFM.app" \
+ 		--app-drop-link 0 0 \
+ 		--skip-jenkins \
+		"../sing-box/dist/SFM/SFM.dmg" "build/SFM.System/SFM.app"

 notarize_macos_dmg:
-	$(MAKE) -C ../sing-box-for-apple notarize_macos_dmg
-
-notarize_macos_pkg:
-	$(MAKE) -C ../sing-box-for-apple notarize_macos_pkg
+	xcrun notarytool submit "dist/SFM/SFM.dmg" --wait \
+	  --keychain-profile "notarytool-password" \
+  	  --no-s3-acceleration

 upload_macos_dmg:
-	mkdir -p dist/SFM
-	cp ../sing-box-for-apple/build/SFM-Apple.dmg "dist/SFM/SFM-${VERSION}-Apple.dmg"
-	cp ../sing-box-for-apple/build/SFM-Intel.dmg "dist/SFM/SFM-${VERSION}-Intel.dmg"
-	cp ../sing-box-for-apple/build/SFM-Universal.dmg "dist/SFM/SFM-${VERSION}-Universal.dmg"
-	ghr --replace --draft --prerelease "v${VERSION}" "dist/SFM/SFM-${VERSION}-Apple.dmg"
-	ghr --replace --draft --prerelease "v${VERSION}" "dist/SFM/SFM-${VERSION}-Intel.dmg"
-	ghr --replace --draft --prerelease "v${VERSION}" "dist/SFM/SFM-${VERSION}-Universal.dmg"
-
-upload_macos_pkg:
-	mkdir -p dist/SFM
-	cp ../sing-box-for-apple/build/SFM-Apple.pkg "dist/SFM/SFM-${VERSION}-Apple.pkg"
-	cp ../sing-box-for-apple/build/SFM-Intel.pkg "dist/SFM/SFM-${VERSION}-Intel.pkg"
-	cp ../sing-box-for-apple/build/SFM-Universal.pkg "dist/SFM/SFM-${VERSION}-Universal.pkg"
-	ghr --replace --draft --prerelease "v${VERSION}" "dist/SFM/SFM-${VERSION}-Apple.pkg"
-	ghr --replace --draft --prerelease "v${VERSION}" "dist/SFM/SFM-${VERSION}-Intel.pkg"
-	ghr --replace --draft --prerelease "v${VERSION}" "dist/SFM/SFM-${VERSION}-Universal.pkg"
+	cd dist/SFM && \
+	cp SFM.dmg "SFM-${VERSION}-universal.dmg" && \
+	ghr --replace --draft --prerelease "v${VERSION}" "SFM-${VERSION}-universal.dmg"

 upload_macos_dsyms:
-	mkdir -p dist/SFM
-	cd ../sing-box-for-apple/build/SFM.System-universal.xcarchive && zip -r SFM.dSYMs.zip dSYMs
-	cp ../sing-box-for-apple/build/SFM.System-universal.xcarchive/SFM.dSYMs.zip "dist/SFM/SFM-${VERSION}.dSYMs.zip"
-	ghr --replace --draft --prerelease "v${VERSION}" "dist/SFM/SFM-${VERSION}.dSYMs.zip"
+	pushd ../sing-box-for-apple/build/SFM.System.xcarchive && \
+	zip -r SFM.dSYMs.zip dSYMs && \
+	mv SFM.dSYMs.zip ../../../sing-box/dist/SFM && \
+	popd && \
+	cd dist/SFM && \
+	cp SFM.dSYMs.zip "SFM-${VERSION}-universal.dSYMs.zip" && \
+	ghr --replace --draft --prerelease "v${VERSION}" "SFM-${VERSION}-universal.dSYMs.zip"

-release_macos_standalone: build_macos_pkg notarize_macos_pkg upload_macos_pkg upload_macos_dsyms
+release_macos_standalone: build_macos_standalone build_macos_dmg notarize_macos_dmg upload_macos_dmg upload_macos_dsyms

 build_tvos:
 	cd ../sing-box-for-apple && \
 	rm -rf build/SFT.xcarchive && \
-	xcodebuild archive -scheme SFT -configuration Release -archivePath build/SFT.xcarchive -allowProvisioningUpdates | xcbeautify | grep -A 10 -e "Archive Succeeded" -e "ARCHIVE FAILED" -e "❌"
+	xcodebuild archive -scheme SFT -configuration Release -archivePath build/SFT.xcarchive -allowProvisioningUpdates

 upload_tvos_app_store:
 	cd ../sing-box-for-apple && \
@@ -209,12 +207,12 @@ update_apple_version:
 update_macos_version:
 	MACOS_PROJECT_VERSION=$(shell go run -v ./cmd/internal/app_store_connect next_macos_project_version) go run ./cmd/internal/update_apple_version

-release_apple: lib_apple update_apple_version release_ios release_macos release_tvos release_macos_standalone
+release_apple: lib_ios update_apple_version release_ios release_macos release_tvos release_macos_standalone

 release_apple_beta: update_apple_version release_ios release_macos release_tvos

 publish_testflight:
-	go run -v ./cmd/internal/app_store_connect publish_testflight $(filter-out $@,$(MAKECMDGOALS))
+	go run -v ./cmd/internal/app_store_connect publish_testflight

 prepare_app_store:
 	go run -v ./cmd/internal/app_store_connect prepare_app_store
@@ -237,21 +235,22 @@ test_stdio:
 lib_android:
 	go run ./cmd/internal/build_libbox -target android

+lib_android_debug:
+	go run ./cmd/internal/build_libbox -target android -debug
+
 lib_apple:
 	go run ./cmd/internal/build_libbox -target apple

-lib_windows:
-	$(SING_FFI) generate --config $(LIBBOX_FFI_CONFIG) --platform-type csharp
+lib_ios:
+	go run ./cmd/internal/build_libbox -target apple -platform ios -debug

-lib_android_new:
-	$(SING_FFI) generate --config $(LIBBOX_FFI_CONFIG) --platform-type android
-
-lib_apple_new:
-	$(SING_FFI) generate --config $(LIBBOX_FFI_CONFIG) --platform-type apple
+lib:
+	go run ./cmd/internal/build_libbox -target android
+	go run ./cmd/internal/build_libbox -target ios

 lib_install:
-	go install -v github.com/sagernet/gomobile/cmd/gomobile@v0.1.12
-	go install -v github.com/sagernet/gomobile/cmd/gobind@v0.1.12
+	go install -v github.com/sagernet/gomobile/cmd/gomobile@v0.1.8
+	go install -v github.com/sagernet/gomobile/cmd/gobind@v0.1.8

 docs:
 	venv/bin/mkdocs serve
@@ -260,8 +259,8 @@ publish_docs:
 	venv/bin/mkdocs gh-deploy -m "Update" --force --ignore-version --no-history

 docs_install:
-	python3 -m venv venv
-	source ./venv/bin/activate && pip install --force-reinstall mkdocs-material=="9.7.2" mkdocs-static-i18n=="1.2.*"
+	python -m venv venv
+	source ./venv/bin/activate && pip install --force-reinstall mkdocs-material=="9.*" mkdocs-static-i18n=="1.2.*"

 clean:
 	rm -rf bin dist sing-box
@@ -271,6 +270,3 @@ update:
 	git fetch
 	git reset FETCH_HEAD --hard
 	git clean -fdx
-
-%:
-	@:
--- a/adapter/certificate/adapter.go
+++ b/adapter/certificate/adapter.go
@@ -1,21 +0,0 @@
-package certificate
-
-type Adapter struct {
-	providerType string
-	providerTag  string
-}
-
-func NewAdapter(providerType string, providerTag string) Adapter {
-	return Adapter{
-		providerType: providerType,
-		providerTag:  providerTag,
-	}
-}
-
-func (a *Adapter) Type() string {
-	return a.providerType
-}
-
-func (a *Adapter) Tag() string {
-	return a.providerTag
-}
--- a/adapter/certificate/manager.go
+++ b/adapter/certificate/manager.go
@@ -1,158 +0,0 @@
-package certificate
-
-import (
-	"context"
-	"os"
-	"sync"
-	"time"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/taskmonitor"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
-)
-
-var _ adapter.CertificateProviderManager = (*Manager)(nil)
-
-type Manager struct {
-	logger        log.ContextLogger
-	registry      adapter.CertificateProviderRegistry
-	access        sync.Mutex
-	started       bool
-	stage         adapter.StartStage
-	providers     []adapter.CertificateProviderService
-	providerByTag map[string]adapter.CertificateProviderService
-}
-
-func NewManager(logger log.ContextLogger, registry adapter.CertificateProviderRegistry) *Manager {
-	return &Manager{
-		logger:        logger,
-		registry:      registry,
-		providerByTag: make(map[string]adapter.CertificateProviderService),
-	}
-}
-
-func (m *Manager) Start(stage adapter.StartStage) error {
-	m.access.Lock()
-	if m.started && m.stage >= stage {
-		panic("already started")
-	}
-	m.started = true
-	m.stage = stage
-	providers := m.providers
-	m.access.Unlock()
-	for _, provider := range providers {
-		name := "certificate-provider/" + provider.Type() + "[" + provider.Tag() + "]"
-		m.logger.Trace(stage, " ", name)
-		startTime := time.Now()
-		err := adapter.LegacyStart(provider, stage)
-		if err != nil {
-			return E.Cause(err, stage, " ", name)
-		}
-		m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
-	}
-	return nil
-}
-
-func (m *Manager) Close() error {
-	m.access.Lock()
-	defer m.access.Unlock()
-	if !m.started {
-		return nil
-	}
-	m.started = false
-	providers := m.providers
-	m.providers = nil
-	monitor := taskmonitor.New(m.logger, C.StopTimeout)
-	var err error
-	for _, provider := range providers {
-		name := "certificate-provider/" + provider.Type() + "[" + provider.Tag() + "]"
-		m.logger.Trace("close ", name)
-		startTime := time.Now()
-		monitor.Start("close ", name)
-		err = E.Append(err, provider.Close(), func(err error) error {
-			return E.Cause(err, "close ", name)
-		})
-		monitor.Finish()
-		m.logger.Trace("close ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
-	}
-	return err
-}
-
-func (m *Manager) CertificateProviders() []adapter.CertificateProviderService {
-	m.access.Lock()
-	defer m.access.Unlock()
-	return m.providers
-}
-
-func (m *Manager) Get(tag string) (adapter.CertificateProviderService, bool) {
-	m.access.Lock()
-	provider, found := m.providerByTag[tag]
-	m.access.Unlock()
-	return provider, found
-}
-
-func (m *Manager) Remove(tag string) error {
-	m.access.Lock()
-	provider, found := m.providerByTag[tag]
-	if !found {
-		m.access.Unlock()
-		return os.ErrInvalid
-	}
-	delete(m.providerByTag, tag)
-	index := common.Index(m.providers, func(it adapter.CertificateProviderService) bool {
-		return it == provider
-	})
-	if index == -1 {
-		panic("invalid certificate provider index")
-	}
-	m.providers = append(m.providers[:index], m.providers[index+1:]...)
-	started := m.started
-	m.access.Unlock()
-	if started {
-		return provider.Close()
-	}
-	return nil
-}
-
-func (m *Manager) Create(ctx context.Context, logger log.ContextLogger, tag string, providerType string, options any) error {
-	provider, err := m.registry.Create(ctx, logger, tag, providerType, options)
-	if err != nil {
-		return err
-	}
-	m.access.Lock()
-	defer m.access.Unlock()
-	if m.started {
-		name := "certificate-provider/" + provider.Type() + "[" + provider.Tag() + "]"
-		for _, stage := range adapter.ListStartStages {
-			m.logger.Trace(stage, " ", name)
-			startTime := time.Now()
-			err = adapter.LegacyStart(provider, stage)
-			if err != nil {
-				return E.Cause(err, stage, " ", name)
-			}
-			m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
-		}
-	}
-	if existsProvider, loaded := m.providerByTag[tag]; loaded {
-		if m.started {
-			err = existsProvider.Close()
-			if err != nil {
-				return E.Cause(err, "close certificate-provider/", existsProvider.Type(), "[", existsProvider.Tag(), "]")
-			}
-		}
-		existsIndex := common.Index(m.providers, func(it adapter.CertificateProviderService) bool {
-			return it == existsProvider
-		})
-		if existsIndex == -1 {
-			panic("invalid certificate provider index")
-		}
-		m.providers = append(m.providers[:existsIndex], m.providers[existsIndex+1:]...)
-	}
-	m.providers = append(m.providers, provider)
-	m.providerByTag[tag] = provider
-	return nil
-}
--- a/adapter/certificate/registry.go
+++ b/adapter/certificate/registry.go
@@ -1,72 +0,0 @@
-package certificate
-
-import (
-	"context"
-	"sync"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-type ConstructorFunc[T any] func(ctx context.Context, logger log.ContextLogger, tag string, options T) (adapter.CertificateProviderService, error)
-
-func Register[Options any](registry *Registry, providerType string, constructor ConstructorFunc[Options]) {
-	registry.register(providerType, func() any {
-		return new(Options)
-	}, func(ctx context.Context, logger log.ContextLogger, tag string, rawOptions any) (adapter.CertificateProviderService, error) {
-		var options *Options
-		if rawOptions != nil {
-			options = rawOptions.(*Options)
-		}
-		return constructor(ctx, logger, tag, common.PtrValueOrDefault(options))
-	})
-}
-
-var _ adapter.CertificateProviderRegistry = (*Registry)(nil)
-
-type (
-	optionsConstructorFunc func() any
-	constructorFunc        func(ctx context.Context, logger log.ContextLogger, tag string, options any) (adapter.CertificateProviderService, error)
-)
-
-type Registry struct {
-	access      sync.Mutex
-	optionsType map[string]optionsConstructorFunc
-	constructor map[string]constructorFunc
-}
-
-func NewRegistry() *Registry {
-	return &Registry{
-		optionsType: make(map[string]optionsConstructorFunc),
-		constructor: make(map[string]constructorFunc),
-	}
-}
-
-func (m *Registry) CreateOptions(providerType string) (any, bool) {
-	m.access.Lock()
-	defer m.access.Unlock()
-	optionsConstructor, loaded := m.optionsType[providerType]
-	if !loaded {
-		return nil, false
-	}
-	return optionsConstructor(), true
-}
-
-func (m *Registry) Create(ctx context.Context, logger log.ContextLogger, tag string, providerType string, options any) (adapter.CertificateProviderService, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-	constructor, loaded := m.constructor[providerType]
-	if !loaded {
-		return nil, E.New("certificate provider type not found: " + providerType)
-	}
-	return constructor(ctx, logger, tag, options)
-}
-
-func (m *Registry) register(providerType string, optionsConstructor optionsConstructorFunc, constructor constructorFunc) {
-	m.access.Lock()
-	defer m.access.Unlock()
-	m.optionsType[providerType] = optionsConstructor
-	m.constructor[providerType] = constructor
-}
--- a/adapter/certificate_provider.go
+++ b/adapter/certificate_provider.go
@@ -1,38 +0,0 @@
-package adapter
-
-import (
-	"context"
-	"crypto/tls"
-
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-)
-
-type CertificateProvider interface {
-	GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
-}
-
-type ACMECertificateProvider interface {
-	CertificateProvider
-	GetACMENextProtos() []string
-}
-
-type CertificateProviderService interface {
-	Lifecycle
-	Type() string
-	Tag() string
-	CertificateProvider
-}
-
-type CertificateProviderRegistry interface {
-	option.CertificateProviderOptionsRegistry
-	Create(ctx context.Context, logger log.ContextLogger, tag string, providerType string, options any) (CertificateProviderService, error)
-}
-
-type CertificateProviderManager interface {
-	Lifecycle
-	CertificateProviders() []CertificateProviderService
-	Get(tag string) (CertificateProviderService, bool)
-	Remove(tag string) error
-	Create(ctx context.Context, logger log.ContextLogger, tag string, providerType string, options any) error
-}
--- a/adapter/connections.go
+++ b/adapter/connections.go
@@ -9,10 +9,6 @@ import (

 type ConnectionManager interface {
 	Lifecycle
-	Count() int
-	CloseAll()
-	TrackConn(conn net.Conn) net.Conn
-	TrackPacketConn(conn net.PacketConn) net.PacketConn
 	NewConnection(ctx context.Context, this N.Dialer, conn net.Conn, metadata InboundContext, onClose N.CloseHandlerFunc)
 	NewPacketConnection(ctx context.Context, this N.Dialer, conn N.PacketConn, metadata InboundContext, onClose N.CloseHandlerFunc)
 }
--- a/adapter/dns.go
+++ b/adapter/dns.go
@@ -3,7 +3,6 @@ package adapter
 import (
 	"context"
 	"net/netip"
-	"time"

 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
@@ -26,19 +25,18 @@ type DNSRouter interface {

 type DNSClient interface {
 	Start()
-	Exchange(ctx context.Context, transport DNSTransport, message *dns.Msg, options DNSQueryOptions, responseChecker func(response *dns.Msg) bool) (*dns.Msg, error)
-	Lookup(ctx context.Context, transport DNSTransport, domain string, options DNSQueryOptions, responseChecker func(response *dns.Msg) bool) ([]netip.Addr, error)
+	Exchange(ctx context.Context, transport DNSTransport, message *dns.Msg, options DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) (*dns.Msg, error)
+	Lookup(ctx context.Context, transport DNSTransport, domain string, options DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) ([]netip.Addr, error)
 	ClearCache()
 }

 type DNSQueryOptions struct {
-	Transport              DNSTransport
-	Strategy               C.DomainStrategy
-	LookupStrategy         C.DomainStrategy
-	DisableCache           bool
-	DisableOptimisticCache bool
-	RewriteTTL             *uint32
-	ClientSubnet           netip.Prefix
+	Transport      DNSTransport
+	Strategy       C.DomainStrategy
+	LookupStrategy C.DomainStrategy
+	DisableCache   bool
+	RewriteTTL     *uint32
+	ClientSubnet   netip.Prefix
 }

 func DNSQueryOptionsFrom(ctx context.Context, options *option.DomainResolveOptions) (*DNSQueryOptions, error) {
@@ -51,12 +49,11 @@ func DNSQueryOptionsFrom(ctx context.Context, options *option.DomainResolveOptio
 		return nil, E.New("domain resolver not found: " + options.Server)
 	}
 	return &DNSQueryOptions{
-		Transport:              transport,
-		Strategy:               C.DomainStrategy(options.Strategy),
-		DisableCache:           options.DisableCache,
-		DisableOptimisticCache: options.DisableOptimisticCache,
-		RewriteTTL:             options.RewriteTTL,
-		ClientSubnet:           options.ClientSubnet.Build(netip.Prefix{}),
+		Transport:    transport,
+		Strategy:     C.DomainStrategy(options.Strategy),
+		DisableCache: options.DisableCache,
+		RewriteTTL:   options.RewriteTTL,
+		ClientSubnet: options.ClientSubnet.Build(netip.Prefix{}),
 	}, nil
 }

@@ -66,22 +63,19 @@ type RDRCStore interface {
 	SaveRDRCAsync(transportName string, qName string, qType uint16, logger logger.Logger)
 }

-type DNSCacheStore interface {
-	LoadDNSCache(transportName string, qName string, qType uint16) (rawMessage []byte, expireAt time.Time, loaded bool)
-	SaveDNSCache(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time) error
-	SaveDNSCacheAsync(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time, logger logger.Logger)
-	ClearDNSCache() error
-}
-
 type DNSTransport interface {
 	Lifecycle
 	Type() string
 	Tag() string
 	Dependencies() []string
-	Reset()
 	Exchange(ctx context.Context, message *dns.Msg) (*dns.Msg, error)
 }

+type LegacyDNSTransport interface {
+	LegacyStrategy() C.DomainStrategy
+	LegacyClientSubnet() netip.Prefix
+}
+
 type DNSTransportRegistry interface {
 	option.DNSTransportOptionsRegistry
 	CreateDNSTransport(ctx context.Context, logger log.ContextLogger, tag string, transportType string, options any) (DNSTransport, error)
--- a/adapter/endpoint/manager.go
+++ b/adapter/endpoint/manager.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"os"
 	"sync"
-	"time"

 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/common/taskmonitor"
@@ -12,7 +11,6 @@ import (
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
 )

 var _ adapter.EndpointManager = (*Manager)(nil)
@@ -48,14 +46,10 @@ func (m *Manager) Start(stage adapter.StartStage) error {
 		return nil
 	}
 	for _, endpoint := range m.endpoints {
-		name := "endpoint/" + endpoint.Type() + "[" + endpoint.Tag() + "]"
-		m.logger.Trace(stage, " ", name)
-		startTime := time.Now()
 		err := adapter.LegacyStart(endpoint, stage)
 		if err != nil {
-			return E.Cause(err, stage, " ", name)
+			return E.Cause(err, stage, " endpoint/", endpoint.Type(), "[", endpoint.Tag(), "]")
 		}
-		m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
 	return nil
 }
@@ -72,15 +66,11 @@ func (m *Manager) Close() error {
 	monitor := taskmonitor.New(m.logger, C.StopTimeout)
 	var err error
 	for _, endpoint := range endpoints {
-		name := "endpoint/" + endpoint.Type() + "[" + endpoint.Tag() + "]"
-		m.logger.Trace("close ", name)
-		startTime := time.Now()
-		monitor.Start("close ", name)
+		monitor.Start("close endpoint/", endpoint.Type(), "[", endpoint.Tag(), "]")
 		err = E.Append(err, endpoint.Close(), func(err error) error {
-			return E.Cause(err, "close ", name)
+			return E.Cause(err, "close endpoint/", endpoint.Type(), "[", endpoint.Tag(), "]")
 		})
 		monitor.Finish()
-		m.logger.Trace("close ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
 	return nil
 }
@@ -129,15 +119,11 @@ func (m *Manager) Create(ctx context.Context, router adapter.Router, logger log.
 	m.access.Lock()
 	defer m.access.Unlock()
 	if m.started {
-		name := "endpoint/" + endpoint.Type() + "[" + endpoint.Tag() + "]"
 		for _, stage := range adapter.ListStartStages {
-			m.logger.Trace(stage, " ", name)
-			startTime := time.Now()
 			err = adapter.LegacyStart(endpoint, stage)
 			if err != nil {
-				return E.Cause(err, stage, " ", name)
+				return E.Cause(err, stage, " endpoint/", endpoint.Type(), "[", endpoint.Tag(), "]")
 			}
-			m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 		}
 	}
 	if existsEndpoint, loaded := m.endpointByTag[tag]; loaded {
--- a/adapter/experimental.go
+++ b/adapter/experimental.go
@@ -4,10 +4,8 @@ import (
 	"bytes"
 	"context"
 	"encoding/binary"
-	"io"
 	"time"

-	"github.com/sagernet/sing/common/observable"
 	"github.com/sagernet/sing/common/varbin"
 )

@@ -16,7 +14,6 @@ type ClashServer interface {
 	ConnectionTracker
 	Mode() string
 	ModeList() []string
-	SetModeUpdateHook(hook *observable.Subscriber[struct{}])
 	HistoryStorage() URLTestHistoryStorage
 }

@@ -26,7 +23,7 @@ type URLTestHistory struct {
 }

 type URLTestHistoryStorage interface {
-	SetHook(hook *observable.Subscriber[struct{}])
+	SetHook(hook chan<- struct{})
 	LoadURLTestHistory(tag string) *URLTestHistory
 	DeleteURLTestHistory(tag string)
 	StoreURLTestHistory(tag string, history *URLTestHistory)
@@ -47,12 +44,6 @@ type CacheFile interface {
 	StoreRDRC() bool
 	RDRCStore

-	StoreDNS() bool
-	DNSCacheStore
-
-	SetDisableExpire(disableExpire bool)
-	SetOptimisticTimeout(timeout time.Duration)
-
 	LoadMode() string
 	StoreMode(mode string) error
 	LoadSelected(group string) string
@@ -75,11 +66,7 @@ func (s *SavedBinary) MarshalBinary() ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	_, err = varbin.WriteUvarint(&buffer, uint64(len(s.Content)))
-	if err != nil {
-		return nil, err
-	}
-	_, err = buffer.Write(s.Content)
+	err = varbin.Write(&buffer, binary.BigEndian, s.Content)
 	if err != nil {
 		return nil, err
 	}
@@ -87,11 +74,7 @@ func (s *SavedBinary) MarshalBinary() ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	_, err = varbin.WriteUvarint(&buffer, uint64(len(s.LastEtag)))
-	if err != nil {
-		return nil, err
-	}
-	_, err = buffer.WriteString(s.LastEtag)
+	err = varbin.Write(&buffer, binary.BigEndian, s.LastEtag)
 	if err != nil {
 		return nil, err
 	}
@@ -105,12 +88,7 @@ func (s *SavedBinary) UnmarshalBinary(data []byte) error {
 	if err != nil {
 		return err
 	}
-	contentLength, err := binary.ReadUvarint(reader)
-	if err != nil {
-		return err
-	}
-	s.Content = make([]byte, contentLength)
-	_, err = io.ReadFull(reader, s.Content)
+	err = varbin.Read(reader, binary.BigEndian, &s.Content)
 	if err != nil {
 		return err
 	}
@@ -120,16 +98,10 @@ func (s *SavedBinary) UnmarshalBinary(data []byte) error {
 		return err
 	}
 	s.LastUpdated = time.Unix(lastUpdated, 0)
-	etagLength, err := binary.ReadUvarint(reader)
+	err = varbin.Read(reader, binary.BigEndian, &s.LastEtag)
 	if err != nil {
 		return err
 	}
-	etagBytes := make([]byte, etagLength)
-	_, err = io.ReadFull(reader, etagBytes)
-	if err != nil {
-		return err
-	}
-	s.LastEtag = string(etagBytes)
 	return nil
 }

--- a/adapter/http.go
+++ b/adapter/http.go
@@ -1,22 +0,0 @@
-package adapter
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common/logger"
-)
-
-type HTTPTransport interface {
-	http.RoundTripper
-	CloseIdleConnections()
-	Clone() HTTPTransport
-	Close() error
-}
-
-type HTTPClientManager interface {
-	ResolveTransport(ctx context.Context, logger logger.ContextLogger, options option.HTTPClientOptions) (HTTPTransport, error)
-	DefaultTransport() HTTPTransport
-	ResetNetwork()
-}
--- a/adapter/inbound.go
+++ b/adapter/inbound.go
@@ -2,16 +2,14 @@ package adapter

 import (
 	"context"
-	"net"
 	"net/netip"
 	"time"

+	"github.com/sagernet/sing-box/common/process"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	M "github.com/sagernet/sing/common/metadata"
-
-	"github.com/miekg/dns"
 )

 type Inbound interface {
@@ -65,10 +63,13 @@ type InboundContext struct {
 	// cache

 	// Deprecated: implement in rule action
-	InboundDetour             string
-	LastInbound               string
-	OriginDestination         M.Socksaddr
-	RouteOriginalDestination  M.Socksaddr
+	InboundDetour            string
+	LastInbound              string
+	OriginDestination        M.Socksaddr
+	RouteOriginalDestination M.Socksaddr
+	// Deprecated: to be removed
+	//nolint:staticcheck
+	InboundOptions            option.InboundOptions
 	UDPDisableDomainUnmapping bool
 	UDPConnect                bool
 	UDPTimeout                time.Duration
@@ -81,16 +82,12 @@ type InboundContext struct {
 	FallbackNetworkType []C.InterfaceType
 	FallbackDelay       time.Duration

-	DestinationAddresses                []netip.Addr
-	DNSResponse                         *dns.Msg
-	DestinationAddressMatchFromResponse bool
-	SourceGeoIPCode                     string
-	GeoIPCode                           string
-	ProcessInfo                         *ConnectionOwner
-	SourceMACAddress                    net.HardwareAddr
-	SourceHostname                      string
-	QueryType                           uint16
-	FakeIP                              bool
+	DestinationAddresses []netip.Addr
+	SourceGeoIPCode      string
+	GeoIPCode            string
+	ProcessInfo          *process.Info
+	QueryType            uint16
+	FakeIP               bool

 	// rule cache

@@ -108,10 +105,6 @@ type InboundContext struct {
 func (c *InboundContext) ResetRuleCache() {
 	c.IPCIDRMatchSource = false
 	c.IPCIDRAcceptEmpty = false
-	c.ResetRuleMatchCache()
-}
-
-func (c *InboundContext) ResetRuleMatchCache() {
 	c.SourceAddressMatch = false
 	c.SourcePortMatch = false
 	c.DestinationAddressMatch = false
@@ -119,51 +112,6 @@ func (c *InboundContext) ResetRuleMatchCache() {
 	c.DidMatch = false
 }

-func (c *InboundContext) DNSResponseAddressesForMatch() []netip.Addr {
-	return DNSResponseAddresses(c.DNSResponse)
-}
-
-func DNSResponseAddresses(response *dns.Msg) []netip.Addr {
-	if response == nil || response.Rcode != dns.RcodeSuccess {
-		return nil
-	}
-	addresses := make([]netip.Addr, 0, len(response.Answer))
-	for _, rawRecord := range response.Answer {
-		switch record := rawRecord.(type) {
-		case *dns.A:
-			addr := M.AddrFromIP(record.A)
-			if addr.IsValid() {
-				addresses = append(addresses, addr)
-			}
-		case *dns.AAAA:
-			addr := M.AddrFromIP(record.AAAA)
-			if addr.IsValid() {
-				addresses = append(addresses, addr)
-			}
-		case *dns.HTTPS:
-			for _, value := range record.SVCB.Value {
-				switch hint := value.(type) {
-				case *dns.SVCBIPv4Hint:
-					for _, ip := range hint.Hint {
-						addr := M.AddrFromIP(ip).Unmap()
-						if addr.IsValid() {
-							addresses = append(addresses, addr)
-						}
-					}
-				case *dns.SVCBIPv6Hint:
-					for _, ip := range hint.Hint {
-						addr := M.AddrFromIP(ip)
-						if addr.IsValid() {
-							addresses = append(addresses, addr)
-						}
-					}
-				}
-			}
-		}
-	}
-	return addresses
-}
-
 type inboundContextKey struct{}

 func WithContext(ctx context.Context, inboundContext *InboundContext) context.Context {
--- a/adapter/inbound/manager.go
+++ b/adapter/inbound/manager.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"os"
 	"sync"
-	"time"

 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/common/taskmonitor"
@@ -12,7 +11,6 @@ import (
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
 )

 var _ adapter.InboundManager = (*Manager)(nil)
@@ -47,14 +45,10 @@ func (m *Manager) Start(stage adapter.StartStage) error {
 	inbounds := m.inbounds
 	m.access.Unlock()
 	for _, inbound := range inbounds {
-		name := "inbound/" + inbound.Type() + "[" + inbound.Tag() + "]"
-		m.logger.Trace(stage, " ", name)
-		startTime := time.Now()
 		err := adapter.LegacyStart(inbound, stage)
 		if err != nil {
-			return E.Cause(err, stage, " ", name)
+			return E.Cause(err, stage, " inbound/", inbound.Type(), "[", inbound.Tag(), "]")
 		}
-		m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
 	return nil
 }
@@ -71,15 +65,11 @@ func (m *Manager) Close() error {
 	monitor := taskmonitor.New(m.logger, C.StopTimeout)
 	var err error
 	for _, inbound := range inbounds {
-		name := "inbound/" + inbound.Type() + "[" + inbound.Tag() + "]"
-		m.logger.Trace("close ", name)
-		startTime := time.Now()
-		monitor.Start("close ", name)
+		monitor.Start("close inbound/", inbound.Type(), "[", inbound.Tag(), "]")
 		err = E.Append(err, inbound.Close(), func(err error) error {
-			return E.Cause(err, "close ", name)
+			return E.Cause(err, "close inbound/", inbound.Type(), "[", inbound.Tag(), "]")
 		})
 		monitor.Finish()
-		m.logger.Trace("close ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
 	return nil
 }
@@ -131,15 +121,11 @@ func (m *Manager) Create(ctx context.Context, router adapter.Router, logger log.
 	m.access.Lock()
 	defer m.access.Unlock()
 	if m.started {
-		name := "inbound/" + inbound.Type() + "[" + inbound.Tag() + "]"
 		for _, stage := range adapter.ListStartStages {
-			m.logger.Trace(stage, " ", name)
-			startTime := time.Now()
 			err = adapter.LegacyStart(inbound, stage)
 			if err != nil {
-				return E.Cause(err, stage, " ", name)
+				return E.Cause(err, stage, " inbound/", inbound.Type(), "[", inbound.Tag(), "]")
 			}
-			m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 		}
 	}
 	if existsInbound, loaded := m.inboundByTag[tag]; loaded {
--- a/adapter/inbound_test.go
+++ b/adapter/inbound_test.go
@@ -1,45 +0,0 @@
-package adapter
-
-import (
-	"net"
-	"net/netip"
-	"testing"
-
-	"github.com/miekg/dns"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDNSResponseAddressesUnmapsHTTPSIPv4Hints(t *testing.T) {
-	t.Parallel()
-
-	ipv4Hint := net.ParseIP("1.1.1.1")
-	require.NotNil(t, ipv4Hint)
-
-	response := &dns.Msg{
-		MsgHdr: dns.MsgHdr{
-			Response: true,
-			Rcode:    dns.RcodeSuccess,
-		},
-		Answer: []dns.RR{
-			&dns.HTTPS{
-				SVCB: dns.SVCB{
-					Hdr: dns.RR_Header{
-						Name:   dns.Fqdn("example.com"),
-						Rrtype: dns.TypeHTTPS,
-						Class:  dns.ClassINET,
-						Ttl:    60,
-					},
-					Priority: 1,
-					Target:   ".",
-					Value: []dns.SVCBKeyValue{
-						&dns.SVCBIPv4Hint{Hint: []net.IP{ipv4Hint}},
-					},
-				},
-			},
-		},
-	}
-
-	addresses := DNSResponseAddresses(response)
-	require.Equal(t, []netip.Addr{netip.MustParseAddr("1.1.1.1")}, addresses)
-	require.True(t, addresses[0].Is4())
-}
--- a/adapter/lifecycle.go
+++ b/adapter/lifecycle.go
@@ -1,14 +1,6 @@
 package adapter

-import (
-	"reflect"
-	"strings"
-	"time"
-
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
-)
+import E "github.com/sagernet/sing/common/exceptions"

 type SimpleLifecycle interface {
 	Start() error
@@ -56,47 +48,22 @@ type LifecycleService interface {
 	Lifecycle
 }

-func getServiceName(service any) string {
-	if named, ok := service.(interface {
-		Type() string
-		Tag() string
-	}); ok {
-		tag := named.Tag()
-		if tag != "" {
-			return named.Type() + "[" + tag + "]"
-		}
-		return named.Type()
-	}
-	t := reflect.TypeOf(service)
-	if t.Kind() == reflect.Ptr {
-		t = t.Elem()
-	}
-	return strings.ToLower(t.Name())
-}
-
-func Start(logger log.ContextLogger, stage StartStage, services ...Lifecycle) error {
+func Start(stage StartStage, services ...Lifecycle) error {
 	for _, service := range services {
-		name := getServiceName(service)
-		logger.Trace(stage, " ", name)
-		startTime := time.Now()
 		err := service.Start(stage)
 		if err != nil {
 			return err
 		}
-		logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
 	return nil
 }

-func StartNamed(logger log.ContextLogger, stage StartStage, services []LifecycleService) error {
+func StartNamed(stage StartStage, services []LifecycleService) error {
 	for _, service := range services {
-		logger.Trace(stage, " ", service.Name())
-		startTime := time.Now()
 		err := service.Start(stage)
 		if err != nil {
 			return E.Cause(err, stage.String(), " ", service.Name())
 		}
-		logger.Trace(stage, " ", service.Name(), " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
 	return nil
 }
--- a/adapter/neighbor.go
+++ b/adapter/neighbor.go
@@ -1,23 +0,0 @@
-package adapter
-
-import (
-	"net"
-	"net/netip"
-)
-
-type NeighborEntry struct {
-	Address    netip.Addr
-	MACAddress net.HardwareAddr
-	Hostname   string
-}
-
-type NeighborResolver interface {
-	LookupMAC(address netip.Addr) (net.HardwareAddr, bool)
-	LookupHostname(address netip.Addr) (string, bool)
-	Start() error
-	Close() error
-}
-
-type NeighborUpdateListener interface {
-	UpdateNeighborTable(entries []NeighborEntry)
-}
--- a/adapter/network.go
+++ b/adapter/network.go
@@ -10,7 +10,6 @@ import (

 type NetworkManager interface {
 	Lifecycle
-	Initialize(ruleSets []RuleSet)
 	InterfaceFinder() control.InterfaceFinder
 	UpdateInterfaces() error
 	DefaultNetworkInterface() *NetworkInterface
@@ -25,10 +24,9 @@ type NetworkManager interface {
 	NetworkMonitor() tun.NetworkUpdateMonitor
 	InterfaceMonitor() tun.DefaultInterfaceMonitor
 	PackageManager() tun.PackageManager
-	NeedWIFIState() bool
 	WIFIState() WIFIState
-	UpdateWIFIState()
 	ResetNetwork()
+	UpdateWIFIState()
 }

 type NetworkOptions struct {
--- a/adapter/outbound.go
+++ b/adapter/outbound.go
@@ -2,12 +2,9 @@ package adapter

 import (
 	"context"
-	"net/netip"
-	"time"

 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-tun"
 	N "github.com/sagernet/sing/common/network"
 )

@@ -21,17 +18,6 @@ type Outbound interface {
 	N.Dialer
 }

-type OutboundWithPreferredRoutes interface {
-	Outbound
-	PreferredDomain(domain string) bool
-	PreferredAddress(address netip.Addr) bool
-}
-
-type DirectRouteOutbound interface {
-	Outbound
-	NewDirectRouteConnection(metadata InboundContext, routeContext tun.DirectRouteContext, timeout time.Duration) (tun.DirectRouteDestination, error)
-}
-
 type OutboundRegistry interface {
 	option.OutboundOptionsRegistry
 	CreateOutbound(ctx context.Context, router Router, logger log.ContextLogger, tag string, outboundType string, options any) (Outbound, error)
--- a/adapter/outbound/manager.go
+++ b/adapter/outbound/manager.go
@@ -6,7 +6,6 @@ import (
 	"os"
 	"strings"
 	"sync"
-	"time"

 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/common/taskmonitor"
@@ -14,7 +13,6 @@ import (
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
 	"github.com/sagernet/sing/common/logger"
 )

@@ -83,14 +81,10 @@ func (m *Manager) Start(stage adapter.StartStage) error {
 		outbounds := m.outbounds
 		m.access.Unlock()
 		for _, outbound := range outbounds {
-			name := "outbound/" + outbound.Type() + "[" + outbound.Tag() + "]"
-			m.logger.Trace(stage, " ", name)
-			startTime := time.Now()
 			err := adapter.LegacyStart(outbound, stage)
 			if err != nil {
-				return E.Cause(err, stage, " ", name)
+				return E.Cause(err, stage, " outbound/", outbound.Type(), "[", outbound.Tag(), "]")
 			}
-			m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 		}
 	}
 	return nil
@@ -115,29 +109,22 @@ func (m *Manager) startOutbounds(outbounds []adapter.Outbound) error {
 			}
 			started[outboundTag] = true
 			canContinue = true
-			name := "outbound/" + outboundToStart.Type() + "[" + outboundTag + "]"
 			if starter, isStarter := outboundToStart.(adapter.Lifecycle); isStarter {
-				m.logger.Trace("start ", name)
-				startTime := time.Now()
-				monitor.Start("start ", name)
+				monitor.Start("start outbound/", outboundToStart.Type(), "[", outboundTag, "]")
 				err := starter.Start(adapter.StartStateStart)
 				monitor.Finish()
 				if err != nil {
-					return E.Cause(err, "start ", name)
+					return E.Cause(err, "start outbound/", outboundToStart.Type(), "[", outboundTag, "]")
 				}
-				m.logger.Trace("start ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 			} else if starter, isStarter := outboundToStart.(interface {
 				Start() error
 			}); isStarter {
-				m.logger.Trace("start ", name)
-				startTime := time.Now()
-				monitor.Start("start ", name)
+				monitor.Start("start outbound/", outboundToStart.Type(), "[", outboundTag, "]")
 				err := starter.Start()
 				monitor.Finish()
 				if err != nil {
-					return E.Cause(err, "start ", name)
+					return E.Cause(err, "start outbound/", outboundToStart.Type(), "[", outboundTag, "]")
 				}
-				m.logger.Trace("start ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 			}
 		}
 		if len(started) == len(outbounds) {
@@ -184,15 +171,11 @@ func (m *Manager) Close() error {
 	var err error
 	for _, outbound := range outbounds {
 		if closer, isCloser := outbound.(io.Closer); isCloser {
-			name := "outbound/" + outbound.Type() + "[" + outbound.Tag() + "]"
-			m.logger.Trace("close ", name)
-			startTime := time.Now()
-			monitor.Start("close ", name)
+			monitor.Start("close outbound/", outbound.Type(), "[", outbound.Tag(), "]")
 			err = E.Append(err, closer.Close(), func(err error) error {
-				return E.Cause(err, "close ", name)
+				return E.Cause(err, "close outbound/", outbound.Type(), "[", outbound.Tag(), "]")
 			})
 			monitor.Finish()
-			m.logger.Trace("close ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 		}
 	}
 	return nil
@@ -273,15 +256,11 @@ func (m *Manager) Create(ctx context.Context, router adapter.Router, logger log.
 		return err
 	}
 	if m.started {
-		name := "outbound/" + outbound.Type() + "[" + outbound.Tag() + "]"
 		for _, stage := range adapter.ListStartStages {
-			m.logger.Trace(stage, " ", name)
-			startTime := time.Now()
 			err = adapter.LegacyStart(outbound, stage)
 			if err != nil {
-				return E.Cause(err, stage, " ", name)
+				return E.Cause(err, stage, " outbound/", outbound.Type(), "[", outbound.Tag(), "]")
 			}
-			m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 		}
 	}
 	m.access.Lock()
--- a/adapter/platform.go
+++ b/adapter/platform.go
@@ -1,74 +0,0 @@
-package adapter
-
-import (
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-tun"
-	"github.com/sagernet/sing/common/logger"
-)
-
-type PlatformInterface interface {
-	Initialize(networkManager NetworkManager) error
-
-	UsePlatformAutoDetectInterfaceControl() bool
-	AutoDetectInterfaceControl(fd int) error
-
-	UsePlatformInterface() bool
-	OpenInterface(options *tun.Options, platformOptions option.TunPlatformOptions) (tun.Tun, error)
-
-	UsePlatformDefaultInterfaceMonitor() bool
-	CreateDefaultInterfaceMonitor(logger logger.Logger) tun.DefaultInterfaceMonitor
-
-	UsePlatformNetworkInterfaces() bool
-	NetworkInterfaces() ([]NetworkInterface, error)
-
-	UnderNetworkExtension() bool
-	NetworkExtensionIncludeAllNetworks() bool
-
-	ClearDNSCache()
-	RequestPermissionForWIFIState() error
-	ReadWIFIState() WIFIState
-	SystemCertificates() []string
-
-	UsePlatformConnectionOwnerFinder() bool
-	FindConnectionOwner(request *FindConnectionOwnerRequest) (*ConnectionOwner, error)
-
-	UsePlatformWIFIMonitor() bool
-
-	UsePlatformNotification() bool
-	SendNotification(notification *Notification) error
-
-	UsePlatformNeighborResolver() bool
-	StartNeighborMonitor(listener NeighborUpdateListener) error
-	CloseNeighborMonitor(listener NeighborUpdateListener) error
-}
-
-type FindConnectionOwnerRequest struct {
-	IpProtocol         int32
-	SourceAddress      string
-	SourcePort         int32
-	DestinationAddress string
-	DestinationPort    int32
-}
-
-type ConnectionOwner struct {
-	ProcessID           uint32
-	UserId              int32
-	UserName            string
-	ProcessPath         string
-	AndroidPackageNames []string
-}
-
-type Notification struct {
-	Identifier string
-	TypeName   string
-	TypeID     int32
-	Title      string
-	Subtitle   string
-	Body       string
-	OpenURL    string
-}
-
-type SystemProxyStatus struct {
-	Available bool
-	Enabled   bool
-}
--- a/adapter/router.go
+++ b/adapter/router.go
@@ -2,11 +2,15 @@ package adapter

 import (
 	"context"
+	"crypto/tls"
 	"net"
-	"time"
+	"net/http"
+	"sync"

-	"github.com/sagernet/sing-tun"
+	C "github.com/sagernet/sing-box/constant"
+	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/sing/common/ntp"
 	"github.com/sagernet/sing/common/x/list"

 	"go4.org/netipx"
@@ -15,13 +19,11 @@ import (
 type Router interface {
 	Lifecycle
 	ConnectionRouter
-	PreMatch(metadata InboundContext, context tun.DirectRouteContext, timeout time.Duration, supportBypass bool) (tun.DirectRouteDestination, error)
+	PreMatch(metadata InboundContext) error
 	ConnectionRouterEx
 	RuleSet(tag string) (RuleSet, bool)
+	NeedWIFIState() bool
 	Rules() []Rule
-	NeedFindProcess() bool
-	NeedFindNeighbor() bool
-	NeighborResolver() NeighborResolver
 	AppendTracker(tracker ConnectionTracker)
 	ResetNetwork()
 }
@@ -45,7 +47,7 @@ type ConnectionRouterEx interface {

 type RuleSet interface {
 	Name() string
-	StartContext(ctx context.Context) error
+	StartContext(ctx context.Context, startContext *HTTPStartContext) error
 	PostStart() error
 	Metadata() RuleSetMetadata
 	ExtractIPSet() []*netipx.IPSet
@@ -60,14 +62,51 @@ type RuleSet interface {

 type RuleSetUpdateCallback func(it RuleSet)

-type DNSRuleSetUpdateValidator interface {
-	ValidateRuleSetMetadataUpdate(tag string, metadata RuleSetMetadata) error
+type RuleSetMetadata struct {
+	ContainsProcessRule bool
+	ContainsWIFIRule    bool
+	ContainsIPCIDRRule  bool
+}
+type HTTPStartContext struct {
+	ctx             context.Context
+	access          sync.Mutex
+	httpClientCache map[string]*http.Client
 }

-// ip_version is not a headless-rule item, so ContainsIPVersionRule is intentionally absent.
-type RuleSetMetadata struct {
-	ContainsProcessRule      bool
-	ContainsWIFIRule         bool
-	ContainsIPCIDRRule       bool
-	ContainsDNSQueryTypeRule bool
+func NewHTTPStartContext(ctx context.Context) *HTTPStartContext {
+	return &HTTPStartContext{
+		ctx:             ctx,
+		httpClientCache: make(map[string]*http.Client),
+	}
+}
+
+func (c *HTTPStartContext) HTTPClient(detour string, dialer N.Dialer) *http.Client {
+	c.access.Lock()
+	defer c.access.Unlock()
+	if httpClient, loaded := c.httpClientCache[detour]; loaded {
+		return httpClient
+	}
+	httpClient := &http.Client{
+		Transport: &http.Transport{
+			ForceAttemptHTTP2:   true,
+			TLSHandshakeTimeout: C.TCPTimeout,
+			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				return dialer.DialContext(ctx, network, M.ParseSocksaddr(addr))
+			},
+			TLSClientConfig: &tls.Config{
+				Time:    ntp.TimeFuncFromContext(c.ctx),
+				RootCAs: RootPoolFromContext(c.ctx),
+			},
+		},
+	}
+	c.httpClientCache[detour] = httpClient
+	return httpClient
+}
+
+func (c *HTTPStartContext) Close() {
+	c.access.Lock()
+	defer c.access.Unlock()
+	for _, client := range c.httpClientCache {
+		client.CloseIdleConnections()
+	}
 }
--- a/adapter/rule.go
+++ b/adapter/rule.go
@@ -2,8 +2,6 @@ package adapter

 import (
 	C "github.com/sagernet/sing-box/constant"
-
-	"github.com/miekg/dns"
 )

 type HeadlessRule interface {
@@ -20,9 +18,8 @@ type Rule interface {

 type DNSRule interface {
 	Rule
-	LegacyPreMatch(metadata *InboundContext) bool
 	WithAddressLimit() bool
-	MatchAddressLimit(metadata *InboundContext, response *dns.Msg) bool
+	MatchAddressLimit(metadata *InboundContext) bool
 }

 type RuleAction interface {
@@ -32,7 +29,7 @@ type RuleAction interface {

 func IsFinalAction(action RuleAction) bool {
 	switch action.Type() {
-	case C.RuleActionTypeSniff, C.RuleActionTypeResolve, C.RuleActionTypeEvaluate:
+	case C.RuleActionTypeSniff, C.RuleActionTypeResolve:
 		return false
 	default:
 		return true
--- a/adapter/service/manager.go
+++ b/adapter/service/manager.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"os"
 	"sync"
-	"time"

 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/common/taskmonitor"
@@ -12,7 +11,6 @@ import (
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
 )

 var _ adapter.ServiceManager = (*Manager)(nil)
@@ -45,14 +43,10 @@ func (m *Manager) Start(stage adapter.StartStage) error {
 	services := m.services
 	m.access.Unlock()
 	for _, service := range services {
-		name := "service/" + service.Type() + "[" + service.Tag() + "]"
-		m.logger.Trace(stage, " ", name)
-		startTime := time.Now()
 		err := adapter.LegacyStart(service, stage)
 		if err != nil {
-			return E.Cause(err, stage, " ", name)
+			return E.Cause(err, stage, " service/", service.Type(), "[", service.Tag(), "]")
 		}
-		m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
 	return nil
 }
@@ -69,15 +63,11 @@ func (m *Manager) Close() error {
 	monitor := taskmonitor.New(m.logger, C.StopTimeout)
 	var err error
 	for _, service := range services {
-		name := "service/" + service.Type() + "[" + service.Tag() + "]"
-		m.logger.Trace("close ", name)
-		startTime := time.Now()
-		monitor.Start("close ", name)
+		monitor.Start("close service/", service.Type(), "[", service.Tag(), "]")
 		err = E.Append(err, service.Close(), func(err error) error {
-			return E.Cause(err, "close ", name)
+			return E.Cause(err, "close service/", service.Type(), "[", service.Tag(), "]")
 		})
 		monitor.Finish()
-		m.logger.Trace("close ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
 	return nil
 }
@@ -126,15 +116,11 @@ func (m *Manager) Create(ctx context.Context, logger log.ContextLogger, tag stri
 	m.access.Lock()
 	defer m.access.Unlock()
 	if m.started {
-		name := "service/" + service.Type() + "[" + service.Tag() + "]"
 		for _, stage := range adapter.ListStartStages {
-			m.logger.Trace(stage, " ", name)
-			startTime := time.Now()
 			err = adapter.LegacyStart(service, stage)
 			if err != nil {
-				return E.Cause(err, stage, " ", name)
+				return E.Cause(err, stage, " service/", service.Type(), "[", service.Tag(), "]")
 			}
-			m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 		}
 	}
 	if existsService, loaded := m.serviceByTag[tag]; loaded {
--- a/adapter/tailscale.go
+++ b/adapter/tailscale.go
@@ -1,49 +0,0 @@
-package adapter
-
-import "context"
-
-type TailscaleEndpoint interface {
-	SubscribeTailscaleStatus(ctx context.Context, fn func(*TailscaleEndpointStatus)) error
-	StartTailscalePing(ctx context.Context, peerIP string, fn func(*TailscalePingResult)) error
-}
-
-type TailscalePingResult struct {
-	LatencyMs      float64
-	IsDirect       bool
-	Endpoint       string
-	DERPRegionID   int32
-	DERPRegionCode string
-	Error          string
-}
-
-type TailscaleEndpointStatus struct {
-	BackendState   string
-	AuthURL        string
-	NetworkName    string
-	MagicDNSSuffix string
-	Self           *TailscalePeer
-	UserGroups     []*TailscaleUserGroup
-}
-
-type TailscaleUserGroup struct {
-	UserID        int64
-	LoginName     string
-	DisplayName   string
-	ProfilePicURL string
-	Peers         []*TailscalePeer
-}
-
-type TailscalePeer struct {
-	HostName       string
-	DNSName        string
-	OS             string
-	TailscaleIPs   []string
-	Online         bool
-	ExitNode       bool
-	ExitNodeOption bool
-	Active         bool
-	RxBytes        int64
-	TxBytes        int64
-	UserID         int64
-	KeyExpiry      int64
-}
--- a/box.go
+++ b/box.go
@@ -9,21 +9,20 @@ import (
 	"time"

 	"github.com/sagernet/sing-box/adapter"
-	boxCertificate "github.com/sagernet/sing-box/adapter/certificate"
 	"github.com/sagernet/sing-box/adapter/endpoint"
 	"github.com/sagernet/sing-box/adapter/inbound"
 	"github.com/sagernet/sing-box/adapter/outbound"
 	boxService "github.com/sagernet/sing-box/adapter/service"
 	"github.com/sagernet/sing-box/common/certificate"
 	"github.com/sagernet/sing-box/common/dialer"
-	"github.com/sagernet/sing-box/common/httpclient"
 	"github.com/sagernet/sing-box/common/taskmonitor"
 	"github.com/sagernet/sing-box/common/tls"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/dns"
+	"github.com/sagernet/sing-box/dns/transport/local"
 	"github.com/sagernet/sing-box/experimental"
 	"github.com/sagernet/sing-box/experimental/cachefile"
-	"github.com/sagernet/sing-box/experimental/deprecated"
+	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing-box/protocol/direct"
@@ -39,22 +38,20 @@ import (
 var _ adapter.SimpleLifecycle = (*Box)(nil)

 type Box struct {
-	createdAt           time.Time
-	logFactory          log.Factory
-	logger              log.ContextLogger
-	network             *route.NetworkManager
-	endpoint            *endpoint.Manager
-	inbound             *inbound.Manager
-	outbound            *outbound.Manager
-	service             *boxService.Manager
-	certificateProvider *boxCertificate.Manager
-	dnsTransport        *dns.TransportManager
-	dnsRouter           *dns.Router
-	connection          *route.ConnectionManager
-	router              *route.Router
-	httpClientService   adapter.LifecycleService
-	internalService     []adapter.LifecycleService
-	done                chan struct{}
+	createdAt       time.Time
+	logFactory      log.Factory
+	logger          log.ContextLogger
+	network         *route.NetworkManager
+	endpoint        *endpoint.Manager
+	inbound         *inbound.Manager
+	outbound        *outbound.Manager
+	service         *boxService.Manager
+	dnsTransport    *dns.TransportManager
+	dnsRouter       *dns.Router
+	connection      *route.ConnectionManager
+	router          *route.Router
+	internalService []adapter.LifecycleService
+	done            chan struct{}
 }

 type Options struct {
@@ -70,7 +67,6 @@ func Context(
 	endpointRegistry adapter.EndpointRegistry,
 	dnsTransportRegistry adapter.DNSTransportRegistry,
 	serviceRegistry adapter.ServiceRegistry,
-	certificateProviderRegistry adapter.CertificateProviderRegistry,
 ) context.Context {
 	if service.FromContext[option.InboundOptionsRegistry](ctx) == nil ||
 		service.FromContext[adapter.InboundRegistry](ctx) == nil {
@@ -95,10 +91,6 @@ func Context(
 		ctx = service.ContextWith[option.ServiceOptionsRegistry](ctx, serviceRegistry)
 		ctx = service.ContextWith[adapter.ServiceRegistry](ctx, serviceRegistry)
 	}
-	if service.FromContext[adapter.CertificateProviderRegistry](ctx) == nil {
-		ctx = service.ContextWith[option.CertificateProviderOptionsRegistry](ctx, certificateProviderRegistry)
-		ctx = service.ContextWith[adapter.CertificateProviderRegistry](ctx, certificateProviderRegistry)
-	}
 	return ctx
 }

@@ -115,7 +107,6 @@ func New(options Options) (*Box, error) {
 	outboundRegistry := service.FromContext[adapter.OutboundRegistry](ctx)
 	dnsTransportRegistry := service.FromContext[adapter.DNSTransportRegistry](ctx)
 	serviceRegistry := service.FromContext[adapter.ServiceRegistry](ctx)
-	certificateProviderRegistry := service.FromContext[adapter.CertificateProviderRegistry](ctx)

 	if endpointRegistry == nil {
 		return nil, E.New("missing endpoint registry in context")
@@ -132,16 +123,10 @@ func New(options Options) (*Box, error) {
 	if serviceRegistry == nil {
 		return nil, E.New("missing service registry in context")
 	}
-	if certificateProviderRegistry == nil {
-		return nil, E.New("missing certificate provider registry in context")
-	}

 	ctx = pause.WithDefaultManager(ctx)
 	experimentalOptions := common.PtrValueOrDefault(options.Experimental)
-	err := applyDebugOptions(common.PtrValueOrDefault(experimentalOptions.Debug))
-	if err != nil {
-		return nil, err
-	}
+	applyDebugOptions(common.PtrValueOrDefault(experimentalOptions.Debug))
 	var needCacheFile bool
 	var needClashAPI bool
 	var needV2RayAPI bool
@@ -154,7 +139,7 @@ func New(options Options) (*Box, error) {
 	if experimentalOptions.V2RayAPI != nil && experimentalOptions.V2RayAPI.Listen != "" {
 		needV2RayAPI = true
 	}
-	platformInterface := service.FromContext[adapter.PlatformInterface](ctx)
+	platformInterface := service.FromContext[platform.Interface](ctx)
 	var defaultLogWriter io.Writer
 	if platformInterface != nil {
 		defaultLogWriter = io.Discard
@@ -172,7 +157,6 @@ func New(options Options) (*Box, error) {
 	}

 	var internalServices []adapter.LifecycleService
-	routeOptions := common.PtrValueOrDefault(options.Route)
 	certificateOptions := common.PtrValueOrDefault(options.Certificate)
 	if C.IsAndroid || certificateOptions.Store != "" && certificateOptions.Store != C.CertificateStoreSystem ||
 		len(certificateOptions.Certificate) > 0 ||
@@ -185,36 +169,28 @@ func New(options Options) (*Box, error) {
 		service.MustRegister[adapter.CertificateStore](ctx, certificateStore)
 		internalServices = append(internalServices, certificateStore)
 	}
+
+	routeOptions := common.PtrValueOrDefault(options.Route)
 	dnsOptions := common.PtrValueOrDefault(options.DNS)
 	endpointManager := endpoint.NewManager(logFactory.NewLogger("endpoint"), endpointRegistry)
 	inboundManager := inbound.NewManager(logFactory.NewLogger("inbound"), inboundRegistry, endpointManager)
 	outboundManager := outbound.NewManager(logFactory.NewLogger("outbound"), outboundRegistry, endpointManager, routeOptions.Final)
 	dnsTransportManager := dns.NewTransportManager(logFactory.NewLogger("dns/transport"), dnsTransportRegistry, outboundManager, dnsOptions.Final)
 	serviceManager := boxService.NewManager(logFactory.NewLogger("service"), serviceRegistry)
-	certificateProviderManager := boxCertificate.NewManager(logFactory.NewLogger("certificate-provider"), certificateProviderRegistry)
 	service.MustRegister[adapter.EndpointManager](ctx, endpointManager)
 	service.MustRegister[adapter.InboundManager](ctx, inboundManager)
 	service.MustRegister[adapter.OutboundManager](ctx, outboundManager)
 	service.MustRegister[adapter.DNSTransportManager](ctx, dnsTransportManager)
 	service.MustRegister[adapter.ServiceManager](ctx, serviceManager)
-	service.MustRegister[adapter.CertificateProviderManager](ctx, certificateProviderManager)
-	dnsRouter, err := dns.NewRouter(ctx, logFactory, dnsOptions)
-	if err != nil {
-		return nil, E.Cause(err, "initialize DNS router")
-	}
+	dnsRouter := dns.NewRouter(ctx, logFactory, dnsOptions)
 	service.MustRegister[adapter.DNSRouter](ctx, dnsRouter)
-	service.MustRegister[adapter.DNSRuleSetUpdateValidator](ctx, dnsRouter)
-	networkManager, err := route.NewNetworkManager(ctx, logFactory.NewLogger("network"), routeOptions, dnsOptions)
+	networkManager, err := route.NewNetworkManager(ctx, logFactory.NewLogger("network"), routeOptions)
 	if err != nil {
 		return nil, E.Cause(err, "initialize network manager")
 	}
 	service.MustRegister[adapter.NetworkManager](ctx, networkManager)
 	connectionManager := route.NewConnectionManager(logFactory.NewLogger("connection"))
 	service.MustRegister[adapter.ConnectionManager](ctx, connectionManager)
-	// Must register after ConnectionManager: the Apple HTTP engine's proxy bridge reads it from the context when Manager.Start resolves the default client.
-	httpClientManager := httpclient.NewManager(ctx, logFactory.NewLogger("httpclient"), options.HTTPClients, routeOptions.DefaultHTTPClient)
-	service.MustRegister[adapter.HTTPClientManager](ctx, httpClientManager)
-	httpClientService := adapter.LifecycleService(httpClientManager)
 	router := route.NewRouter(ctx, logFactory, routeOptions, dnsOptions)
 	service.MustRegister[adapter.Router](ctx, router)
 	err = router.Initialize(routeOptions.Rules, routeOptions.RuleSet)
@@ -294,24 +270,6 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "initialize inbound[", i, "]")
 		}
 	}
-	for i, serviceOptions := range options.Services {
-		var tag string
-		if serviceOptions.Tag != "" {
-			tag = serviceOptions.Tag
-		} else {
-			tag = F.ToString(i)
-		}
-		err = serviceManager.Create(
-			ctx,
-			logFactory.NewLogger(F.ToString("service/", serviceOptions.Type, "[", tag, "]")),
-			tag,
-			serviceOptions.Type,
-			serviceOptions.Options,
-		)
-		if err != nil {
-			return nil, E.Cause(err, "initialize service[", i, "]")
-		}
-	}
 	for i, outboundOptions := range options.Outbounds {
 		var tag string
 		if outboundOptions.Tag != "" {
@@ -338,22 +296,22 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "initialize outbound[", i, "]")
 		}
 	}
-	for i, certificateProviderOptions := range options.CertificateProviders {
+	for i, serviceOptions := range options.Services {
 		var tag string
-		if certificateProviderOptions.Tag != "" {
-			tag = certificateProviderOptions.Tag
+		if serviceOptions.Tag != "" {
+			tag = serviceOptions.Tag
 		} else {
 			tag = F.ToString(i)
 		}
-		err = certificateProviderManager.Create(
+		err = serviceManager.Create(
 			ctx,
-			logFactory.NewLogger(F.ToString("certificate-provider/", certificateProviderOptions.Type, "[", tag, "]")),
+			logFactory.NewLogger(F.ToString("service/", serviceOptions.Type, "[", tag, "]")),
 			tag,
-			certificateProviderOptions.Type,
-			certificateProviderOptions.Options,
+			serviceOptions.Type,
+			serviceOptions.Options,
 		)
 		if err != nil {
-			return nil, E.Cause(err, "initialize certificate provider[", i, "]")
+			return nil, E.Cause(err, "initialize service[", i, "]")
 		}
 	}
 	outboundManager.Initialize(func() (adapter.Outbound, error) {
@@ -365,21 +323,13 @@ func New(options Options) (*Box, error) {
 			option.DirectOutboundOptions{},
 		)
 	})
-	dnsTransportManager.Initialize(func() (adapter.DNSTransport, error) {
-		return dnsTransportRegistry.CreateDNSTransport(
+	dnsTransportManager.Initialize(common.Must1(
+		local.NewTransport(
 			ctx,
 			logFactory.NewLogger("dns/local"),
 			"local",
-			C.DNSTypeLocal,
-			&option.LocalDNSServerOptions{},
-		)
-	})
-	httpClientManager.Initialize(func() (*httpclient.Transport, error) {
-		deprecated.Report(ctx, deprecated.OptionImplicitDefaultHTTPClient)
-		var httpClientOptions option.HTTPClientOptions
-		httpClientOptions.DefaultOutbound = true
-		return httpclient.NewTransport(ctx, logFactory.NewLogger("httpclient"), "", httpClientOptions)
-	})
+			option.LocalDNSServerOptions{},
+		)))
 	if platformInterface != nil {
 		err = platformInterface.Initialize(networkManager)
 		if err != nil {
@@ -387,7 +337,7 @@ func New(options Options) (*Box, error) {
 		}
 	}
 	if needCacheFile {
-		cacheFile := cachefile.New(ctx, logFactory.NewLogger("cache-file"), common.PtrValueOrDefault(experimentalOptions.CacheFile))
+		cacheFile := cachefile.New(ctx, common.PtrValueOrDefault(experimentalOptions.CacheFile))
 		service.MustRegister[adapter.CacheFile](ctx, cacheFile)
 		internalServices = append(internalServices, cacheFile)
 	}
@@ -430,22 +380,20 @@ func New(options Options) (*Box, error) {
 		internalServices = append(internalServices, adapter.NewLifecycleService(ntpService, "ntp service"))
 	}
 	return &Box{
-		network:             networkManager,
-		endpoint:            endpointManager,
-		inbound:             inboundManager,
-		outbound:            outboundManager,
-		dnsTransport:        dnsTransportManager,
-		service:             serviceManager,
-		certificateProvider: certificateProviderManager,
-		dnsRouter:           dnsRouter,
-		connection:          connectionManager,
-		router:              router,
-		httpClientService:   httpClientService,
-		createdAt:           createdAt,
-		logFactory:          logFactory,
-		logger:              logFactory.Logger(),
-		internalService:     internalServices,
-		done:                make(chan struct{}),
+		network:         networkManager,
+		endpoint:        endpointManager,
+		inbound:         inboundManager,
+		outbound:        outboundManager,
+		dnsTransport:    dnsTransportManager,
+		service:         serviceManager,
+		dnsRouter:       dnsRouter,
+		connection:      connectionManager,
+		router:          router,
+		createdAt:       createdAt,
+		logFactory:      logFactory,
+		logger:          logFactory.Logger(),
+		internalService: internalServices,
+		done:            make(chan struct{}),
 	}, nil
 }

@@ -495,23 +443,15 @@ func (s *Box) preStart() error {
 	if err != nil {
 		return E.Cause(err, "start logger")
 	}
-	err = adapter.StartNamed(s.logger, adapter.StartStateInitialize, s.internalService) // cache-file clash-api v2ray-api
+	err = adapter.StartNamed(adapter.StartStateInitialize, s.internalService) // cache-file clash-api v2ray-api
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateInitialize, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.inbound, s.endpoint, s.service, s.certificateProvider)
+	err = adapter.Start(adapter.StartStateInitialize, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.inbound, s.endpoint, s.service)
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.outbound, s.dnsTransport, s.network, s.connection)
-	if err != nil {
-		return err
-	}
-	err = adapter.StartNamed(s.logger, adapter.StartStateStart, []adapter.LifecycleService{s.httpClientService})
-	if err != nil {
-		return err
-	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.router, s.dnsRouter)
+	err = adapter.Start(adapter.StartStateStart, s.outbound, s.dnsTransport, s.dnsRouter, s.network, s.connection, s.router)
 	if err != nil {
 		return err
 	}
@@ -523,35 +463,27 @@ func (s *Box) start() error {
 	if err != nil {
 		return err
 	}
-	err = adapter.StartNamed(s.logger, adapter.StartStateStart, s.internalService)
+	err = adapter.StartNamed(adapter.StartStateStart, s.internalService)
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.endpoint)
+	err = adapter.Start(adapter.StartStateStart, s.inbound, s.endpoint, s.service)
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.certificateProvider)
+	err = adapter.Start(adapter.StartStatePostStart, s.outbound, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.inbound, s.endpoint, s.service)
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.inbound, s.service)
+	err = adapter.StartNamed(adapter.StartStatePostStart, s.internalService)
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStatePostStart, s.outbound, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.endpoint, s.certificateProvider, s.inbound, s.service)
+	err = adapter.Start(adapter.StartStateStarted, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.inbound, s.endpoint, s.service)
 	if err != nil {
 		return err
 	}
-	err = adapter.StartNamed(s.logger, adapter.StartStatePostStart, s.internalService)
-	if err != nil {
-		return err
-	}
-	err = adapter.Start(s.logger, adapter.StartStateStarted, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.endpoint, s.certificateProvider, s.inbound, s.service)
-	if err != nil {
-		return err
-	}
-	err = adapter.StartNamed(s.logger, adapter.StartStateStarted, s.internalService)
+	err = adapter.StartNamed(adapter.StartStateStarted, s.internalService)
 	if err != nil {
 		return err
 	}
@@ -565,51 +497,17 @@ func (s *Box) Close() error {
 	default:
 		close(s.done)
 	}
-	var err error
-	for _, closeItem := range []struct {
-		name    string
-		service adapter.Lifecycle
-	}{
-		{"service", s.service},
-		{"inbound", s.inbound},
-		{"certificate-provider", s.certificateProvider},
-		{"endpoint", s.endpoint},
-		{"outbound", s.outbound},
-		{"router", s.router},
-		{"connection", s.connection},
-		{"dns-router", s.dnsRouter},
-		{"dns-transport", s.dnsTransport},
-		{"network", s.network},
-	} {
-		s.logger.Trace("close ", closeItem.name)
-		startTime := time.Now()
-		err = E.Append(err, closeItem.service.Close(), func(err error) error {
-			return E.Cause(err, "close ", closeItem.name)
-		})
-		s.logger.Trace("close ", closeItem.name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
-	}
-	if s.httpClientService != nil {
-		s.logger.Trace("close ", s.httpClientService.Name())
-		startTime := time.Now()
-		err = E.Append(err, s.httpClientService.Close(), func(err error) error {
-			return E.Cause(err, "close ", s.httpClientService.Name())
-		})
-		s.logger.Trace("close ", s.httpClientService.Name(), " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
-	}
+	err := common.Close(
+		s.service, s.endpoint, s.inbound, s.outbound, s.router, s.connection, s.dnsRouter, s.dnsTransport, s.network,
+	)
 	for _, lifecycleService := range s.internalService {
-		s.logger.Trace("close ", lifecycleService.Name())
-		startTime := time.Now()
 		err = E.Append(err, lifecycleService.Close(), func(err error) error {
 			return E.Cause(err, "close ", lifecycleService.Name())
 		})
-		s.logger.Trace("close ", lifecycleService.Name(), " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	}
-	s.logger.Trace("close logger")
-	startTime := time.Now()
 	err = E.Append(err, s.logFactory.Close(), func(err error) error {
 		return E.Cause(err, "close logger")
 	})
-	s.logger.Trace("close logger completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
 	return err
 }

@@ -628,11 +526,3 @@ func (s *Box) Inbound() adapter.InboundManager {
 func (s *Box) Outbound() adapter.OutboundManager {
 	return s.outbound
 }
-
-func (s *Box) Endpoint() adapter.EndpointManager {
-	return s.endpoint
-}
-
-func (s *Box) LogFactory() log.Factory {
-	return s.logFactory
-}
--- a/clients/android
+++ b/clients/android
--- a/clients/apple
+++ b/clients/apple
--- a/cmd/internal/app_store_connect/main.go
+++ b/cmd/internal/app_store_connect/main.go
@@ -100,32 +100,11 @@ findVersion:
 }

 func publishTestflight(ctx context.Context) error {
-	if len(os.Args) < 3 {
-		return E.New("platform required: ios, macos, or tvos")
-	}
-	var platform asc.Platform
-	switch os.Args[2] {
-	case "ios":
-		platform = asc.PlatformIOS
-	case "macos":
-		platform = asc.PlatformMACOS
-	case "tvos":
-		platform = asc.PlatformTVOS
-	default:
-		return E.New("unknown platform: ", os.Args[2])
-	}
-
 	tagVersion, err := build_shared.ReadTagVersion()
 	if err != nil {
 		return err
 	}
 	tag := tagVersion.VersionString()
-
-	releaseNotes := F.ToString("sing-box ", tagVersion.String())
-	if len(os.Args) >= 4 {
-		releaseNotes = strings.Join(os.Args[3:], " ")
-	}
-
 	client := createClient(20 * time.Minute)

 	log.Info(tag, " list build IDs")
@@ -136,76 +115,97 @@ func publishTestflight(ctx context.Context) error {
 	buildIDs := common.Map(buildIDsResponse.Data, func(it asc.RelationshipData) string {
 		return it.ID
 	})
-
+	var platforms []asc.Platform
+	if len(os.Args) == 3 {
+		switch os.Args[2] {
+		case "ios":
+			platforms = []asc.Platform{asc.PlatformIOS}
+		case "macos":
+			platforms = []asc.Platform{asc.PlatformMACOS}
+		case "tvos":
+			platforms = []asc.Platform{asc.PlatformTVOS}
+		default:
+			return E.New("unknown platform: ", os.Args[2])
+		}
+	} else {
+		platforms = []asc.Platform{
+			asc.PlatformIOS,
+			asc.PlatformMACOS,
+			asc.PlatformTVOS,
+		}
+	}
 	waitingForProcess := false
-	log.Info(string(platform), " list builds")
-	for {
-		builds, _, err := client.Builds.ListBuilds(ctx, &asc.ListBuildsQuery{
-			FilterApp:                       []string{appID},
-			FilterPreReleaseVersionPlatform: []string{string(platform)},
-		})
-		if err != nil {
-			return err
-		}
-		build := builds.Data[0]
-		log.Info(string(platform), " ", tag, " found build: ", build.ID, " (", *build.Attributes.Version, ")")
-		if !waitingForProcess && (common.Contains(buildIDs, build.ID) || time.Since(build.Attributes.UploadedDate.Time) > 30*time.Minute) {
-			log.Info(string(platform), " ", tag, " waiting for process")
-			time.Sleep(15 * time.Second)
-			continue
-		}
-		if *build.Attributes.ProcessingState != "VALID" {
-			waitingForProcess = true
-			log.Info(string(platform), " ", tag, " waiting for process: ", *build.Attributes.ProcessingState)
-			time.Sleep(15 * time.Second)
-			continue
-		}
-		log.Info(string(platform), " ", tag, " list localizations")
-		localizations, _, err := client.TestFlight.ListBetaBuildLocalizationsForBuild(ctx, build.ID, nil)
-		if err != nil {
-			return err
-		}
-		localization := common.Find(localizations.Data, func(it asc.BetaBuildLocalization) bool {
-			return *it.Attributes.Locale == "en-US"
-		})
-		if localization.ID == "" {
-			log.Fatal(string(platform), " ", tag, " no en-US localization found")
-		}
-		if localization.Attributes == nil || localization.Attributes.WhatsNew == nil || *localization.Attributes.WhatsNew == "" {
-			log.Info(string(platform), " ", tag, " update localization")
-			_, _, err = client.TestFlight.UpdateBetaBuildLocalization(ctx, localization.ID, common.Ptr(releaseNotes))
+	for _, platform := range platforms {
+		log.Info(string(platform), " list builds")
+		for {
+			builds, _, err := client.Builds.ListBuilds(ctx, &asc.ListBuildsQuery{
+				FilterApp:                       []string{appID},
+				FilterPreReleaseVersionPlatform: []string{string(platform)},
+			})
 			if err != nil {
 				return err
 			}
-		}
-		log.Info(string(platform), " ", tag, " publish")
-		response, err := client.TestFlight.AddBuildsToBetaGroup(ctx, groupID, []string{build.ID})
-		if response != nil && (response.StatusCode == http.StatusUnprocessableEntity || response.StatusCode == http.StatusNotFound) {
-			log.Info("waiting for process")
-			time.Sleep(15 * time.Second)
-			continue
-		} else if err != nil {
-			return err
-		}
-		log.Info(string(platform), " ", tag, " list submissions")
-		betaSubmissions, _, err := client.TestFlight.ListBetaAppReviewSubmissions(ctx, &asc.ListBetaAppReviewSubmissionsQuery{
-			FilterBuild: []string{build.ID},
-		})
-		if err != nil {
-			return err
-		}
-		if len(betaSubmissions.Data) == 0 {
-			log.Info(string(platform), " ", tag, " create submission")
-			_, _, err = client.TestFlight.CreateBetaAppReviewSubmission(ctx, build.ID)
+			build := builds.Data[0]
+			if !waitingForProcess && (common.Contains(buildIDs, build.ID) || time.Since(build.Attributes.UploadedDate.Time) > 30*time.Minute) {
+				log.Info(string(platform), " ", tag, " waiting for process")
+				time.Sleep(15 * time.Second)
+				continue
+			}
+			if *build.Attributes.ProcessingState != "VALID" {
+				waitingForProcess = true
+				log.Info(string(platform), " ", tag, " waiting for process: ", *build.Attributes.ProcessingState)
+				time.Sleep(15 * time.Second)
+				continue
+			}
+			log.Info(string(platform), " ", tag, " list localizations")
+			localizations, _, err := client.TestFlight.ListBetaBuildLocalizationsForBuild(ctx, build.ID, nil)
 			if err != nil {
-				if strings.Contains(err.Error(), "ANOTHER_BUILD_IN_REVIEW") {
-					log.Error(err)
-					break
+				return err
+			}
+			localization := common.Find(localizations.Data, func(it asc.BetaBuildLocalization) bool {
+				return *it.Attributes.Locale == "en-US"
+			})
+			if localization.ID == "" {
+				log.Fatal(string(platform), " ", tag, " no en-US localization found")
+			}
+			if localization.Attributes == nil || localization.Attributes.WhatsNew == nil || *localization.Attributes.WhatsNew == "" {
+				log.Info(string(platform), " ", tag, " update localization")
+				_, _, err = client.TestFlight.UpdateBetaBuildLocalization(ctx, localization.ID, common.Ptr(
+					F.ToString("sing-box ", tagVersion.String()),
+				))
+				if err != nil {
+					return err
 				}
+			}
+			log.Info(string(platform), " ", tag, " publish")
+			response, err := client.TestFlight.AddBuildsToBetaGroup(ctx, groupID, []string{build.ID})
+			if response != nil && (response.StatusCode == http.StatusUnprocessableEntity || response.StatusCode == http.StatusNotFound) {
+				log.Info("waiting for process")
+				time.Sleep(15 * time.Second)
+				continue
+			} else if err != nil {
 				return err
 			}
+			log.Info(string(platform), " ", tag, " list submissions")
+			betaSubmissions, _, err := client.TestFlight.ListBetaAppReviewSubmissions(ctx, &asc.ListBetaAppReviewSubmissionsQuery{
+				FilterBuild: []string{build.ID},
+			})
+			if err != nil {
+				return err
+			}
+			if len(betaSubmissions.Data) == 0 {
+				log.Info(string(platform), " ", tag, " create submission")
+				_, _, err = client.TestFlight.CreateBetaAppReviewSubmission(ctx, build.ID)
+				if err != nil {
+					if strings.Contains(err.Error(), "ANOTHER_BUILD_IN_REVIEW") {
+						log.Error(err)
+						break
+					}
+					return err
+				}
+			}
+			break
 		}
-		break
 	}
 	return nil
 }
--- a/cmd/internal/build_libbox/main.go
+++ b/cmd/internal/build_libbox/main.go
@@ -5,7 +5,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strconv"
 	"strings"

 	_ "github.com/sagernet/gomobile"
@@ -17,17 +16,17 @@ import (
 )

 var (
-	debugEnabled bool
-	target       string
-	platform     string
-	// withTailscale bool
+	debugEnabled  bool
+	target        string
+	platform      string
+	withTailscale bool
 )

 func init() {
 	flag.BoolVar(&debugEnabled, "debug", false, "enable debug")
 	flag.StringVar(&target, "target", "android", "target platform")
 	flag.StringVar(&platform, "platform", "", "specify platform")
-	// flag.BoolVar(&withTailscale, "with-tailscale", false, "build tailscale for iOS and tvOS")
+	flag.BoolVar(&withTailscale, "with-tailscale", false, "build tailscale for iOS and tvOS")
 }

 func main() {
@@ -48,7 +47,7 @@ var (
 	debugFlags  []string
 	sharedTags  []string
 	darwinTags  []string
-	// memcTags    []string
+	memcTags    []string
 	notMemcTags []string
 	debugTags   []string
 )
@@ -60,38 +59,19 @@ func init() {
 	if err != nil {
 		currentTag = "unknown"
 	}
-	sharedFlags = append(sharedFlags, "-ldflags", "-X github.com/sagernet/sing-box/constant.Version="+currentTag+" -X internal/godebug.defaultGODEBUG=multipathtcp=0 -s -w -buildid=  -checklinkname=0")
-	debugFlags = append(debugFlags, "-ldflags", "-X github.com/sagernet/sing-box/constant.Version="+currentTag+" -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0")
+	sharedFlags = append(sharedFlags, "-ldflags", "-X github.com/sagernet/sing-box/constant.Version="+currentTag+" -s -w -buildid=")
+	debugFlags = append(debugFlags, "-ldflags", "-X github.com/sagernet/sing-box/constant.Version="+currentTag)

-	sharedTags = append(sharedTags, "with_gvisor", "with_quic", "with_wireguard", "with_utls", "with_naive_outbound", "with_clash_api", "badlinkname", "tfogo_checklinkname0")
-	darwinTags = append(darwinTags, "with_dhcp", "grpcnotrace")
-	// memcTags = append(memcTags, "with_tailscale")
-	sharedTags = append(sharedTags, "with_tailscale", "ts_omit_logtail", "ts_omit_ssh", "ts_omit_drive", "ts_omit_taildrop", "ts_omit_webclient", "ts_omit_doctor", "ts_omit_capture", "ts_omit_kube", "ts_omit_aws", "ts_omit_synology", "ts_omit_bird")
+	sharedTags = append(sharedTags, "with_gvisor", "with_quic", "with_wireguard", "with_utls", "with_clash_api", "with_conntrack")
+	darwinTags = append(darwinTags, "with_dhcp")
+	memcTags = append(memcTags, "with_tailscale")
 	notMemcTags = append(notMemcTags, "with_low_memory")
 	debugTags = append(debugTags, "debug")
 }

-type AndroidBuildConfig struct {
-	AndroidAPI int
-	OutputName string
-	Tags       []string
-}
+func buildAndroid() {
+	build_shared.FindSDK()

-func filterTags(tags []string, exclude ...string) []string {
-	excludeMap := make(map[string]bool)
-	for _, tag := range exclude {
-		excludeMap[tag] = true
-	}
-	var result []string
-	for _, tag := range tags {
-		if !excludeMap[tag] {
-			result = append(result, tag)
-		}
-	}
-	return result
-}
-
-func checkJavaVersion() {
 	var javaPath string
 	javaHome := os.Getenv("JAVA_HOME")
 	if javaHome == "" {
@@ -107,87 +87,61 @@ func checkJavaVersion() {
 	if !strings.Contains(javaVersion, "openjdk 17") {
 		log.Fatal("java version should be openjdk 17")
 	}
-}

-func getAndroidBindTarget() string {
+	var bindTarget string
 	if platform != "" {
-		return platform
+		bindTarget = platform
 	} else if debugEnabled {
-		return "android/arm64"
+		bindTarget = "android/arm64"
+	} else {
+		bindTarget = "android"
 	}
-	return "android"
-}

-func buildAndroidVariant(config AndroidBuildConfig, bindTarget string) {
 	args := []string{
 		"bind",
 		"-v",
-		"-o", config.OutputName,
 		"-target", bindTarget,
-		"-androidapi", strconv.Itoa(config.AndroidAPI),
+		"-androidapi", "21",
 		"-javapkg=io.nekohasekai",
 		"-libname=box",
 	}

 	if !debugEnabled {
+		sharedFlags[3] = sharedFlags[3] + " -checklinkname=0"
 		args = append(args, sharedFlags...)
 	} else {
+		debugFlags[1] = debugFlags[1] + " -checklinkname=0"
 		args = append(args, debugFlags...)
 	}

-	args = append(args, "-tags", strings.Join(config.Tags, ","))
+	tags := append(sharedTags, memcTags...)
+	if debugEnabled {
+		tags = append(tags, debugTags...)
+	}
+
+	args = append(args, "-tags", strings.Join(tags, ","))
 	args = append(args, "./experimental/libbox")

 	command := exec.Command(build_shared.GoBinPath+"/gomobile", args...)
 	command.Stdout = os.Stdout
 	command.Stderr = os.Stderr
-	err := command.Run()
+	err = command.Run()
 	if err != nil {
 		log.Fatal(err)
 	}

+	const name = "libbox.aar"
 	copyPath := filepath.Join("..", "sing-box-for-android", "app", "libs")
 	if rw.IsDir(copyPath) {
 		copyPath, _ = filepath.Abs(copyPath)
-		err = rw.CopyFile(config.OutputName, filepath.Join(copyPath, config.OutputName))
+		err = rw.CopyFile(name, filepath.Join(copyPath, name))
 		if err != nil {
 			log.Fatal(err)
 		}
-		log.Info("copied ", config.OutputName, " to ", copyPath)
+		log.Info("copied to ", copyPath)
 	}
 }

-func buildAndroid() {
-	build_shared.FindSDK()
-	checkJavaVersion()
-
-	bindTarget := getAndroidBindTarget()
-
-	// Build main variant (SDK 23)
-	mainTags := append([]string{}, sharedTags...)
-	// mainTags = append(mainTags, memcTags...)
-	if debugEnabled {
-		mainTags = append(mainTags, debugTags...)
-	}
-	buildAndroidVariant(AndroidBuildConfig{
-		AndroidAPI: 23,
-		OutputName: "libbox.aar",
-		Tags:       mainTags,
-	}, bindTarget)
-
-	// Build legacy variant (SDK 21, no naive outbound)
-	legacyTags := filterTags(sharedTags, "with_naive_outbound")
-	// legacyTags = append(legacyTags, memcTags...)
-	if debugEnabled {
-		legacyTags = append(legacyTags, debugTags...)
-	}
-	buildAndroidVariant(AndroidBuildConfig{
-		AndroidAPI: 21,
-		OutputName: "libbox-legacy.aar",
-		Tags:       legacyTags,
-	}, bindTarget)
-}
-
 func buildApple() {
 	var bindTarget string
 	if platform != "" {
@@ -195,7 +149,7 @@ func buildApple() {
 	} else if debugEnabled {
 		bindTarget = "ios"
 	} else {
-		bindTarget = "ios,iossimulator,tvos,tvossimulator,macos"
+		bindTarget = "ios,tvos,macos"
 	}

 	args := []string{
@@ -204,13 +158,10 @@ func buildApple() {
 		"-target", bindTarget,
 		"-libname=box",
 		"-tags-not-macos=with_low_memory",
-		"-iosversion=15.0",
-		"-macosversion=13.0",
-		"-tvosversion=17.0",
 	}
-	//if !withTailscale {
-	//	args = append(args, "-tags-macos="+strings.Join(memcTags, ","))
-	//}
+	if !withTailscale {
+		args = append(args, "-tags-macos="+strings.Join(memcTags, ","))
+	}

 	if !debugEnabled {
 		args = append(args, sharedFlags...)
@@ -219,9 +170,9 @@ func buildApple() {
 	}

 	tags := append(sharedTags, darwinTags...)
-	//if withTailscale {
-	//	tags = append(tags, memcTags...)
-	//}
+	if withTailscale {
+		tags = append(tags, memcTags...)
+	}
 	if debugEnabled {
 		tags = append(tags, debugTags...)
 	}
--- a/cmd/internal/format_docs/main.go
+++ b/cmd/internal/format_docs/main.go
@@ -1,117 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/sagernet/sing-box/log"
-)
-
-func main() {
-	err := filepath.Walk("docs", func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		if info.IsDir() {
-			return nil
-		}
-		if !strings.HasSuffix(path, ".md") {
-			return nil
-		}
-		return processFile(path)
-	})
-	if err != nil {
-		log.Fatal(err)
-	}
-}
-
-func processFile(path string) error {
-	content, err := os.ReadFile(path)
-	if err != nil {
-		return err
-	}
-
-	lines := strings.Split(string(content), "\n")
-	modified := false
-	result := make([]string, 0, len(lines))
-
-	inQuoteBlock := false
-	materialLines := []int{} // indices of :material- lines in the block
-
-	for _, line := range lines {
-		// Check for quote block start
-		if strings.HasPrefix(line, "!!! quote \"") && strings.Contains(line, "sing-box") {
-			inQuoteBlock = true
-			materialLines = nil
-			result = append(result, line)
-			continue
-		}
-
-		// Inside a quote block
-		if inQuoteBlock {
-			trimmed := strings.TrimPrefix(line, "    ")
-			isMaterialLine := strings.HasPrefix(trimmed, ":material-")
-			isEmpty := strings.TrimSpace(line) == ""
-			isIndented := strings.HasPrefix(line, "    ")
-
-			if isMaterialLine {
-				materialLines = append(materialLines, len(result))
-				result = append(result, line)
-				continue
-			}
-
-			// Block ends when:
-			// - Empty line AFTER we've seen material lines, OR
-			// - Non-indented, non-empty line
-			blockEnds := (isEmpty && len(materialLines) > 0) || (!isEmpty && !isIndented)
-			if blockEnds {
-				// Process collected material lines
-				if len(materialLines) > 0 {
-					for j, idx := range materialLines {
-						isLast := j == len(materialLines)-1
-						resultLine := strings.TrimRight(result[idx], " ")
-						if !isLast {
-							// Add trailing two spaces for non-last lines
-							resultLine += "  "
-						}
-						if result[idx] != resultLine {
-							modified = true
-							result[idx] = resultLine
-						}
-					}
-				}
-				inQuoteBlock = false
-				materialLines = nil
-			}
-		}
-
-		result = append(result, line)
-	}
-
-	// Handle case where file ends while still in a block
-	if inQuoteBlock && len(materialLines) > 0 {
-		for j, idx := range materialLines {
-			isLast := j == len(materialLines)-1
-			resultLine := strings.TrimRight(result[idx], " ")
-			if !isLast {
-				resultLine += "  "
-			}
-			if result[idx] != resultLine {
-				modified = true
-				result[idx] = resultLine
-			}
-		}
-	}
-
-	if modified {
-		newContent := strings.Join(result, "\n")
-		if !bytes.Equal(content, []byte(newContent)) {
-			log.Info("formatted: ", path)
-			return os.WriteFile(path, []byte(newContent), 0o644)
-		}
-	}
-
-	return nil
-}
--- a/cmd/internal/update_apple_version/main.go
+++ b/cmd/internal/update_apple_version/main.go
@@ -71,12 +71,12 @@ func findAndReplace(objectsMap map[string]any, projectContent string, bundleIDLi
 		indexEnd := indexStart + strings.Index(projectContent[indexStart:], "}")
 		versionStart := indexStart + strings.Index(projectContent[indexStart:indexEnd], "MARKETING_VERSION = ") + 20
 		versionEnd := versionStart + strings.Index(projectContent[versionStart:indexEnd], ";")
-		version := strings.Trim(projectContent[versionStart:versionEnd], "\"")
+		version := projectContent[versionStart:versionEnd]
 		if version == newVersion {
 			continue
 		}
 		updated = true
-		projectContent = projectContent[:versionStart] + "\"" + newVersion + "\"" + projectContent[versionEnd:]
+		projectContent = projectContent[:versionStart] + newVersion + projectContent[versionEnd:]
 	}
 	return projectContent, updated
 }
--- a/cmd/internal/update_certificates/main.go
+++ b/cmd/internal/update_certificates/main.go
@@ -5,7 +5,6 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"path/filepath"
 	"strings"

 	"github.com/sagernet/sing-box/log"
@@ -18,10 +17,6 @@ func main() {
 	if err != nil {
 		log.Error(err)
 	}
-	err = updateChromeIncludedRootCAs()
-	if err != nil {
-		log.Error(err)
-	}
 }

 func updateMozillaIncludedRootCAs() error {
@@ -36,9 +31,21 @@ func updateMozillaIncludedRootCAs() error {
 		return err
 	}
 	geoIndex := slices.Index(header, "Geographic Focus")
+	nameIndex := slices.Index(header, "Common Name or Certificate Name")
 	certIndex := slices.Index(header, "PEM Info")

-	pemBundle := strings.Builder{}
+	generated := strings.Builder{}
+	generated.WriteString(`// Code generated by 'make update_certificates'. DO NOT EDIT.
+
+package certificate
+
+import "crypto/x509"
+
+var mozillaIncluded *x509.CertPool
+
+func init() {
+	mozillaIncluded = x509.NewCertPool()
+`)
 	for {
 		record, err := reader.Read()
 		if err == io.EOF {
@@ -49,110 +56,16 @@ func updateMozillaIncludedRootCAs() error {
 		if record[geoIndex] == "China" {
 			continue
 		}
+		generated.WriteString("\n	// ")
+		generated.WriteString(record[nameIndex])
+		generated.WriteString("\n")
+		generated.WriteString("	mozillaIncluded.AppendCertsFromPEM([]byte(`")
 		cert := record[certIndex]
+		// Remove single quotes
 		cert = cert[1 : len(cert)-1]
-		pemBundle.WriteString(cert)
-		pemBundle.WriteString("\n")
+		generated.WriteString(cert)
+		generated.WriteString("`))\n")
 	}
-	return writeGeneratedCertificateBundle("mozilla", "mozillaIncluded", pemBundle.String())
-}
-
-func fetchChinaFingerprints() (map[string]bool, error) {
-	response, err := http.Get("https://ccadb.my.salesforce-sites.com/ccadb/AllCertificateRecordsCSVFormatv4")
-	if err != nil {
-		return nil, err
-	}
-	defer response.Body.Close()
-	reader := csv.NewReader(response.Body)
-	header, err := reader.Read()
-	if err != nil {
-		return nil, err
-	}
-	countryIndex := slices.Index(header, "Country")
-	fingerprintIndex := slices.Index(header, "SHA-256 Fingerprint")
-
-	chinaFingerprints := make(map[string]bool)
-	for {
-		record, err := reader.Read()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			return nil, err
-		}
-		if record[countryIndex] == "China" {
-			chinaFingerprints[record[fingerprintIndex]] = true
-		}
-	}
-	return chinaFingerprints, nil
-}
-
-func updateChromeIncludedRootCAs() error {
-	chinaFingerprints, err := fetchChinaFingerprints()
-	if err != nil {
-		return err
-	}
-
-	response, err := http.Get("https://ccadb.my.salesforce-sites.com/ccadb/RootCACertificatesIncludedByRSReportCSV")
-	if err != nil {
-		return err
-	}
-	defer response.Body.Close()
-	reader := csv.NewReader(response.Body)
-	header, err := reader.Read()
-	if err != nil {
-		return err
-	}
-	statusIndex := slices.Index(header, "Google Chrome Status")
-	certIndex := slices.Index(header, "X.509 Certificate (PEM)")
-	fingerprintIndex := slices.Index(header, "SHA-256 Fingerprint")
-
-	pemBundle := strings.Builder{}
-	for {
-		record, err := reader.Read()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			return err
-		}
-		if record[statusIndex] != "Included" {
-			continue
-		}
-		if chinaFingerprints[record[fingerprintIndex]] {
-			continue
-		}
-		cert := record[certIndex]
-		if len(cert) > 0 && cert[0] == '\'' {
-			cert = cert[1 : len(cert)-1]
-		}
-		pemBundle.WriteString(cert)
-		pemBundle.WriteString("\n")
-	}
-	return writeGeneratedCertificateBundle("chrome", "chromeIncluded", pemBundle.String())
-}
-
-func writeGeneratedCertificateBundle(name string, variableName string, pemBundle string) error {
-	goSource := `// Code generated by 'make update_certificates'. DO NOT EDIT.
-
-package certificate
-
-import (
-	"crypto/x509"
-	_ "embed"
-)
-
-//go:embed ` + name + `.pem
-var ` + variableName + `PEM string
-
-var ` + variableName + ` *x509.CertPool
-
-func init() {
-	` + variableName + ` = x509.NewCertPool()
-	` + variableName + `.AppendCertsFromPEM([]byte(` + variableName + `PEM))
-}
-`
-	err := os.WriteFile(filepath.Join("common/certificate", name+".pem"), []byte(pemBundle), 0o644)
-	if err != nil {
-		return err
-	}
-	return os.WriteFile(filepath.Join("common/certificate", name+".go"), []byte(goSource), 0o644)
+	generated.WriteString("}\n")
+	return os.WriteFile("common/certificate/mozilla.go", []byte(generated.String()), 0o644)
 }
--- a/cmd/sing-box/cmd_rule_set_compile.go
+++ b/cmd/sing-box/cmd_rule_set_compile.go
@@ -6,10 +6,8 @@ import (
 	"strings"

 	"github.com/sagernet/sing-box/common/srs"
-	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-box/route/rule"
 	"github.com/sagernet/sing/common/json"

 	"github.com/spf13/cobra"
@@ -71,7 +69,7 @@ func compileRuleSet(sourcePath string) error {
 	if err != nil {
 		return err
 	}
-	err = srs.Write(outputFile, plainRuleSet.Options, downgradeRuleSetVersion(plainRuleSet.Version, plainRuleSet.Options))
+	err = srs.Write(outputFile, plainRuleSet.Options, plainRuleSet.Version)
 	if err != nil {
 		outputFile.Close()
 		os.Remove(outputPath)
@@ -80,23 +78,3 @@ func compileRuleSet(sourcePath string) error {
 	outputFile.Close()
 	return nil
 }
-
-func downgradeRuleSetVersion(version uint8, options option.PlainRuleSet) uint8 {
-	if version == C.RuleSetVersion5 && !rule.HasHeadlessRule(options.Rules, func(rule option.DefaultHeadlessRule) bool {
-		return len(rule.PackageNameRegex) > 0
-	}) {
-		version = C.RuleSetVersion4
-	}
-	if version == C.RuleSetVersion4 && !rule.HasHeadlessRule(options.Rules, func(rule option.DefaultHeadlessRule) bool {
-		return rule.NetworkInterfaceAddress != nil && rule.NetworkInterfaceAddress.Size() > 0 ||
-			len(rule.DefaultInterfaceAddress) > 0
-	}) {
-		version = C.RuleSetVersion3
-	}
-	if version == C.RuleSetVersion3 && !rule.HasHeadlessRule(options.Rules, func(rule option.DefaultHeadlessRule) bool {
-		return len(rule.NetworkType) > 0 || rule.NetworkIsExpensive || rule.NetworkIsConstrained
-	}) {
-		version = C.RuleSetVersion2
-	}
-	return version
-}
--- a/cmd/sing-box/cmd_tools_fetch_http3.go
+++ b/cmd/sing-box/cmd_tools_fetch_http3.go
@@ -22,7 +22,7 @@ func initializeHTTP3Client(instance *box.Box) error {
 	}
 	http3Client = &http.Client{
 		Transport: &http3.Transport{
-			Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
+			Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
 				destination := M.ParseSocksaddr(addr)
 				udpConn, dErr := dialer.DialContext(ctx, N.NetworkUDP, destination)
 				if dErr != nil {
--- a/cmd/sing-box/cmd_tools_networkquality.go
+++ b/cmd/sing-box/cmd_tools_networkquality.go
@@ -1,121 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/sagernet/sing-box/common/networkquality"
-	"github.com/sagernet/sing-box/log"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	commandNetworkQualityFlagConfigURL  string
-	commandNetworkQualityFlagSerial     bool
-	commandNetworkQualityFlagMaxRuntime int
-	commandNetworkQualityFlagHTTP3      bool
-)
-
-var commandNetworkQuality = &cobra.Command{
-	Use:   "networkquality",
-	Short: "Run a network quality test",
-	Run: func(cmd *cobra.Command, args []string) {
-		err := runNetworkQuality()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandNetworkQuality.Flags().StringVar(
-		&commandNetworkQualityFlagConfigURL,
-		"config-url", "",
-		"Network quality test config URL (default: Apple mensura)",
-	)
-	commandNetworkQuality.Flags().BoolVar(
-		&commandNetworkQualityFlagSerial,
-		"serial", false,
-		"Run download and upload tests sequentially instead of in parallel",
-	)
-	commandNetworkQuality.Flags().IntVar(
-		&commandNetworkQualityFlagMaxRuntime,
-		"max-runtime", int(networkquality.DefaultMaxRuntime/time.Second),
-		"Network quality maximum runtime in seconds",
-	)
-	commandNetworkQuality.Flags().BoolVar(
-		&commandNetworkQualityFlagHTTP3,
-		"http3", false,
-		"Use HTTP/3 (QUIC) for measurement traffic",
-	)
-	commandTools.AddCommand(commandNetworkQuality)
-}
-
-func runNetworkQuality() error {
-	instance, err := createPreStartedClient()
-	if err != nil {
-		return err
-	}
-	defer instance.Close()
-
-	dialer, err := createDialer(instance, commandToolsFlagOutbound)
-	if err != nil {
-		return err
-	}
-
-	httpClient := networkquality.NewHTTPClient(dialer)
-	defer httpClient.CloseIdleConnections()
-
-	measurementClientFactory, err := networkquality.NewOptionalHTTP3Factory(dialer, commandNetworkQualityFlagHTTP3)
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintln(os.Stderr, "==== NETWORK QUALITY TEST ====")
-
-	result, err := networkquality.Run(networkquality.Options{
-		ConfigURL:            commandNetworkQualityFlagConfigURL,
-		HTTPClient:           httpClient,
-		NewMeasurementClient: measurementClientFactory,
-		Serial:               commandNetworkQualityFlagSerial,
-		MaxRuntime:           time.Duration(commandNetworkQualityFlagMaxRuntime) * time.Second,
-		Context:              globalCtx,
-		OnProgress: func(p networkquality.Progress) {
-			if !commandNetworkQualityFlagSerial && p.Phase != networkquality.PhaseIdle {
-				fmt.Fprintf(os.Stderr, "\rDownload: %s  RPM: %d  Upload: %s  RPM: %d",
-					networkquality.FormatBitrate(p.DownloadCapacity), p.DownloadRPM,
-					networkquality.FormatBitrate(p.UploadCapacity), p.UploadRPM)
-				return
-			}
-			switch networkquality.Phase(p.Phase) {
-			case networkquality.PhaseIdle:
-				if p.IdleLatencyMs > 0 {
-					fmt.Fprintf(os.Stderr, "\rIdle Latency: %d ms", p.IdleLatencyMs)
-				} else {
-					fmt.Fprint(os.Stderr, "\rMeasuring idle latency...")
-				}
-			case networkquality.PhaseDownload:
-				fmt.Fprintf(os.Stderr, "\rDownload: %s  RPM: %d",
-					networkquality.FormatBitrate(p.DownloadCapacity), p.DownloadRPM)
-			case networkquality.PhaseUpload:
-				fmt.Fprintf(os.Stderr, "\rUpload: %s  RPM: %d",
-					networkquality.FormatBitrate(p.UploadCapacity), p.UploadRPM)
-			}
-		},
-	})
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintln(os.Stderr)
-	fmt.Fprintln(os.Stderr, strings.Repeat("-", 40))
-	fmt.Fprintf(os.Stderr, "Idle Latency:            %d ms\n", result.IdleLatencyMs)
-	fmt.Fprintf(os.Stderr, "Download Capacity:       %-20s Accuracy: %s\n", networkquality.FormatBitrate(result.DownloadCapacity), result.DownloadCapacityAccuracy)
-	fmt.Fprintf(os.Stderr, "Upload Capacity:         %-20s Accuracy: %s\n", networkquality.FormatBitrate(result.UploadCapacity), result.UploadCapacityAccuracy)
-	fmt.Fprintf(os.Stderr, "Download Responsiveness: %-20s Accuracy: %s\n", fmt.Sprintf("%d RPM", result.DownloadRPM), result.DownloadRPMAccuracy)
-	fmt.Fprintf(os.Stderr, "Upload Responsiveness:   %-20s Accuracy: %s\n", fmt.Sprintf("%d RPM", result.UploadRPM), result.UploadRPMAccuracy)
-	return nil
-}
--- a/cmd/sing-box/cmd_tools_stun.go
+++ b/cmd/sing-box/cmd_tools_stun.go
@@ -1,79 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/sagernet/sing-box/common/stun"
-	"github.com/sagernet/sing-box/log"
-
-	"github.com/spf13/cobra"
-)
-
-var commandSTUNFlagServer string
-
-var commandSTUN = &cobra.Command{
-	Use:   "stun",
-	Short: "Run a STUN test",
-	Args:  cobra.NoArgs,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := runSTUN()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandSTUN.Flags().StringVarP(&commandSTUNFlagServer, "server", "s", stun.DefaultServer, "STUN server address")
-	commandTools.AddCommand(commandSTUN)
-}
-
-func runSTUN() error {
-	instance, err := createPreStartedClient()
-	if err != nil {
-		return err
-	}
-	defer instance.Close()
-
-	dialer, err := createDialer(instance, commandToolsFlagOutbound)
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintln(os.Stderr, "==== STUN TEST ====")
-
-	result, err := stun.Run(stun.Options{
-		Server:  commandSTUNFlagServer,
-		Dialer:  dialer,
-		Context: globalCtx,
-		OnProgress: func(p stun.Progress) {
-			switch p.Phase {
-			case stun.PhaseBinding:
-				if p.ExternalAddr != "" {
-					fmt.Fprintf(os.Stderr, "\rExternal Address: %s (%d ms)", p.ExternalAddr, p.LatencyMs)
-				} else {
-					fmt.Fprint(os.Stderr, "\rSending binding request...")
-				}
-			case stun.PhaseNATMapping:
-				fmt.Fprint(os.Stderr, "\rDetecting NAT mapping behavior...")
-			case stun.PhaseNATFiltering:
-				fmt.Fprint(os.Stderr, "\rDetecting NAT filtering behavior...")
-			}
-		},
-	})
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintln(os.Stderr)
-	fmt.Fprintf(os.Stderr, "External Address: %s\n", result.ExternalAddr)
-	fmt.Fprintf(os.Stderr, "Latency:          %d ms\n", result.LatencyMs)
-	if result.NATTypeSupported {
-		fmt.Fprintf(os.Stderr, "NAT Mapping:      %s\n", result.NATMapping)
-		fmt.Fprintf(os.Stderr, "NAT Filtering:    %s\n", result.NATFiltering)
-	} else {
-		fmt.Fprintln(os.Stderr, "NAT Type Detection: not supported by server")
-	}
-	return nil
-}
--- a/common/badtls/raw_conn.go
+++ b/common/badtls/raw_conn.go
@@ -1,176 +0,0 @@
-//go:build go1.25 && badlinkname
-
-package badtls
-
-import (
-	"bytes"
-	"os"
-	"reflect"
-	"sync/atomic"
-	"unsafe"
-
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/tls"
-)
-
-type RawConn struct {
-	pointer unsafe.Pointer
-	methods *Methods
-
-	IsClient            *bool
-	IsHandshakeComplete *atomic.Bool
-	Vers                *uint16
-	CipherSuite         *uint16
-
-	RawInput *bytes.Buffer
-	Input    *bytes.Reader
-	Hand     *bytes.Buffer
-
-	CloseNotifySent *bool
-	CloseNotifyErr  *error
-
-	In  *RawHalfConn
-	Out *RawHalfConn
-
-	BytesSent   *int64
-	PacketsSent *int64
-
-	ActiveCall *atomic.Int32
-	Tmp        *[16]byte
-}
-
-func NewRawConn(rawTLSConn tls.Conn) (*RawConn, error) {
-	var (
-		pointer unsafe.Pointer
-		methods *Methods
-		loaded  bool
-	)
-	for _, tlsCreator := range methodRegistry {
-		pointer, methods, loaded = tlsCreator(rawTLSConn)
-		if loaded {
-			break
-		}
-	}
-	if !loaded {
-		return nil, os.ErrInvalid
-	}
-
-	conn := &RawConn{
-		pointer: pointer,
-		methods: methods,
-	}
-
-	rawConn := reflect.Indirect(reflect.ValueOf(rawTLSConn))
-
-	rawIsClient := rawConn.FieldByName("isClient")
-	if !rawIsClient.IsValid() || rawIsClient.Kind() != reflect.Bool {
-		return nil, E.New("invalid Conn.isClient")
-	}
-	conn.IsClient = (*bool)(unsafe.Pointer(rawIsClient.UnsafeAddr()))
-
-	rawIsHandshakeComplete := rawConn.FieldByName("isHandshakeComplete")
-	if !rawIsHandshakeComplete.IsValid() || rawIsHandshakeComplete.Kind() != reflect.Struct {
-		return nil, E.New("invalid Conn.isHandshakeComplete")
-	}
-	conn.IsHandshakeComplete = (*atomic.Bool)(unsafe.Pointer(rawIsHandshakeComplete.UnsafeAddr()))
-
-	rawVers := rawConn.FieldByName("vers")
-	if !rawVers.IsValid() || rawVers.Kind() != reflect.Uint16 {
-		return nil, E.New("invalid Conn.vers")
-	}
-	conn.Vers = (*uint16)(unsafe.Pointer(rawVers.UnsafeAddr()))
-
-	rawCipherSuite := rawConn.FieldByName("cipherSuite")
-	if !rawCipherSuite.IsValid() || rawCipherSuite.Kind() != reflect.Uint16 {
-		return nil, E.New("invalid Conn.cipherSuite")
-	}
-	conn.CipherSuite = (*uint16)(unsafe.Pointer(rawCipherSuite.UnsafeAddr()))
-
-	rawRawInput := rawConn.FieldByName("rawInput")
-	if !rawRawInput.IsValid() || rawRawInput.Kind() != reflect.Struct {
-		return nil, E.New("invalid Conn.rawInput")
-	}
-	conn.RawInput = (*bytes.Buffer)(unsafe.Pointer(rawRawInput.UnsafeAddr()))
-
-	rawInput := rawConn.FieldByName("input")
-	if !rawInput.IsValid() || rawInput.Kind() != reflect.Struct {
-		return nil, E.New("invalid Conn.input")
-	}
-	conn.Input = (*bytes.Reader)(unsafe.Pointer(rawInput.UnsafeAddr()))
-
-	rawHand := rawConn.FieldByName("hand")
-	if !rawHand.IsValid() || rawHand.Kind() != reflect.Struct {
-		return nil, E.New("invalid Conn.hand")
-	}
-	conn.Hand = (*bytes.Buffer)(unsafe.Pointer(rawHand.UnsafeAddr()))
-
-	rawCloseNotifySent := rawConn.FieldByName("closeNotifySent")
-	if !rawCloseNotifySent.IsValid() || rawCloseNotifySent.Kind() != reflect.Bool {
-		return nil, E.New("invalid Conn.closeNotifySent")
-	}
-	conn.CloseNotifySent = (*bool)(unsafe.Pointer(rawCloseNotifySent.UnsafeAddr()))
-
-	rawCloseNotifyErr := rawConn.FieldByName("closeNotifyErr")
-	if !rawCloseNotifyErr.IsValid() || rawCloseNotifyErr.Kind() != reflect.Interface {
-		return nil, E.New("invalid Conn.closeNotifyErr")
-	}
-	conn.CloseNotifyErr = (*error)(unsafe.Pointer(rawCloseNotifyErr.UnsafeAddr()))
-
-	rawIn := rawConn.FieldByName("in")
-	if !rawIn.IsValid() || rawIn.Kind() != reflect.Struct {
-		return nil, E.New("invalid Conn.in")
-	}
-	halfIn, err := NewRawHalfConn(rawIn, methods)
-	if err != nil {
-		return nil, E.Cause(err, "invalid Conn.in")
-	}
-	conn.In = halfIn
-
-	rawOut := rawConn.FieldByName("out")
-	if !rawOut.IsValid() || rawOut.Kind() != reflect.Struct {
-		return nil, E.New("invalid Conn.out")
-	}
-	halfOut, err := NewRawHalfConn(rawOut, methods)
-	if err != nil {
-		return nil, E.Cause(err, "invalid Conn.out")
-	}
-	conn.Out = halfOut
-
-	rawBytesSent := rawConn.FieldByName("bytesSent")
-	if !rawBytesSent.IsValid() || rawBytesSent.Kind() != reflect.Int64 {
-		return nil, E.New("invalid Conn.bytesSent")
-	}
-	conn.BytesSent = (*int64)(unsafe.Pointer(rawBytesSent.UnsafeAddr()))
-
-	rawPacketsSent := rawConn.FieldByName("packetsSent")
-	if !rawPacketsSent.IsValid() || rawPacketsSent.Kind() != reflect.Int64 {
-		return nil, E.New("invalid Conn.packetsSent")
-	}
-	conn.PacketsSent = (*int64)(unsafe.Pointer(rawPacketsSent.UnsafeAddr()))
-
-	rawActiveCall := rawConn.FieldByName("activeCall")
-	if !rawActiveCall.IsValid() || rawActiveCall.Kind() != reflect.Struct {
-		return nil, E.New("invalid Conn.activeCall")
-	}
-	conn.ActiveCall = (*atomic.Int32)(unsafe.Pointer(rawActiveCall.UnsafeAddr()))
-
-	rawTmp := rawConn.FieldByName("tmp")
-	if !rawTmp.IsValid() || rawTmp.Kind() != reflect.Array || rawTmp.Len() != 16 || rawTmp.Type().Elem().Kind() != reflect.Uint8 {
-		return nil, E.New("invalid Conn.tmp")
-	}
-	conn.Tmp = (*[16]byte)(unsafe.Pointer(rawTmp.UnsafeAddr()))
-
-	return conn, nil
-}
-
-func (c *RawConn) ReadRecord() error {
-	return c.methods.readRecord(c.pointer)
-}
-
-func (c *RawConn) HandlePostHandshakeMessage() error {
-	return c.methods.handlePostHandshakeMessage(c.pointer)
-}
-
-func (c *RawConn) WriteRecordLocked(typ uint16, data []byte) (int, error) {
-	return c.methods.writeRecordLocked(c.pointer, typ, data)
-}
--- a/common/badtls/raw_half_conn.go
+++ b/common/badtls/raw_half_conn.go
@@ -1,121 +0,0 @@
-//go:build go1.25 && badlinkname
-
-package badtls
-
-import (
-	"hash"
-	"reflect"
-	"sync"
-	"unsafe"
-
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-type RawHalfConn struct {
-	pointer unsafe.Pointer
-	methods *Methods
-	*sync.Mutex
-	Err           *error
-	Version       *uint16
-	Cipher        *any
-	Seq           *[8]byte
-	ScratchBuf    *[13]byte
-	TrafficSecret *[]byte
-	Mac           *hash.Hash
-	RawKey        *[]byte
-	RawIV         *[]byte
-	RawMac        *[]byte
-}
-
-func NewRawHalfConn(rawHalfConn reflect.Value, methods *Methods) (*RawHalfConn, error) {
-	halfConn := &RawHalfConn{
-		pointer: (unsafe.Pointer)(rawHalfConn.UnsafeAddr()),
-		methods: methods,
-	}
-
-	rawMutex := rawHalfConn.FieldByName("Mutex")
-	if !rawMutex.IsValid() || rawMutex.Kind() != reflect.Struct {
-		return nil, E.New("badtls: invalid halfConn.Mutex")
-	}
-	halfConn.Mutex = (*sync.Mutex)(unsafe.Pointer(rawMutex.UnsafeAddr()))
-
-	rawErr := rawHalfConn.FieldByName("err")
-	if !rawErr.IsValid() || rawErr.Kind() != reflect.Interface {
-		return nil, E.New("badtls: invalid halfConn.err")
-	}
-	halfConn.Err = (*error)(unsafe.Pointer(rawErr.UnsafeAddr()))
-
-	rawVersion := rawHalfConn.FieldByName("version")
-	if !rawVersion.IsValid() || rawVersion.Kind() != reflect.Uint16 {
-		return nil, E.New("badtls: invalid halfConn.version")
-	}
-	halfConn.Version = (*uint16)(unsafe.Pointer(rawVersion.UnsafeAddr()))
-
-	rawCipher := rawHalfConn.FieldByName("cipher")
-	if !rawCipher.IsValid() || rawCipher.Kind() != reflect.Interface {
-		return nil, E.New("badtls: invalid halfConn.cipher")
-	}
-	halfConn.Cipher = (*any)(unsafe.Pointer(rawCipher.UnsafeAddr()))
-
-	rawSeq := rawHalfConn.FieldByName("seq")
-	if !rawSeq.IsValid() || rawSeq.Kind() != reflect.Array || rawSeq.Len() != 8 || rawSeq.Type().Elem().Kind() != reflect.Uint8 {
-		return nil, E.New("badtls: invalid halfConn.seq")
-	}
-	halfConn.Seq = (*[8]byte)(unsafe.Pointer(rawSeq.UnsafeAddr()))
-
-	rawScratchBuf := rawHalfConn.FieldByName("scratchBuf")
-	if !rawScratchBuf.IsValid() || rawScratchBuf.Kind() != reflect.Array || rawScratchBuf.Len() != 13 || rawScratchBuf.Type().Elem().Kind() != reflect.Uint8 {
-		return nil, E.New("badtls: invalid halfConn.scratchBuf")
-	}
-	halfConn.ScratchBuf = (*[13]byte)(unsafe.Pointer(rawScratchBuf.UnsafeAddr()))
-
-	rawTrafficSecret := rawHalfConn.FieldByName("trafficSecret")
-	if !rawTrafficSecret.IsValid() || rawTrafficSecret.Kind() != reflect.Slice || rawTrafficSecret.Type().Elem().Kind() != reflect.Uint8 {
-		return nil, E.New("badtls: invalid halfConn.trafficSecret")
-	}
-	halfConn.TrafficSecret = (*[]byte)(unsafe.Pointer(rawTrafficSecret.UnsafeAddr()))
-
-	rawMac := rawHalfConn.FieldByName("mac")
-	if !rawMac.IsValid() || rawMac.Kind() != reflect.Interface {
-		return nil, E.New("badtls: invalid halfConn.mac")
-	}
-	halfConn.Mac = (*hash.Hash)(unsafe.Pointer(rawMac.UnsafeAddr()))
-
-	rawKey := rawHalfConn.FieldByName("rawKey")
-	if rawKey.IsValid() {
-		if /*!rawKey.IsValid() || */ rawKey.Kind() != reflect.Slice || rawKey.Type().Elem().Kind() != reflect.Uint8 {
-			return nil, E.New("badtls: invalid halfConn.rawKey")
-		}
-		halfConn.RawKey = (*[]byte)(unsafe.Pointer(rawKey.UnsafeAddr()))
-
-		rawIV := rawHalfConn.FieldByName("rawIV")
-		if !rawIV.IsValid() || rawIV.Kind() != reflect.Slice || rawIV.Type().Elem().Kind() != reflect.Uint8 {
-			return nil, E.New("badtls: invalid halfConn.rawIV")
-		}
-		halfConn.RawIV = (*[]byte)(unsafe.Pointer(rawIV.UnsafeAddr()))
-
-		rawMAC := rawHalfConn.FieldByName("rawMac")
-		if !rawMAC.IsValid() || rawMAC.Kind() != reflect.Slice || rawMAC.Type().Elem().Kind() != reflect.Uint8 {
-			return nil, E.New("badtls: invalid halfConn.rawMac")
-		}
-		halfConn.RawMac = (*[]byte)(unsafe.Pointer(rawMAC.UnsafeAddr()))
-	}
-
-	return halfConn, nil
-}
-
-func (hc *RawHalfConn) Decrypt(record []byte) ([]byte, uint8, error) {
-	return hc.methods.decrypt(hc.pointer, record)
-}
-
-func (hc *RawHalfConn) SetErrorLocked(err error) error {
-	return hc.methods.setErrorLocked(hc.pointer, err)
-}
-
-func (hc *RawHalfConn) SetTrafficSecret(suite unsafe.Pointer, level int, secret []byte) {
-	hc.methods.setTrafficSecret(hc.pointer, suite, level, secret)
-}
-
-func (hc *RawHalfConn) ExplicitNonceLen() int {
-	return hc.methods.explicitNonceLen(hc.pointer)
-}
--- a/common/badtls/read_wait.go
+++ b/common/badtls/read_wait.go
@@ -1,9 +1,18 @@
-//go:build go1.25 && badlinkname
+//go:build go1.21 && !without_badtls

 package badtls

 import (
+	"bytes"
+	"context"
+	"net"
+	"os"
+	"reflect"
+	"sync"
+	"unsafe"
+
 	"github.com/sagernet/sing/common/buf"
+	E "github.com/sagernet/sing/common/exceptions"
 	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/common/tls"
 )
@@ -12,21 +21,63 @@ var _ N.ReadWaiter = (*ReadWaitConn)(nil)

 type ReadWaitConn struct {
 	tls.Conn
-	rawConn         *RawConn
-	readWaitOptions N.ReadWaitOptions
+	halfAccess                    *sync.Mutex
+	rawInput                      *bytes.Buffer
+	input                         *bytes.Reader
+	hand                          *bytes.Buffer
+	readWaitOptions               N.ReadWaitOptions
+	tlsReadRecord                 func() error
+	tlsHandlePostHandshakeMessage func() error
 }

 func NewReadWaitConn(conn tls.Conn) (tls.Conn, error) {
-	if _, isReadWaitConn := conn.(N.ReadWaiter); isReadWaitConn {
-		return conn, nil
+	var (
+		loaded                        bool
+		tlsReadRecord                 func() error
+		tlsHandlePostHandshakeMessage func() error
+	)
+	for _, tlsCreator := range tlsRegistry {
+		loaded, tlsReadRecord, tlsHandlePostHandshakeMessage = tlsCreator(conn)
+		if loaded {
+			break
+		}
 	}
-	rawConn, err := NewRawConn(conn)
-	if err != nil {
-		return nil, err
+	if !loaded {
+		return nil, os.ErrInvalid
 	}
+	rawConn := reflect.Indirect(reflect.ValueOf(conn))
+	rawHalfConn := rawConn.FieldByName("in")
+	if !rawHalfConn.IsValid() || rawHalfConn.Kind() != reflect.Struct {
+		return nil, E.New("badtls: invalid half conn")
+	}
+	rawHalfMutex := rawHalfConn.FieldByName("Mutex")
+	if !rawHalfMutex.IsValid() || rawHalfMutex.Kind() != reflect.Struct {
+		return nil, E.New("badtls: invalid half mutex")
+	}
+	halfAccess := (*sync.Mutex)(unsafe.Pointer(rawHalfMutex.UnsafeAddr()))
+	rawRawInput := rawConn.FieldByName("rawInput")
+	if !rawRawInput.IsValid() || rawRawInput.Kind() != reflect.Struct {
+		return nil, E.New("badtls: invalid raw input")
+	}
+	rawInput := (*bytes.Buffer)(unsafe.Pointer(rawRawInput.UnsafeAddr()))
+	rawInput0 := rawConn.FieldByName("input")
+	if !rawInput0.IsValid() || rawInput0.Kind() != reflect.Struct {
+		return nil, E.New("badtls: invalid input")
+	}
+	input := (*bytes.Reader)(unsafe.Pointer(rawInput0.UnsafeAddr()))
+	rawHand := rawConn.FieldByName("hand")
+	if !rawHand.IsValid() || rawHand.Kind() != reflect.Struct {
+		return nil, E.New("badtls: invalid hand")
+	}
+	hand := (*bytes.Buffer)(unsafe.Pointer(rawHand.UnsafeAddr()))
 	return &ReadWaitConn{
-		Conn:    conn,
-		rawConn: rawConn,
+		Conn:                          conn,
+		halfAccess:                    halfAccess,
+		rawInput:                      rawInput,
+		input:                         input,
+		hand:                          hand,
+		tlsReadRecord:                 tlsReadRecord,
+		tlsHandlePostHandshakeMessage: tlsHandlePostHandshakeMessage,
 	}, nil
 }

@@ -36,36 +87,36 @@ func (c *ReadWaitConn) InitializeReadWaiter(options N.ReadWaitOptions) (needCopy
 }

 func (c *ReadWaitConn) WaitReadBuffer() (buffer *buf.Buffer, err error) {
-	//err = c.HandshakeContext(context.Background())
-	//if err != nil {
-	//	return
-	//}
-	c.rawConn.In.Lock()
-	defer c.rawConn.In.Unlock()
-	for c.rawConn.Input.Len() == 0 {
-		err = c.rawConn.ReadRecord()
+	err = c.HandshakeContext(context.Background())
+	if err != nil {
+		return
+	}
+	c.halfAccess.Lock()
+	defer c.halfAccess.Unlock()
+	for c.input.Len() == 0 {
+		err = c.tlsReadRecord()
 		if err != nil {
 			return
 		}
-		for c.rawConn.Hand.Len() > 0 {
-			err = c.rawConn.HandlePostHandshakeMessage()
+		for c.hand.Len() > 0 {
+			err = c.tlsHandlePostHandshakeMessage()
 			if err != nil {
 				return
 			}
 		}
 	}
 	buffer = c.readWaitOptions.NewBuffer()
-	n, err := c.rawConn.Input.Read(buffer.FreeBytes())
+	n, err := c.input.Read(buffer.FreeBytes())
 	if err != nil {
 		buffer.Release()
 		return
 	}
 	buffer.Truncate(n)

-	if n != 0 && c.rawConn.Input.Len() == 0 && c.rawConn.Input.Len() > 0 &&
-		// recordType(c.RawInput.Bytes()[0]) == recordTypeAlert {
-		c.rawConn.RawInput.Bytes()[0] == 21 {
-		_ = c.rawConn.ReadRecord()
+	if n != 0 && c.input.Len() == 0 && c.rawInput.Len() > 0 &&
+		// recordType(c.rawInput.Bytes()[0]) == recordTypeAlert {
+		c.rawInput.Bytes()[0] == 21 {
+		_ = c.tlsReadRecord()
 		// return n, err // will be io.EOF on closeNotify
 	}

@@ -80,3 +131,25 @@ func (c *ReadWaitConn) Upstream() any {
 func (c *ReadWaitConn) ReaderReplaceable() bool {
 	return true
 }
+
+var tlsRegistry []func(conn net.Conn) (loaded bool, tlsReadRecord func() error, tlsHandlePostHandshakeMessage func() error)
+
+func init() {
+	tlsRegistry = append(tlsRegistry, func(conn net.Conn) (loaded bool, tlsReadRecord func() error, tlsHandlePostHandshakeMessage func() error) {
+		tlsConn, loaded := conn.(*tls.STDConn)
+		if !loaded {
+			return
+		}
+		return true, func() error {
+				return stdTLSReadRecord(tlsConn)
+			}, func() error {
+				return stdTLSHandlePostHandshakeMessage(tlsConn)
+			}
+	})
+}
+
+//go:linkname stdTLSReadRecord crypto/tls.(*Conn).readRecord
+func stdTLSReadRecord(c *tls.STDConn) error
+
+//go:linkname stdTLSHandlePostHandshakeMessage crypto/tls.(*Conn).handlePostHandshakeMessage
+func stdTLSHandlePostHandshakeMessage(c *tls.STDConn) error
--- a/common/badtls/read_wait_stub.go
+++ b/common/badtls/read_wait_stub.go
@@ -1,4 +1,4 @@
-//go:build !go1.25 || !badlinkname
+//go:build !go1.21 || without_badtls

 package badtls

--- a/common/badtls/read_wait_utls.go
+++ b/common/badtls/read_wait_utls.go
@@ -0,0 +1,36 @@
+//go:build go1.21 && !without_badtls && with_utls
+
+package badtls
+
+import (
+	"net"
+	_ "unsafe"
+
+	"github.com/metacubex/utls"
+)
+
+func init() {
+	tlsRegistry = append(tlsRegistry, func(conn net.Conn) (loaded bool, tlsReadRecord func() error, tlsHandlePostHandshakeMessage func() error) {
+		switch tlsConn := conn.(type) {
+		case *tls.UConn:
+			return true, func() error {
+					return utlsReadRecord(tlsConn.Conn)
+				}, func() error {
+					return utlsHandlePostHandshakeMessage(tlsConn.Conn)
+				}
+		case *tls.Conn:
+			return true, func() error {
+					return utlsReadRecord(tlsConn)
+				}, func() error {
+					return utlsHandlePostHandshakeMessage(tlsConn)
+				}
+		}
+		return
+	})
+}
+
+//go:linkname utlsReadRecord github.com/metacubex/utls.(*Conn).readRecord
+func utlsReadRecord(c *tls.Conn) error
+
+//go:linkname utlsHandlePostHandshakeMessage github.com/metacubex/utls.(*Conn).handlePostHandshakeMessage
+func utlsHandlePostHandshakeMessage(c *tls.Conn) error
--- a/common/badtls/registry.go
+++ b/common/badtls/registry.go
@@ -1,62 +0,0 @@
-//go:build go1.25 && badlinkname
-
-package badtls
-
-import (
-	"crypto/tls"
-	"net"
-	"unsafe"
-)
-
-type Methods struct {
-	readRecord                 func(c unsafe.Pointer) error
-	handlePostHandshakeMessage func(c unsafe.Pointer) error
-	writeRecordLocked          func(c unsafe.Pointer, typ uint16, data []byte) (int, error)
-
-	setErrorLocked   func(hc unsafe.Pointer, err error) error
-	decrypt          func(hc unsafe.Pointer, record []byte) ([]byte, uint8, error)
-	setTrafficSecret func(hc unsafe.Pointer, suite unsafe.Pointer, level int, secret []byte)
-	explicitNonceLen func(hc unsafe.Pointer) int
-}
-
-var methodRegistry []func(conn net.Conn) (unsafe.Pointer, *Methods, bool)
-
-func init() {
-	methodRegistry = append(methodRegistry, func(conn net.Conn) (unsafe.Pointer, *Methods, bool) {
-		tlsConn, loaded := conn.(*tls.Conn)
-		if !loaded {
-			return nil, nil, false
-		}
-		return unsafe.Pointer(tlsConn), &Methods{
-			readRecord:                 stdTLSReadRecord,
-			handlePostHandshakeMessage: stdTLSHandlePostHandshakeMessage,
-			writeRecordLocked:          stdWriteRecordLocked,
-
-			setErrorLocked:   stdSetErrorLocked,
-			decrypt:          stdDecrypt,
-			setTrafficSecret: stdSetTrafficSecret,
-			explicitNonceLen: stdExplicitNonceLen,
-		}, true
-	})
-}
-
-//go:linkname stdTLSReadRecord crypto/tls.(*Conn).readRecord
-func stdTLSReadRecord(c unsafe.Pointer) error
-
-//go:linkname stdTLSHandlePostHandshakeMessage crypto/tls.(*Conn).handlePostHandshakeMessage
-func stdTLSHandlePostHandshakeMessage(c unsafe.Pointer) error
-
-//go:linkname stdWriteRecordLocked crypto/tls.(*Conn).writeRecordLocked
-func stdWriteRecordLocked(c unsafe.Pointer, typ uint16, data []byte) (int, error)
-
-//go:linkname stdSetErrorLocked crypto/tls.(*halfConn).setErrorLocked
-func stdSetErrorLocked(hc unsafe.Pointer, err error) error
-
-//go:linkname stdDecrypt crypto/tls.(*halfConn).decrypt
-func stdDecrypt(hc unsafe.Pointer, record []byte) ([]byte, uint8, error)
-
-//go:linkname stdSetTrafficSecret crypto/tls.(*halfConn).setTrafficSecret
-func stdSetTrafficSecret(hc unsafe.Pointer, suite unsafe.Pointer, level int, secret []byte)
-
-//go:linkname stdExplicitNonceLen crypto/tls.(*halfConn).explicitNonceLen
-func stdExplicitNonceLen(hc unsafe.Pointer) int
--- a/common/badtls/registry_utls.go
+++ b/common/badtls/registry_utls.go
@@ -1,56 +0,0 @@
-//go:build go1.25 && badlinkname
-
-package badtls
-
-import (
-	"net"
-	"unsafe"
-
-	N "github.com/sagernet/sing/common/network"
-
-	"github.com/metacubex/utls"
-)
-
-func init() {
-	methodRegistry = append(methodRegistry, func(conn net.Conn) (unsafe.Pointer, *Methods, bool) {
-		var pointer unsafe.Pointer
-		if uConn, loaded := N.CastReader[*tls.Conn](conn); loaded {
-			pointer = unsafe.Pointer(uConn)
-		} else if uConn, loaded := N.CastReader[*tls.UConn](conn); loaded {
-			pointer = unsafe.Pointer(uConn.Conn)
-		} else {
-			return nil, nil, false
-		}
-		return pointer, &Methods{
-			readRecord:                 utlsReadRecord,
-			handlePostHandshakeMessage: utlsHandlePostHandshakeMessage,
-			writeRecordLocked:          utlsWriteRecordLocked,
-
-			setErrorLocked:   utlsSetErrorLocked,
-			decrypt:          utlsDecrypt,
-			setTrafficSecret: utlsSetTrafficSecret,
-			explicitNonceLen: utlsExplicitNonceLen,
-		}, true
-	})
-}
-
-//go:linkname utlsReadRecord github.com/metacubex/utls.(*Conn).readRecord
-func utlsReadRecord(c unsafe.Pointer) error
-
-//go:linkname utlsHandlePostHandshakeMessage github.com/metacubex/utls.(*Conn).handlePostHandshakeMessage
-func utlsHandlePostHandshakeMessage(c unsafe.Pointer) error
-
-//go:linkname utlsWriteRecordLocked github.com/metacubex/utls.(*Conn).writeRecordLocked
-func utlsWriteRecordLocked(hc unsafe.Pointer, typ uint16, data []byte) (int, error)
-
-//go:linkname utlsSetErrorLocked github.com/metacubex/utls.(*halfConn).setErrorLocked
-func utlsSetErrorLocked(hc unsafe.Pointer, err error) error
-
-//go:linkname utlsDecrypt github.com/metacubex/utls.(*halfConn).decrypt
-func utlsDecrypt(hc unsafe.Pointer, record []byte) ([]byte, uint8, error)
-
-//go:linkname utlsSetTrafficSecret github.com/metacubex/utls.(*halfConn).setTrafficSecret
-func utlsSetTrafficSecret(hc unsafe.Pointer, suite unsafe.Pointer, level int, secret []byte)
-
-//go:linkname utlsExplicitNonceLen github.com/metacubex/utls.(*halfConn).explicitNonceLen
-func utlsExplicitNonceLen(hc unsafe.Pointer) int
--- a/common/badversion/version.go
+++ b/common/badversion/version.go
@@ -5,8 +5,6 @@ import (
 	"strings"

 	F "github.com/sagernet/sing/common/format"
-
-	"golang.org/x/mod/semver"
 )

 type Version struct {
@@ -18,19 +16,7 @@ type Version struct {
 	PreReleaseVersion    int
 }

-func (v Version) LessThan(anotherVersion Version) bool {
-	return !v.GreaterThanOrEqual(anotherVersion)
-}
-
-func (v Version) LessThanOrEqual(anotherVersion Version) bool {
-	return v == anotherVersion || anotherVersion.GreaterThan(v)
-}
-
-func (v Version) GreaterThanOrEqual(anotherVersion Version) bool {
-	return v == anotherVersion || v.GreaterThan(anotherVersion)
-}
-
-func (v Version) GreaterThan(anotherVersion Version) bool {
+func (v Version) After(anotherVersion Version) bool {
 	if v.Major > anotherVersion.Major {
 		return true
 	} else if v.Major < anotherVersion.Major {
@@ -58,29 +44,19 @@ func (v Version) GreaterThan(anotherVersion Version) bool {
 			} else if v.PreReleaseVersion < anotherVersion.PreReleaseVersion {
 				return false
 			}
-		}
-		preReleaseIdentifier := parsePreReleaseIdentifier(v.PreReleaseIdentifier)
-		anotherPreReleaseIdentifier := parsePreReleaseIdentifier(anotherVersion.PreReleaseIdentifier)
-		if preReleaseIdentifier < anotherPreReleaseIdentifier {
+		} else if v.PreReleaseIdentifier == "rc" && anotherVersion.PreReleaseIdentifier == "beta" {
 			return true
-		} else if preReleaseIdentifier > anotherPreReleaseIdentifier {
+		} else if v.PreReleaseIdentifier == "beta" && anotherVersion.PreReleaseIdentifier == "rc" {
+			return false
+		} else if v.PreReleaseIdentifier == "beta" && anotherVersion.PreReleaseIdentifier == "alpha" {
+			return true
+		} else if v.PreReleaseIdentifier == "alpha" && anotherVersion.PreReleaseIdentifier == "beta" {
 			return false
 		}
 	}
 	return false
 }

-func parsePreReleaseIdentifier(identifier string) int {
-	if strings.HasPrefix(identifier, "rc") {
-		return 1
-	} else if strings.HasPrefix(identifier, "beta") {
-		return 2
-	} else if strings.HasPrefix(identifier, "alpha") {
-		return 3
-	}
-	return 0
-}
-
 func (v Version) VersionString() string {
 	return F.ToString(v.Major, ".", v.Minor, ".", v.Patch)
 }
@@ -107,10 +83,6 @@ func (v Version) BadString() string {
 	return version
 }

-func IsValid(versionName string) bool {
-	return semver.IsValid("v" + versionName)
-}
-
 func Parse(versionName string) (version Version) {
 	if strings.HasPrefix(versionName, "v") {
 		versionName = versionName[1:]
--- a/common/badversion/version_test.go
+++ b/common/badversion/version_test.go
@@ -10,9 +10,9 @@ func TestCompareVersion(t *testing.T) {
 	t.Parallel()
 	require.Equal(t, "1.3.0-beta.1", Parse("v1.3.0-beta1").String())
 	require.Equal(t, "1.3-beta1", Parse("v1.3.0-beta.1").BadString())
-	require.True(t, Parse("1.3.0").GreaterThan(Parse("1.3-beta1")))
-	require.True(t, Parse("1.3.0").GreaterThan(Parse("1.3.0-beta1")))
-	require.True(t, Parse("1.3.0-beta1").GreaterThan(Parse("1.3.0-alpha1")))
-	require.True(t, Parse("1.3.1").GreaterThan(Parse("1.3.0")))
-	require.True(t, Parse("1.4").GreaterThan(Parse("1.3")))
+	require.True(t, Parse("1.3.0").After(Parse("1.3-beta1")))
+	require.True(t, Parse("1.3.0").After(Parse("1.3.0-beta1")))
+	require.True(t, Parse("1.3.0-beta1").After(Parse("1.3.0-alpha1")))
+	require.True(t, Parse("1.3.1").After(Parse("1.3.0")))
+	require.True(t, Parse("1.4").After(Parse("1.3")))
 }
--- a/common/certificate/chrome.go
+++ b/common/certificate/chrome.go
@@ -1,18 +0,0 @@
-// Code generated by 'make update_certificates'. DO NOT EDIT.
-
-package certificate
-
-import (
-	"crypto/x509"
-	_ "embed"
-)
-
-//go:embed chrome.pem
-var chromeIncludedPEM string
-
-var chromeIncluded *x509.CertPool
-
-func init() {
-	chromeIncluded = x509.NewCertPool()
-	chromeIncluded.AppendCertsFromPEM([]byte(chromeIncludedPEM))
-}
--- a/common/certificate/chrome.pem
+++ b/common/certificate/chrome.pem
--- a/common/certificate/mozilla.go
+++ b/common/certificate/mozilla.go
--- a/common/certificate/mozilla.pem
+++ b/common/certificate/mozilla.pem
--- a/common/certificate/store.go
+++ b/common/certificate/store.go
@@ -12,6 +12,7 @@ import (
 	"github.com/sagernet/fswatch"
 	"github.com/sagernet/sing-box/adapter"
 	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/logger"
@@ -22,10 +23,8 @@ var _ adapter.CertificateStore = (*Store)(nil)

 type Store struct {
 	access                    sync.RWMutex
-	store                     string
 	systemPool                *x509.CertPool
 	currentPool               *x509.CertPool
-	currentPEM                []string
 	certificate               string
 	certificatePaths          []string
 	certificateDirectoryPaths []string
@@ -37,7 +36,7 @@ func NewStore(ctx context.Context, logger logger.Logger, options option.Certific
 	switch options.Store {
 	case C.CertificateStoreSystem, "":
 		systemPool = x509.NewCertPool()
-		platformInterface := service.FromContext[adapter.PlatformInterface](ctx)
+		platformInterface := service.FromContext[platform.Interface](ctx)
 		var systemValid bool
 		if platformInterface != nil {
 			for _, cert := range platformInterface.SystemCertificates() {
@@ -55,15 +54,12 @@ func NewStore(ctx context.Context, logger logger.Logger, options option.Certific
 		}
 	case C.CertificateStoreMozilla:
 		systemPool = mozillaIncluded
-	case C.CertificateStoreChrome:
-		systemPool = chromeIncluded
 	case C.CertificateStoreNone:
 		systemPool = nil
 	default:
 		return nil, E.New("unknown certificate store: ", options.Store)
 	}
 	store := &Store{
-		store:                     options.Store,
 		systemPool:                systemPool,
 		certificate:               strings.Join(options.Certificate, "\n"),
 		certificatePaths:          options.CertificatePath,
@@ -126,37 +122,19 @@ func (s *Store) Pool() *x509.CertPool {
 	return s.currentPool
 }

-func (s *Store) StoreKind() string {
-	return s.store
-}
-
-func (s *Store) CurrentPEM() []string {
-	s.access.RLock()
-	defer s.access.RUnlock()
-	return append([]string(nil), s.currentPEM...)
-}
-
 func (s *Store) update() error {
 	s.access.Lock()
 	defer s.access.Unlock()
 	var currentPool *x509.CertPool
-	var currentPEM []string
 	if s.systemPool == nil {
 		currentPool = x509.NewCertPool()
 	} else {
 		currentPool = s.systemPool.Clone()
 	}
-	switch s.store {
-	case C.CertificateStoreMozilla:
-		currentPEM = append(currentPEM, mozillaIncludedPEM)
-	case C.CertificateStoreChrome:
-		currentPEM = append(currentPEM, chromeIncludedPEM)
-	}
 	if s.certificate != "" {
 		if !currentPool.AppendCertsFromPEM([]byte(s.certificate)) {
 			return E.New("invalid certificate PEM strings")
 		}
-		currentPEM = append(currentPEM, s.certificate)
 	}
 	for _, path := range s.certificatePaths {
 		pemContent, err := os.ReadFile(path)
@@ -166,7 +144,6 @@ func (s *Store) update() error {
 		if !currentPool.AppendCertsFromPEM(pemContent) {
 			return E.New("invalid certificate PEM file: ", path)
 		}
-		currentPEM = append(currentPEM, string(pemContent))
 	}
 	var firstErr error
 	for _, directoryPath := range s.certificateDirectoryPaths {
@@ -179,8 +156,8 @@ func (s *Store) update() error {
 		}
 		for _, directoryEntry := range directoryEntries {
 			pemContent, err := os.ReadFile(filepath.Join(directoryPath, directoryEntry.Name()))
-			if err == nil && currentPool.AppendCertsFromPEM(pemContent) {
-				currentPEM = append(currentPEM, string(pemContent))
+			if err == nil {
+				currentPool.AppendCertsFromPEM(pemContent)
 			}
 		}
 	}
@@ -188,7 +165,6 @@ func (s *Store) update() error {
 		return firstErr
 	}
 	s.currentPool = currentPool
-	s.currentPEM = currentPEM
 	return nil
 }

--- a/common/conntrack/conn.go
+++ b/common/conntrack/conn.go
@@ -0,0 +1,54 @@
+package conntrack
+
+import (
+	"io"
+	"net"
+
+	"github.com/sagernet/sing/common/x/list"
+)
+
+type Conn struct {
+	net.Conn
+	element *list.Element[io.Closer]
+}
+
+func NewConn(conn net.Conn) (net.Conn, error) {
+	connAccess.Lock()
+	element := openConnection.PushBack(conn)
+	connAccess.Unlock()
+	if KillerEnabled {
+		err := KillerCheck()
+		if err != nil {
+			conn.Close()
+			return nil, err
+		}
+	}
+	return &Conn{
+		Conn:    conn,
+		element: element,
+	}, nil
+}
+
+func (c *Conn) Close() error {
+	if c.element.Value != nil {
+		connAccess.Lock()
+		if c.element.Value != nil {
+			openConnection.Remove(c.element)
+			c.element.Value = nil
+		}
+		connAccess.Unlock()
+	}
+	return c.Conn.Close()
+}
+
+func (c *Conn) Upstream() any {
+	return c.Conn
+}
+
+func (c *Conn) ReaderReplaceable() bool {
+	return true
+}
+
+func (c *Conn) WriterReplaceable() bool {
+	return true
+}
--- a/common/conntrack/killer.go
+++ b/common/conntrack/killer.go
@@ -0,0 +1,35 @@
+package conntrack
+
+import (
+	runtimeDebug "runtime/debug"
+	"time"
+
+	E "github.com/sagernet/sing/common/exceptions"
+	"github.com/sagernet/sing/common/memory"
+)
+
+var (
+	KillerEnabled   bool
+	MemoryLimit     uint64
+	killerLastCheck time.Time
+)
+
+func KillerCheck() error {
+	if !KillerEnabled {
+		return nil
+	}
+	nowTime := time.Now()
+	if nowTime.Sub(killerLastCheck) < 3*time.Second {
+		return nil
+	}
+	killerLastCheck = nowTime
+	if memory.Total() > MemoryLimit {
+		Close()
+		go func() {
+			time.Sleep(time.Second)
+			runtimeDebug.FreeOSMemory()
+		}()
+		return E.New("out of memory")
+	}
+	return nil
+}
--- a/common/conntrack/packet_conn.go
+++ b/common/conntrack/packet_conn.go
@@ -0,0 +1,55 @@
+package conntrack
+
+import (
+	"io"
+	"net"
+
+	"github.com/sagernet/sing/common/bufio"
+	"github.com/sagernet/sing/common/x/list"
+)
+
+type PacketConn struct {
+	net.PacketConn
+	element *list.Element[io.Closer]
+}
+
+func NewPacketConn(conn net.PacketConn) (net.PacketConn, error) {
+	connAccess.Lock()
+	element := openConnection.PushBack(conn)
+	connAccess.Unlock()
+	if KillerEnabled {
+		err := KillerCheck()
+		if err != nil {
+			conn.Close()
+			return nil, err
+		}
+	}
+	return &PacketConn{
+		PacketConn: conn,
+		element:    element,
+	}, nil
+}
+
+func (c *PacketConn) Close() error {
+	if c.element.Value != nil {
+		connAccess.Lock()
+		if c.element.Value != nil {
+			openConnection.Remove(c.element)
+			c.element.Value = nil
+		}
+		connAccess.Unlock()
+	}
+	return c.PacketConn.Close()
+}
+
+func (c *PacketConn) Upstream() any {
+	return bufio.NewPacketConn(c.PacketConn)
+}
+
+func (c *PacketConn) ReaderReplaceable() bool {
+	return true
+}
+
+func (c *PacketConn) WriterReplaceable() bool {
+	return true
+}
--- a/common/conntrack/track.go
+++ b/common/conntrack/track.go
@@ -0,0 +1,47 @@
+package conntrack
+
+import (
+	"io"
+	"sync"
+
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/x/list"
+)
+
+var (
+	connAccess     sync.RWMutex
+	openConnection list.List[io.Closer]
+)
+
+func Count() int {
+	if !Enabled {
+		return 0
+	}
+	return openConnection.Len()
+}
+
+func List() []io.Closer {
+	if !Enabled {
+		return nil
+	}
+	connAccess.RLock()
+	defer connAccess.RUnlock()
+	connList := make([]io.Closer, 0, openConnection.Len())
+	for element := openConnection.Front(); element != nil; element = element.Next() {
+		connList = append(connList, element.Value)
+	}
+	return connList
+}
+
+func Close() {
+	if !Enabled {
+		return
+	}
+	connAccess.Lock()
+	defer connAccess.Unlock()
+	for element := openConnection.Front(); element != nil; element = element.Next() {
+		common.Close(element.Value)
+		element.Value = nil
+	}
+	openConnection.Init()
+}
--- a/common/conntrack/track_disable.go
+++ b/common/conntrack/track_disable.go
@@ -0,0 +1,5 @@
+//go:build !with_conntrack
+
+package conntrack
+
+const Enabled = false
--- a/common/conntrack/track_enable.go
+++ b/common/conntrack/track_enable.go
@@ -0,0 +1,5 @@
+//go:build with_conntrack
+
+package conntrack
+
+const Enabled = true
--- a/common/dialer/default.go
+++ b/common/dialer/default.go
@@ -9,8 +9,10 @@ import (
 	"time"

 	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/conntrack"
 	"github.com/sagernet/sing-box/common/listener"
 	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/control"
@@ -18,8 +20,6 @@ import (
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/service"
-
-	"github.com/database64128/tfo-go/v2"
 )

 var (
@@ -28,15 +28,14 @@ var (
 )

 type DefaultDialer struct {
-	dialer4                tfo.Dialer
-	dialer6                tfo.Dialer
+	dialer4                tcpDialer
+	dialer6                tcpDialer
 	udpDialer4             net.Dialer
 	udpDialer6             net.Dialer
 	udpListener            net.ListenConfig
 	udpAddr4               string
 	udpAddr6               string
 	netns                  string
-	connectionManager      adapter.ConnectionManager
 	networkManager         adapter.NetworkManager
 	networkStrategy        *C.NetworkStrategy
 	defaultNetworkStrategy bool
@@ -47,9 +46,8 @@ type DefaultDialer struct {
 }

 func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDialer, error) {
-	connectionManager := service.FromContext[adapter.ConnectionManager](ctx)
 	networkManager := service.FromContext[adapter.NetworkManager](ctx)
-	platformInterface := service.FromContext[adapter.PlatformInterface](ctx)
+	platformInterface := service.FromContext[platform.Interface](ctx)

 	var (
 		dialer                 net.Dialer
@@ -138,35 +136,13 @@ func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDial
 		dialer.Control = control.Append(dialer.Control, control.ProtectPath(options.ProtectPath))
 		listener.Control = control.Append(listener.Control, control.ProtectPath(options.ProtectPath))
 	}
-	if options.BindAddressNoPort {
-		if !C.IsLinux {
-			return nil, E.New("`bind_address_no_port` is only supported on Linux")
-		}
-		dialer.Control = control.Append(dialer.Control, control.BindAddressNoPort())
-	}
 	if options.ConnectTimeout != 0 {
 		dialer.Timeout = time.Duration(options.ConnectTimeout)
 	} else {
 		dialer.Timeout = C.TCPConnectTimeout
 	}
-	if options.DisableTCPKeepAlive {
-		dialer.KeepAlive = -1
-		dialer.KeepAliveConfig.Enable = false
-	} else {
-		keepIdle := time.Duration(options.TCPKeepAlive)
-		if keepIdle == 0 {
-			keepIdle = C.TCPKeepAliveInitial
-		}
-		keepInterval := time.Duration(options.TCPKeepAliveInterval)
-		if keepInterval == 0 {
-			keepInterval = C.TCPKeepAliveInterval
-		}
-		dialer.KeepAliveConfig = net.KeepAliveConfig{
-			Enable:   true,
-			Idle:     keepIdle,
-			Interval: keepInterval,
-		}
-	}
+	// TODO: Add an option to customize the keep alive period
+	setKeepAliveConfig(&dialer, C.TCPKeepAliveInitial, C.TCPKeepAliveInterval)
 	var udpFragment bool
 	if options.UDPFragment != nil {
 		udpFragment = *options.UDPFragment
@@ -200,10 +176,19 @@ func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDial
 		udpAddr6 = M.SocksaddrFrom(bindAddr, 0).String()
 	}
 	if options.TCPMultiPath {
-		dialer4.SetMultipathTCP(true)
+		if !go121Available {
+			return nil, E.New("MultiPath TCP requires go1.21, please recompile your binary.")
+		}
+		setMultiPathTCP(&dialer4)
+	}
+	tcpDialer4, err := newTCPDialer(dialer4, options.TCPFastOpen)
+	if err != nil {
+		return nil, err
+	}
+	tcpDialer6, err := newTCPDialer(dialer6, options.TCPFastOpen)
+	if err != nil {
+		return nil, err
 	}
-	tcpDialer4 := tfo.Dialer{Dialer: dialer4, DisableTFO: !options.TCPFastOpen}
-	tcpDialer6 := tfo.Dialer{Dialer: dialer6, DisableTFO: !options.TCPFastOpen}
 	return &DefaultDialer{
 		dialer4:                tcpDialer4,
 		dialer6:                tcpDialer6,
@@ -213,7 +198,6 @@ func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDial
 		udpAddr4:               udpAddr4,
 		udpAddr6:               udpAddr6,
 		netns:                  options.NetNs,
-		connectionManager:      connectionManager,
 		networkManager:         networkManager,
 		networkStrategy:        networkStrategy,
 		defaultNetworkStrategy: defaultNetworkStrategy,
@@ -242,11 +226,11 @@ func setMarkWrapper(networkManager adapter.NetworkManager, mark uint32, isDefaul
 func (d *DefaultDialer) DialContext(ctx context.Context, network string, address M.Socksaddr) (net.Conn, error) {
 	if !address.IsValid() {
 		return nil, E.New("invalid address")
-	} else if address.IsDomain() {
+	} else if address.IsFqdn() {
 		return nil, E.New("domain not resolved")
 	}
 	if d.networkStrategy == nil {
-		return d.trackConn(listener.ListenNetworkNamespace[net.Conn](d.netns, func() (net.Conn, error) {
+		return trackConn(listener.ListenNetworkNamespace[net.Conn](d.netns, func() (net.Conn, error) {
 			switch N.NetworkName(network) {
 			case N.NetworkUDP:
 				if !address.IsIPv6() {
@@ -284,7 +268,7 @@ func (d *DefaultDialer) DialParallelInterface(ctx context.Context, network strin
 	}
 	var dialer net.Dialer
 	if N.NetworkName(network) == N.NetworkTCP {
-		dialer = d.dialer4.Dialer
+		dialer = dialerFromTCPDialer(d.dialer4)
 	} else {
 		dialer = d.udpDialer4
 	}
@@ -311,12 +295,12 @@ func (d *DefaultDialer) DialParallelInterface(ctx context.Context, network strin
 	if !fastFallback && !isPrimary {
 		d.networkLastFallback.Store(time.Now())
 	}
-	return d.trackConn(conn, nil)
+	return trackConn(conn, nil)
 }

 func (d *DefaultDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
 	if d.networkStrategy == nil {
-		return d.trackPacketConn(listener.ListenNetworkNamespace[net.PacketConn](d.netns, func() (net.PacketConn, error) {
+		return trackPacketConn(listener.ListenNetworkNamespace[net.PacketConn](d.netns, func() (net.PacketConn, error) {
 			if destination.IsIPv6() {
 				return d.udpListener.ListenPacket(ctx, N.NetworkUDP, d.udpAddr6)
 			} else if destination.IsIPv4() && !destination.Addr.IsUnspecified() {
@@ -330,14 +314,6 @@ func (d *DefaultDialer) ListenPacket(ctx context.Context, destination M.Socksadd
 	}
 }

-func (d *DefaultDialer) DialerForICMPDestination(destination netip.Addr) net.Dialer {
-	if !destination.Is6() {
-		return d.dialer4.Dialer
-	} else {
-		return d.dialer6.Dialer
-	}
-}
-
 func (d *DefaultDialer) ListenSerialInterfacePacket(ctx context.Context, destination M.Socksaddr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, error) {
 	if strategy == nil {
 		strategy = d.networkStrategy
@@ -368,23 +344,33 @@ func (d *DefaultDialer) ListenSerialInterfacePacket(ctx context.Context, destina
 			return nil, err
 		}
 	}
-	return d.trackPacketConn(packetConn, nil)
+	return trackPacketConn(packetConn, nil)
 }

-func (d *DefaultDialer) WireGuardControl() control.Func {
-	return d.udpListener.Control
+func (d *DefaultDialer) ListenPacketCompat(network, address string) (net.PacketConn, error) {
+	udpListener := d.udpListener
+	udpListener.Control = control.Append(udpListener.Control, func(network, address string, conn syscall.RawConn) error {
+		for _, wgControlFn := range WgControlFns {
+			err := wgControlFn(network, address, conn)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	return udpListener.ListenPacket(context.Background(), network, address)
 }

-func (d *DefaultDialer) trackConn(conn net.Conn, err error) (net.Conn, error) {
-	if d.connectionManager == nil || err != nil {
+func trackConn(conn net.Conn, err error) (net.Conn, error) {
+	if !conntrack.Enabled || err != nil {
 		return conn, err
 	}
-	return d.connectionManager.TrackConn(conn), nil
+	return conntrack.NewConn(conn)
 }

-func (d *DefaultDialer) trackPacketConn(conn net.PacketConn, err error) (net.PacketConn, error) {
-	if d.connectionManager == nil || err != nil {
+func trackPacketConn(conn net.PacketConn, err error) (net.PacketConn, error) {
+	if !conntrack.Enabled || err != nil {
 		return conn, err
 	}
-	return d.connectionManager.TrackPacketConn(conn), nil
+	return conntrack.NewPacketConn(conn)
 }
--- a/common/dialer/default_go1.20.go
+++ b/common/dialer/default_go1.20.go
@@ -0,0 +1,19 @@
+//go:build go1.20
+
+package dialer
+
+import (
+	"net"
+
+	"github.com/metacubex/tfo-go"
+)
+
+type tcpDialer = tfo.Dialer
+
+func newTCPDialer(dialer net.Dialer, tfoEnabled bool) (tcpDialer, error) {
+	return tfo.Dialer{Dialer: dialer, DisableTFO: !tfoEnabled}, nil
+}
+
+func dialerFromTCPDialer(dialer tcpDialer) net.Dialer {
+	return dialer.Dialer
+}
--- a/common/dialer/default_go1.21.go
+++ b/common/dialer/default_go1.21.go
@@ -0,0 +1,11 @@
+//go:build go1.21
+
+package dialer
+
+import "net"
+
+const go121Available = true
+
+func setMultiPathTCP(dialer *net.Dialer) {
+	dialer.SetMultipathTCP(true)
+}
--- a/common/dialer/default_go123.go
+++ b/common/dialer/default_go123.go
@@ -0,0 +1,16 @@
+//go:build go1.23
+
+package dialer
+
+import (
+	"net"
+	"time"
+)
+
+func setKeepAliveConfig(dialer *net.Dialer, idle time.Duration, interval time.Duration) {
+	dialer.KeepAliveConfig = net.KeepAliveConfig{
+		Enable:   true,
+		Idle:     idle,
+		Interval: interval,
+	}
+}
--- a/common/dialer/default_nongo1.20.go
+++ b/common/dialer/default_nongo1.20.go
@@ -0,0 +1,22 @@
+//go:build !go1.20
+
+package dialer
+
+import (
+	"net"
+
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+type tcpDialer = net.Dialer
+
+func newTCPDialer(dialer net.Dialer, tfoEnabled bool) (tcpDialer, error) {
+	if tfoEnabled {
+		return dialer, E.New("TCP Fast Open requires go1.20, please recompile your binary.")
+	}
+	return dialer, nil
+}
+
+func dialerFromTCPDialer(dialer tcpDialer) net.Dialer {
+	return dialer
+}
--- a/common/dialer/default_nongo1.21.go
+++ b/common/dialer/default_nongo1.21.go
@@ -0,0 +1,12 @@
+//go:build !go1.21
+
+package dialer
+
+import (
+	"net"
+)
+
+const go121Available = false
+
+func setMultiPathTCP(dialer *net.Dialer) {
+}
--- a/common/dialer/default_nongo123.go
+++ b/common/dialer/default_nongo123.go
@@ -0,0 +1,15 @@
+//go:build !go1.23
+
+package dialer
+
+import (
+	"net"
+	"time"
+
+	"github.com/sagernet/sing/common/control"
+)
+
+func setKeepAliveConfig(dialer *net.Dialer, idle time.Duration, interval time.Duration) {
+	dialer.KeepAlive = idle
+	dialer.Control = control.Append(dialer.Control, control.SetKeepAlivePeriod(idle, interval))
+}
--- a/common/dialer/detour.go
+++ b/common/dialer/detour.go
@@ -19,7 +19,6 @@ type DirectDialer interface {
 type DetourDialer struct {
 	outboundManager adapter.OutboundManager
 	detour          string
-	defaultOutbound bool
 	legacyDNSDialer bool
 	dialer          N.Dialer
 	initOnce        sync.Once
@@ -34,13 +33,6 @@ func NewDetour(outboundManager adapter.OutboundManager, detour string, legacyDNS
 	}
 }

-func NewDefaultOutboundDetour(outboundManager adapter.OutboundManager) N.Dialer {
-	return &DetourDialer{
-		outboundManager: outboundManager,
-		defaultOutbound: true,
-	}
-}
-
 func InitializeDetour(dialer N.Dialer) error {
 	detourDialer, isDetour := common.Cast[*DetourDialer](dialer)
 	if !isDetour {
@@ -55,18 +47,12 @@ func (d *DetourDialer) Dialer() (N.Dialer, error) {
 }

 func (d *DetourDialer) init() {
-	var dialer adapter.Outbound
-	if d.detour != "" {
-		var loaded bool
-		dialer, loaded = d.outboundManager.Outbound(d.detour)
-		if !loaded {
-			d.initErr = E.New("outbound detour not found: ", d.detour)
-			return
-		}
-	} else {
-		dialer = d.outboundManager.Default()
+	dialer, loaded := d.outboundManager.Outbound(d.detour)
+	if !loaded {
+		d.initErr = E.New("outbound detour not found: ", d.detour)
+		return
 	}
-	if !d.defaultOutbound && !d.legacyDNSDialer {
+	if !d.legacyDNSDialer {
 		if directDialer, isDirect := dialer.(DirectDialer); isDirect {
 			if directDialer.IsEmpty() {
 				d.initErr = E.New("detour to an empty direct outbound makes no sense")
--- a/common/dialer/dialer.go
+++ b/common/dialer/dialer.go
@@ -25,7 +25,6 @@ type Options struct {
 	NewDialer        bool
 	LegacyDNSDialer  bool
 	DirectOutbound   bool
-	DefaultOutbound  bool
 }

 // TODO: merge with NewWithOptions
@@ -43,26 +42,19 @@ func NewWithOptions(options Options) (N.Dialer, error) {
 		dialer N.Dialer
 		err    error
 	)
-	hasDetour := dialOptions.Detour != "" || options.DefaultOutbound
 	if dialOptions.Detour != "" {
 		outboundManager := service.FromContext[adapter.OutboundManager](options.Context)
 		if outboundManager == nil {
 			return nil, E.New("missing outbound manager")
 		}
 		dialer = NewDetour(outboundManager, dialOptions.Detour, options.LegacyDNSDialer)
-	} else if options.DefaultOutbound {
-		outboundManager := service.FromContext[adapter.OutboundManager](options.Context)
-		if outboundManager == nil {
-			return nil, E.New("missing outbound manager")
-		}
-		dialer = NewDefaultOutboundDetour(outboundManager)
 	} else {
 		dialer, err = NewDefault(options.Context, dialOptions)
 		if err != nil {
 			return nil, err
 		}
 	}
-	if options.RemoteIsDomain && (!hasDetour || options.ResolverOnDetour || dialOptions.DomainResolver != nil && dialOptions.DomainResolver.Server != "") {
+	if options.RemoteIsDomain && (dialOptions.Detour == "" || options.ResolverOnDetour || dialOptions.DomainResolver != nil && dialOptions.DomainResolver.Server != "") {
 		networkManager := service.FromContext[adapter.NetworkManager](options.Context)
 		dnsTransport := service.FromContext[adapter.DNSTransportManager](options.Context)
 		var defaultOptions adapter.NetworkOptions
@@ -95,12 +87,11 @@ func NewWithOptions(options Options) (N.Dialer, error) {
 			}
 			server = dialOptions.DomainResolver.Server
 			dnsQueryOptions = adapter.DNSQueryOptions{
-				Transport:              transport,
-				Strategy:               strategy,
-				DisableCache:           dialOptions.DomainResolver.DisableCache,
-				DisableOptimisticCache: dialOptions.DomainResolver.DisableOptimisticCache,
-				RewriteTTL:             dialOptions.DomainResolver.RewriteTTL,
-				ClientSubnet:           dialOptions.DomainResolver.ClientSubnet.Build(netip.Prefix{}),
+				Transport:    transport,
+				Strategy:     strategy,
+				DisableCache: dialOptions.DomainResolver.DisableCache,
+				RewriteTTL:   dialOptions.DomainResolver.RewriteTTL,
+				ClientSubnet: dialOptions.DomainResolver.ClientSubnet.Build(netip.Prefix{}),
 			}
 			resolveFallbackDelay = time.Duration(dialOptions.FallbackDelay)
 		} else if options.DirectResolver {
--- a/common/dialer/resolve.go
+++ b/common/dialer/resolve.go
@@ -96,7 +96,7 @@ func (d *resolveDialer) DialContext(ctx context.Context, network string, destina
 	if err != nil {
 		return nil, err
 	}
-	if !destination.IsDomain() {
+	if !destination.IsFqdn() {
 		return d.dialer.DialContext(ctx, network, destination)
 	}
 	ctx = log.ContextWithOverrideLevel(ctx, log.LevelDebug)
@@ -116,7 +116,7 @@ func (d *resolveDialer) ListenPacket(ctx context.Context, destination M.Socksadd
 	if err != nil {
 		return nil, err
 	}
-	if !destination.IsDomain() {
+	if !destination.IsFqdn() {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
 	ctx = log.ContextWithOverrideLevel(ctx, log.LevelDebug)
@@ -144,7 +144,7 @@ func (d *resolveParallelNetworkDialer) DialParallelInterface(ctx context.Context
 	if err != nil {
 		return nil, err
 	}
-	if !destination.IsDomain() {
+	if !destination.IsFqdn() {
 		return d.dialer.DialContext(ctx, network, destination)
 	}
 	ctx = log.ContextWithOverrideLevel(ctx, log.LevelDebug)
@@ -167,7 +167,7 @@ func (d *resolveParallelNetworkDialer) ListenSerialInterfacePacket(ctx context.C
 	if err != nil {
 		return nil, err
 	}
-	if !destination.IsDomain() {
+	if !destination.IsFqdn() {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
 	ctx = log.ContextWithOverrideLevel(ctx, log.LevelDebug)
--- a/common/dialer/tfo.go
+++ b/common/dialer/tfo.go
@@ -1,3 +1,5 @@
+//go:build go1.20
+
 package dialer

 import (
@@ -14,7 +16,7 @@ import (
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"

-	"github.com/database64128/tfo-go/v2"
+	"github.com/metacubex/tfo-go"
 )

 type slowOpenConn struct {
@@ -30,7 +32,7 @@ type slowOpenConn struct {
 	err         error
 }

-func DialSlowContext(dialer *tfo.Dialer, ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+func DialSlowContext(dialer *tcpDialer, ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
 	if dialer.DisableTFO || N.NetworkName(network) != N.NetworkTCP {
 		switch N.NetworkName(network) {
 		case N.NetworkTCP, N.NetworkUDP:
--- a/common/dialer/tfo_stub.go
+++ b/common/dialer/tfo_stub.go
@@ -0,0 +1,20 @@
+//go:build !go1.20
+
+package dialer
+
+import (
+	"context"
+	"net"
+
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+)
+
+func DialSlowContext(dialer *tcpDialer, ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	switch N.NetworkName(network) {
+	case N.NetworkTCP, N.NetworkUDP:
+		return dialer.DialContext(ctx, network, destination.String())
+	default:
+		return dialer.DialContext(ctx, network, destination.AddrString())
+	}
+}
--- a/common/dialer/wireguard.go
+++ b/common/dialer/wireguard.go
@@ -1,9 +1,13 @@
 package dialer

 import (
+	"net"
+
 	"github.com/sagernet/sing/common/control"
 )

 type WireGuardListener interface {
-	WireGuardControl() control.Func
+	ListenPacketCompat(network, address string) (net.PacketConn, error)
 }
+
+var WgControlFns []control.Func
--- a/common/geosite/compat_test.go
+++ b/common/geosite/compat_test.go
@@ -1,234 +0,0 @@
-package geosite
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/binary"
-	"strings"
-	"testing"
-
-	"github.com/sagernet/sing/common/varbin"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Old implementation using varbin reflection-based serialization
-
-func oldWriteString(writer varbin.Writer, value string) error {
-	//nolint:staticcheck
-	return varbin.Write(writer, binary.BigEndian, value)
-}
-
-func oldWriteItem(writer varbin.Writer, item Item) error {
-	//nolint:staticcheck
-	return varbin.Write(writer, binary.BigEndian, item)
-}
-
-func oldReadString(reader varbin.Reader) (string, error) {
-	//nolint:staticcheck
-	return varbin.ReadValue[string](reader, binary.BigEndian)
-}
-
-func oldReadItem(reader varbin.Reader) (Item, error) {
-	//nolint:staticcheck
-	return varbin.ReadValue[Item](reader, binary.BigEndian)
-}
-
-func TestStringCompat(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name  string
-		input string
-	}{
-		{"empty", ""},
-		{"single_char", "a"},
-		{"ascii", "example.com"},
-		{"utf8", "测试域名.中国"},
-		{"special_chars", "\x00\xff\n\t"},
-		{"127_bytes", strings.Repeat("x", 127)},
-		{"128_bytes", strings.Repeat("x", 128)},
-		{"16383_bytes", strings.Repeat("x", 16383)},
-		{"16384_bytes", strings.Repeat("x", 16384)},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			// Old write
-			var oldBuf bytes.Buffer
-			err := oldWriteString(&oldBuf, tc.input)
-			require.NoError(t, err)
-
-			// New write
-			var newBuf bytes.Buffer
-			err = writeString(&newBuf, tc.input)
-			require.NoError(t, err)
-
-			// Bytes must match
-			require.Equal(t, oldBuf.Bytes(), newBuf.Bytes(),
-				"mismatch for %q\nold: %x\nnew: %x", tc.name, oldBuf.Bytes(), newBuf.Bytes())
-
-			// New write -> old read
-			readBack, err := oldReadString(bufio.NewReader(bytes.NewReader(newBuf.Bytes())))
-			require.NoError(t, err)
-			require.Equal(t, tc.input, readBack)
-
-			// Old write -> new read
-			readBack2, err := readString(bufio.NewReader(bytes.NewReader(oldBuf.Bytes())))
-			require.NoError(t, err)
-			require.Equal(t, tc.input, readBack2)
-		})
-	}
-}
-
-func TestItemCompat(t *testing.T) {
-	t.Parallel()
-
-	// Note: varbin.Write has a bug where struct values (not pointers) don't write their fields
-	// because field.CanSet() returns false for non-addressable values.
-	// The old geosite code passed Item values to varbin.Write, which silently wrote nothing.
-	// The new code correctly writes Type + Value using manual serialization.
-	// This test verifies the new serialization format and round-trip correctness.
-
-	cases := []struct {
-		name  string
-		input Item
-	}{
-		{"domain_empty", Item{Type: RuleTypeDomain, Value: ""}},
-		{"domain_normal", Item{Type: RuleTypeDomain, Value: "example.com"}},
-		{"domain_suffix", Item{Type: RuleTypeDomainSuffix, Value: ".example.com"}},
-		{"domain_keyword", Item{Type: RuleTypeDomainKeyword, Value: "google"}},
-		{"domain_regex", Item{Type: RuleTypeDomainRegex, Value: `^.*\.example\.com$`}},
-		{"utf8_domain", Item{Type: RuleTypeDomain, Value: "测试.com"}},
-		{"long_domain", Item{Type: RuleTypeDomainSuffix, Value: strings.Repeat("a", 200) + ".com"}},
-		{"128_bytes_value", Item{Type: RuleTypeDomain, Value: strings.Repeat("x", 128)}},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			// New write
-			var newBuf bytes.Buffer
-			err := newBuf.WriteByte(byte(tc.input.Type))
-			require.NoError(t, err)
-			err = writeString(&newBuf, tc.input.Value)
-			require.NoError(t, err)
-
-			// Verify format: Type (1 byte) + Value (uvarint len + bytes)
-			require.True(t, len(newBuf.Bytes()) >= 1, "output too short")
-			require.Equal(t, byte(tc.input.Type), newBuf.Bytes()[0], "type byte mismatch")
-
-			// New write -> old read (varbin can read correctly when given addressable target)
-			readBack, err := oldReadItem(bufio.NewReader(bytes.NewReader(newBuf.Bytes())))
-			require.NoError(t, err)
-			require.Equal(t, tc.input, readBack)
-
-			// New write -> new read
-			reader := bufio.NewReader(bytes.NewReader(newBuf.Bytes()))
-			typeByte, err := reader.ReadByte()
-			require.NoError(t, err)
-			value, err := readString(reader)
-			require.NoError(t, err)
-			require.Equal(t, tc.input, Item{Type: ItemType(typeByte), Value: value})
-		})
-	}
-}
-
-func TestGeositeWriteReadCompat(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name  string
-		input map[string][]Item
-	}{
-		{
-			"empty_map",
-			map[string][]Item{},
-		},
-		{
-			"single_code_empty_items",
-			map[string][]Item{"test": {}},
-		},
-		{
-			"single_code_single_item",
-			map[string][]Item{"test": {{Type: RuleTypeDomain, Value: "a.com"}}},
-		},
-		{
-			"single_code_multi_items",
-			map[string][]Item{
-				"test": {
-					{Type: RuleTypeDomain, Value: "a.com"},
-					{Type: RuleTypeDomainSuffix, Value: ".b.com"},
-					{Type: RuleTypeDomainKeyword, Value: "keyword"},
-					{Type: RuleTypeDomainRegex, Value: `^.*$`},
-				},
-			},
-		},
-		{
-			"multi_code",
-			map[string][]Item{
-				"cn": {{Type: RuleTypeDomain, Value: "baidu.com"}, {Type: RuleTypeDomainSuffix, Value: ".cn"}},
-				"us": {{Type: RuleTypeDomain, Value: "google.com"}},
-				"jp": {{Type: RuleTypeDomainSuffix, Value: ".jp"}},
-			},
-		},
-		{
-			"utf8_values",
-			map[string][]Item{
-				"test": {
-					{Type: RuleTypeDomain, Value: "测试.中国"},
-					{Type: RuleTypeDomainSuffix, Value: ".テスト"},
-				},
-			},
-		},
-		{
-			"large_items",
-			generateLargeItems(1000),
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			// Write using new implementation
-			var buf bytes.Buffer
-			err := Write(&buf, tc.input)
-			require.NoError(t, err)
-
-			// Read back and verify
-			reader, codes, err := NewReader(bytes.NewReader(buf.Bytes()))
-			require.NoError(t, err)
-
-			// Verify all codes exist
-			codeSet := make(map[string]bool)
-			for _, code := range codes {
-				codeSet[code] = true
-			}
-			for code := range tc.input {
-				require.True(t, codeSet[code], "missing code: %s", code)
-			}
-
-			// Verify items match
-			for code, expectedItems := range tc.input {
-				items, err := reader.Read(code)
-				require.NoError(t, err)
-				require.Equal(t, expectedItems, items, "items mismatch for code: %s", code)
-			}
-		})
-	}
-}
-
-func generateLargeItems(count int) map[string][]Item {
-	items := make([]Item, count)
-	for i := 0; i < count; i++ {
-		items[i] = Item{
-			Type:  ItemType(i % 4),
-			Value: strings.Repeat("x", i%200) + ".com",
-		}
-	}
-	return map[string][]Item{"large": items}
-}
--- a/common/geosite/reader.go
+++ b/common/geosite/reader.go
@@ -9,6 +9,7 @@ import (
 	"sync/atomic"

 	E "github.com/sagernet/sing/common/exceptions"
+	"github.com/sagernet/sing/common/varbin"
 )

 type Reader struct {
@@ -77,7 +78,7 @@ func (r *Reader) readMetadata() error {
 			codeIndex  uint64
 			codeLength uint64
 		)
-		code, err = readString(reader)
+		code, err = varbin.ReadValue[string](reader, binary.BigEndian)
 		if err != nil {
 			return err
 		}
@@ -111,16 +112,9 @@ func (r *Reader) Read(code string) ([]Item, error) {
 	}
 	r.bufferedReader.Reset(r.reader)
 	itemList := make([]Item, r.domainLength[code])
-	for i := range itemList {
-		typeByte, err := r.bufferedReader.ReadByte()
-		if err != nil {
-			return nil, err
-		}
-		itemList[i].Type = ItemType(typeByte)
-		itemList[i].Value, err = readString(r.bufferedReader)
-		if err != nil {
-			return nil, err
-		}
+	err = varbin.Read(r.bufferedReader, binary.BigEndian, &itemList)
+	if err != nil {
+		return nil, err
 	}
 	return itemList, nil
 }
@@ -141,18 +135,3 @@ func (r *readCounter) Read(p []byte) (n int, err error) {
 	}
 	return
 }
-
-func readString(reader io.ByteReader) (string, error) {
-	length, err := binary.ReadUvarint(reader)
-	if err != nil {
-		return "", err
-	}
-	bytes := make([]byte, length)
-	for i := range bytes {
-		bytes[i], err = reader.ReadByte()
-		if err != nil {
-			return "", err
-		}
-	}
-	return string(bytes), nil
-}
--- a/common/geosite/writer.go
+++ b/common/geosite/writer.go
@@ -2,6 +2,7 @@ package geosite

 import (
 	"bytes"
+	"encoding/binary"
 	"sort"

 	"github.com/sagernet/sing/common/varbin"
@@ -19,11 +20,7 @@ func Write(writer varbin.Writer, domains map[string][]Item) error {
 	for _, code := range keys {
 		index[code] = content.Len()
 		for _, item := range domains[code] {
-			err := content.WriteByte(byte(item.Type))
-			if err != nil {
-				return err
-			}
-			err = writeString(content, item.Value)
+			err := varbin.Write(content, binary.BigEndian, item)
 			if err != nil {
 				return err
 			}
@@ -41,7 +38,7 @@ func Write(writer varbin.Writer, domains map[string][]Item) error {
 	}

 	for _, code := range keys {
-		err = writeString(writer, code)
+		err = varbin.Write(writer, binary.BigEndian, code)
 		if err != nil {
 			return err
 		}
@@ -62,12 +59,3 @@ func Write(writer varbin.Writer, domains map[string][]Item) error {

 	return nil
 }
-
-func writeString(writer varbin.Writer, value string) error {
-	_, err := varbin.WriteUvarint(writer, uint64(len(value)))
-	if err != nil {
-		return err
-	}
-	_, err = writer.Write([]byte(value))
-	return err
-}
--- a/common/httpclient/apple_transport_darwin.go
+++ b/common/httpclient/apple_transport_darwin.go
@@ -1,456 +0,0 @@
-//go:build darwin && cgo
-
-package httpclient
-
-/*
-#cgo CFLAGS: -x objective-c -fobjc-arc
-#cgo LDFLAGS: -framework Foundation -framework Security
-
-#include <stdlib.h>
-#include "apple_transport_darwin.h"
-*/
-import "C"
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-	"unsafe"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/proxybridge"
-	boxTLS "github.com/sagernet/sing-box/common/tls"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/common/ntp"
-)
-
-const applePinnedHashSize = sha256.Size
-
-func verifyApplePinnedPublicKeySHA256(flatHashes []byte, leafCertificate []byte) error {
-	if len(flatHashes)%applePinnedHashSize != 0 {
-		return E.New("invalid pinned public key list")
-	}
-	knownHashes := make([][]byte, 0, len(flatHashes)/applePinnedHashSize)
-	for offset := 0; offset < len(flatHashes); offset += applePinnedHashSize {
-		knownHashes = append(knownHashes, append([]byte(nil), flatHashes[offset:offset+applePinnedHashSize]...))
-	}
-	return boxTLS.VerifyPublicKeySHA256(knownHashes, [][]byte{leafCertificate})
-}
-
-//export box_apple_http_verify_public_key_sha256
-func box_apple_http_verify_public_key_sha256(knownHashValues *C.uint8_t, knownHashValuesLen C.size_t, leafCert *C.uint8_t, leafCertLen C.size_t) *C.char {
-	flatHashes := C.GoBytes(unsafe.Pointer(knownHashValues), C.int(knownHashValuesLen))
-	leafCertificate := C.GoBytes(unsafe.Pointer(leafCert), C.int(leafCertLen))
-	err := verifyApplePinnedPublicKeySHA256(flatHashes, leafCertificate)
-	if err == nil {
-		return nil
-	}
-	return C.CString(err.Error())
-}
-
-type appleSessionConfig struct {
-	serverName             string
-	minVersion             uint16
-	maxVersion             uint16
-	insecure               bool
-	anchorPEM              string
-	anchorOnly             bool
-	pinnedPublicKeySHA256s []byte
-}
-
-type appleTransportShared struct {
-	logger logger.ContextLogger
-	bridge *proxybridge.Bridge
-	config appleSessionConfig
-	timeFunc func() time.Time
-	refs   atomic.Int32
-}
-
-type appleTransport struct {
-	shared  *appleTransportShared
-	access  sync.Mutex
-	session *C.box_apple_http_session_t
-	closed  bool
-}
-
-type errorTransport struct {
-	err error
-}
-
-func newAppleTransport(ctx context.Context, logger logger.ContextLogger, rawDialer N.Dialer, options option.HTTPClientOptions) (adapter.HTTPTransport, error) {
-	sessionConfig, err := newAppleSessionConfig(ctx, options)
-	if err != nil {
-		return nil, err
-	}
-	bridge, err := proxybridge.New(ctx, logger, "apple http proxy", rawDialer)
-	if err != nil {
-		return nil, err
-	}
-	shared := &appleTransportShared{
-		logger: logger,
-		bridge: bridge,
-		config: sessionConfig,
-		timeFunc: ntp.TimeFuncFromContext(ctx),
-	}
-	shared.refs.Store(1)
-	session, err := shared.newSession()
-	if err != nil {
-		bridge.Close()
-		return nil, err
-	}
-	return &appleTransport{
-		shared:  shared,
-		session: session,
-	}, nil
-}
-
-func newAppleSessionConfig(ctx context.Context, options option.HTTPClientOptions) (appleSessionConfig, error) {
-	version := options.Version
-	if version == 0 {
-		version = 2
-	}
-	switch version {
-	case 2:
-	case 1:
-		return appleSessionConfig{}, E.New("HTTP/1.1 is unsupported in Apple HTTP engine")
-	case 3:
-		return appleSessionConfig{}, E.New("HTTP/3 is unsupported in Apple HTTP engine")
-	default:
-		return appleSessionConfig{}, E.New("unknown HTTP version: ", version)
-	}
-	if options.DisableVersionFallback {
-		return appleSessionConfig{}, E.New("disable_version_fallback is unsupported in Apple HTTP engine")
-	}
-	if options.HTTP2Options != (option.HTTP2Options{}) {
-		return appleSessionConfig{}, E.New("HTTP/2 options are unsupported in Apple HTTP engine")
-	}
-	if options.HTTP3Options != (option.QUICOptions{}) {
-		return appleSessionConfig{}, E.New("QUIC options are unsupported in Apple HTTP engine")
-	}
-
-	tlsOptions := common.PtrValueOrDefault(options.TLS)
-	if tlsOptions.Engine != "" {
-		return appleSessionConfig{}, E.New("tls.engine is unsupported in Apple HTTP engine")
-	}
-	if len(tlsOptions.ALPN) > 0 {
-		return appleSessionConfig{}, E.New("tls.alpn is unsupported in Apple HTTP engine")
-	}
-	validated, err := boxTLS.ValidateAppleTLSOptions(ctx, tlsOptions, "Apple HTTP engine")
-	if err != nil {
-		return appleSessionConfig{}, err
-	}
-
-	config := appleSessionConfig{
-		serverName: tlsOptions.ServerName,
-		minVersion: validated.MinVersion,
-		maxVersion: validated.MaxVersion,
-		insecure:   tlsOptions.Insecure || len(tlsOptions.CertificatePublicKeySHA256) > 0,
-		anchorPEM:  validated.AnchorPEM,
-		anchorOnly: validated.AnchorOnly,
-	}
-	if len(tlsOptions.CertificatePublicKeySHA256) > 0 {
-		config.pinnedPublicKeySHA256s = make([]byte, 0, len(tlsOptions.CertificatePublicKeySHA256)*applePinnedHashSize)
-		for _, hashValue := range tlsOptions.CertificatePublicKeySHA256 {
-			if len(hashValue) != applePinnedHashSize {
-				return appleSessionConfig{}, E.New("invalid certificate_public_key_sha256 length: ", len(hashValue))
-			}
-			config.pinnedPublicKeySHA256s = append(config.pinnedPublicKeySHA256s, hashValue...)
-		}
-	}
-	return config, nil
-}
-
-func (s *appleTransportShared) retain() {
-	s.refs.Add(1)
-}
-
-func (s *appleTransportShared) release() error {
-	if s.refs.Add(-1) == 0 {
-		return s.bridge.Close()
-	}
-	return nil
-}
-
-func (s *appleTransportShared) newSession() (*C.box_apple_http_session_t, error) {
-	cProxyHost := C.CString("127.0.0.1")
-	defer C.free(unsafe.Pointer(cProxyHost))
-	cProxyUsername := C.CString(s.bridge.Username())
-	defer C.free(unsafe.Pointer(cProxyUsername))
-	cProxyPassword := C.CString(s.bridge.Password())
-	defer C.free(unsafe.Pointer(cProxyPassword))
-	var cAnchorPEM *C.char
-	if s.config.anchorPEM != "" {
-		cAnchorPEM = C.CString(s.config.anchorPEM)
-		defer C.free(unsafe.Pointer(cAnchorPEM))
-	}
-	var pinnedPointer *C.uint8_t
-	if len(s.config.pinnedPublicKeySHA256s) > 0 {
-		pinnedPointer = (*C.uint8_t)(C.CBytes(s.config.pinnedPublicKeySHA256s))
-		defer C.free(unsafe.Pointer(pinnedPointer))
-	}
-	cConfig := C.box_apple_http_session_config_t{
-		proxy_host:                   cProxyHost,
-		proxy_port:                   C.int(s.bridge.Port()),
-		proxy_username:               cProxyUsername,
-		proxy_password:               cProxyPassword,
-		min_tls_version:              C.uint16_t(s.config.minVersion),
-		max_tls_version:              C.uint16_t(s.config.maxVersion),
-		insecure:                     C.bool(s.config.insecure),
-		anchor_pem:                   cAnchorPEM,
-		anchor_pem_len:               C.size_t(len(s.config.anchorPEM)),
-		anchor_only:                  C.bool(s.config.anchorOnly),
-		pinned_public_key_sha256:     pinnedPointer,
-		pinned_public_key_sha256_len: C.size_t(len(s.config.pinnedPublicKeySHA256s)),
-	}
-	var cErr *C.char
-	session := C.box_apple_http_session_create(&cConfig, &cErr)
-	if session != nil {
-		return session, nil
-	}
-	return nil, appleCStringError(cErr, "create Apple HTTP session")
-}
-
-func (t *appleTransport) RoundTrip(request *http.Request) (*http.Response, error) {
-	if requestRequiresHTTP1(request) {
-		return nil, E.New("HTTP upgrade requests are unsupported in Apple HTTP engine")
-	}
-	if request.URL == nil {
-		return nil, E.New("missing request URL")
-	}
-	switch request.URL.Scheme {
-	case "http", "https":
-	default:
-		return nil, E.New("unsupported URL scheme: ", request.URL.Scheme)
-	}
-	if request.URL.Scheme == "https" && t.shared.config.serverName != "" && !strings.EqualFold(t.shared.config.serverName, request.URL.Hostname()) {
-		return nil, E.New("tls.server_name is unsupported in Apple HTTP engine unless it matches request host")
-	}
-	var body []byte
-	if request.Body != nil && request.Body != http.NoBody {
-		defer request.Body.Close()
-		var err error
-		body, err = io.ReadAll(request.Body)
-		if err != nil {
-			return nil, err
-		}
-	}
-	headerKeys, headerValues := flattenRequestHeaders(request)
-	cMethod := C.CString(request.Method)
-	defer C.free(unsafe.Pointer(cMethod))
-	cURL := C.CString(request.URL.String())
-	defer C.free(unsafe.Pointer(cURL))
-	cHeaderKeys := make([]*C.char, len(headerKeys))
-	cHeaderValues := make([]*C.char, len(headerValues))
-	defer func() {
-		for _, ptr := range cHeaderKeys {
-			C.free(unsafe.Pointer(ptr))
-		}
-		for _, ptr := range cHeaderValues {
-			C.free(unsafe.Pointer(ptr))
-		}
-	}()
-	for index, value := range headerKeys {
-		cHeaderKeys[index] = C.CString(value)
-	}
-	for index, value := range headerValues {
-		cHeaderValues[index] = C.CString(value)
-	}
-	var headerKeysPointer **C.char
-	var headerValuesPointer **C.char
-	if len(cHeaderKeys) > 0 {
-		pointerArraySize := C.size_t(len(cHeaderKeys)) * C.size_t(unsafe.Sizeof((*C.char)(nil)))
-		headerKeysPointer = (**C.char)(C.malloc(pointerArraySize))
-		defer C.free(unsafe.Pointer(headerKeysPointer))
-		headerValuesPointer = (**C.char)(C.malloc(pointerArraySize))
-		defer C.free(unsafe.Pointer(headerValuesPointer))
-		copy(unsafe.Slice(headerKeysPointer, len(cHeaderKeys)), cHeaderKeys)
-		copy(unsafe.Slice(headerValuesPointer, len(cHeaderValues)), cHeaderValues)
-	}
-	var bodyPointer *C.uint8_t
-	if len(body) > 0 {
-		bodyPointer = (*C.uint8_t)(C.CBytes(body))
-		defer C.free(unsafe.Pointer(bodyPointer))
-	}
-	var (
-		hasVerifyTime       bool
-		verifyTimeUnixMilli int64
-	)
-	if t.shared.timeFunc != nil {
-		hasVerifyTime = true
-		verifyTimeUnixMilli = t.shared.timeFunc().UnixMilli()
-	}
-	cRequest := C.box_apple_http_request_t{
-		method:                 cMethod,
-		url:                    cURL,
-		header_keys:            (**C.char)(headerKeysPointer),
-		header_values:          (**C.char)(headerValuesPointer),
-		header_count:           C.size_t(len(cHeaderKeys)),
-		body:                   bodyPointer,
-		body_len:               C.size_t(len(body)),
-		has_verify_time:        C.bool(hasVerifyTime),
-		verify_time_unix_millis: C.int64_t(verifyTimeUnixMilli),
-	}
-	var cErr *C.char
-	var task *C.box_apple_http_task_t
-	t.access.Lock()
-	if t.session == nil {
-		t.access.Unlock()
-		return nil, net.ErrClosed
-	}
-	// Keep the session attached until NSURLSession has created the task.
-	task = C.box_apple_http_session_send_async(t.session, &cRequest, &cErr)
-	t.access.Unlock()
-	if task == nil {
-		return nil, appleCStringError(cErr, "create Apple HTTP request")
-	}
-	cancelDone := make(chan struct{})
-	cancelExit := make(chan struct{})
-	go func() {
-		defer close(cancelExit)
-		select {
-		case <-request.Context().Done():
-			C.box_apple_http_task_cancel(task)
-		case <-cancelDone:
-		}
-	}()
-	cResponse := C.box_apple_http_task_wait(task, &cErr)
-	close(cancelDone)
-	<-cancelExit
-	C.box_apple_http_task_close(task)
-	if cResponse == nil {
-		err := appleCStringError(cErr, "Apple HTTP request failed")
-		if request.Context().Err() != nil {
-			return nil, request.Context().Err()
-		}
-		return nil, err
-	}
-	defer C.box_apple_http_response_free(cResponse)
-	return parseAppleHTTPResponse(request, cResponse), nil
-}
-
-func (t *appleTransport) CloseIdleConnections() {
-	t.access.Lock()
-	if t.closed {
-		t.access.Unlock()
-		return
-	}
-	t.access.Unlock()
-	newSession, err := t.shared.newSession()
-	if err != nil {
-		t.shared.logger.Error(E.Cause(err, "reset Apple HTTP session"))
-		return
-	}
-	t.access.Lock()
-	if t.closed {
-		t.access.Unlock()
-		C.box_apple_http_session_close(newSession)
-		return
-	}
-	oldSession := t.session
-	t.session = newSession
-	t.access.Unlock()
-	C.box_apple_http_session_retire(oldSession)
-}
-
-func (t *appleTransport) Clone() adapter.HTTPTransport {
-	t.shared.retain()
-	session, err := t.shared.newSession()
-	if err != nil {
-		_ = t.shared.release()
-		return &errorTransport{err: err}
-	}
-	return &appleTransport{
-		shared:  t.shared,
-		session: session,
-	}
-}
-
-func (t *appleTransport) Close() error {
-	t.access.Lock()
-	if t.closed {
-		t.access.Unlock()
-		return nil
-	}
-	t.closed = true
-	session := t.session
-	t.session = nil
-	t.access.Unlock()
-	C.box_apple_http_session_close(session)
-	return t.shared.release()
-}
-
-func (t *errorTransport) RoundTrip(request *http.Request) (*http.Response, error) {
-	return nil, t.err
-}
-
-func (t *errorTransport) CloseIdleConnections() {
-}
-
-func (t *errorTransport) Clone() adapter.HTTPTransport {
-	return &errorTransport{err: t.err}
-}
-
-func (t *errorTransport) Close() error {
-	return nil
-}
-
-func flattenRequestHeaders(request *http.Request) ([]string, []string) {
-	var (
-		keys   []string
-		values []string
-	)
-	for key, headerValues := range request.Header {
-		for _, value := range headerValues {
-			keys = append(keys, key)
-			values = append(values, value)
-		}
-	}
-	if request.Host != "" {
-		keys = append(keys, "Host")
-		values = append(values, request.Host)
-	}
-	return keys, values
-}
-
-func parseAppleHTTPResponse(request *http.Request, response *C.box_apple_http_response_t) *http.Response {
-	headers := make(http.Header)
-	headerKeys := unsafe.Slice(response.header_keys, int(response.header_count))
-	headerValues := unsafe.Slice(response.header_values, int(response.header_count))
-	for index := range headerKeys {
-		headers.Add(C.GoString(headerKeys[index]), C.GoString(headerValues[index]))
-	}
-	body := bytes.NewReader(C.GoBytes(unsafe.Pointer(response.body), C.int(response.body_len)))
-	// NSURLSession's completion-handler API does not expose the negotiated protocol;
-	// callers that read Response.Proto will see HTTP/1.1 even when the wire was HTTP/2.
-	return &http.Response{
-		StatusCode:    int(response.status_code),
-		Status:        fmt.Sprintf("%d %s", int(response.status_code), http.StatusText(int(response.status_code))),
-		Proto:         "HTTP/1.1",
-		ProtoMajor:    1,
-		ProtoMinor:    1,
-		Header:        headers,
-		Body:          io.NopCloser(body),
-		ContentLength: int64(body.Len()),
-		Request:       request,
-	}
-}
-
-func appleCStringError(cErr *C.char, message string) error {
-	if cErr == nil {
-		return E.New(message)
-	}
-	defer C.free(unsafe.Pointer(cErr))
-	return E.New(message, ": ", C.GoString(cErr))
-}
--- a/common/httpclient/apple_transport_darwin.h
+++ b/common/httpclient/apple_transport_darwin.h
@@ -1,71 +0,0 @@
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdint.h>
-
-typedef struct box_apple_http_session box_apple_http_session_t;
-typedef struct box_apple_http_task box_apple_http_task_t;
-
-typedef struct box_apple_http_session_config {
-	const char *proxy_host;
-	int proxy_port;
-	const char *proxy_username;
-	const char *proxy_password;
-	uint16_t min_tls_version;
-	uint16_t max_tls_version;
-	bool insecure;
-	const char *anchor_pem;
-	size_t anchor_pem_len;
-	bool anchor_only;
-	const uint8_t *pinned_public_key_sha256;
-	size_t pinned_public_key_sha256_len;
-} box_apple_http_session_config_t;
-
-typedef struct box_apple_http_request {
-	const char *method;
-	const char *url;
-	const char **header_keys;
-	const char **header_values;
-	size_t header_count;
-	const uint8_t *body;
-	size_t body_len;
-	bool has_verify_time;
-	int64_t verify_time_unix_millis;
-} box_apple_http_request_t;
-
-typedef struct box_apple_http_response {
-	int status_code;
-	char **header_keys;
-	char **header_values;
-	size_t header_count;
-	uint8_t *body;
-	size_t body_len;
-	char *error;
-} box_apple_http_response_t;
-
-box_apple_http_session_t *box_apple_http_session_create(
-	const box_apple_http_session_config_t *config,
-	char **error_out
-);
-void box_apple_http_session_retire(box_apple_http_session_t *session);
-void box_apple_http_session_close(box_apple_http_session_t *session);
-
-box_apple_http_task_t *box_apple_http_session_send_async(
-	box_apple_http_session_t *session,
-	const box_apple_http_request_t *request,
-	char **error_out
-);
-box_apple_http_response_t *box_apple_http_task_wait(
-	box_apple_http_task_t *task,
-	char **error_out
-);
-void box_apple_http_task_cancel(box_apple_http_task_t *task);
-void box_apple_http_task_close(box_apple_http_task_t *task);
-
-void box_apple_http_response_free(box_apple_http_response_t *response);
-
-char *box_apple_http_verify_public_key_sha256(
-	uint8_t *known_hash_values,
-	size_t known_hash_values_len,
-	uint8_t *leaf_cert,
-	size_t leaf_cert_len
-);
--- a/common/httpclient/apple_transport_darwin.m
+++ b/common/httpclient/apple_transport_darwin.m
@@ -1,398 +0,0 @@
-#import "apple_transport_darwin.h"
-
-#import <CoreFoundation/CFStream.h>
-#import <Foundation/Foundation.h>
-#import <Security/Security.h>
-#import <dispatch/dispatch.h>
-#import <stdlib.h>
-#import <string.h>
-
-typedef struct box_apple_http_session {
-	void *handle;
-} box_apple_http_session_t;
-
-typedef struct box_apple_http_task {
-	void *task;
-	void *done_semaphore;
-	box_apple_http_response_t *response;
-	char *error;
-} box_apple_http_task_t;
-
-static NSString *const box_apple_http_verify_time_key = @"sing-box.verify-time";
-
-static void box_set_error_string(char **error_out, NSString *message) {
-	if (error_out == NULL || *error_out != NULL) {
-		return;
-	}
-	const char *utf8 = [message UTF8String];
-	*error_out = strdup(utf8 != NULL ? utf8 : "unknown error");
-}
-
-static void box_set_error_from_nserror(char **error_out, NSError *error) {
-	if (error == nil) {
-		box_set_error_string(error_out, @"unknown error");
-		return;
-	}
-	box_set_error_string(error_out, error.localizedDescription ?: error.description);
-}
-
-static NSArray *box_parse_certificates_from_pem(const char *pem, size_t pem_len) {
-	if (pem == NULL || pem_len == 0) {
-		return @[];
-	}
-	NSString *content = [[NSString alloc] initWithBytes:pem length:pem_len encoding:NSUTF8StringEncoding];
-	if (content == nil) {
-		return @[];
-	}
-	NSString *beginMarker = @"-----BEGIN CERTIFICATE-----";
-	NSString *endMarker = @"-----END CERTIFICATE-----";
-	NSMutableArray *certificates = [NSMutableArray array];
-	NSUInteger searchFrom = 0;
-	while (searchFrom < content.length) {
-		NSRange beginRange = [content rangeOfString:beginMarker options:0 range:NSMakeRange(searchFrom, content.length - searchFrom)];
-		if (beginRange.location == NSNotFound) {
-			break;
-		}
-		NSUInteger bodyStart = beginRange.location + beginRange.length;
-		NSRange endRange = [content rangeOfString:endMarker options:0 range:NSMakeRange(bodyStart, content.length - bodyStart)];
-		if (endRange.location == NSNotFound) {
-			break;
-		}
-		NSString *base64Section = [content substringWithRange:NSMakeRange(bodyStart, endRange.location - bodyStart)];
-		NSArray<NSString *> *components = [base64Section componentsSeparatedByCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]];
-		NSString *base64Content = [components componentsJoinedByString:@""];
-		NSData *der = [[NSData alloc] initWithBase64EncodedString:base64Content options:0];
-		if (der != nil) {
-			SecCertificateRef certificate = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)der);
-			if (certificate != NULL) {
-				[certificates addObject:(__bridge id)certificate];
-				CFRelease(certificate);
-			}
-		}
-		searchFrom = endRange.location + endRange.length;
-	}
-	return certificates;
-}
-
-static bool box_evaluate_trust(SecTrustRef trustRef, NSArray *anchors, bool anchor_only, NSDate *verifyDate) {
-	if (trustRef == NULL) {
-		return false;
-	}
-	if (verifyDate != nil && SecTrustSetVerifyDate(trustRef, (__bridge CFDateRef)verifyDate) != errSecSuccess) {
-		return false;
-	}
-	if (anchors.count > 0 || anchor_only) {
-		CFMutableArrayRef anchorArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
-		for (id certificate in anchors) {
-			CFArrayAppendValue(anchorArray, (__bridge const void *)certificate);
-		}
-		SecTrustSetAnchorCertificates(trustRef, anchorArray);
-		SecTrustSetAnchorCertificatesOnly(trustRef, anchor_only);
-		CFRelease(anchorArray);
-	}
-	CFErrorRef error = NULL;
-	bool result = SecTrustEvaluateWithError(trustRef, &error);
-	if (error != NULL) {
-		CFRelease(error);
-	}
-	return result;
-}
-
-static NSDate *box_apple_http_verify_date_for_request(NSURLRequest *request) {
-	if (request == nil) {
-		return nil;
-	}
-	id value = [NSURLProtocol propertyForKey:box_apple_http_verify_time_key inRequest:request];
-	if (![value isKindOfClass:[NSNumber class]]) {
-		return nil;
-	}
-	return [NSDate dateWithTimeIntervalSince1970:[(NSNumber *)value longLongValue] / 1000.0];
-}
-
-static box_apple_http_response_t *box_create_response(NSHTTPURLResponse *httpResponse, NSData *data) {
-	box_apple_http_response_t *response = calloc(1, sizeof(box_apple_http_response_t));
-	response->status_code = (int)httpResponse.statusCode;
-	NSDictionary *headers = httpResponse.allHeaderFields;
-	response->header_count = headers.count;
-	if (response->header_count > 0) {
-		response->header_keys = calloc(response->header_count, sizeof(char *));
-		response->header_values = calloc(response->header_count, sizeof(char *));
-		NSUInteger index = 0;
-		for (id key in headers) {
-			NSString *keyString = [[key description] copy];
-			NSString *valueString = [[headers[key] description] copy];
-			response->header_keys[index] = strdup(keyString.UTF8String ?: "");
-			response->header_values[index] = strdup(valueString.UTF8String ?: "");
-			index++;
-		}
-	}
-	if (data.length > 0) {
-		response->body_len = data.length;
-		response->body = malloc(data.length);
-		memcpy(response->body, data.bytes, data.length);
-	}
-	return response;
-}
-
-@interface BoxAppleHTTPSessionDelegate : NSObject <NSURLSessionTaskDelegate, NSURLSessionDataDelegate>
-@property(nonatomic, assign) BOOL insecure;
-@property(nonatomic, assign) BOOL anchorOnly;
-@property(nonatomic, strong) NSArray *anchors;
-@property(nonatomic, strong) NSData *pinnedPublicKeyHashes;
-@end
-
-@implementation BoxAppleHTTPSessionDelegate
-
- (void)URLSession:(NSURLSession *)session
-              task:(NSURLSessionTask *)task
-willPerformHTTPRedirection:(NSHTTPURLResponse *)response
-        newRequest:(NSURLRequest *)request
- completionHandler:(void (^)(NSURLRequest * _Nullable))completionHandler {
-	completionHandler(nil);
-}
-
- (void)URLSession:(NSURLSession *)session
-              task:(NSURLSessionTask *)task
-didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge
- completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential * _Nullable credential))completionHandler {
-	if (![challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
-		completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
-		return;
-	}
-	SecTrustRef trustRef = challenge.protectionSpace.serverTrust;
-	if (trustRef == NULL) {
-		completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
-		return;
-	}
-	NSDate *verifyDate = box_apple_http_verify_date_for_request(task.currentRequest ?: task.originalRequest);
-	BOOL needsCustomHandling = self.insecure || self.anchorOnly || self.anchors.count > 0 || self.pinnedPublicKeyHashes.length > 0 || verifyDate != nil;
-	if (!needsCustomHandling) {
-		completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
-		return;
-	}
-	BOOL ok = YES;
-	if (!self.insecure) {
-		ok = box_evaluate_trust(trustRef, self.anchors, self.anchorOnly, verifyDate);
-	}
-	if (ok && self.pinnedPublicKeyHashes.length > 0) {
-		CFArrayRef certificateChain = SecTrustCopyCertificateChain(trustRef);
-		SecCertificateRef leafCertificate = NULL;
-		if (certificateChain != NULL && CFArrayGetCount(certificateChain) > 0) {
-			leafCertificate = (SecCertificateRef)CFArrayGetValueAtIndex(certificateChain, 0);
-		}
-		if (leafCertificate == NULL) {
-			ok = NO;
-		} else {
-			NSData *leafData = CFBridgingRelease(SecCertificateCopyData(leafCertificate));
-			char *pinError = box_apple_http_verify_public_key_sha256(
-				(uint8_t *)self.pinnedPublicKeyHashes.bytes,
-				self.pinnedPublicKeyHashes.length,
-				(uint8_t *)leafData.bytes,
-				leafData.length
-			);
-			if (pinError != NULL) {
-				free(pinError);
-				ok = NO;
-			}
-		}
-		if (certificateChain != NULL) {
-			CFRelease(certificateChain);
-		}
-	}
-	if (!ok) {
-		completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
-		return;
-	}
-	completionHandler(NSURLSessionAuthChallengeUseCredential, [NSURLCredential credentialForTrust:trustRef]);
-}
-
-@end
-
-@interface BoxAppleHTTPSessionHandle : NSObject
-@property(nonatomic, strong) NSURLSession *session;
-@property(nonatomic, strong) BoxAppleHTTPSessionDelegate *delegate;
-@end
-
-@implementation BoxAppleHTTPSessionHandle
-@end
-
-box_apple_http_session_t *box_apple_http_session_create(
-	const box_apple_http_session_config_t *config,
-	char **error_out
-) {
-	@autoreleasepool {
-		NSURLSessionConfiguration *sessionConfig = [NSURLSessionConfiguration ephemeralSessionConfiguration];
-		sessionConfig.URLCache = nil;
-		sessionConfig.HTTPCookieStorage = nil;
-		sessionConfig.URLCredentialStorage = nil;
-		sessionConfig.HTTPShouldSetCookies = NO;
-		if (config != NULL && config->proxy_host != NULL && config->proxy_port > 0) {
-			NSMutableDictionary *proxyDictionary = [NSMutableDictionary dictionary];
-			proxyDictionary[(__bridge NSString *)kCFStreamPropertySOCKSProxyHost] = [NSString stringWithUTF8String:config->proxy_host];
-			proxyDictionary[(__bridge NSString *)kCFStreamPropertySOCKSProxyPort] = @(config->proxy_port);
-			proxyDictionary[(__bridge NSString *)kCFStreamPropertySOCKSVersion] = (__bridge NSString *)kCFStreamSocketSOCKSVersion5;
-			if (config->proxy_username != NULL) {
-				proxyDictionary[(__bridge NSString *)kCFStreamPropertySOCKSUser] = [NSString stringWithUTF8String:config->proxy_username];
-			}
-			if (config->proxy_password != NULL) {
-				proxyDictionary[(__bridge NSString *)kCFStreamPropertySOCKSPassword] = [NSString stringWithUTF8String:config->proxy_password];
-			}
-			sessionConfig.connectionProxyDictionary = proxyDictionary;
-		}
-		if (config != NULL && config->min_tls_version != 0) {
-			sessionConfig.TLSMinimumSupportedProtocolVersion = (tls_protocol_version_t)config->min_tls_version;
-		}
-		if (config != NULL && config->max_tls_version != 0) {
-			sessionConfig.TLSMaximumSupportedProtocolVersion = (tls_protocol_version_t)config->max_tls_version;
-		}
-		BoxAppleHTTPSessionDelegate *delegate = [[BoxAppleHTTPSessionDelegate alloc] init];
-		if (config != NULL) {
-			delegate.insecure = config->insecure;
-			delegate.anchorOnly = config->anchor_only;
-			delegate.anchors = box_parse_certificates_from_pem(config->anchor_pem, config->anchor_pem_len);
-			if (config->pinned_public_key_sha256 != NULL && config->pinned_public_key_sha256_len > 0) {
-				delegate.pinnedPublicKeyHashes = [NSData dataWithBytes:config->pinned_public_key_sha256 length:config->pinned_public_key_sha256_len];
-			}
-		}
-		NSURLSession *session = [NSURLSession sessionWithConfiguration:sessionConfig delegate:delegate delegateQueue:nil];
-		if (session == nil) {
-			box_set_error_string(error_out, @"create URLSession");
-			return NULL;
-		}
-		BoxAppleHTTPSessionHandle *handle = [[BoxAppleHTTPSessionHandle alloc] init];
-		handle.session = session;
-		handle.delegate = delegate;
-		box_apple_http_session_t *sessionHandle = calloc(1, sizeof(box_apple_http_session_t));
-		sessionHandle->handle = (__bridge_retained void *)handle;
-		return sessionHandle;
-	}
-}
-
-void box_apple_http_session_retire(box_apple_http_session_t *session) {
-	if (session == NULL || session->handle == NULL) {
-		return;
-	}
-	BoxAppleHTTPSessionHandle *handle = (__bridge_transfer BoxAppleHTTPSessionHandle *)session->handle;
-	[handle.session finishTasksAndInvalidate];
-	free(session);
-}
-
-void box_apple_http_session_close(box_apple_http_session_t *session) {
-	if (session == NULL || session->handle == NULL) {
-		return;
-	}
-	BoxAppleHTTPSessionHandle *handle = (__bridge_transfer BoxAppleHTTPSessionHandle *)session->handle;
-	[handle.session invalidateAndCancel];
-	free(session);
-}
-
-box_apple_http_task_t *box_apple_http_session_send_async(
-	box_apple_http_session_t *session,
-	const box_apple_http_request_t *request,
-	char **error_out
-) {
-	@autoreleasepool {
-		if (session == NULL || session->handle == NULL || request == NULL || request->method == NULL || request->url == NULL) {
-			box_set_error_string(error_out, @"invalid apple HTTP request");
-			return NULL;
-		}
-		BoxAppleHTTPSessionHandle *handle = (__bridge BoxAppleHTTPSessionHandle *)session->handle;
-		NSURL *requestURL = [NSURL URLWithString:[NSString stringWithUTF8String:request->url]];
-		if (requestURL == nil) {
-			box_set_error_string(error_out, @"invalid request URL");
-			return NULL;
-		}
-		NSMutableURLRequest *urlRequest = [NSMutableURLRequest requestWithURL:requestURL];
-		urlRequest.HTTPMethod = [NSString stringWithUTF8String:request->method];
-		for (size_t index = 0; index < request->header_count; index++) {
-			const char *key = request->header_keys[index];
-			const char *value = request->header_values[index];
-			if (key == NULL || value == NULL) {
-				continue;
-			}
-			[urlRequest addValue:[NSString stringWithUTF8String:value] forHTTPHeaderField:[NSString stringWithUTF8String:key]];
-		}
-		if (request->body != NULL && request->body_len > 0) {
-			urlRequest.HTTPBody = [NSData dataWithBytes:request->body length:request->body_len];
-		}
-		if (request->has_verify_time) {
-			[NSURLProtocol setProperty:@(request->verify_time_unix_millis) forKey:box_apple_http_verify_time_key inRequest:urlRequest];
-		}
-		box_apple_http_task_t *task = calloc(1, sizeof(box_apple_http_task_t));
-		dispatch_semaphore_t doneSemaphore = dispatch_semaphore_create(0);
-		task->done_semaphore = (__bridge_retained void *)doneSemaphore;
-		NSURLSessionDataTask *dataTask = [handle.session dataTaskWithRequest:urlRequest completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
-			if (error != nil) {
-				box_set_error_from_nserror(&task->error, error);
-			} else if (![response isKindOfClass:[NSHTTPURLResponse class]]) {
-				box_set_error_string(&task->error, @"unexpected HTTP response type");
-			} else {
-				task->response = box_create_response((NSHTTPURLResponse *)response, data ?: [NSData data]);
-			}
-			dispatch_semaphore_signal((__bridge dispatch_semaphore_t)task->done_semaphore);
-		}];
-		if (dataTask == nil) {
-			box_set_error_string(error_out, @"create data task");
-			box_apple_http_task_close(task);
-			return NULL;
-		}
-		task->task = (__bridge_retained void *)dataTask;
-		[dataTask resume];
-		return task;
-	}
-}
-
-box_apple_http_response_t *box_apple_http_task_wait(
-	box_apple_http_task_t *task,
-	char **error_out
-) {
-	if (task == NULL || task->done_semaphore == NULL) {
-		box_set_error_string(error_out, @"invalid apple HTTP task");
-		return NULL;
-	}
-	dispatch_semaphore_wait((__bridge dispatch_semaphore_t)task->done_semaphore, DISPATCH_TIME_FOREVER);
-	if (task->error != NULL) {
-		box_set_error_string(error_out, [NSString stringWithUTF8String:task->error]);
-		return NULL;
-	}
-	return task->response;
-}
-
-void box_apple_http_task_cancel(box_apple_http_task_t *task) {
-	if (task == NULL || task->task == NULL) {
-		return;
-	}
-	NSURLSessionTask *nsTask = (__bridge NSURLSessionTask *)task->task;
-	[nsTask cancel];
-}
-
-void box_apple_http_task_close(box_apple_http_task_t *task) {
-	if (task == NULL) {
-		return;
-	}
-	if (task->task != NULL) {
-		__unused NSURLSessionTask *nsTask = (__bridge_transfer NSURLSessionTask *)task->task;
-		task->task = NULL;
-	}
-	if (task->done_semaphore != NULL) {
-		__unused dispatch_semaphore_t doneSemaphore = (__bridge_transfer dispatch_semaphore_t)task->done_semaphore;
-		task->done_semaphore = NULL;
-	}
-	free(task->error);
-	free(task);
-}
-
-void box_apple_http_response_free(box_apple_http_response_t *response) {
-	if (response == NULL) {
-		return;
-	}
-	for (size_t index = 0; index < response->header_count; index++) {
-		free(response->header_keys[index]);
-		free(response->header_values[index]);
-	}
-	free(response->header_keys);
-	free(response->header_values);
-	free(response->body);
-	free(response->error);
-	free(response);
-}
--- a/common/httpclient/apple_transport_darwin_test.go
+++ b/common/httpclient/apple_transport_darwin_test.go
@@ -1,876 +0,0 @@
-//go:build darwin && cgo
-
-package httpclient
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	stdtls "crypto/tls"
-	"crypto/x509"
-	"errors"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"slices"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/sagernet/sing-box/adapter"
-	boxTLS "github.com/sagernet/sing-box/common/tls"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-box/route"
-	"github.com/sagernet/sing/common/json/badoption"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/service"
-)
-
-const appleHTTPTestTimeout = 5 * time.Second
-
-const appleHTTPRecoveryLoops = 5
-
-type appleHTTPTestDialer struct {
-	dialer   net.Dialer
-	listener net.ListenConfig
-	hostMap  map[string]string
-}
-
-type appleHTTPObservedRequest struct {
-	method     string
-	body       string
-	host       string
-	values     []string
-	protoMajor int
-}
-
-type appleHTTPTestServer struct {
-	server         *httptest.Server
-	baseURL        string
-	dialHost       string
-	certificate    stdtls.Certificate
-	certificatePEM string
-	publicKeyHash  []byte
-}
-
-func TestNewAppleSessionConfig(t *testing.T) {
-	serverCertificate, serverCertificatePEM := newAppleHTTPTestCertificate(t, "localhost")
-	serverHash := certificatePublicKeySHA256(t, serverCertificate.Certificate[0])
-	otherHash := bytes.Repeat([]byte{0x7f}, applePinnedHashSize)
-
-	testCases := []struct {
-		name    string
-		options option.HTTPClientOptions
-		check   func(t *testing.T, config appleSessionConfig)
-		wantErr string
-	}{
-		{
-			name: "success with certificate anchors",
-			options: option.HTTPClientOptions{
-				Version: 2,
-				DialerOptions: option.DialerOptions{
-					ConnectTimeout: badoption.Duration(2 * time.Second),
-				},
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						Enabled:     true,
-						ServerName:  "localhost",
-						MinVersion:  "1.2",
-						MaxVersion:  "1.3",
-						Certificate: badoption.Listable[string]{serverCertificatePEM},
-					},
-				},
-			},
-			check: func(t *testing.T, config appleSessionConfig) {
-				t.Helper()
-				if config.serverName != "localhost" {
-					t.Fatalf("unexpected server name: %q", config.serverName)
-				}
-				if config.minVersion != stdtls.VersionTLS12 {
-					t.Fatalf("unexpected min version: %x", config.minVersion)
-				}
-				if config.maxVersion != stdtls.VersionTLS13 {
-					t.Fatalf("unexpected max version: %x", config.maxVersion)
-				}
-				if config.insecure {
-					t.Fatal("unexpected insecure flag")
-				}
-				if !config.anchorOnly {
-					t.Fatal("expected anchor_only")
-				}
-				if !strings.Contains(config.anchorPEM, "BEGIN CERTIFICATE") {
-					t.Fatalf("unexpected anchor pem: %q", config.anchorPEM)
-				}
-				if len(config.pinnedPublicKeySHA256s) != 0 {
-					t.Fatalf("unexpected pinned hashes: %d", len(config.pinnedPublicKeySHA256s))
-				}
-			},
-		},
-		{
-			name: "success with flattened pins",
-			options: option.HTTPClientOptions{
-				Version: 2,
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						Enabled:                    true,
-						Insecure:                   true,
-						CertificatePublicKeySHA256: badoption.Listable[[]byte]{serverHash, otherHash},
-					},
-				},
-			},
-			check: func(t *testing.T, config appleSessionConfig) {
-				t.Helper()
-				if !config.insecure {
-					t.Fatal("expected insecure flag")
-				}
-				if len(config.pinnedPublicKeySHA256s) != 2*applePinnedHashSize {
-					t.Fatalf("unexpected flattened pin length: %d", len(config.pinnedPublicKeySHA256s))
-				}
-				if !bytes.Equal(config.pinnedPublicKeySHA256s[:applePinnedHashSize], serverHash) {
-					t.Fatal("unexpected first pin")
-				}
-				if !bytes.Equal(config.pinnedPublicKeySHA256s[applePinnedHashSize:], otherHash) {
-					t.Fatal("unexpected second pin")
-				}
-				if config.anchorPEM != "" {
-					t.Fatalf("unexpected anchor pem: %q", config.anchorPEM)
-				}
-				if config.anchorOnly {
-					t.Fatal("unexpected anchor_only")
-				}
-			},
-		},
-		{
-			name:    "http11 unsupported",
-			options: option.HTTPClientOptions{Version: 1},
-			wantErr: "HTTP/1.1 is unsupported in Apple HTTP engine",
-		},
-		{
-			name:    "http3 unsupported",
-			options: option.HTTPClientOptions{Version: 3},
-			wantErr: "HTTP/3 is unsupported in Apple HTTP engine",
-		},
-		{
-			name:    "unknown version",
-			options: option.HTTPClientOptions{Version: 9},
-			wantErr: "unknown HTTP version: 9",
-		},
-		{
-			name: "disable version fallback unsupported",
-			options: option.HTTPClientOptions{
-				DisableVersionFallback: true,
-			},
-			wantErr: "disable_version_fallback is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "http2 options unsupported",
-			options: option.HTTPClientOptions{
-				HTTP2Options: option.HTTP2Options{
-					IdleTimeout: badoption.Duration(time.Second),
-				},
-			},
-			wantErr: "HTTP/2 options are unsupported in Apple HTTP engine",
-		},
-		{
-			name: "quic options unsupported",
-			options: option.HTTPClientOptions{
-				HTTP3Options: option.QUICOptions{
-					InitialPacketSize: 1200,
-				},
-			},
-			wantErr: "QUIC options are unsupported in Apple HTTP engine",
-		},
-		{
-			name: "tls engine unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{Engine: "go"},
-				},
-			},
-			wantErr: "tls.engine is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "disable sni unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{DisableSNI: true},
-				},
-			},
-			wantErr: "disable_sni is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "alpn unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						ALPN: badoption.Listable[string]{"h2"},
-					},
-				},
-			},
-			wantErr: "tls.alpn is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "cipher suites unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						CipherSuites: badoption.Listable[string]{"TLS_AES_128_GCM_SHA256"},
-					},
-				},
-			},
-			wantErr: "cipher_suites is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "curve preferences unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						CurvePreferences: badoption.Listable[option.CurvePreference]{option.CurvePreference(option.X25519)},
-					},
-				},
-			},
-			wantErr: "curve_preferences is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "client certificate unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						ClientCertificate: badoption.Listable[string]{"client-certificate"},
-						ClientKey:         badoption.Listable[string]{"client-key"},
-					},
-				},
-			},
-			wantErr: "client certificate is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "tls fragment unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{Fragment: true},
-				},
-			},
-			wantErr: "tls fragment is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "ktls unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{KernelTx: true},
-				},
-			},
-			wantErr: "ktls is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "ech unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						ECH: &option.OutboundECHOptions{Enabled: true},
-					},
-				},
-			},
-			wantErr: "ech is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "utls unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						UTLS: &option.OutboundUTLSOptions{Enabled: true},
-					},
-				},
-			},
-			wantErr: "utls is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "reality unsupported",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						Reality: &option.OutboundRealityOptions{Enabled: true},
-					},
-				},
-			},
-			wantErr: "reality is unsupported in Apple HTTP engine",
-		},
-		{
-			name: "pin and certificate conflict",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						Certificate:                badoption.Listable[string]{serverCertificatePEM},
-						CertificatePublicKeySHA256: badoption.Listable[[]byte]{serverHash},
-					},
-				},
-			},
-			wantErr: "certificate_public_key_sha256 is conflict with certificate or certificate_path",
-		},
-		{
-			name: "invalid min version",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{MinVersion: "bogus"},
-				},
-			},
-			wantErr: "parse min_version",
-		},
-		{
-			name: "invalid max version",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{MaxVersion: "bogus"},
-				},
-			},
-			wantErr: "parse max_version",
-		},
-		{
-			name: "invalid pin length",
-			options: option.HTTPClientOptions{
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						CertificatePublicKeySHA256: badoption.Listable[[]byte]{{0x01, 0x02}},
-					},
-				},
-			},
-			wantErr: "invalid certificate_public_key_sha256 length: 2",
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			config, err := newAppleSessionConfig(context.Background(), testCase.options)
-			if testCase.wantErr != "" {
-				if err == nil {
-					t.Fatal("expected error")
-				}
-				if !strings.Contains(err.Error(), testCase.wantErr) {
-					t.Fatalf("unexpected error: %v", err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			if testCase.check != nil {
-				testCase.check(t, config)
-			}
-		})
-	}
-}
-
-func TestAppleTransportVerifyPublicKeySHA256(t *testing.T) {
-	serverCertificate, _ := newAppleHTTPTestCertificate(t, "localhost")
-	goodHash := certificatePublicKeySHA256(t, serverCertificate.Certificate[0])
-	badHash := append([]byte(nil), goodHash...)
-	badHash[0] ^= 0xff
-
-	err := verifyApplePinnedPublicKeySHA256(goodHash, serverCertificate.Certificate[0])
-	if err != nil {
-		t.Fatalf("expected correct pin to succeed: %v", err)
-	}
-
-	err = verifyApplePinnedPublicKeySHA256(badHash, serverCertificate.Certificate[0])
-	if err == nil {
-		t.Fatal("expected incorrect pin to fail")
-	}
-	if !strings.Contains(err.Error(), "unrecognized remote public key") {
-		t.Fatalf("unexpected pin mismatch error: %v", err)
-	}
-
-	err = verifyApplePinnedPublicKeySHA256(goodHash[:applePinnedHashSize-1], serverCertificate.Certificate[0])
-	if err == nil {
-		t.Fatal("expected malformed pin list to fail")
-	}
-	if !strings.Contains(err.Error(), "invalid pinned public key list") {
-		t.Fatalf("unexpected malformed pin error: %v", err)
-	}
-}
-
-func TestAppleTransportRoundTripHTTPS(t *testing.T) {
-	requests := make(chan appleHTTPObservedRequest, 1)
-	server := startAppleHTTPTestServer(t, func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		if err != nil {
-			t.Error(err)
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-		requests <- appleHTTPObservedRequest{
-			method:     r.Method,
-			body:       string(body),
-			host:       r.Host,
-			values:     append([]string(nil), r.Header.Values("X-Test")...),
-			protoMajor: r.ProtoMajor,
-		}
-		w.Header().Set("X-Reply", "apple")
-		w.WriteHeader(http.StatusCreated)
-		_, _ = w.Write([]byte("response body"))
-	})
-
-	transport := newAppleHTTPTestTransport(t, server, option.HTTPClientOptions{
-		Version: 2,
-		OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-			TLS: appleHTTPServerTLSOptions(server),
-		},
-	})
-
-	request, err := http.NewRequest(http.MethodPost, server.URL("/roundtrip"), bytes.NewReader([]byte("request body")))
-	if err != nil {
-		t.Fatal(err)
-	}
-	request.Header.Add("X-Test", "one")
-	request.Header.Add("X-Test", "two")
-	request.Host = "custom.example"
-
-	response, err := transport.RoundTrip(request)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer response.Body.Close()
-
-	responseBody := readResponseBody(t, response)
-	if response.StatusCode != http.StatusCreated {
-		t.Fatalf("unexpected status code: %d", response.StatusCode)
-	}
-	if response.Status != "201 Created" {
-		t.Fatalf("unexpected status: %q", response.Status)
-	}
-	if response.Header.Get("X-Reply") != "apple" {
-		t.Fatalf("unexpected response header: %q", response.Header.Get("X-Reply"))
-	}
-	if responseBody != "response body" {
-		t.Fatalf("unexpected response body: %q", responseBody)
-	}
-	if response.ContentLength != int64(len(responseBody)) {
-		t.Fatalf("unexpected content length: %d", response.ContentLength)
-	}
-
-	observed := waitObservedRequest(t, requests)
-	if observed.method != http.MethodPost {
-		t.Fatalf("unexpected method: %q", observed.method)
-	}
-	if observed.body != "request body" {
-		t.Fatalf("unexpected request body: %q", observed.body)
-	}
-	if observed.host != "custom.example" {
-		t.Fatalf("unexpected host: %q", observed.host)
-	}
-	if observed.protoMajor != 2 {
-		t.Fatalf("expected HTTP/2 request, got HTTP/%d", observed.protoMajor)
-	}
-	var normalizedValues []string
-	for _, value := range observed.values {
-		for _, part := range strings.Split(value, ",") {
-			normalizedValues = append(normalizedValues, strings.TrimSpace(part))
-		}
-	}
-	slices.Sort(normalizedValues)
-	if !slices.Equal(normalizedValues, []string{"one", "two"}) {
-		t.Fatalf("unexpected header values: %#v", observed.values)
-	}
-}
-
-func TestAppleTransportPinnedPublicKey(t *testing.T) {
-	server := startAppleHTTPTestServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("pinned"))
-	})
-
-	goodTransport := newAppleHTTPTestTransport(t, server, option.HTTPClientOptions{
-		Version: 2,
-		OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-			TLS: &option.OutboundTLSOptions{
-				Enabled:                    true,
-				ServerName:                 "localhost",
-				Insecure:                   true,
-				CertificatePublicKeySHA256: badoption.Listable[[]byte]{server.publicKeyHash},
-			},
-		},
-	})
-
-	response, err := goodTransport.RoundTrip(newAppleHTTPRequest(t, http.MethodGet, server.URL("/good"), nil))
-	if err != nil {
-		t.Fatalf("expected pinned request to succeed: %v", err)
-	}
-	response.Body.Close()
-
-	badHash := append([]byte(nil), server.publicKeyHash...)
-	badHash[0] ^= 0xff
-	badTransport := newAppleHTTPTestTransport(t, server, option.HTTPClientOptions{
-		Version: 2,
-		OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-			TLS: &option.OutboundTLSOptions{
-				Enabled:                    true,
-				ServerName:                 "localhost",
-				Insecure:                   true,
-				CertificatePublicKeySHA256: badoption.Listable[[]byte]{badHash},
-			},
-		},
-	})
-
-	response, err = badTransport.RoundTrip(newAppleHTTPRequest(t, http.MethodGet, server.URL("/bad"), nil))
-	if err == nil {
-		response.Body.Close()
-		t.Fatal("expected incorrect pinned public key to fail")
-	}
-}
-
-func TestAppleTransportGuardrails(t *testing.T) {
-	testCases := []struct {
-		name          string
-		options       option.HTTPClientOptions
-		buildRequest  func(t *testing.T) *http.Request
-		wantErrSubstr string
-	}{
-		{
-			name: "websocket upgrade rejected",
-			options: option.HTTPClientOptions{
-				Version: 2,
-			},
-			buildRequest: func(t *testing.T) *http.Request {
-				t.Helper()
-				request := newAppleHTTPRequest(t, http.MethodGet, "https://localhost/socket", nil)
-				request.Header.Set("Connection", "Upgrade")
-				request.Header.Set("Upgrade", "websocket")
-				return request
-			},
-			wantErrSubstr: "HTTP upgrade requests are unsupported in Apple HTTP engine",
-		},
-		{
-			name: "missing url rejected",
-			options: option.HTTPClientOptions{
-				Version: 2,
-			},
-			buildRequest: func(t *testing.T) *http.Request {
-				t.Helper()
-				return &http.Request{Method: http.MethodGet}
-			},
-			wantErrSubstr: "missing request URL",
-		},
-		{
-			name: "unsupported scheme rejected",
-			options: option.HTTPClientOptions{
-				Version: 2,
-			},
-			buildRequest: func(t *testing.T) *http.Request {
-				t.Helper()
-				return newAppleHTTPRequest(t, http.MethodGet, "ftp://localhost/file", nil)
-			},
-			wantErrSubstr: "unsupported URL scheme: ftp",
-		},
-		{
-			name: "server name mismatch rejected",
-			options: option.HTTPClientOptions{
-				Version: 2,
-				OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-					TLS: &option.OutboundTLSOptions{
-						Enabled:    true,
-						ServerName: "example.com",
-					},
-				},
-			},
-			buildRequest: func(t *testing.T) *http.Request {
-				t.Helper()
-				return newAppleHTTPRequest(t, http.MethodGet, "https://localhost/path", nil)
-			},
-			wantErrSubstr: "tls.server_name is unsupported in Apple HTTP engine unless it matches request host",
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			transport := newAppleHTTPTestTransport(t, nil, testCase.options)
-			response, err := transport.RoundTrip(testCase.buildRequest(t))
-			if err == nil {
-				response.Body.Close()
-				t.Fatal("expected error")
-			}
-			if !strings.Contains(err.Error(), testCase.wantErrSubstr) {
-				t.Fatalf("unexpected error: %v", err)
-			}
-		})
-	}
-}
-
-func TestAppleTransportCancellationRecovery(t *testing.T) {
-	server := startAppleHTTPTestServer(t, func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/block":
-			select {
-			case <-r.Context().Done():
-				return
-			case <-time.After(appleHTTPTestTimeout):
-				http.Error(w, "request was not canceled", http.StatusGatewayTimeout)
-			}
-		default:
-			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write([]byte("ok"))
-		}
-	})
-
-	transport := newAppleHTTPTestTransport(t, server, option.HTTPClientOptions{
-		Version: 2,
-		OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-			TLS: appleHTTPServerTLSOptions(server),
-		},
-	})
-
-	for index := 0; index < appleHTTPRecoveryLoops; index++ {
-		ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-		request := newAppleHTTPRequestWithContext(t, ctx, http.MethodGet, server.URL("/block"), nil)
-		response, err := transport.RoundTrip(request)
-		cancel()
-		if err == nil {
-			response.Body.Close()
-			t.Fatalf("iteration %d: expected cancellation error", index)
-		}
-		if !errors.Is(err, context.DeadlineExceeded) && !errors.Is(err, context.Canceled) {
-			t.Fatalf("iteration %d: unexpected cancellation error: %v", index, err)
-		}
-
-		response, err = transport.RoundTrip(newAppleHTTPRequest(t, http.MethodGet, server.URL("/ok"), nil))
-		if err != nil {
-			t.Fatalf("iteration %d: follow-up request failed: %v", index, err)
-		}
-		if body := readResponseBody(t, response); body != "ok" {
-			response.Body.Close()
-			t.Fatalf("iteration %d: unexpected follow-up body: %q", index, body)
-		}
-		response.Body.Close()
-	}
-}
-
-func TestAppleTransportLifecycle(t *testing.T) {
-	server := startAppleHTTPTestServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("ok"))
-	})
-
-	transport := newAppleHTTPTestTransport(t, server, option.HTTPClientOptions{
-		Version: 2,
-		OutboundTLSOptionsContainer: option.OutboundTLSOptionsContainer{
-			TLS: appleHTTPServerTLSOptions(server),
-		},
-	})
-	clone := transport.Clone()
-	t.Cleanup(func() {
-		_ = clone.Close()
-	})
-
-	assertAppleHTTPSucceeds(t, transport, server.URL("/original"))
-	assertAppleHTTPSucceeds(t, clone, server.URL("/clone"))
-
-	transport.CloseIdleConnections()
-	assertAppleHTTPSucceeds(t, transport, server.URL("/reset"))
-
-	if err := transport.Close(); err != nil {
-		t.Fatal(err)
-	}
-
-	response, err := transport.RoundTrip(newAppleHTTPRequest(t, http.MethodGet, server.URL("/closed"), nil))
-	if err == nil {
-		response.Body.Close()
-		t.Fatal("expected closed transport to fail")
-	}
-	if !errors.Is(err, net.ErrClosed) {
-		t.Fatalf("unexpected closed transport error: %v", err)
-	}
-
-	assertAppleHTTPSucceeds(t, clone, server.URL("/clone-after-original-close"))
-
-	clone.CloseIdleConnections()
-	assertAppleHTTPSucceeds(t, clone, server.URL("/clone-reset"))
-
-	if err := clone.Close(); err != nil {
-		t.Fatal(err)
-	}
-	response, err = clone.RoundTrip(newAppleHTTPRequest(t, http.MethodGet, server.URL("/clone-closed"), nil))
-	if err == nil {
-		response.Body.Close()
-		t.Fatal("expected closed clone to fail")
-	}
-	if !errors.Is(err, net.ErrClosed) {
-		t.Fatalf("unexpected closed clone error: %v", err)
-	}
-}
-
-func startAppleHTTPTestServer(t *testing.T, handler http.HandlerFunc) *appleHTTPTestServer {
-	t.Helper()
-
-	serverCertificate, serverCertificatePEM := newAppleHTTPTestCertificate(t, "localhost")
-	server := httptest.NewUnstartedServer(handler)
-	server.EnableHTTP2 = true
-	server.TLS = &stdtls.Config{
-		Certificates: []stdtls.Certificate{serverCertificate},
-		MinVersion:   stdtls.VersionTLS12,
-	}
-	server.StartTLS()
-	t.Cleanup(server.Close)
-
-	parsedURL, err := url.Parse(server.URL)
-	if err != nil {
-		t.Fatal(err)
-	}
-	baseURL := *parsedURL
-	baseURL.Host = net.JoinHostPort("localhost", parsedURL.Port())
-
-	return &appleHTTPTestServer{
-		server:         server,
-		baseURL:        baseURL.String(),
-		dialHost:       parsedURL.Hostname(),
-		certificate:    serverCertificate,
-		certificatePEM: serverCertificatePEM,
-		publicKeyHash:  certificatePublicKeySHA256(t, serverCertificate.Certificate[0]),
-	}
-}
-
-func (s *appleHTTPTestServer) URL(path string) string {
-	if path == "" {
-		return s.baseURL
-	}
-	if strings.HasPrefix(path, "/") {
-		return s.baseURL + path
-	}
-	return s.baseURL + "/" + path
-}
-
-func newAppleHTTPTestTransport(t *testing.T, server *appleHTTPTestServer, options option.HTTPClientOptions) adapter.HTTPTransport {
-	t.Helper()
-
-	ctx := service.ContextWith[adapter.ConnectionManager](
-		context.Background(),
-		route.NewConnectionManager(log.NewNOPFactory().NewLogger("connection")),
-	)
-	dialer := &appleHTTPTestDialer{
-		hostMap: make(map[string]string),
-	}
-	if server != nil {
-		dialer.hostMap["localhost"] = server.dialHost
-	}
-
-	transport, err := newAppleTransport(ctx, log.NewNOPFactory().NewLogger("httpclient"), dialer, options)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		_ = transport.Close()
-	})
-	return transport
-}
-
-func (d *appleHTTPTestDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	host := destination.AddrString()
-	if destination.IsDomain() {
-		host = destination.Fqdn
-		if mappedHost, loaded := d.hostMap[host]; loaded {
-			host = mappedHost
-		}
-	}
-	return d.dialer.DialContext(ctx, network, net.JoinHostPort(host, strconv.Itoa(int(destination.Port))))
-}
-
-func (d *appleHTTPTestDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	host := destination.AddrString()
-	if destination.IsDomain() {
-		host = destination.Fqdn
-		if mappedHost, loaded := d.hostMap[host]; loaded {
-			host = mappedHost
-		}
-	}
-	if host == "" {
-		host = "127.0.0.1"
-	}
-	return d.listener.ListenPacket(ctx, N.NetworkUDP, net.JoinHostPort(host, strconv.Itoa(int(destination.Port))))
-}
-
-func newAppleHTTPTestCertificate(t *testing.T, serverName string) (stdtls.Certificate, string) {
-	t.Helper()
-
-	privateKeyPEM, certificatePEM, err := boxTLS.GenerateCertificate(nil, nil, time.Now, serverName, time.Now().Add(time.Hour))
-	if err != nil {
-		t.Fatal(err)
-	}
-	certificate, err := stdtls.X509KeyPair(certificatePEM, privateKeyPEM)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return certificate, string(certificatePEM)
-}
-
-func certificatePublicKeySHA256(t *testing.T, certificateDER []byte) []byte {
-	t.Helper()
-
-	certificate, err := x509.ParseCertificate(certificateDER)
-	if err != nil {
-		t.Fatal(err)
-	}
-	publicKeyDER, err := x509.MarshalPKIXPublicKey(certificate.PublicKey)
-	if err != nil {
-		t.Fatal(err)
-	}
-	hashValue := sha256.Sum256(publicKeyDER)
-	return append([]byte(nil), hashValue[:]...)
-}
-
-func appleHTTPServerTLSOptions(server *appleHTTPTestServer) *option.OutboundTLSOptions {
-	return &option.OutboundTLSOptions{
-		Enabled:     true,
-		ServerName:  "localhost",
-		Certificate: badoption.Listable[string]{server.certificatePEM},
-	}
-}
-
-func newAppleHTTPRequest(t *testing.T, method string, rawURL string, body []byte) *http.Request {
-	t.Helper()
-	return newAppleHTTPRequestWithContext(t, context.Background(), method, rawURL, body)
-}
-
-func newAppleHTTPRequestWithContext(t *testing.T, ctx context.Context, method string, rawURL string, body []byte) *http.Request {
-	t.Helper()
-	request, err := http.NewRequestWithContext(ctx, method, rawURL, bytes.NewReader(body))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return request
-}
-
-func waitObservedRequest(t *testing.T, requests <-chan appleHTTPObservedRequest) appleHTTPObservedRequest {
-	t.Helper()
-
-	select {
-	case request := <-requests:
-		return request
-	case <-time.After(appleHTTPTestTimeout):
-		t.Fatal("timed out waiting for observed request")
-		return appleHTTPObservedRequest{}
-	}
-}
-
-func readResponseBody(t *testing.T, response *http.Response) string {
-	t.Helper()
-
-	body, err := io.ReadAll(response.Body)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return string(body)
-}
-
-func assertAppleHTTPSucceeds(t *testing.T, transport adapter.HTTPTransport, rawURL string) {
-	t.Helper()
-
-	response, err := transport.RoundTrip(newAppleHTTPRequest(t, http.MethodGet, rawURL, nil))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer response.Body.Close()
-	if body := readResponseBody(t, response); body != "ok" {
-		t.Fatalf("unexpected response body: %q", body)
-	}
-}
--- a/common/httpclient/apple_transport_stub.go
+++ b/common/httpclient/apple_transport_stub.go
@@ -1,17 +0,0 @@
-//go:build !darwin || !cgo
-
-package httpclient
-
-import (
-	"context"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func newAppleTransport(ctx context.Context, logger logger.ContextLogger, rawDialer N.Dialer, options option.HTTPClientOptions) (adapter.HTTPTransport, error) {
-	return nil, E.New("Apple HTTP engine is not available on non-Apple platforms")
-}
--- a/common/httpclient/client.go
+++ b/common/httpclient/client.go
@@ -1,197 +0,0 @@
-package httpclient
-
-import (
-	"context"
-	"net/http"
-	"time"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/dialer"
-	"github.com/sagernet/sing-box/common/tls"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-	N "github.com/sagernet/sing/common/network"
-)
-
-type Transport struct {
-	transport adapter.HTTPTransport
-	dialer    N.Dialer
-	headers   http.Header
-	host      string
-	tag       string
-}
-
-func NewTransport(ctx context.Context, logger logger.ContextLogger, tag string, options option.HTTPClientOptions) (*Transport, error) {
-	rawDialer, err := dialer.NewWithOptions(dialer.Options{
-		Context:          ctx,
-		Options:          options.DialerOptions,
-		RemoteIsDomain:   true,
-		DirectResolver:   options.DirectResolver,
-		ResolverOnDetour: options.ResolveOnDetour,
-		NewDialer:        options.ResolveOnDetour,
-		DefaultOutbound:  options.DefaultOutbound,
-	})
-	if err != nil {
-		return nil, err
-	}
-	switch options.Engine {
-	case C.TLSEngineApple:
-		transport, transportErr := newAppleTransport(ctx, logger, rawDialer, options)
-		if transportErr != nil {
-			return nil, transportErr
-		}
-		headers := options.Headers.Build()
-		host := headers.Get("Host")
-		headers.Del("Host")
-		return &Transport{
-			transport: transport,
-			dialer:    rawDialer,
-			headers:   headers,
-			host:      host,
-			tag:       tag,
-		}, nil
-	case C.TLSEngineCronet:
-		transport, transportErr := newCronetTransport(ctx, logger, rawDialer, options)
-		if transportErr != nil {
-			return nil, transportErr
-		}
-		headers := options.Headers.Build()
-		host := headers.Get("Host")
-		headers.Del("Host")
-		return &Transport{
-			transport: transport,
-			dialer:    rawDialer,
-			headers:   headers,
-			host:      host,
-			tag:       tag,
-		}, nil
-	case C.TLSEngineDefault, "go":
-	default:
-		return nil, E.New("unknown HTTP engine: ", options.Engine)
-	}
-	tlsOptions := common.PtrValueOrDefault(options.TLS)
-	tlsOptions.Enabled = true
-	baseTLSConfig, err := tls.NewClientWithOptions(tls.ClientOptions{
-		Context:              ctx,
-		Logger:               logger,
-		Options:              tlsOptions,
-		AllowEmptyServerName: true,
-	})
-	if err != nil {
-		return nil, err
-	}
-	return NewTransportWithDialer(rawDialer, baseTLSConfig, tag, options)
-}
-
-func NewTransportWithDialer(rawDialer N.Dialer, baseTLSConfig tls.Config, tag string, options option.HTTPClientOptions) (*Transport, error) {
-	transport, err := newTransport(rawDialer, baseTLSConfig, options)
-	if err != nil {
-		return nil, err
-	}
-	headers := options.Headers.Build()
-	host := headers.Get("Host")
-	headers.Del("Host")
-	return &Transport{
-		transport: transport,
-		dialer:    rawDialer,
-		headers:   headers,
-		host:      host,
-		tag:       tag,
-	}, nil
-}
-
-func newTransport(rawDialer N.Dialer, baseTLSConfig tls.Config, options option.HTTPClientOptions) (adapter.HTTPTransport, error) {
-	version := options.Version
-	if version == 0 {
-		version = 2
-	}
-	fallbackDelay := time.Duration(options.DialerOptions.FallbackDelay)
-	if fallbackDelay == 0 {
-		fallbackDelay = 300 * time.Millisecond
-	}
-	var transport adapter.HTTPTransport
-	var err error
-	switch version {
-	case 1:
-		transport = newHTTP1Transport(rawDialer, baseTLSConfig)
-	case 2:
-		if options.DisableVersionFallback {
-			transport, err = newHTTP2Transport(rawDialer, baseTLSConfig, options.HTTP2Options)
-		} else {
-			transport, err = newHTTP2FallbackTransport(rawDialer, baseTLSConfig, options.HTTP2Options)
-		}
-	case 3:
-		if baseTLSConfig != nil {
-			_, err = baseTLSConfig.STDConfig()
-			if err != nil {
-				return nil, err
-			}
-		}
-		if options.DisableVersionFallback {
-			transport, err = newHTTP3Transport(rawDialer, baseTLSConfig, options.HTTP3Options)
-		} else {
-			var h2Fallback adapter.HTTPTransport
-			h2Fallback, err = newHTTP2FallbackTransport(rawDialer, baseTLSConfig, options.HTTP2Options)
-			if err != nil {
-				return nil, err
-			}
-			transport, err = newHTTP3FallbackTransport(rawDialer, baseTLSConfig, h2Fallback, options.HTTP3Options, fallbackDelay)
-		}
-	default:
-		return nil, E.New("unknown HTTP version: ", version)
-	}
-	if err != nil {
-		return nil, err
-	}
-	return transport, nil
-}
-
-func (c *Transport) RoundTrip(request *http.Request) (*http.Response, error) {
-	if c.tag == "" && len(c.headers) == 0 && c.host == "" {
-		return c.transport.RoundTrip(request)
-	}
-	if c.tag != "" {
-		if transportTag, loaded := transportTagFromContext(request.Context()); loaded && transportTag == c.tag {
-			return nil, E.New("HTTP request loopback in transport[", c.tag, "]")
-		}
-		request = request.Clone(contextWithTransportTag(request.Context(), c.tag))
-	} else {
-		request = request.Clone(request.Context())
-	}
-	applyHeaders(request, c.headers, c.host)
-	return c.transport.RoundTrip(request)
-}
-
-func (c *Transport) CloseIdleConnections() {
-	c.transport.CloseIdleConnections()
-}
-
-func (c *Transport) Clone() adapter.HTTPTransport {
-	return &Transport{
-		transport: c.transport.Clone(),
-		dialer:    c.dialer,
-		headers:   c.headers.Clone(),
-		host:      c.host,
-		tag:       c.tag,
-	}
-}
-
-func (c *Transport) Close() error {
-	return c.transport.Close()
-}
-
-// InitializeDetour eagerly resolves the detour dialer backing transport so that
-// detour misconfigurations surface at startup instead of on the first request.
-func InitializeDetour(transport adapter.HTTPTransport) error {
-	if shared, isShared := transport.(*sharedTransport); isShared {
-		transport = shared.HTTPTransport
-	}
-	inner, isInner := transport.(*Transport)
-	if !isInner {
-		return nil
-	}
-	return dialer.InitializeDetour(inner.dialer)
-}
--- a/common/httpclient/context.go
+++ b/common/httpclient/context.go
@@ -1,14 +0,0 @@
-package httpclient
-
-import "context"
-
-type transportKey struct{}
-
-func contextWithTransportTag(ctx context.Context, transportTag string) context.Context {
-	return context.WithValue(ctx, transportKey{}, transportTag)
-}
-
-func transportTagFromContext(ctx context.Context) (string, bool) {
-	value, loaded := ctx.Value(transportKey{}).(string)
-	return value, loaded
-}
--- a/common/httpclient/cronet_transport_stub.go
+++ b/common/httpclient/cronet_transport_stub.go
@@ -1,17 +0,0 @@
-//go:build !with_naive_outbound
-
-package httpclient
-
-import (
-	"context"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func newCronetTransport(ctx context.Context, logger logger.ContextLogger, rawDialer N.Dialer, options option.HTTPClientOptions) (adapter.HTTPTransport, error) {
-	return nil, E.New("Cronet HTTP engine is not available on current platform/build")
-}
--- a/common/httpclient/cronet_transport_supported.go
+++ b/common/httpclient/cronet_transport_supported.go
@@ -1,249 +0,0 @@
-//go:build with_naive_outbound
-
-package httpclient
-
-import (
-	"context"
-	"encoding/pem"
-	"net/http"
-	"os"
-	"strings"
-	"sync/atomic"
-	"time"
-
-	"github.com/sagernet/cronet-go"
-	_ "github.com/sagernet/cronet-go/all"
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/dialer"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	singLogger "github.com/sagernet/sing/common/logger"
-	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/service"
-
-	mDNS "github.com/miekg/dns"
-)
-
-type cronetTransportShared struct {
-	roundTripper *cronet.RoundTripper
-	refs         atomic.Int32
-}
-
-type cronetTransport struct {
-	shared *cronetTransportShared
-}
-
-func newCronetTransport(ctx context.Context, logger singLogger.ContextLogger, rawDialer N.Dialer, options option.HTTPClientOptions) (adapter.HTTPTransport, error) {
-	version := options.Version
-	if version == 0 {
-		version = 2
-	}
-	switch version {
-	case 1, 2, 3:
-	default:
-		return nil, E.New("unknown HTTP version: ", version)
-	}
-	if options.DisableVersionFallback && version != 3 {
-		return nil, E.New("disable_version_fallback is unsupported in Cronet HTTP engine unless version is 3")
-	}
-	switch version {
-	case 1:
-		if options.HTTP2Options != (option.HTTP2Options{}) {
-			return nil, E.New("HTTP/2 options are unsupported in Cronet HTTP engine for HTTP/1.1")
-		}
-		if options.HTTP3Options != (option.QUICOptions{}) {
-			return nil, E.New("QUIC options are unsupported in Cronet HTTP engine for HTTP/1.1")
-		}
-	case 2:
-		if options.HTTP2Options.IdleTimeout != 0 ||
-			options.HTTP2Options.KeepAlivePeriod != 0 ||
-			options.HTTP2Options.MaxConcurrentStreams > 0 {
-			return nil, E.New("selected HTTP/2 options are unsupported in Cronet HTTP engine")
-		}
-	case 3:
-		if options.HTTP3Options.KeepAlivePeriod != 0 ||
-			options.HTTP3Options.InitialPacketSize > 0 ||
-			options.HTTP3Options.DisablePathMTUDiscovery ||
-			options.HTTP3Options.MaxConcurrentStreams > 0 {
-			return nil, E.New("selected QUIC options are unsupported in Cronet HTTP engine")
-		}
-	}
-
-	tlsOptions := common.PtrValueOrDefault(options.TLS)
-	if tlsOptions.Engine != "" {
-		return nil, E.New("tls.engine is unsupported in Cronet HTTP engine")
-	}
-	if tlsOptions.DisableSNI {
-		return nil, E.New("disable_sni is unsupported in Cronet HTTP engine")
-	}
-	if tlsOptions.Insecure {
-		return nil, E.New("tls.insecure is unsupported in Cronet HTTP engine")
-	}
-	if len(tlsOptions.ALPN) > 0 {
-		return nil, E.New("tls.alpn is unsupported in Cronet HTTP engine")
-	}
-	if tlsOptions.MinVersion != "" || tlsOptions.MaxVersion != "" {
-		return nil, E.New("tls.min_version/max_version is unsupported in Cronet HTTP engine")
-	}
-	if len(tlsOptions.CipherSuites) > 0 {
-		return nil, E.New("cipher_suites is unsupported in Cronet HTTP engine")
-	}
-	if len(tlsOptions.CurvePreferences) > 0 {
-		return nil, E.New("curve_preferences is unsupported in Cronet HTTP engine")
-	}
-	if len(tlsOptions.ClientCertificate) > 0 || len(tlsOptions.ClientCertificatePath) > 0 {
-		return nil, E.New("client certificate is unsupported in Cronet HTTP engine")
-	}
-	if len(tlsOptions.ClientKey) > 0 || tlsOptions.ClientKeyPath != "" {
-		return nil, E.New("client key is unsupported in Cronet HTTP engine")
-	}
-	if tlsOptions.Fragment || tlsOptions.RecordFragment {
-		return nil, E.New("tls fragment is unsupported in Cronet HTTP engine")
-	}
-	if tlsOptions.KernelTx || tlsOptions.KernelRx {
-		return nil, E.New("ktls is unsupported in Cronet HTTP engine")
-	}
-	if tlsOptions.HandshakeTimeout != 0 {
-		return nil, E.New("tls.handshake_timeout is unsupported in Cronet HTTP engine")
-	}
-	if tlsOptions.UTLS != nil && tlsOptions.UTLS.Enabled {
-		return nil, E.New("utls is unsupported in Cronet HTTP engine")
-	}
-	if tlsOptions.Reality != nil && tlsOptions.Reality.Enabled {
-		return nil, E.New("reality is unsupported in Cronet HTTP engine")
-	}
-
-	trustedRootCertificates, err := readCronetRootCertificates(tlsOptions)
-	if err != nil {
-		return nil, err
-	}
-
-	echEnabled, echConfigList, echQueryServerName, err := readCronetECH(tlsOptions)
-	if err != nil {
-		return nil, err
-	}
-
-	dnsResolver := newCronetDNSResolver(ctx, logger, rawDialer)
-	if echEnabled && dnsResolver == nil {
-		return nil, E.New("ECH requires a configured DNS resolver in Cronet HTTP engine")
-	}
-
-	roundTripper, err := cronet.NewRoundTripper(cronet.RoundTripperOptions{
-		Logger:                 logger,
-		Version:                version,
-		DisableVersionFallback: options.DisableVersionFallback,
-		Dialer:                 rawDialer,
-		DNSResolver:            dnsResolver,
-		TLS: cronet.RoundTripperTLSOptions{
-			ServerName:              tlsOptions.ServerName,
-			TrustedRootCertificates: trustedRootCertificates,
-			PinnedPublicKeySHA256:   tlsOptions.CertificatePublicKeySHA256,
-			ECHEnabled:              echEnabled,
-			ECHConfigList:           echConfigList,
-			ECHQueryServerName:      echQueryServerName,
-		},
-		HTTP2: cronet.RoundTripperHTTP2Options{
-			StreamReceiveWindow:     options.HTTP2Options.StreamReceiveWindow.Value(),
-			ConnectionReceiveWindow: options.HTTP2Options.ConnectionReceiveWindow.Value(),
-		},
-		QUIC: cronet.RoundTripperQUICOptions{
-			StreamReceiveWindow:     options.HTTP3Options.StreamReceiveWindow.Value(),
-			ConnectionReceiveWindow: options.HTTP3Options.ConnectionReceiveWindow.Value(),
-			IdleTimeout:             time.Duration(options.HTTP3Options.IdleTimeout),
-		},
-	})
-	if err != nil {
-		return nil, err
-	}
-	shared := &cronetTransportShared{
-		roundTripper: roundTripper,
-	}
-	shared.refs.Store(1)
-	return &cronetTransport{shared: shared}, nil
-}
-
-func readCronetRootCertificates(tlsOptions option.OutboundTLSOptions) (string, error) {
-	if len(tlsOptions.Certificate) > 0 {
-		return strings.Join(tlsOptions.Certificate, "\n"), nil
-	}
-	if tlsOptions.CertificatePath == "" {
-		return "", nil
-	}
-	content, err := os.ReadFile(tlsOptions.CertificatePath)
-	if err != nil {
-		return "", E.Cause(err, "read certificate")
-	}
-	return string(content), nil
-}
-
-func readCronetECH(tlsOptions option.OutboundTLSOptions) (bool, []byte, string, error) {
-	if tlsOptions.ECH == nil || !tlsOptions.ECH.Enabled {
-		return false, nil, "", nil
-	}
-	//nolint:staticcheck
-	if tlsOptions.ECH.PQSignatureSchemesEnabled || tlsOptions.ECH.DynamicRecordSizingDisabled {
-		return false, nil, "", E.New("legacy ECH options are deprecated in sing-box 1.12.0 and removed in sing-box 1.13.0")
-	}
-	var echConfig []byte
-	if len(tlsOptions.ECH.Config) > 0 {
-		echConfig = []byte(strings.Join(tlsOptions.ECH.Config, "\n"))
-	} else if tlsOptions.ECH.ConfigPath != "" {
-		content, err := os.ReadFile(tlsOptions.ECH.ConfigPath)
-		if err != nil {
-			return false, nil, "", E.Cause(err, "read ECH config")
-		}
-		echConfig = content
-	}
-	if len(echConfig) == 0 {
-		return true, nil, tlsOptions.ECH.QueryServerName, nil
-	}
-	block, rest := pem.Decode(echConfig)
-	if block == nil || block.Type != "ECH CONFIGS" || len(rest) > 0 {
-		return false, nil, "", E.New("invalid ECH configs pem")
-	}
-	return true, block.Bytes, tlsOptions.ECH.QueryServerName, nil
-}
-
-func newCronetDNSResolver(ctx context.Context, logger singLogger.ContextLogger, rawDialer N.Dialer) cronet.DNSResolverFunc {
-	resolveDialer, isResolveDialer := rawDialer.(dialer.ResolveDialer)
-	if !isResolveDialer {
-		return nil
-	}
-	dnsRouter := service.FromContext[adapter.DNSRouter](ctx)
-	if dnsRouter == nil {
-		return nil
-	}
-	queryOptions := resolveDialer.QueryOptions()
-	return func(dnsContext context.Context, request *mDNS.Msg) *mDNS.Msg {
-		response, err := dnsRouter.Exchange(dnsContext, request, queryOptions)
-		if err == nil {
-			return response
-		}
-		logger.Error("DNS exchange failed: ", err)
-		failure := new(mDNS.Msg)
-		failure.SetReply(request)
-		failure.Rcode = mDNS.RcodeServerFailure
-		return failure
-	}
-}
-
-func (t *cronetTransport) RoundTrip(request *http.Request) (*http.Response, error) {
-	return t.shared.roundTripper.RoundTrip(request)
-}
-
-func (t *cronetTransport) CloseIdleConnections() {
-	t.shared.roundTripper.CloseIdleConnections()
-}
-
-func (t *cronetTransport) Clone() adapter.HTTPTransport {
-	t.shared.refs.Add(1)
-	return &cronetTransport{shared: t.shared}
-}
-
-func (t *cronetTransport) Close() error {
-	if t.shared.refs.Add(-1) == 0 {
-		return t.shared.roundTripper.Close()
-	}
-	return nil
-}
--- a/common/httpclient/helpers.go
+++ b/common/httpclient/helpers.go
@@ -1,86 +0,0 @@
-package httpclient
-
-import (
-	"context"
-	stdTLS "crypto/tls"
-	"io"
-	"net"
-	"net/http"
-	"strings"
-
-	"github.com/sagernet/sing-box/common/tls"
-	E "github.com/sagernet/sing/common/exceptions"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func dialTLS(ctx context.Context, rawDialer N.Dialer, baseTLSConfig tls.Config, destination M.Socksaddr, nextProtos []string, expectProto string) (net.Conn, error) {
-	if baseTLSConfig == nil {
-		return nil, E.New("TLS transport unavailable")
-	}
-	tlsConfig := baseTLSConfig.Clone()
-	if tlsConfig.ServerName() == "" && destination.IsValid() {
-		tlsConfig.SetServerName(destination.AddrString())
-	}
-	tlsConfig.SetNextProtos(nextProtos)
-	conn, err := rawDialer.DialContext(ctx, N.NetworkTCP, destination)
-	if err != nil {
-		return nil, err
-	}
-	tlsConn, err := tls.ClientHandshake(ctx, conn, tlsConfig)
-	if err != nil {
-		conn.Close()
-		return nil, err
-	}
-	if expectProto != "" && tlsConn.ConnectionState().NegotiatedProtocol != expectProto {
-		tlsConn.Close()
-		return nil, errHTTP2Fallback
-	}
-	return tlsConn, nil
-}
-
-func applyHeaders(request *http.Request, headers http.Header, host string) {
-	for header, values := range headers {
-		request.Header[header] = append([]string(nil), values...)
-	}
-	if host != "" {
-		request.Host = host
-	}
-}
-
-func requestRequiresHTTP1(request *http.Request) bool {
-	return strings.Contains(strings.ToLower(request.Header.Get("Connection")), "upgrade") &&
-		strings.EqualFold(request.Header.Get("Upgrade"), "websocket")
-}
-
-func requestReplayable(request *http.Request) bool {
-	return request.Body == nil || request.Body == http.NoBody || request.GetBody != nil
-}
-
-func cloneRequestForRetry(request *http.Request) *http.Request {
-	cloned := request.Clone(request.Context())
-	if request.Body != nil && request.Body != http.NoBody && request.GetBody != nil {
-		cloned.Body = mustGetBody(request)
-	}
-	return cloned
-}
-
-func mustGetBody(request *http.Request) io.ReadCloser {
-	body, err := request.GetBody()
-	if err != nil {
-		panic(err)
-	}
-	return body
-}
-
-func buildSTDTLSConfig(baseTLSConfig tls.Config, destination M.Socksaddr, nextProtos []string) (*stdTLS.Config, error) {
-	if baseTLSConfig == nil {
-		return nil, nil
-	}
-	tlsConfig := baseTLSConfig.Clone()
-	if tlsConfig.ServerName() == "" && destination.IsValid() {
-		tlsConfig.SetServerName(destination.AddrString())
-	}
-	tlsConfig.SetNextProtos(nextProtos)
-	return tlsConfig.STDConfig()
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
世界	11077fd3d7	release: Refactor release tracks for Linux packages and Docker Support 4 release tracks instead of 2: - sing-box / latest (stable release) - sing-box-beta / latest-beta (stable pre-release) - sing-box-testing / latest-testing (testing branch) - sing-box-oldstable / latest-oldstable (oldstable branch) Track is detected via git branch --contains and git tag, replacing the old version-string hyphen check.	2026-03-24 15:02:44 +08:00
世界	73bfb99ebc	Bump version	2026-03-15 16:57:08 +08:00
世界	7ed63c5e01	Update Go to 1.25.8	2026-03-15 16:57:08 +08:00
Heng lu	92b24c5ecd	Fix netns fd leak in ListenNetworkNamespace	2026-03-15 16:54:55 +08:00
世界	ec182cd24e	Fix websocket connection and goroutine leaks in Clash API Co-authored-by: traitman <112139837+traitman@users.noreply.github.com>	2026-03-15 16:54:11 +08:00
世界	f411a8a0e5	tun: Backport fixes	2026-03-15 16:53:15 +08:00
世界	bc2b0820a0	Bump version	2026-03-05 21:38:26 +08:00
世界	2c60eebc42	Fix rule_set_ip_cidr_accept_empty not working	2026-03-05 21:25:36 +08:00
世界	0ef1c78c0e	Fix fake-ip address allocation	2026-03-05 21:25:26 +08:00
世界	7a1bc204b2	endpoint: Fix UDP resolved destination	2026-03-05 21:24:57 +08:00
traitman	78f494831d	clash-api: Fix websocket connection not closed after config reload via SIGHUP Co-authored-by: TraitMan <traitman@maildog.top> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-03-05 21:22:53 +08:00
dyhkwong	d07c908e5d	Fix IPv6 local DNS on Windows	2026-03-05 21:22:46 +08:00
世界	6126f8712b	tun: Backport fixes	2026-03-05 21:21:48 +08:00
世界	ea5c2446b2	Rename branches and update release workflows stable-next → oldstable, main-next → stable, dev-next → testing, new unstable	2026-03-05 21:10:46 +08:00
世界	c0fcd6afce	Bump version	2026-02-27 15:06:00 +08:00
世界	795eda967b	Pin Go version to 1.25.7	2026-02-27 15:03:31 +08:00
世界	f2ec82dd2a	dialer: use KeepAliveConfig for TCP keepalive	2026-02-27 14:02:58 +08:00
世界	53853e9ae1	release: Fix pacman package	2026-02-26 22:09:12 +08:00
世界	e663b7f974	Fix per-outbound bind_interface	2026-02-26 21:49:05 +08:00
世界	f63091d14d	Bump version	2026-02-15 21:05:34 +08:00
世界	1c4a01ee90	Fix matching multi predefined	2026-02-15 19:20:31 +08:00
世界	4d7f99310c	Fix matching rule-set invert	2026-02-15 19:20:11 +08:00
世界	6fc511f56e	wireguard: Fix missing fallback for gso	2026-02-15 19:20:03 +08:00
世界	d18d2b352a	Bump version	2026-02-09 13:57:18 +08:00
世界	534128bba9	tuic: Fix udp context	2026-02-09 13:55:09 +08:00
世界	736a7368c6	Fix naive padding	2026-02-09 13:53:32 +08:00
世界	e7a9c90213	Fix DNS cache lock goroutine leak The cache deduplication in Client.Exchange uses a channel-based lock per DNS question. Waiting goroutines blocked on <-cond without context awareness, causing them to accumulate indefinitely when the owning goroutine's transport call stalls. Add select on ctx.Done() so waiters respect context cancellation and timeouts.	2026-02-06 22:28:30 +08:00
世界	0f3774e501	Bump version	2026-02-05 17:13:38 +08:00
世界	2f8e656522	Update Go to 1.25.7	2026-02-05 17:12:42 +08:00
世界	3ba30e3f00	Fix route_address_set duplicated IP sets causing route creation failure The FlatMap calls pre-populated routeAddressSet and routeExcludeAddressSet before the for-loops which appended the same IP sets again, doubling every entry. On Windows this caused CreateIpForwardEntry2 to return ERROR_OBJECT_ALREADY_EXISTS. Fixes #3725	2026-02-02 17:29:21 +08:00
世界	f2639a5829	Fix random iproute2 table index was incorrectly removed	2026-02-02 14:13:49 +08:00
世界	69bebbda82	Bump version	2026-02-01 10:19:35 +08:00
世界	00b2c042ee	Disable rp filter atomically	2026-02-01 10:17:34 +08:00
世界	d9eb8f3ab6	Fix varbin serialization	2026-02-01 10:11:15 +08:00
世界	58025a01f8	Fix auto_redirect fallback rule	2026-01-29 12:07:15 +08:00
世界	99cad72ea8	Bump version	2026-01-28 16:56:08 +08:00
世界	6e96d620fe	Minor fixes	2026-01-28 16:56:08 +08:00