- Expand query object into flat key-value pairs in VLESS View dialog
- Fix [object Object] rendering for query parameters
- Display fp/pbk/sid/spx (fingerprint/publicKey/shortId/spiderX)
  as individual form items
- Fix VLESS auth parsing: use decodeURIComponent instead of atob().split()
- Delete expanded query key after flattening to avoid duplicates

- Add build-with-ngui.sh (Linux) and build-with-ngui.ps1 (Windows)
  using pnpm + nuxt generate for ngui frontend
- Configure nuxt.config.ts with nitro.output.publicDir pointing to
  service/server/router/web/ for go:embed compatibility
- Add /_nuxt/* route in ServeGUI() to serve Nuxt 3 static assets
  alongside existing /static/* route
- Both build systems coexist: build.sh for gui, build-with-ngui.sh for
  ngui, Go router handles both

- Add ServerEditor.vue (1864 lines): full server create/edit dialog
  supporting 11 protocols (VMess/VLESS/Trojan/SS/SSR/Hysteria2/Juicity/
  AnyTLS/TUIC/HTTP/SOCKS5/WireGuard) with Reality protocol parameters
  (fp/pbk/sid/spx), URL import/export, and form validation
- Integrate ServerEditor into SubServer.vue with create/edit buttons
  and refresh callback
- Rewrite settings page (setting.vue) with ElCollapse panels covering:
  GFWList, Transparent Proxy, Routing Rules, Advanced Settings,
  Auto-Update, Ports/DNS/CustomInbound/TUN sub-dialogs
- All components use Vue 3 Composition API, Element Plus, and
  ngui composables (fetch.ts) for backend API communication

- 重新生成 pnpm-lock.yaml (lockfileVersion 9.0)，兼容 pnpm 10.x
- 添加 pnpm.overrides 将 @intlify/shared 和 @intlify/message-compiler
  固定在 9.3.0-beta.16，解决 Node.js 25.x 下 ESM-only 包被 CJS require 的问题
- 修复 locales/zh-hans.yaml 中重复的 'log' 键

- Wrap /_nuxt/* route registration in fs.Sub() error check
- When _nuxt directory is absent (gui build without ngui),
  skip route registration entirely instead of passing an invalid
  FS to statigz.FileServer which caused panic on Open('.')

Add a safe statigz handler wrapper that validates fs roots and recovers from FileServer initialization panics.\n\nUse a generic embedded route registrar for /static and /_nuxt with fallback candidates, so both gui and ngui layouts avoid startup panic: open .: file does not exist.

Download Linux arm64 service/core artifacts in release_main workflow, package them into v2raya-arm64-linux.zip, generate checksums, and upload to homebrew release assets.

…s/VLESS tabs

- Split the single 'V2RAY' tab in gui/modalServer.vue into separate
  'VMESS' (tab 0) and 'VLESS' (tab 1) tabs
- Remove the 'Extra Raw JSON' textarea for XHTTP transport and replace
  it with complete structured form fields in both tabs:
  - Mode, Uplink HTTP Method
  - noGRPCHeader / noSSEHeader toggles
  - Range config pairs: scMaxEachPostBytes, scMinPostsIntervalMs,
    scStreamUpServerSecs, xPaddingBytes, scMaxBufferedPosts
  - Full xmux config: maxConcurrency, maxConnections, cMaxReuseTimes,
    hMaxRequestTimes, hMaxReusableSecs (all ranges), hKeepAlivePeriod
  - Dynamic Custom Headers list (key/value pairs)
- Add XHTTPRangeConfig and XHTTPXmux types to coreObj.go; expand
  XHTTPSettings to cover all splithttp proto client fields
- Extend V2Ray struct with 25 new XHTTP fields; update ParseVlessURL,
  ExportToURL, and Configuration() accordingly
- Add queryInt / setIntQuery helpers for URL param parsing
- Update all tabChoice indices (+1) for WireGuard through AnyTLS
- Add watch on tabChoice to auto-set v2ray.protocol

… rules

…s styles

…ience

…ling Tun

When transparent proxy (TinyTun/wintun) is enabled on Windows, the wintun
driver briefly disrupts all traffic while installing routes.  This caused
two problems:

1. The connectivity monitor fired its first probe too early, before routes
   were fully set up, and received a false network-unavailable result.  This
   stopped TinyTun prematurely and set networkPaused=true, leaving the
   frontend's status tag stuck on the Checking spinner indefinitely.

2. The frontend's /touch request in node.vue created() could fail during
   that same disruption window, making the component stay in the loading
   state with no retry.

Fixes:
- connectivity.go: add a 5-second startup delay before the first probe so
  that wintun has time to finish installing routes.
- node.vue: replace the single /touch call with a retry loop (up to 3
  attempts, 2 s apart) that handles both network errors and non-SUCCESS
  responses; always sets ready=true after the last attempt to unblock the UI.
- App.vue: call syncLatestNodeOverview() on every WebSocket (re)connect so
  the running state is refreshed even if a WS message was missed while the
  connection was down.

…startup

On Windows, calling configurev4.IsConfigureNotExists() triggered the v4
library to lazy-initialize using its Linux-default config path (/etc/v2raya).
On Windows, /etc/v2raya resolves to \etc\v2raya on the current drive root
(e.g. C:\etc\v2raya).  The v4 library then called os.MkdirAll to create that
directory and bbolt.Open to create boltv4.db inside it -- neither of which
is intentional or useful on Windows.

v2rayA v4 was Linux-only, so no v4 configuration data can ever exist on a
Windows machine.  Guard the entire v4 migration check with a runtime.GOOS
check to skip it on Windows.

Also extend sanitizeConfigDirForPlatform to catch the relative-path variant
etc/v2raya (without a leading slash) in addition to the existing check for
the drive-relative /etc/v2raya, providing defence-in-depth if V2RAYA_CONFIG
is ever set to such a value.

… TinyTun races

ProcessManager.Start() now runs resolv/GFWList checks before acquiring
m.mu and defers afterStart (transparent-proxy setup, DNS, TinyTun,
post-start hook) to after the lock is released, eliminating multi-second
lock holds caused by DNS lookups and external hook commands.

TinyTun:
- Fix cancel/stopping ordering race in startTinyTun: assign the new
  cancel func before clearing the stopping flag so a concurrent
  stopTinyTun always sees the correct cancel
- Resolve proxy-node hostnames concurrently with sync.WaitGroup instead
  of sequentially, reducing config-generation latency
- stopTinyTun now waits up to 5 s for the process to exit via a done
  channel closed by the monitor goroutine after cmd.Wait() returns

Windows service lifecycle:
- cleanupResources enforces a 30 s hard timeout and adds panic recovery
- HTTP router is shut down before the core process on service stop
- router.Run uses an explicit http.Server + Shutdown() for graceful teardown

Connectivity monitor:
- Extend startup grace period to 15 s on Windows (5 s elsewhere)
- Replace fixed 30 s re-check ticker with exponential back-off (30/60/120 s)
- Probe TinyTun availability via TCP dial to the SOCKS5 port instead of HTTP

Platform guards:
- resolv.CheckResolvConf/WriteResolvConf: no-op on non-Linux
- DNS-hijack operations (NewResolvHijacker, HijackResolv, etc.): Linux-only

…h cert pinning

- Update core/xray submodule from v1.260327.0 (v26.3.27) to v26.6.1
- Remove deprecated AllowInsecure field from all protocol structs
- Add PinnedPeerCertSha256 and VerifyPeerCertByName fields (service layer)
- Update ngui (Nuxt) frontend with text inputs for new fields
- Update gui (Vue 2) frontend with text inputs for new fields
- Keep existing PinnedSHA256 for juicity (no duplicate)
- Backward compatible: old allowInsecure params silently ignored
- Run go mod tidy to update dependencies