diff --git a/client/lib/main.dart b/client/lib/main.dart
index 4ced3fa..4522380 100644
--- a/client/lib/main.dart
+++ b/client/lib/main.dart
@@ -1,8 +1,11 @@
 // main.dart — 入口(演示态)
 // 串接:登录 → 引导 → 主框架(4 Tab);状态层统一走 Riverpod。
+import 'dart:ui' as ui;
+
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
+import 'bridge/vpn_bridge_provider.dart';
 import 'pangolin_theme.dart';
 import 'services/token_store.dart';
 import 'shell/home_shell.dart';
@@ -22,11 +25,45 @@ Future<void> main() async {
   runApp(const ProviderScope(child: PangolinApp()));
 }
 
-class PangolinApp extends ConsumerWidget {
+class PangolinApp extends ConsumerStatefulWidget {
   const PangolinApp({super.key});
 
   @override
-  Widget build(BuildContext context, WidgetRef ref) {
+  ConsumerState<PangolinApp> createState() => _PangolinAppState();
+}
+
+class _PangolinAppState extends ConsumerState<PangolinApp> {
+  AppLifecycleListener? _lifecycle;
+
+  @override
+  void initState() {
+    super.initState();
+    if (isDesktop) {
+      // 真退出(Cmd+Q / 托盘退出)前先停内核拆隧道,避免 sing-box 孤儿 + TUN 残留。
+      _lifecycle = AppLifecycleListener(onExitRequested: () async {
+        await _teardownVpn();
+        return ui.AppExitResponse.exit;
+      });
+      TrayService.instance.onBeforeQuit = _teardownVpn;
+    }
+  }
+
+  Future<void> _teardownVpn() async {
+    try {
+      await ref.read(vpnBridgeProvider).stop().timeout(const Duration(seconds: 3));
+    } catch (_) {
+      // 内核未启动/已退出:忽略。
+    }
+  }
+
+  @override
+  void dispose() {
+    _lifecycle?.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
     final mode = ref.watch(themeModeProvider);
     return MaterialApp(
       title: '穿山甲',
diff --git a/client/lib/system_tray.dart b/client/lib/system_tray.dart
index 478f2cb..01c72fa 100644
--- a/client/lib/system_tray.dart
+++ b/client/lib/system_tray.dart
@@ -15,6 +15,9 @@ class TrayService with TrayListener, WindowListener {
   TrayService._();
   static final TrayService instance = TrayService._();
 
+  /// 真正退出前的清理钩子(由 app 注册,用于先停内核拆隧道再退出)。
+  Future<void> Function()? onBeforeQuit;
+
   /// 在 runApp 前调用(仅桌面端)。设置窗口拦截关闭 + 托盘图标与菜单。
   Future<void> init() async {
     await windowManager.ensureInitialized();
@@ -45,13 +48,15 @@ class TrayService with TrayListener, WindowListener {
   void onTrayIconRightMouseDown() => trayManager.popUpContextMenu();
 
   @override
-  void onTrayMenuItemClick(MenuItem menuItem) {
+  void onTrayMenuItemClick(MenuItem menuItem) async {
     switch (menuItem.key) {
       case 'show':
         _show();
       case 'quit':
-        windowManager.setPreventClose(false);
-        windowManager.destroy();
+        // 退出前先停内核拆隧道(避免 sudo sing-box 孤儿 + TUN 残留)。
+        await onBeforeQuit?.call();
+        await windowManager.setPreventClose(false);
+        await windowManager.destroy();
     }
   }