* feat(config): add conditions while preserving mask rules
Accept conditions alongside the existing masks and mask spellings, rejecting conflicting matching fields and flat-source combinations. Normalize all forms into the existing predicate engine.
Add explicit masks leaves for composed expressions and source groups. Keep simple address exports compact and serialize richer rules under conditions.
Cover round-trips, nested source discovery, controller payloads, warning-free compatibility, and routing across accepted and rejected reloads.
* docs(routing): explain conditions and compatible mask syntax
Document expression composition, conflicting fields, source shorthand, and canonical serialization in English and Chinese. Record the controller diagnostic shape in the changelog.
Add a complete conditions example, validate it through the native configuration pipeline, and show conditions in the rule-source example.
* fix(config): clarify invalid rule conditions diagnostics
Name the mutually exclusive matching fields explicitly, including legacy aliases, instead of reporting an unwritten duplicate conditions key.
Explain that nested masks leaves accept only strings or nonempty string lists, with regression tests for JSON/YAML conflicts and invalid leaf shapes.
* refactor(tests): simplify rule conditions coverage
Stage all spelling and format variants before checking their shared canonical form. Restore that form once while preserving per-variant compilation and the complete decision matrix.
Remove conflict inputs already covered by stronger diagnostic assertions, clarify controller payload names, and validate all five rule forms in one fixture per CLI mode.
* fix(rules): correct source-group predicate guidance
Recommend the rule_source_group predicate without a masks wrapper so the rename hint works in nested expressions and source groups. Cover the suggested syntax and diagnostic in regression tests.
Update both documentation locales to describe source-group references under conditions or masks, including boolean composition.
Report shared selector and group ancestry once per selected occurrence while preserving reverse hop order, independently repeated references, routing behavior, and catalog identities. Cover nested selections and pinned TCP/UDP flows, simplify reporting metadata assembly, and clarify chain ordering, client naming, and DIRECT-to-proxy semantics in both controller guides.
Keep managed desktop capture working without native default routes or usable loopback addresses. Add local-only fallback routing with fail-closed TUN egress guards, preserve strict ownership and native exclusions, enable IPv6 only on the owned TUN, and keep automatic DNS reachable with split routes.
Allow rule caches in directories accessible through group permissions or ACLs without requiring directory ownership, and create missing cache directories and parents automatically. Existing ownership and permissions remain unchanged, while world-writable directories, unsafe cache files, and conflicting cache leases remain rejected. Clarify the startup and cache-save permission requirements.
Add optional NTP synchronization for hosts where shoes cannot set the system clock. Share the corrected time across REALITY, VMess, Shadowsocks 2022, and TLS certificate validation, using protected direct UDP with bounded synchronization, periodic refresh, and reload-safe ownership. Preserve timestamp windows and replay protection, retain the last correction on refresh failure, and document configuration and clock limitations.
Add optional global_settings.default_dns so listeners, TUN entries, and WireGuard inbounds can share DNS configuration without repetition. Omitted or null inbound DNS inherits the default, while explicit objects override it completely. Inline fake-IP defaults share one pool, and independent bootstrap and service lookups remain unchanged. Includes validation, regression coverage, and English and Chinese documentation.
Allow client groups to select complete paths of different lengths consistently across forwarding, DNS, downloads, and carrier routes. Separate source configuration from bounded runtime plans, preserve selection boundaries and per-flow path pinning, and keep TCP/UDP rotation and automatic selection independent. Unify chain syntax while retaining legacy proxy-list alternatives, and cache up to 16 NaiveProxy sessions by selected prefix, pruning closed entries before LRU eviction without interrupting active tunnels. Add routing measurements, lifecycle coverage, and updated English and Chinese configuration guidance.
* Validate published configuration examples
* Move configuration reference into Starlight site
* Check documentation site in CI
* Complete optional docs dependency lock entries
cfal