3x UI Updates & Release Notes

🚀 Native TUIC, Tunnels on Nodes, Xray-core v26.9.30 & Reliable Client Resets

• 🚀 Native TUIC v5 server — TUIC now runs inside the panel in Go, with no external binary to download, BBR congestion control and crash-safe traffic accounting.
• 🌐 AmneziaWG, TUIC & MTProto on nodes — these inbounds can now be created and cloned from the master straight onto a node.
• ⚙️ Xray-core v26.9.30 — stored XDNS masks and WireGuard outbound settings are migrated to the new core's shape automatically.
• 🔁 Client lifecycle you can trust — resets, renewals and quota cuts now reach every counter on every node, and saving an inbound or editing a client no longer reverts changes made in the meantime.
• 🤖 Telegram bot access levels — unknown accounts are locked out, customers link themselves with an invite link, and admins can broadcast to every client.
• 🗓️ Weekly calendar renewal — clients can renew on a fixed weekday, with a preview of the upcoming schedule.
• 📦 Subscription controls — hide an inbound from subscriptions without disabling it, carry traffic through export/import, and set the User-Agent used for external subscriptions.
• 🔐 Security hardening — API token rotation, database restore, certificate fetching and the bot's command surface are all tightened.

---

⚠️ Before you upgrade

Action required …

🚀 Subscription page rebuilt, Xray that survives a bad config, AmneziaWG relay ports & large-fleet node sync

• 🔐 Profile page no longer disclosed — subscription responses stop advertising a link to the built-in profile page, and the page itself is now opt-in.
• 🎨 New subscription page — usage ring, remaining quota, Subscription / Apps / Configs tabs, one-tap import on Android, iOS , and right-to-left rendering for Persian and Arabic.
• 🛡️ Xray stays up on a bad config — a config the running core cannot bind is refused at the restart funnel with the reason shown in the panel, instead of killing every protocol in a one-second retry loop.
• 📡 AmneziaWG relay ports fixed for good — the loopback relay slot now wraps, survives disabled and peerless rows, and refuses a row its own port; on databases with a high inbound-id counter the protocol simply never worked before.
• 🧵 Large node fleets — 32-way sync, pooled per-node HTTP clients, fanned-out fleet operations and no more node I/O inside the traffic writer.
• 🔁 Reverse tunnels survive the panel — a vless reverse client keeps its tunnel across edits, bulk enables, quota renewals and IP-limit cycles.
• 🧭 DNS query type 0 repaired — a stored "qType": 0 blocked every query through that outbound; a one-time migration fixes existing templates.
• 🧰 Panel polish — API docs split into tabs, clickable stat-card filtering on the Clients page.

---

⚠️ Before you upgrade …

🚀 TUIC v5, AmneziaWG outbounds, Discord notifications, Xray-core v26.9.9 & hardened installs

• 🚀 TUIC v5 inbounds — a bundled tuic-server sidecar terminates TUIC and relays into Xray, so TUIC clients get per-client stats, routing and quotas like every other protocol, with tuic:// share links, Clash output and their own QR tab.
• 🛰️ AmneziaWG everywhere — AmneziaWG is now an outbound protocol too, Clash subscriptions can emit AmneziaWG proxies, multi-server NordLynx outbounds arrive alongside, and the embedded tunnel picked up a dozen relay, MTU, keying, locking and throughput fixes.
• 💬 Discord notifications — a Discord bot service mirrors the Telegram alerts with its own settings tab, while the Telegram bot gained ownership checks, HTML escaping, mutex-safe state and panic containment.
• ⚙️ Xray-core v26.9.9 — two core bumps, with one-time template migrations for the keys the new core refuses or deprecates and a follow of the udpHop → udphop mask move.
• 🔐 Hardened installs — release archives ship SHA-256 sums that install.sh/update.sh verify, geo databases are checked against published digests, the management script comes from the tag you installed, the SQLite store is owner-only and fresh panels get random subscription paths. …

🚀 Native AmneziaWG, Calendar-Day Renewals, Scoped API Tokens & Node-Sync Hardening

• 🛡️ Native AmneziaWG 3.1 — AmneziaWG inbounds run in-process on an embedded userspace device with a reconcile manager, so DPI-resistant peers need no kernel module, no Docker and no second panel.
• 🌐 More outbound and routing reach — PIA WireGuard outbounds added by login, remote routing URLs, a client picker inside user rules, and geosite/geoip categories browsable straight from a routing rule.
• 📅 Client lifecycle you can actually bill against — renewals that step whole calendar months, a per-client traffic reset cycle, a cap on auto-renewals, single-device HWID removal, per-client subscription HWID limits and per-client external-link controls.
• 🔑 Credentials that can be scoped and revoked — API tokens now carry scopes and an optional expiry, node API tokens can be encrypted at rest, replacing the TOTP secret requires a 2FA code, and the CLI stopped quietly accumulating admin-equivalent tokens.
• 🔗 Subscription output — client-side balancers in the JSON format, template variables in subscription metadata, an exposed last-fetch time, and a neutral copy-only page when a subscription URL is opened in a browser. …

🚀 Trend-First Overview, xray-core v26.7.28, Subscription Correctness & Panel Hardening

• 🧭 Overview rebuilt as a command deck — the ten small cards are gone: four vitals tiles with 72-sample sparklines, a two-series throughput chart, a TCP/UDP connections chart, a grouped system strip, and a sidebar that became an auto-collapsed icon rail expanding on hover.
• 🛡 xray-core v26.7.28 — the XMC finalmask breaking change is absorbed end to end: incomplete masks are rejected at save time with the missing field named, and only the offending mask is dropped at config-generation time so one bad row can no longer take every inbound offline.
• 🔗 Subscription output correctness — a long run of link and format fixes (forwarded-URL trust, coalesced external refreshes, Clash scalars a YAML parser would misread, VLESS flow gating, external link names, WireGuard Allowed IPs) plus opt-in identity tokens on every link, raw download actions, live online status with a new ?format=info endpoint, and User-Agent format auto-detection.
• 🔐 Panel surface tightened — openapi.json moved behind session auth (it was serving the whole admin API surface unauthenticated), node API tokens became write-only, production sourcemaps no longer ship inside the binary, and the default freedom rules block private-range egress. …

🚀 MTProto Multi-Client, SQLite→PostgreSQL Migration, 500k-Scale Performance & Node Sync Hardening

• 📬 MTProto goes multi-client — MTProto inbounds now run on the mtg-multi engine with one FakeTLS secret per client, per-client ad-tags, and per-client quota & expiry enforced in the sidecar; client edits hot-apply through a management API so live connections survive.
• 🐘 SQLite → PostgreSQL, end to end — the PostgreSQL panel restore now accepts SQLite .db files and migration dumps directly (uploads are sniffed automatically), cross-db migration became lossless, transactional and pre-checked, and a new x-ui pgclient command installs or upgrades the PostgreSQL client tools.
• 🚄 Built for 500k clients — batched ip-limit lookups, depleted-client disables by id, delta WebSocket stats above a snapshot threshold, and subscriptions resolved from normalized tables — pinned by a scale test suite at 500,000 clients.
• 🧠 Frontend platform overhaul — full React Hook Form migration, axios replaced with the native Fetch API, charts moved to uPlot, and Husky / lint-staged / MSW / Storybook dev tooling.
• 🛰️ Node sync hardening — host overrides adopted into the master, no more premature inbound sweeps or Postgres deadlocks in sync, client edits no longer tear down node inbounds, and node auto-renewals open a fresh quota window. …