Summary

Settings.proxyIgnoreList (the "忽略 / Ignore" list in More Settings → General) is written to the macOS system-proxy bypass list via kCFNetworkProxiesExceptionsList, but mihomo does not read that list. In Rule mode every packet goes:

App → macOS system proxy (127.0.0.1:7890) → mihomo → matched against rules → out via DIRECT / Proxy
                                              ↑
                            mihomo never consults macOS bypass settings

Result: the entries the user puts in this UI have zero effect on actual proxy routing in Rule mode. The list is silently ignored, but the UI presents it as if it filters traffic.

Reproduce

1. Run ClashFX in Rule mode (Enhanced Mode OFF)
2. More Settings → General → Ignore List → add *.126.net (or any domain the active subscription routes via Proxy)
3. Open the affected app (e.g. NetEase Music)
4. ClashFX → Connections viewer → observe the 126.net connection still goes through Proxy, matched by MATCH or GeoIP rules

Root cause

Two independent bypass mechanisms exist:

The Ignore List UI in Rule mode points at the wrong mechanism — it configures macOS, but macOS's setting is bypassed because traffic already goes through mihomo on 127.0.0.1:7890, and the mihomo rule engine doesn't look at macOS bypass.

Relevant code:

• Settings.swift — proxyIgnoreList definition
• SystemProxyManager.swift — passes the list to the helper
• ProxyConfigHelper/ProxySettingTool.m — writes kCFNetworkProxiesExceptionsList (line ~151)

Reported by user

#104 — user added *.126.net to the ignore list expecting NetEase Music to bypass the proxy. It did not.

Proposed fix (one of)

Option A: Inject DIRECT rules into the active mihomo config

When the user edits proxyIgnoreList in Rule mode, ClashFX should also inject corresponding DOMAIN-SUFFIX,<entry>,DIRECT (or matching) rules at the top of the active config's rules: section, then trigger a config reload. This way the bypass actually takes effect because mihomo sees it.

• Pros: keeps existing UI affordance, fixes the silent-no-op behavior
• Cons: needs careful handling of subscription auto-update (which would otherwise overwrite the injection); also wildcard syntax has to be translated (*.126.net → DOMAIN-SUFFIX,126.net)

Option B: Merge with #108 (mode-aware bypass toggle)

Deprecate the two-list design, replace with the unified mode-aware mechanism #108 is already designing. The Ignore List becomes a thin layer on top of #108's injection logic, working uniformly in both Rule and Enhanced modes.

• Pros: avoids two parallel implementations; cleaner UX
• Cons: bigger scope; until [Feature] Bypass Chinese apps in Rule mode via domain-based rule-set #108 lands users see a half-fixed feature

Option C (short term): Disable + label the field in Rule mode

As a quick mitigation, grey out the Ignore List in Rule mode and add a tooltip: "macOS bypass list is not honored by the proxy engine in Rule mode. Use the config editor to add DOMAIN-SUFFIX,<host>,DIRECT rules instead."

Not satisfying but at least stops the silent no-op confusion until A or B lands.

Implementation tasks (Option A path)

• Translate proxyIgnoreList entries into mihomo rule syntax (DOMAIN-SUFFIX, DOMAIN-KEYWORD, IP-CIDR, etc.) — esp. handle leading-wildcard like *.example.com
• Inject those rules at the top of the active config's rules: on Rule-mode activation / list change
• Make injection survive subscription auto-update (cache the injection separately and re-apply on reload)
• Add a "Reset to defaults" action in the UI
• Tooltip clarifying behaviour (it now affects mihomo routing, not just macOS proxy)
• Tests / smoke check

Related

• #104 — user-facing report
• #108 — mode-aware bypass toggle (potential merge target)
• Clash-FX/cn-apps-direct-domains — domain-based rule-set users can manually wire while this is unfixed