Merge branch 'main' into feat/configurable-proxy

# Conflicts:
#	.gitignore
#	client/lib/l10n/strings_es.dart
#	client/lib/l10n/strings_ja.dart
#	client/lib/l10n/strings_ko.dart
#	client/lib/l10n/strings_ru.dart
#	docs/index.html
#	scripts/local_test.sh

client/ios/PacketTunnel/PacketTunnelProvider.swift

@@ -206,6 +206,7 @@ final class PangolinPlatformInterface: NSObject, LibboxPlatformInterfaceProtocol
             let ipv4 = NEIPv4Settings(addresses: v4addrs.map(\.address),
                                       subnetMasks: v4addrs.map(\.mask))
             ipv4.includedRoutes = includedRoutes4(options)
+            ipv4.excludedRoutes = excludedRoutes4(options)
             settings.ipv4Settings = ipv4
         }
         let v6addrs = routePrefixes(options.getInet6Address())
@@ -213,6 +214,7 @@ final class PangolinPlatformInterface: NSObject, LibboxPlatformInterfaceProtocol
             let ipv6 = NEIPv6Settings(addresses: v6addrs.map(\.address),
                                       networkPrefixLengths: v6addrs.map { NSNumber(value: $0.prefix) })
             ipv6.includedRoutes = includedRoutes6(options)
+            ipv6.excludedRoutes = excludedRoutes6(options)
             settings.ipv6Settings = ipv6
         }
         if let dns = try? options.getDNSServerAddress(), !dns.value.isEmpty {
@@ -311,6 +313,19 @@ final class PangolinPlatformInterface: NSObject, LibboxPlatformInterfaceProtocol
                                    networkPrefixLength: NSNumber(value: $0.prefix)) }
     }
 
+    // 排除路由:sing-box config 的 route_exclude_address(私有 LAN 网段)经 libbox
+    // 暴露在此。之前只设 includedRoutes、丢了 excludedRoutes → strict_route 把 LAN 也
+    // 抓进隧道,VPN 开着连不上局域网/NAS/家里机器。设上 excludedRoutes 后 LAN 直连。
+    private func excludedRoutes4(_ o: any LibboxTunOptionsProtocol) -> [NEIPv4Route] {
+        routePrefixes(o.getInet4RouteExcludeAddress())
+            .map { NEIPv4Route(destinationAddress: $0.address, subnetMask: $0.mask) }
+    }
+    private func excludedRoutes6(_ o: any LibboxTunOptionsProtocol) -> [NEIPv6Route] {
+        routePrefixes(o.getInet6RouteExcludeAddress())
+            .map { NEIPv6Route(destinationAddress: $0.address,
+                               networkPrefixLength: NSNumber(value: $0.prefix)) }
+    }
+
     // utun fd:getpeername 得 sockaddr_ctl,匹配 utun 控制 id(WireGuard 技法)
     private static func tunFd() -> Int32? {
         var ctlInfo = ctl_info()