feat: network-policy — auto-switch select groups based on network environment

[wangwei354]

Update (Apr 22, 2026): This PR has been force-pushed to replace the original single-primary-iface design with a clean-slate multi-interface rewrite. The original design failed to express common desktop scenarios (wired + Wi-Fi with different gateways; Wi-Fi + VPN coexistence; "in the office" when both Ethernet and Wi-Fi are up). Design discussion is at #2722. No reviewer time had been consumed on the old revision (0 formal review comments), so the in-place rewrite is the least disruptive path. If you'd prefer a fresh PR number for a clean review history, just say so and I'll close + reopen.

TL;DR

English: Introduces a top-level networks: YAML block and a per-select-group network-policy: mapping, exposed through PUT / DELETE / GET /network/context. A GUI host pushes a NetworkContext containing the full active-interface set; the kernel evaluates the rule list in order, applies the first-match's policy target on each affected group, and preserves user manual picks within the same network. Zero behavioral change when networks: is absent.

中文：新增 YAML networks: 顶层字段与 select 组的 network-policy: 子字段，通过 PUT / DELETE / GET /network/context 三个 REST 端点暴露。宿主推送包含全部活跃接口集合的 NetworkContext，内核按 networks: 列表顺序 first-match 求值，对每个带 policy 的 select 组应用对应目标；同一 network 下用户手动选择被尊重，network 变化时自动流程接管。不配置 networks: 时行为与旧版字节级等价。

Closes MetaCubeX/mihomo#1330. Design RFC: #2722. Pairs with clash-verge-rev#1231 on the GUI side.

Why the force-push (what changed from the previous revision)

The earlier five-commit revision modeled NetworkContext as a single "primary interface" snapshot with fields like primary_iface / iface_type / ssid / gateway_mac at the top level. On desktop that proves too narrow:

• Multi-NIC is the common case (wired + Wi-Fi together), and the host has no principled way to pick "the" primary. Whichever one it picks throws away the other's identity.
• {iface-type: vpn, ...} rules could never match a user-installed WireGuard that runs alongside Wi-Fi, because the host's "physical-iface-fallback" would hide the VPN when the VPN wasn't the primary.
• Combined conditions like "home Wi-Fi + company VPN" are inexpressible in a single-iface schema.

The v2 design in this PR:

• Host reports all active interfaces (interfaces[], hard-capped at 32), plus a top-level dns_suffix list.
• Matchers evaluate with ∃iface ∈ interfaces semantics; multiple per-iface fields in the same block must be satisfied by the same iface (atomic AND). any: / all: / not: combinators are grammar primitives.
• Per-network precedence is expressed by rule order in networks: (first-match wins). The "primary interface" concept is gone.

The architecture is intentionally conservative: no CGO, no new platform dependencies, no subscription-pushed policy (signed YAML stays the source of truth).

High-level design

The functionality splits naturally into two halves:

Concern	Owner	Why
Platform-specific network detection (WlanAPI, NWPathMonitor, netlink, NetworkCallback)	GUI host	Rust / Kotlin ecosystems already have first-class APIs; deep OS event subscriptions; desktop-app territory
Rule semantics, select group state, persistence, REST	mihomo kernel (this PR)	Same concepts as store-selected; needs to live with proxy groups; YAML rules should travel with the subscription

Rules live in YAML so they ride subscriptions, backups, and are visible to any GUI that implements the detector. Host and kernel communicate through a single versioned REST contract (/network/context). No new platform APIs, CGO, or third-party deps in the kernel.

What's in this PR

Twelve commits, layered so each one compiles, passes go vet, and keeps existing tests green:

1. feat(network-policy): add package skeleton with multi-interface schema — new component/networkpolicy/ package: NetworkContext (interfaces[] + global dns_suffix + optional ttl), NormalizeAndValidate, stable FNV-64a Fingerprint, the block-level matcher AST with any: / all: / not: combinators and ∃iface semantics, GroupPolicy, shared constants. Pure logic.
2. feat(network-policy): parse networks and network-policy in config — wires the schema into config.Parse: ParseNetworks builds the list, ParseGroupPolicy validates each select group's Mapping (static proxies fail-fast, provider-expanded targets tolerant-until-first-PUT, default as reserved key). Selector gains NetworkPolicy() / GroupSource() getters. No runtime behaviour yet.
3. feat(network-policy): persist bucketNetworkPolicy — new bucketNetworkPolicy bucket in component/profile/cachefile stores {source, last_matched_network} per group (proxy name stays in the existing bucketSelected). Decode path tolerates schema drift (unknown schema_version → treated as branch B, cold start).
4. feat(network-policy): add manager with state machine and TTL — the Manager singleton: per-group state (source + last_matched), global ctx snapshot + TTL timer with generation-stamped stale-callback protection, single-serial-queue evaluation pipeline (evaluate → selector.Set → cachefile → publish). TTL-light-path handles heartbeat renewals under five guard conditions so steady state doesn't hit the full pipeline. Provider barrier on startup prevents races with subscription-driven candidate sets.
5. feat(network-policy): wire manager into executor lifecycle — hub/executor/executor.go owns Install / Uninstall via ApplyConfig (the package exports only these two; a single Install handles both first-time install and hot-reload state migration via the internal inheritFrom). Hot-reload migrates per-group state + ctx + TTL timer + selected proxy from old to new Manager. collectNetworkPolicySelectors uses the SelectorWithPolicy interface (no concrete type assertions).
6. feat(network-policy): expose /network/context REST endpoints — hub/route/network.go registers PUT / DELETE / GET under /network/context, with a 10 MiB body cap, strict-end JSON parsing (no trailing junk), and sentinel-error classification that maps validation errors to the {code, message} envelope (see §REST API).
7. feat(network-policy): hook manual PUT /proxies/:name into state machine — updateProxy calls Manager.HandleManualSet(name) after selector.Set returns; respects lock order globalMu → selector.mu → manager.mu (hook runs outside selector.mu). Select groups without network-policy keep byte-for-byte compatible behavior.
8. feat(network-policy): warn on exposed external-controller without secret — startup warning when networks: is configured, external-controller is bound to a non-loopback address, and no secret is set (TLS with strong mutual-auth exempts the warning).
9. refactor(network-policy): narrow exported API surface — package-private where possible; only SelectorWithPolicy / the sentinel error values / NetworkContext / Install / a few lifecycle exports remain.
10. docs: document network-policy config and REST API — docs/config.yaml gains the networks: + network-policy: comment-only example; docs/api.md is a new comprehensive REST reference (covers every endpoint in hub/route/, including the /network/context contract in full: the wire schema, the applied[] shape, the seven-reason enumeration, the manual-wins state machine including the missing_target branch, the tri-state wire-null encoding for matched_network / last_matched_network, and the complete {code, message} error code matrix).
11. feat(tun): expose actual bound device name in /configs response — tiny fd-override fix in listener/sing_tun/server.go: when FileDescriptor > 0, after getTunnelName(fd) succeeds, mirror the resolved name into options.Device so tunLister.Config().Device and therefore GET /configs.tun.device reflect the real bound interface. Host samplers rely on this to filter mihomo's own TUN from the NetworkContext they push.
12. docs(network-policy): fix dangling reference in config.yaml — post-review follow-up: the comment block added in commit Full regexp support #10 pointed at docs/network-policy.md which was never committed; redirected to docs/api.md §11 where the full field list / combinator semantics / REST contract already live.

Configuration

Minimal — one network, one group:

networks:
  - name: office
    match:
      ssid: corp-5g
      iface-type: wifi

proxy-groups:
  - name: Smart
    type: select
    proxies: [hk, us, DIRECT]
    network-policy:
      office: hk
      default: DIRECT     # matched-nothing or matched-but-no-mapping fallback

Richer grammar (per-iface atomic AND, field-level OR, sub-block combinators):

networks:
  # Ethernet with a specific gateway MAC (office wired)
  - name: office-wired
    match:
      iface-type: ethernet
      gateway-mac: "aa:bb:cc:dd:ee:00"

  # Wi-Fi to any AP in the office set (field-level OR)
  - name: office-wifi
    match:
      ssid: [corp-5g, corp-2.4g, corp-guest]
      iface-type: wifi

  # Home Wi-Fi + company VPN simultaneously (cross-iface AND)
  - name: home-with-corp-vpn
    match:
      all:
        - iface-type: wifi
          ssid: home-network
        - iface-type: vpn
          dns-suffix: corp.example.com   # dns-suffix is global, not bound to this sub-block

  # Any cellular / wwan interface (`not:` for the complement)
  - name: no-cellular
    match:
      not:
        any:
          - iface-type: cellular
          - iface-type: wwan

Full field list, combinator semantics (including the "same iface satisfies all top-level per-iface fields" atomic rule), normalization, and the dns-suffix global-scope caveat are in docs/api.md §11 and docs/config.yaml (the committed example block).

REST API

Method	Path	Purpose
PUT	/network/context	Host pushes the current active-interface snapshot; returns matched_network + per-group applied[]
DELETE	/network/context	Clear the cached context (204); per-group state is preserved (does not trigger default)
GET	/network/context	Normalized snapshot of the context, current matched_network, per-group current_proxy / selection_source / last_matched_network

curl -X PUT \
  -H "Authorization: Bearer $SECRET" \
  -H "Content-Type: application/json" \
  -d '{
        "version": 1,
        "interfaces": [
          {"name":"wlan0","iface_type":"wifi","ssid":"corp-5g","gateway_ip":"10.0.0.1"}
        ],
        "dns_suffix": ["corp.example.com"],
        "ttl": 1800
      }' \
  http://127.0.0.1:9090/network/context

Error responses on /network/context use a structured envelope (distinct from other mihomo endpoints' {"message":"..."}):

{ "code": "invalid_field", "message": "field: interfaces[0].gateway_ip, reason: parse error" }

Stable code values: malformed_body / invalid_version / invalid_ttl / too_many_interfaces / duplicate_iface_name / invalid_field / invalid_gateway_combo / internal_error. Full schema, normalization rules, and per-code semantics are in docs/api.md §11.

Runtime semantics

Manual-wins is hard-coded. When the user hand-picks a proxy on a policy-bearing group, the group's selection_source flips to manual. Subsequent PUT /network/context behavior:

• matched_network unchanged + source=manual → reason=manual_locked, user's pick preserved.
• matched_network changed + evaluation lands in matched / already_selected / default / no_change_no_default → auto flow takes over, source resets to auto, last_matched_network advances.
• matched_network changed but evaluation lands in missing_target (policy-resolved target not currently in the group's candidates, e.g., a subscription-provided node not yet loaded) → skip the switch, source and last_matched_network preserved, retried on the next PUT.

Seven reason values surface on applied[i].reason: matched / already_selected / default / no_change_no_default / unchanged_network (fingerprint-stable skip for the auto path) / manual_locked / missing_target.

DELETE /network/context intentionally preserves per-group state (selection_source, last_matched_network, currently-selected proxy). It only clears the kernel's cached NetworkContext snapshot so the TTL timer can be cancelled. Use cases: host clean shutdown; deliberate "no context, but keep state machine" mode; natural TTL expiry (equivalent). Do not use DELETE to express "host is offline" — instead PUT {version:1, interfaces:[]}, which runs the default / no_change_no_default branch for every group.

State persists across restarts via two buckets: bucketSelected (unchanged semantics — "which proxy was selected") + new bucketNetworkPolicy ({schema_version, source, last_matched_network} — "how that selection was made"). Both gated by profile.store-selected: true, consistent with existing behaviour.

A TTL "light path" skips the full evaluation pipeline when five conditions all hold: fingerprint unchanged, both current and previous bodies carried a TTL, no group has a pending missing_target retry, and the candidate set hasn't drifted since the last full evaluation. Hosts doing periodic keep-alive PUTs pay essentially zero kernel-side cost.

Compatibility

• Zero behaviour change without networks:. Configs that omit the new keys hit exactly the pre-PR code paths: no Manager is installed, applyOnce never runs, updateProxy's pre-existing code path is unchanged, bucketNetworkPolicy is never written.
• No new platform dependencies, no CGO, no third-party imports — standard library + golang.org/x/exp/slices / netip (already in use).
• Cachefile forward/backward compatible: old kernels reading a new DB ignore bucketNetworkPolicy; new kernels reading an old DB (no bucket) start on branch B (cold-start, run initial evaluation after the provider barrier releases).
• REST-layer forward-compat: the wire schema permits unknown fields (json.Unmarshal default) so new host versions can coexist with older kernels. YAML matchers are the opposite — unknown keys fail-fast, so config bugs surface early.

Security

The startup warning in warnNetworkPolicyExternalController fires when all three conditions hold simultaneously, per endpoint:

1. At least one proxy group declares network-policy: in the config.
2. external-controller / external-controller-tls binds a non-loopback address.
3. No REST secret is set (TLS endpoint with client-auth-type: require-and-verify + a client-auth cert is treated as equivalent to a secret for this check).

Non-blocking — it's a nudge for the operator, never an abort. Unix sockets and Windows named pipes are intentionally skipped (filesystem / pipe ACLs already gate access).

The underlying rationale: on a policy-bearing select group, PUT /network/context indirectly picks proxies for the user. An unauthenticated LAN attacker could otherwise push a crafted context to force traffic through a specific node.

Testing

• go test ./component/networkpolicy/... ./config/... ./adapter/outboundgroup/... ./hub/route/... ./hub/executor/... ./component/profile/cachefile/... ./listener/... all green.
• ~4,000 LoC of tests across the new _test.go files. Coverage includes: normalisation idempotency, FNV fingerprint stability, matcher atomic-AND semantics and combinators against the full architecture test matrix, state machine branches (including cold-start branch A vs B, provider barrier, startup eval pending flag), TTL timer stale-callback protection, persistence downgrade scenarios, manual-wins golden paths, concurrent HandleManualSet + PutContext, REST handler error-code mapping end-to-end (including the ttl > 10 years upper-bound case), and the hot-reload Install → inheritFrom state-migration path.
• Manual smoke: start with networks: + network-policy:; curl -X PUT /network/context with a multi-interface body and observe applied[*].reason; re-PUT with same body → unchanged_network; PUT /proxies/Smart -d '{"name":"us"}' then re-PUT same context → manual_locked; change the interfaces[] to a different network → auto takeover; DELETE → state preserved, groups keep their current proxies; next PUT resumes state machine with retained source.

Out of scope / Follow-ups

• Host-side detection is not in this PR — mihomo alone only switches when an external actor (clash-verge-rev, FlClash, a cron script, systemd-networkd dispatcher) PUTs a context. The kernel contract is stable; GUI implementations (clash-verge-rev#1231) can land whenever.
• No automatic Linux netlink collector in-tree. The architecture allows adding one later as an opt-in component for headless deployments.
• Matcher metered: is currently fail-fast (reserved field on the wire but disabled in the matcher). Three-platform samplers don't collect it yet; opening the matcher now would let users write not: {metered: true} rules that silently always match.
• macOS utun real bound name is still best-effort (pre-bind estimate from CalculateInterfaceName()). Tightening that to a true post-bind read-back is deferred.

---

中文版本

更新（2026-04-22）：本 PR 已经 force-push，用 clean-slate 重新设计取代了原先的"单 primary 接口"版本。原设计在桌面场景下表达力不足（有线+Wi-Fi 同时在线、Wi-Fi+VPN 共存、"在公司"同时包含有线和 Wi-Fi 等），RFC 讨论见 #2722。旧版本没有消耗 reviewer 时间（0 条 formal review comment），in-place 重写是最小扰动的方案。如维护者偏好新开 PR 号获得干净的 review 历史，告知即可，我关闭这个并重新开一个。

概要

新增 YAML networks: 顶层字段与 select 组的 network-policy: 子字段，通过 PUT / DELETE / GET /network/context 三个 REST 端点暴露。宿主检测到网络变化后把包含全部活跃接口集合的 NetworkContext 推给内核；内核按 networks: 列表顺序 first-match 求值，对每个带 policy 的 select 组应用对应目标代理；同一 network 下用户手动选择被尊重，network 切换时自动流程接管。未配置 networks: 时行为与旧版字节级等价。

Closes MetaCubeX/mihomo#1330。设计讨论：#2722。与 clash-verge-rev#1231 的 GUI 侧工作配套。

与之前版本的区别（为什么要 force-push）

之前的 5 commit 版本把 NetworkContext 建模为一张 "primary interface" 快照，顶层直接挂 primary_iface / iface_type / ssid / gateway_mac 等字段。桌面端这种抽象太窄：

• 多网卡共存是常态（有线 + Wi-Fi 同时在线），宿主没有放之四海皆准的 "主接口" 判定法则；选了其中一个就丢失另一个的身份信息。
• {iface-type: vpn, ...} 规则永远匹不到用户自装的 WireGuard（当 VPN 不是 primary 时会被宿主的 "物理接口优先 fallback" 隐藏掉）。
• "家里 Wi-Fi + 公司 VPN" 这类组合条件在单接口 schema 下完全表达不出来。

本 PR 的 v2 设计：

• 宿主上报所有活跃接口（interfaces[]，硬上限 32），外加顶层 dns_suffix 列表。
• Matcher 按 ∃iface ∈ interfaces 求值；同一 block 里多个 per-iface 字段必须由同一张 iface 同时满足（原子 AND）。any: / all: / not: 是语法一级组合子。
• network 间优先级由 networks: 列表顺序表达（first-match），彻底放弃 "primary iface" 概念。

设计整体克制：无 CGO、无新平台依赖、不走订阅推送（保留 YAML 作为 source of truth）。

本 PR 包含什么

12 个 commit，每个都能单独 go build / go vet / go test 通过：

1. feat(network-policy): add package skeleton with multi-interface schema — component/networkpolicy/ 新包，含 NetworkContext / 归一化 / FNV-64a fingerprint / 块级 matcher AST（any: / all: / not: + ∃iface 语义）。
2. feat(network-policy): parse networks and network-policy in config — 接入 config.Parse，ParseNetworks + ParseGroupPolicy（静态代理 fail-fast、provider 节点容忍到首次 PUT、default 为保留 key）。
3. feat(network-policy): persist bucketNetworkPolicy — cachefile 新 bucket 存 {source, last_matched_network}；解码路径容忍 schema 漂移。
4. feat(network-policy): add manager with state machine and TTL — Manager 单例：每组状态机 + 全局 ctx 快照 + generation 防 stale 的 TTL timer + 五条件 TTL 轻量路径 + provider 首载屏障。
5. feat(network-policy): wire manager into executor lifecycle — executor.go 的 Install / Uninstall（包里只导出这两个；Install 内部通过私有的 inheritFrom 完成热重载状态迁移），热重载继承每组状态 / ctx / TTL / 已选代理。
6. feat(network-policy): expose /network/context REST endpoints — hub/route/network.go 注册三个 endpoint，带 10 MiB body cap、严格 JSON 结尾检查、{code, message} 错误码分类。
7. feat(network-policy): hook manual PUT /proxies/:name into state machine — updateProxy 在 selector.Set 成功后调 Manager.HandleManualSet，不带 network-policy 的组行为不变。
8. feat(network-policy): warn on exposed external-controller without secret — 启动期三条件全部成立时输出 warning（有 policy + non-loopback + 无 secret）。
9. refactor(network-policy): narrow exported API surface — 尽可能包内私有，仅保留必要导出面。
10. docs: document network-policy config and REST API — docs/config.yaml 加注释例子块；新增 docs/api.md 完整 REST 参考（覆盖所有 hub/route/ endpoint 以及 /network/context 契约的全部细节）。
11. feat(tun): expose actual bound device name in /configs response — sing_tun.New 的 fd-override 分支补 options.Device = tunName 写回，让 GET /configs.tun.device 返回 listener 实际 bound 名，供 host sampler 过滤 mihomo 自己的 TUN。
12. docs(network-policy): fix dangling reference in config.yaml — review 后修补：commit Full regexp support #10 的注释块指向了未提交的 docs/network-policy.md，改为指向实际存在的 docs/api.md §11（完整字段 / 组合子语义 / REST 契约都在那里）。

运行时语义要点

Manual-wins 状态机：用户手动切换后该组 source=manual；下次 PUT 时：

• matched 未变 + source=manual → manual_locked，保留用户选择。
• matched 变了且落入 matched / already_selected / default / no_change_no_default → auto 接管，source 重置为 auto，last_matched 前进。
• matched 变了但落入 missing_target（policy 求得的目标代理当前不在本组候选）→ 跳过切换，state 保留，等下次 PUT 重试。

DELETE 仅清 ctx 快照，保留状态机（不触发评估、不走 default）。要表达"宿主离线"请发 PUT {version:1, interfaces:[]} 让各组走 default 兜底。

持久化：bucketSelected（既有，proxy 名）+ 新增 bucketNetworkPolicy（{schema_version, source, last_matched}）；均受 profile.store-selected: true 门控。

TTL 轻量路径：五条件全部成立时 PUT 跳过完整评估管线（fingerprint 未变 / 本次与上次都带 ttl / 无 pending missing_target / 候选集未漂移）。

兼容性

未配置 networks: 时行为零变化；不引入 CGO 或新依赖；cachefile 前后双向兼容；wire schema 对未知字段宽容，matcher YAML 对未知 key fail-fast。

测试

go test ./component/networkpolicy/... ./config/... ./adapter/outboundgroup/... ./hub/route/... ./hub/executor/... ./component/profile/cachefile/... ./listener/... 全绿。约 4000 LoC 测试覆盖归一化、fingerprint、matcher 原子 AND、状态机分支（含分支 A/B、provider barrier、startupEvalPending）、TTL 防 stale callback、持久化降级、manual-wins 黄金路径、HandleManualSet + PutContext 并发、REST 错误码端到端、热重载继承。

范围之外

• 宿主侧检测不在本 PR 内。内核契约已稳定，GUI 实现可独立推进。
• 内核不含自动 Linux netlink 采集器。
• metered: matcher 当前 fail-fast（wire 字段保留，三平台 sampler 尚未采集）。
• macOS utun 实际 bound 名仍是 best-effort（pre-bind 估计值），真正的 post-bind 读回延后处理。

[wangwei354]

内核和GUI的联合设计RFC在 #2722

[wangwei354]

Update: clean-slate rewrite (force-pushed)

TL;DR (EN): This PR's branch has been force-pushed (1182a2da → a815cee3) to a ground-up redesign. The original 5-commit revision used a single-primary-interface NetworkContext; it turned out too narrow for common desktop multi-NIC scenarios. No reviewer time had been invested (0 formal review comments), so the in-place rewrite is the least disruptive path. If you'd prefer a new PR number for a clean review history, I'm happy to close + reopen — just say so.

概要（中文）：本 PR 的分支已 force-push 到重新设计版本（1182a2da → a815cee3）。原先 5 commit 版本用单一 primary interface 建模 NetworkContext，实测在桌面常见多网卡场景下表达力不足。原版本没有消耗 reviewer 时间（0 条 formal review comment），in-place 重写是最小扰动方案；如果维护者偏好新 PR 号换一个干净历史，告知即可，我关闭这个并重新开一个。

What changed (high level)

	v1 (original)	v2 (this rewrite)
Wire schema	single primary iface: primary_iface / iface_type / ssid / gateway_mac / dns_suffix at top level	interfaces[] (hard-capped 32) + top-level dns_suffix[]
Matcher semantics	field match against the primary iface	∃iface ∈ interfaces with per-iface atomic AND; any: / all: / not: combinators as grammar primitives
Precedence	implicit (primary wins)	networks: list order — first match wins; "primary" concept dropped
VPN coexistence	hidden when not primary	visible and matchable as iface-type: vpn; cross-iface AND via all:
Error envelope	{"message":"..."}	{"code":"...","message":"..."} with stable code values for structured host handling
DELETE semantics	triggers default evaluation	clears ctx snapshot only, per-group state preserved

What didn't change

• The kernel vs host split. Detection is still the host's job; kernel owns rule semantics, select group state, persistence, REST.
• Manual-wins as a hard-coded invariant (same-matched_network manual picks are respected; switching matched_network hands control back to the auto flow).
• Zero behavior change when networks: is absent.
• No new platform deps, no CGO.

Commit history

Now 11 commits, each independently go build / go vet / go test green:

a815cee3  feat(tun): expose actual bound device name in /configs response
9d62bb4a  docs: document network-policy config and REST API
e95f0e97  refactor(network-policy): narrow exported API surface
2528f5cf  feat(network-policy): warn on exposed external-controller without secret
6c793fb2  feat(network-policy): hook manual PUT /proxies/:name into state machine
798a4123  feat(network-policy): expose /network/context REST endpoints
f5a82d81  feat(network-policy): wire manager into executor lifecycle
c1a40851  feat(network-policy): add manager with state machine and TTL
747d1ca6  feat(network-policy): persist bucketNetworkPolicy
17635000  feat(network-policy): parse networks and network-policy in config
6f7e8588  feat(network-policy): add package skeleton with multi-interface schema

Design discussion updated

The design RFC at #2722 has been updated in lockstep so it reflects the v2 schema, matcher grammar, state machine, and REST contract as shipped in this PR.

The PR description at the top of this page is the single source of truth for review; please refer to that rather than older inline discussion above.

[wangwei354]

从mihomo到Clash Verge Rev 全链路的包：
https://github.com/wangwei354/clash-verge-rev/releases