From ec9d373ab8770cb53a5f3c7b051cb3f6bc05acf8 Mon Sep 17 00:00:00 2001
From: inliver233 <inliver23@outlook.com>
Date: Wed, 25 Feb 2026 02:13:06 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0wtf=E9=A1=B6=E9=83=A8?=
 =?UTF-8?q?=E7=AD=9B=E9=80=89=E5=B8=83=E5=B1=80|=E5=AE=9E=E7=8E=B0?=
 =?UTF-8?q?=E6=A0=87=E7=AD=BE=E6=8E=92=E9=99=A4=E7=AD=9B=E9=80=89|?=
 =?UTF-8?q?=E6=94=AF=E6=8C=81proxy=E5=8F=82=E6=95=B0=E8=87=AA=E5=AE=9A?=
 =?UTF-8?q?=E4=B9=89=E5=8F=8D=E4=BB=A3|=E5=A2=9E=E5=8A=A0=E7=AE=80?=
 =?UTF-8?q?=E5=8D=95=E7=9A=84=E6=A6=82=E8=A6=81=E6=A0=87=E7=AD=BE|?=
 =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E7=80=91=E5=B8=83=E6=B5=81=E9=80=89=E4=B8=AD?=
 =?UTF-8?q?=E5=8F=8D=E9=A6=88=E4=B8=8E=E5=8D=95=E5=87=BB=E6=94=BE=E5=A4=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/app/api/admin/settings.py        |  29 +-
 backend/app/api/public/docs_page.py      |  22 +-
 backend/app/api/public/images.py         |  19 +-
 backend/app/api/public/legacy.py         |  39 +-
 backend/app/api/public/random.py         |  31 +-
 backend/app/api/public/wtf_page.py       | 918 ++++++++++++++++++++++-
 backend/app/core/pximg_reverse_proxy.py  |  90 ++-
 backend/app/core/runtime_settings.py     |  19 +-
 frontend/src/pages/SettingsPage.test.tsx |   7 +-
 frontend/src/pages/SettingsPage.tsx      |  10 +
 10 files changed, 1130 insertions(+), 54 deletions(-)

diff --git a/backend/app/api/admin/settings.py b/backend/app/api/admin/settings.py
index 29e15f6..b9c3265 100644
--- a/backend/app/api/admin/settings.py
+++ b/backend/app/api/admin/settings.py
@@ -12,7 +12,11 @@ from app.core.runtime_settings import (
     runtime_config_from_values,
     set_runtime_setting,
 )
-from app.core.pximg_reverse_proxy import DEFAULT_PXIMG_MIRROR_HOST, normalize_pximg_mirror_host
+from app.core.pximg_reverse_proxy import (
+    DEFAULT_PXIMG_MIRROR_HOST,
+    normalize_pximg_custom_mirror_host,
+    normalize_pximg_mirror_host,
+)
 
 router = APIRouter()
 
@@ -255,6 +259,7 @@ async def get_settings(
             "image_proxy": {
                 "use_pixiv_cat": bool(runtime.image_proxy_use_pixiv_cat),
                 "pximg_mirror_host": str(runtime.image_proxy_pximg_mirror_host or DEFAULT_PXIMG_MIRROR_HOST),
+                "extra_pximg_mirror_hosts": list(getattr(runtime, "image_proxy_extra_pximg_mirror_hosts", []) or []),
             },
             "random": random_defaults,
             "security": {"hide_origin_url_in_public_json": bool(runtime.hide_origin_url_in_public_json)},
@@ -371,6 +376,28 @@ async def update_settings(
                     raise ApiError(code=ErrorCode.BAD_REQUEST, message="Invalid image_proxy.pximg_mirror_host", status_code=400)
                 updates.append(("image_proxy.pximg_mirror_host", str(host)))
 
+        if "extra_pximg_mirror_hosts" in image_proxy:
+            raw = image_proxy.get("extra_pximg_mirror_hosts")
+            if raw is None:
+                updates.append(("image_proxy.extra_pximg_mirror_hosts", []))
+            else:
+                if not isinstance(raw, list):
+                    raise ApiError(code=ErrorCode.BAD_REQUEST, message="Invalid image_proxy.extra_pximg_mirror_hosts", status_code=400)
+                candidates = _as_str_list(raw)
+                if len(candidates) > 200:
+                    raise ApiError(code=ErrorCode.BAD_REQUEST, message="Invalid image_proxy.extra_pximg_mirror_hosts", status_code=400)
+                normalized: list[str] = []
+                seen: set[str] = set()
+                for item in candidates:
+                    host = normalize_pximg_custom_mirror_host(item)
+                    if host is None:
+                        raise ApiError(code=ErrorCode.BAD_REQUEST, message="Invalid image_proxy.extra_pximg_mirror_hosts", status_code=400)
+                    if host in seen:
+                        continue
+                    seen.add(host)
+                    normalized.append(host)
+                updates.append(("image_proxy.extra_pximg_mirror_hosts", normalized))
+
     random = body.get("random")
     if random is not None:
         if not isinstance(random, dict):
diff --git a/backend/app/api/public/docs_page.py b/backend/app/api/public/docs_page.py
index 36ee5a3..e20927c 100644
--- a/backend/app/api/public/docs_page.py
+++ b/backend/app/api/public/docs_page.py
@@ -19,6 +19,7 @@ def _build_docs_html(*, base_url: str) -> str:
 
     examples = {
         "img_default": u("/random"),
+        "img_proxy_cat": u("/random?proxy=i-pixiv-cat"),
         "img_pixiv_cat": u("/random?pixiv_cat=1"),
         "img_pixiv_re": u("/random?pixiv_cat=1&pximg_mirror_host=re"),
         "img_redirect": u("/random?redirect=1"),
@@ -303,7 +304,8 @@ def _build_docs_html(*, base_url: str) -> str:
       <p><span class="kbd">/status</span> 为公开仪表盘：展示 API 状态、图库概览、/random 请求统计；<span class="kbd">/status.json</span> 为机器可读 JSON。</p>
       <pre><code>{examples["status"]}
 {examples["status_json"]}</code></pre>
-      <p><span class="kbd">/wtf</span> 为瀑布流：参数与 <span class="kbd">/random</span> 完全一致（例如 r18/标签/分辨率/热度等），页面内部会自动加上 <span class="kbd">adaptive=1</span> 与 <span class="kbd">redirect=1</span> 来做屏幕适配与稳定链接。</p>
+      <p><span class="kbd">/wtf</span> 为瀑布流：支持 <span class="kbd">/random</span> 的全部过滤参数（例如 r18/标签/分辨率/热度/排除标签等），默认会补上 <span class="kbd">adaptive=1</span> 以更适合不同屏幕。</p>
+      <p class="muted">/wtf 额外支持布局参数：<code>view=single|masonry|tiles</code>，以及 <code>wtf_mcols</code>/<code>wtf_mgap</code>/<code>wtf_tcols</code>/<code>wtf_tgap</code>/<code>wtf_tratio</code>（仅影响页面布局）。另有 <code>wtf_gender=girls|boys</code> 与概要标签 <code>@male</code>/<code>@female</code>（仅 /wtf 端展开，用于快速“只看女生/只看男生”）。</p>
       <pre><code>{examples["wtf"]}
 {examples["wtf_r18"]}</code></pre>
     </section>
@@ -332,6 +334,15 @@ def _build_docs_html(*, base_url: str) -> str:
               <span class="muted">quality 会先抽样 N 张候选再按热度/分辨率打分选图。</span>
             </td>
           </tr>
+          <tr>
+            <td><code>proxy</code></td>
+            <td>
+              指定本次请求的图片上游镜像（优先级最高）。会隐式开启第三方镜像（等价于 <code>pixiv_cat=1</code>），并覆盖地区自动选择。<br/>
+              内置值：<code>cat</code>/<code>re</code>/<code>nl</code>，也支持 <code>pixiv-cat</code>/<code>i-pixiv-cat</code> 等写法。<br/>
+              自定义镜像：可填写你自建镜像域名（需在管理端“自定义镜像白名单”允许）。<br/>
+              示例：<a href="{examples["img_proxy_cat"]}">{examples["img_proxy_cat"]}</a>
+            </td>
+          </tr>
           <tr>
             <td><code>pixiv_cat</code></td>
             <td>
@@ -417,6 +428,15 @@ def _build_docs_html(*, base_url: str) -> str:
       <p>示例：R18 + 插画 + 竖图 + 250万像素以上 + 收藏≥2 + 评论≥5 + 标签包含 loli（直接出图）。</p>
       <pre><code>{examples["complex"]}</code></pre>
     </section>
+
+    <section class="card" style="margin-top: 14px;">
+      <h2>6) 管理端导入（可选）</h2>
+      <p class="muted">管理端支持从文件批量导入图片链接：.txt（每行一个 URL）或 PixivBatchDownloader 导出的 .json。</p>
+      <ul>
+        <li><strong>.json</strong> 导入会自动提取图片链接，并尽可能填充已有元数据/标签；不依赖 refresh token 也能使用（无需额外触发补全）。</li>
+        <li><strong>.txt</strong> 导入仅包含 URL，推荐在有 refresh token 时启用导入后补全，以获得更完整的标签/尺寸/R18/AI 等信息。</li>
+      </ul>
+    </section>
   </div>
 </body>
 </html>
diff --git a/backend/app/api/public/images.py b/backend/app/api/public/images.py
index 0b483c0..48f4700 100644
--- a/backend/app/api/public/images.py
+++ b/backend/app/api/public/images.py
@@ -14,6 +14,7 @@ import sqlalchemy as sa
 from app.core.pixiv_urls import ALLOWED_IMAGE_EXTS
 from app.core.pximg_reverse_proxy import (
     normalize_pximg_mirror_host,
+    normalize_pximg_proxy,
     pick_pximg_mirror_host_for_request,
     rewrite_pximg_to_mirror,
 )
@@ -277,6 +278,7 @@ async def proxy_image(
     background_tasks: BackgroundTasks,
     pixiv_cat: int = 0,
     pximg_mirror_host: str | None = None,
+    proxy: str | None = None,
 ):
     ext = (ext or "").lower()
     if ext not in ALLOWED_IMAGE_EXTS:
@@ -284,12 +286,12 @@ async def proxy_image(
     if pixiv_cat not in {0, 1}:
         raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported pixiv_cat", status_code=400)
 
-    mirror_host_override: str | None = None
+    pximg_mirror_host_override: str | None = None
     if pximg_mirror_host is not None:
         raw = str(pximg_mirror_host or "").strip()
         if raw:
-            mirror_host_override = normalize_pximg_mirror_host(raw)
-            if mirror_host_override is None:
+            pximg_mirror_host_override = normalize_pximg_mirror_host(raw)
+            if pximg_mirror_host_override is None:
                 raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported pximg_mirror_host", status_code=400)
 
     engine = request.app.state.engine
@@ -327,7 +329,16 @@ async def proxy_image(
             needs_hydrate = tag_row is None
 
     runtime = await load_runtime_config(engine)
-    use_pixiv_cat = bool(runtime.image_proxy_use_pixiv_cat) or int(pixiv_cat) == 1
+    proxy_override: str | None = None
+    if proxy is not None:
+        raw = str(proxy or "").strip()
+        if raw:
+            proxy_override = normalize_pximg_proxy(raw, extra_hosts=runtime.image_proxy_extra_pximg_mirror_hosts)
+            if proxy_override is None:
+                raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported proxy", status_code=400)
+
+    mirror_host_override = proxy_override or pximg_mirror_host_override
+    use_pixiv_cat = bool(runtime.image_proxy_use_pixiv_cat) or int(pixiv_cat) == 1 or proxy_override is not None
     runtime_mirror_host = str(getattr(runtime, "image_proxy_pximg_mirror_host", "") or "").strip() or "i.pixiv.cat"
     mirror_host = mirror_host_override or (
         pick_pximg_mirror_host_for_request(headers=request.headers, fallback_host=runtime_mirror_host)
diff --git a/backend/app/api/public/legacy.py b/backend/app/api/public/legacy.py
index c2862cb..9f82bf9 100644
--- a/backend/app/api/public/legacy.py
+++ b/backend/app/api/public/legacy.py
@@ -7,6 +7,7 @@ from app.core.http_stream import stream_url
 from app.core.pixiv_urls import ALLOWED_IMAGE_EXTS
 from app.core.pximg_reverse_proxy import (
     normalize_pximg_mirror_host,
+    normalize_pximg_proxy,
     pick_pximg_mirror_host_for_request,
     rewrite_pximg_to_mirror,
 )
@@ -26,6 +27,7 @@ async def legacy_multi(
     ext: str,
     pixiv_cat: int = 0,
     pximg_mirror_host: str | None = None,
+    proxy: str | None = None,
 ):
     if int(illust_id) <= 0:
         raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported illust_id", status_code=400)
@@ -38,12 +40,12 @@ async def legacy_multi(
     if pixiv_cat not in {0, 1}:
         raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported pixiv_cat", status_code=400)
 
-    mirror_host_override: str | None = None
+    pximg_mirror_host_override: str | None = None
     if pximg_mirror_host is not None:
         raw = str(pximg_mirror_host or "").strip()
         if raw:
-            mirror_host_override = normalize_pximg_mirror_host(raw)
-            if mirror_host_override is None:
+            pximg_mirror_host_override = normalize_pximg_mirror_host(raw)
+            if pximg_mirror_host_override is None:
                 raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported pximg_mirror_host", status_code=400)
 
     engine = request.app.state.engine
@@ -55,7 +57,17 @@ async def legacy_multi(
             raise ApiError(code=ErrorCode.NOT_FOUND, message="Image not found", status_code=404)
 
     runtime = await load_runtime_config(engine)
-    use_pixiv_cat = bool(runtime.image_proxy_use_pixiv_cat) or int(pixiv_cat) == 1
+
+    proxy_override: str | None = None
+    if proxy is not None:
+        raw = str(proxy or "").strip()
+        if raw:
+            proxy_override = normalize_pximg_proxy(raw, extra_hosts=runtime.image_proxy_extra_pximg_mirror_hosts)
+            if proxy_override is None:
+                raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported proxy", status_code=400)
+
+    mirror_host_override = proxy_override or pximg_mirror_host_override
+    use_pixiv_cat = bool(runtime.image_proxy_use_pixiv_cat) or int(pixiv_cat) == 1 or proxy_override is not None
     runtime_mirror_host = str(getattr(runtime, "image_proxy_pximg_mirror_host", "") or "").strip() or "i.pixiv.cat"
     mirror_host = mirror_host_override or (
         pick_pximg_mirror_host_for_request(headers=request.headers, fallback_host=runtime_mirror_host)
@@ -91,6 +103,7 @@ async def legacy_single(
     ext: str,
     pixiv_cat: int = 0,
     pximg_mirror_host: str | None = None,
+    proxy: str | None = None,
 ):
     if int(illust_id) <= 0:
         raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported illust_id", status_code=400)
@@ -101,12 +114,12 @@ async def legacy_single(
     if pixiv_cat not in {0, 1}:
         raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported pixiv_cat", status_code=400)
 
-    mirror_host_override: str | None = None
+    pximg_mirror_host_override: str | None = None
     if pximg_mirror_host is not None:
         raw = str(pximg_mirror_host or "").strip()
         if raw:
-            mirror_host_override = normalize_pximg_mirror_host(raw)
-            if mirror_host_override is None:
+            pximg_mirror_host_override = normalize_pximg_mirror_host(raw)
+            if pximg_mirror_host_override is None:
                 raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported pximg_mirror_host", status_code=400)
 
     engine = request.app.state.engine
@@ -118,7 +131,17 @@ async def legacy_single(
             raise ApiError(code=ErrorCode.NOT_FOUND, message="Image not found", status_code=404)
 
     runtime = await load_runtime_config(engine)
-    use_pixiv_cat = bool(runtime.image_proxy_use_pixiv_cat) or int(pixiv_cat) == 1
+
+    proxy_override: str | None = None
+    if proxy is not None:
+        raw = str(proxy or "").strip()
+        if raw:
+            proxy_override = normalize_pximg_proxy(raw, extra_hosts=runtime.image_proxy_extra_pximg_mirror_hosts)
+            if proxy_override is None:
+                raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported proxy", status_code=400)
+
+    mirror_host_override = proxy_override or pximg_mirror_host_override
+    use_pixiv_cat = bool(runtime.image_proxy_use_pixiv_cat) or int(pixiv_cat) == 1 or proxy_override is not None
     runtime_mirror_host = str(getattr(runtime, "image_proxy_pximg_mirror_host", "") or "").strip() or "i.pixiv.cat"
     mirror_host = mirror_host_override or (
         pick_pximg_mirror_host_for_request(headers=request.headers, fallback_host=runtime_mirror_host)
diff --git a/backend/app/api/public/random.py b/backend/app/api/public/random.py
index 26efafe..36ef04f 100644
--- a/backend/app/api/public/random.py
+++ b/backend/app/api/public/random.py
@@ -15,6 +15,7 @@ from app.core.http_stream import stream_url
 from app.core.imgproxy import build_signed_processing_url, load_imgproxy_config_from_settings
 from app.core.pximg_reverse_proxy import (
     normalize_pximg_mirror_host,
+    normalize_pximg_proxy,
     pick_pximg_mirror_host_for_request,
     rewrite_pximg_to_mirror,
 )
@@ -131,6 +132,7 @@ async def random_image(
     adaptive: int = 0,
     pixiv_cat: int = 0,
     pximg_mirror_host: str | None = None,
+    proxy: str | None = None,
     min_width: int = 0,
     min_height: int = 0,
     min_pixels: int = 0,
@@ -185,12 +187,12 @@ async def random_image(
     if pixiv_cat not in {0, 1}:
         raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported pixiv_cat", status_code=400)
 
-    mirror_host_override: str | None = None
+    pximg_mirror_host_override: str | None = None
     if pximg_mirror_host is not None:
         raw = str(pximg_mirror_host or "").strip()
         if raw:
-            mirror_host_override = normalize_pximg_mirror_host(raw)
-            if mirror_host_override is None:
+            pximg_mirror_host_override = normalize_pximg_mirror_host(raw)
+            if pximg_mirror_host_override is None:
                 raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported pximg_mirror_host", status_code=400)
 
     layout_source = "orientation"
@@ -381,7 +383,17 @@ async def random_image(
     engine = request.app.state.engine
     Session = create_sessionmaker(engine)
     runtime = await load_runtime_config(engine)
-    use_pixiv_cat = bool(runtime.image_proxy_use_pixiv_cat) or int(pixiv_cat) == 1
+
+    proxy_override: str | None = None
+    if proxy is not None:
+        raw = str(proxy or "").strip()
+        if raw:
+            proxy_override = normalize_pximg_proxy(raw, extra_hosts=runtime.image_proxy_extra_pximg_mirror_hosts)
+            if proxy_override is None:
+                raise ApiError(code=ErrorCode.BAD_REQUEST, message="Unsupported proxy", status_code=400)
+
+    mirror_host_override = proxy_override or pximg_mirror_host_override
+    use_pixiv_cat = bool(runtime.image_proxy_use_pixiv_cat) or int(pixiv_cat) == 1 or proxy_override is not None
     runtime_mirror_host = str(getattr(runtime, "image_proxy_pximg_mirror_host", "") or "").strip() or "i.pixiv.cat"
     mirror_host = mirror_host_override or (
         pick_pximg_mirror_host_for_request(headers=request.headers, fallback_host=runtime_mirror_host)
@@ -757,10 +769,13 @@ async def random_image(
 
         if format == "image" and redirect == 1:
             qp: list[tuple[str, str]] = []
-            if int(pixiv_cat) == 1:
-                qp.append(("pixiv_cat", "1"))
-            if mirror_host_override is not None:
-                qp.append(("pximg_mirror_host", str(mirror_host_override)))
+            if proxy_override is not None:
+                qp.append(("proxy", str(proxy_override)))
+            else:
+                if int(pixiv_cat) == 1:
+                    qp.append(("pixiv_cat", "1"))
+                if pximg_mirror_host_override is not None:
+                    qp.append(("pximg_mirror_host", str(pximg_mirror_host_override)))
             qs = ("?" + "&".join([f"{k}={v}" for k, v in qp])) if qp else ""
             resp = RedirectResponse(
                 url=f"/i/{image.id}.{image.ext}{qs}",
diff --git a/backend/app/api/public/wtf_page.py b/backend/app/api/public/wtf_page.py
index a3230cf..62a9dc9 100644
--- a/backend/app/api/public/wtf_page.py
+++ b/backend/app/api/public/wtf_page.py
@@ -43,6 +43,9 @@ def _build_wtf_html(*, base_url: str) -> str:
       --accent: #c07046;
       --ok: #1f7a56;
       --bad: #b42318;
+      --tile-cols: 4;
+      --tile-gap: 16px;
+      --masonry-gap: 0px;
       --mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
       --sans: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, "Apple Color Emoji","Segoe UI Emoji";
     }}
@@ -129,6 +132,10 @@ def _build_wtf_html(*, base_url: str) -> str:
       color: rgba(43, 29, 22, 0.90);
     }}
     .btn:hover {{ filter: brightness(0.98); }}
+    .btn.primary {{
+      background: rgba(192, 112, 70, 0.16);
+      border-color: rgba(162, 82, 44, 0.34);
+    }}
 
     .seg {{
       display: inline-flex;
@@ -162,6 +169,7 @@ def _build_wtf_html(*, base_url: str) -> str:
     }}
 
     .muted {{ color: var(--muted2); }}
+    .muted.tight {{ font-size: 12px; }}
     code {{
       font-family: var(--mono);
       font-size: 12px;
@@ -185,6 +193,7 @@ def _build_wtf_html(*, base_url: str) -> str:
       box-shadow: 0 10px 30px rgba(40, 24, 16, 0.06);
       content-visibility: auto;
       contain-intrinsic-size: 800px;
+      position: relative;
     }}
     @keyframes shimmer {{
       0% {{ background-position: 0% 0; }}
@@ -230,11 +239,20 @@ def _build_wtf_html(*, base_url: str) -> str:
       opacity: 0;
       transform: translateY(3px);
       transition: opacity 180ms ease, transform 220ms ease;
+      cursor: zoom-in;
     }}
     .item.loaded img {{
       opacity: 1;
       transform: translateY(0px);
     }}
+    .item:hover img {{
+      outline: 2px solid rgba(162, 82, 44, 0.42);
+      outline-offset: -2px;
+    }}
+    .item.selected img {{
+      outline: 3px solid rgba(162, 82, 44, 0.62);
+      outline-offset: -3px;
+    }}
     .sentinel {{
       text-align: center;
       padding: 12px 0 0;
@@ -257,7 +275,7 @@ def _build_wtf_html(*, base_url: str) -> str:
       margin-top: 14px;
       display: flex;
       flex-direction: row;
-      gap: 0;
+      gap: var(--masonry-gap);
       align-items: flex-start;
       width: 100%;
     }}
@@ -265,7 +283,7 @@ def _build_wtf_html(*, base_url: str) -> str:
       flex: 1 1 0;
       display: flex;
       flex-direction: column;
-      gap: 0;
+      gap: var(--masonry-gap);
       line-height: 0;
       min-width: 0;
     }}
@@ -295,26 +313,17 @@ def _build_wtf_html(*, base_url: str) -> str:
     body.view-tiles .feed {{
       margin-top: 14px;
       display: grid;
-      grid-template-columns: repeat(4, minmax(0, 1fr));
-      gap: 16px;
+      grid-template-columns: repeat(var(--tile-cols), minmax(0, 1fr));
+      gap: var(--tile-gap);
     }}
     @media (max-width: 1100px) {{
-      body.view-tiles .feed {{
-        grid-template-columns: repeat(3, minmax(0, 1fr));
-        gap: 14px;
-      }}
+      :root {{ --tile-cols: 3; --tile-gap: 14px; }}
     }}
     @media (max-width: 760px) {{
-      body.view-tiles .feed {{
-        grid-template-columns: repeat(2, minmax(0, 1fr));
-        gap: 12px;
-      }}
+      :root {{ --tile-cols: 2; --tile-gap: 12px; }}
     }}
     @media (max-width: 520px) {{
-      body.view-tiles .feed {{
-        grid-template-columns: repeat(2, minmax(0, 1fr));
-        gap: 10px;
-      }}
+      :root {{ --tile-cols: 2; --tile-gap: 10px; }}
     }}
     body.view-tiles .item {{
       border-radius: 14px;
@@ -354,6 +363,165 @@ def _build_wtf_html(*, base_url: str) -> str:
       outline: 2px solid rgba(162, 82, 44, 0.55);
       outline-offset: 2px;
     }}
+
+    details.settings {{
+      margin-top: 10px;
+      border: 1px solid var(--border);
+      background: rgba(255, 250, 243, 0.90);
+      border-radius: 12px;
+      padding: 10px 10px 10px;
+    }}
+    details.settings summary {{
+      cursor: pointer;
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      gap: 10px;
+      user-select: none;
+      color: rgba(43, 29, 22, 0.92);
+      font-size: 13px;
+      list-style: none;
+    }}
+    details.settings summary::-webkit-details-marker {{ display: none; }}
+    details.settings[open] summary {{ margin-bottom: 10px; }}
+    .settings-grid {{
+      display: grid;
+      grid-template-columns: repeat(4, minmax(0, 1fr));
+      gap: 10px;
+    }}
+    @media (max-width: 980px) {{
+      .settings-grid {{ grid-template-columns: repeat(2, minmax(0, 1fr)); }}
+    }}
+    @media (max-width: 520px) {{
+      .settings-grid {{ grid-template-columns: 1fr; }}
+    }}
+    .field label {{
+      display: block;
+      margin: 0 0 5px;
+      font-size: 11px;
+      color: var(--muted2);
+    }}
+    .ctrl {{
+      width: 100%;
+      border: 1px solid var(--border);
+      background: rgba(43, 29, 22, 0.04);
+      border-radius: 10px;
+      padding: 8px 10px;
+      font-size: 12px;
+      color: rgba(43, 29, 22, 0.92);
+    }}
+    textarea.ctrl {{
+      min-height: 48px;
+      resize: vertical;
+      font-family: var(--mono);
+      line-height: 1.4;
+    }}
+    .quick {{
+      margin-top: 10px;
+      display: flex;
+      flex-wrap: wrap;
+      gap: 8px;
+      align-items: center;
+    }}
+    .qchip {{
+      cursor: pointer;
+      border: 1px solid var(--border);
+      background: rgba(255, 250, 243, 0.92);
+      border-radius: 999px;
+      padding: 6px 10px;
+      font-size: 12px;
+      color: rgba(43, 29, 22, 0.90);
+      white-space: nowrap;
+    }}
+    .qchip:hover {{ filter: brightness(0.98); }}
+    .qchip.active {{
+      border-color: rgba(162, 82, 44, 0.36);
+      background: rgba(192, 112, 70, 0.12);
+    }}
+    .actions {{
+      margin-top: 10px;
+      display: flex;
+      flex-wrap: wrap;
+      gap: 8px;
+      align-items: center;
+    }}
+
+    .modal {{
+      position: fixed;
+      inset: 0;
+      display: none;
+      align-items: center;
+      justify-content: center;
+      padding: 18px;
+      z-index: 9999;
+    }}
+    @media (max-width: 520px) {{
+      .modal {{ padding: 10px; }}
+    }}
+    .modal.open {{ display: flex; }}
+    .modal-backdrop {{
+      position: absolute;
+      inset: 0;
+      background: rgba(24, 16, 12, 0.68);
+      backdrop-filter: blur(4px);
+    }}
+    .modal-card {{
+      position: relative;
+      z-index: 1;
+      width: min(1120px, 96vw);
+      max-height: 92vh;
+      border: 1px solid rgba(255, 255, 255, 0.14);
+      background: rgba(255, 250, 243, 0.96);
+      border-radius: 16px;
+      box-shadow: 0 22px 60px rgba(0,0,0,0.28);
+      overflow: hidden;
+      display: flex;
+      flex-direction: column;
+    }}
+    .modal-card img {{
+      width: 100%;
+      height: auto;
+      max-height: 82vh;
+      object-fit: contain;
+      background: rgba(43, 29, 22, 0.06);
+    }}
+    .modal-close {{
+      position: absolute;
+      top: 8px;
+      right: 8px;
+      width: 34px;
+      height: 34px;
+      border-radius: 10px;
+      border: 1px solid rgba(58, 38, 26, 0.18);
+      background: rgba(255, 250, 243, 0.92);
+      cursor: pointer;
+      font-size: 18px;
+      line-height: 32px;
+      color: rgba(43, 29, 22, 0.88);
+    }}
+    .modal-close:hover {{ filter: brightness(0.98); }}
+    .modal-meta {{
+      padding: 10px 12px 12px;
+      border-top: 1px solid rgba(58, 38, 26, 0.10);
+      font-size: 12px;
+      line-height: 1.4;
+      color: rgba(67, 51, 44, 0.78);
+      display: flex;
+      flex-wrap: wrap;
+      gap: 8px;
+    }}
+    .modal-meta a {{
+      color: var(--link);
+      text-decoration: none;
+      font-family: var(--mono);
+      font-size: 11px;
+      padding: 2px 6px;
+      border-radius: 8px;
+    }}
+    .modal-meta a:hover {{
+      background: rgba(192, 112, 70, 0.14);
+      text-decoration: none;
+    }}
   </style>
 </head>
 <body>
@@ -377,12 +545,128 @@ def _build_wtf_html(*, base_url: str) -> str:
         </div>
         <span class="muted" id="info"></span>
       </div>
+
+      <details class="settings" id="settings" open>
+        <summary>
+          <span><strong>筛选 / 布局</strong></span>
+          <span class="muted tight" id="settingsHint">展开可快速调参（支持 URL 分享）</span>
+        </summary>
+        <div class="settings-grid" role="group" aria-label="wtf-settings">
+          <div class="field">
+            <label for="r18Sel">R18</label>
+            <select id="r18Sel" class="ctrl">
+              <option value="">默认（安全）</option>
+              <option value="1">仅 R18</option>
+              <option value="2">不限（含未知）</option>
+            </select>
+          </div>
+          <div class="field">
+            <label for="oriSel">方向</label>
+            <select id="oriSel" class="ctrl">
+              <option value="">任意</option>
+              <option value="portrait">竖图</option>
+              <option value="landscape">横图</option>
+              <option value="square">方图</option>
+            </select>
+          </div>
+          <div class="field">
+            <label for="minPixels">最小像素（min_pixels）</label>
+            <input id="minPixels" class="ctrl" type="number" min="0" step="100000" placeholder="0=不限，例如 2000000≈2MP" />
+          </div>
+          <div class="field">
+            <label for="genderSel">快捷性别（仅 /wtf）</label>
+            <select id="genderSel" class="ctrl">
+              <option value="">不限</option>
+              <option value="girls">只看女生（排除男生标签）</option>
+              <option value="boys">只看男生（排除女生标签）</option>
+            </select>
+          </div>
+
+          <div class="field" style="grid-column: span 2;">
+            <label for="incTags">包含标签 included_tags（AND：换行/逗号；OR：|）</label>
+            <textarea id="incTags" class="ctrl" placeholder="例如：loli&#10;girl|boy"></textarea>
+          </div>
+          <div class="field" style="grid-column: span 2;">
+            <label for="excTags">排除标签 excluded_tags（任意命中即排除）</label>
+            <textarea id="excTags" class="ctrl" placeholder="例如：@male 或 @female"></textarea>
+          </div>
+
+          <div class="field">
+            <label for="mcolsSel">标准瀑布流列数（wtf_mcols）</label>
+            <select id="mcolsSel" class="ctrl">
+              <option value="">自动</option>
+              <option value="1">1</option>
+              <option value="2">2</option>
+              <option value="3">3</option>
+              <option value="4">4</option>
+            </select>
+          </div>
+          <div class="field">
+            <label for="mgap">标准瀑布流间距（wtf_mgap） <span class="muted" id="mgapVal"></span></label>
+            <input id="mgap" class="ctrl" type="range" min="0" max="16" step="1" />
+          </div>
+          <div class="field">
+            <label for="tcolsSel">小格子每行（wtf_tcols）</label>
+            <select id="tcolsSel" class="ctrl">
+              <option value="">自动</option>
+              <option value="2">2</option>
+              <option value="3">3</option>
+              <option value="4">4</option>
+              <option value="5">5</option>
+              <option value="6">6</option>
+            </select>
+          </div>
+          <div class="field">
+            <label for="tgap">小格子间距（wtf_tgap） <span class="muted" id="tgapVal"></span></label>
+            <input id="tgap" class="ctrl" type="range" min="8" max="28" step="1" />
+          </div>
+          <div class="field">
+            <label for="tratioSel">小格子比例（wtf_tratio）</label>
+            <select id="tratioSel" class="ctrl">
+              <option value="">自动（跟随方向/自适应）</option>
+              <option value="3/4">3/4</option>
+              <option value="2/3">2/3</option>
+              <option value="1/1">1/1</option>
+              <option value="16/9">16/9</option>
+            </select>
+          </div>
+        </div>
+
+        <div class="quick" id="quickTags" aria-label="quick-tags">
+          <span class="muted">快捷：</span>
+          <button type="button" class="qchip" data-kind="inc" data-tag="loli">loli</button>
+          <button type="button" class="qchip" data-kind="inc" data-tag="女の子">女の子</button>
+          <button type="button" class="qchip" data-kind="inc" data-tag="ロリ">ロリ</button>
+          <button type="button" class="qchip" data-kind="inc" data-tag="猫耳">猫耳</button>
+          <button type="button" class="qchip" data-kind="inc" data-tag="眼鏡">眼鏡</button>
+          <button type="button" class="qchip" data-kind="inc" data-tag="@female">@female（女生合集）</button>
+          <button type="button" class="qchip" data-kind="inc" data-tag="@male">@male（男生合集）</button>
+          <button type="button" class="qchip" data-kind="exc" data-tag="@male">排除男生</button>
+          <button type="button" class="qchip" data-kind="exc" data-tag="@female">排除女生</button>
+        </div>
+
+        <div class="actions">
+          <button class="btn primary" type="button" id="apply">应用并刷新</button>
+          <button class="btn" type="button" id="clearTags">清空标签</button>
+          <button class="btn" type="button" id="copyLink">复制当前链接</button>
+          <span class="muted">提示：<code>@male</code>/<code>@female</code> 为 /wtf 端展开的“概要标签”。</span>
+        </div>
+      </details>
     </div>
 
     <div id="feed" class="feed" aria-label="feed"></div>
     <div id="sentinel" class="sentinel">加载中…</div>
   </div>
 
+  <div id="modal" class="modal" aria-hidden="true">
+    <div id="modalBackdrop" class="modal-backdrop"></div>
+    <div class="modal-card" role="dialog" aria-modal="true" aria-label="预览">
+      <button id="modalClose" class="modal-close" type="button" aria-label="关闭">×</button>
+      <img id="modalImg" alt="" />
+      <div id="modalMeta" class="modal-meta"></div>
+    </div>
+  </div>
+
   <script>
     const feed = document.getElementById("feed");
     const sentinel = document.getElementById("sentinel");
@@ -391,13 +675,97 @@ def _build_wtf_html(*, base_url: str) -> str:
     const viewSeg = document.getElementById("viewSeg");
     const viewButtons = Array.from(viewSeg.querySelectorAll("button[data-view]"));
 
+    const r18Sel = document.getElementById("r18Sel");
+    const oriSel = document.getElementById("oriSel");
+    const minPixels = document.getElementById("minPixels");
+    const genderSel = document.getElementById("genderSel");
+    const incTags = document.getElementById("incTags");
+    const excTags = document.getElementById("excTags");
+    const mcolsSel = document.getElementById("mcolsSel");
+    const mgap = document.getElementById("mgap");
+    const mgapVal = document.getElementById("mgapVal");
+    const tcolsSel = document.getElementById("tcolsSel");
+    const tgap = document.getElementById("tgap");
+    const tgapVal = document.getElementById("tgapVal");
+    const tratioSel = document.getElementById("tratioSel");
+    const quickTags = document.getElementById("quickTags");
+    const applyBtn = document.getElementById("apply");
+    const clearTagsBtn = document.getElementById("clearTags");
+    const copyLinkBtn = document.getElementById("copyLink");
+
+    const modal = document.getElementById("modal");
+    const modalBackdrop = document.getElementById("modalBackdrop");
+    const modalClose = document.getElementById("modalClose");
+    const modalImg = document.getElementById("modalImg");
+    const modalMeta = document.getElementById("modalMeta");
+
     const qs = new URLSearchParams(window.location.search);
     const VIEW_KEY = "wtf_view";
+    const WTF_GENDER_KEY = "wtf_gender";
+    const WTF_MCOLS_KEY = "wtf_mcols";
+    const WTF_MGAP_KEY = "wtf_mgap";
+    const WTF_TCOLS_KEY = "wtf_tcols";
+    const WTF_TGAP_KEY = "wtf_tgap";
+    const WTF_TRATIO_KEY = "wtf_tratio";
+
+    const TAGSET_MALE = [
+      "男", "男性", "男の子", "少年", "男子", "青年", "お兄さん", "お兄ちゃん", "兄貴", "アニキ", "美少年", "イケメン", "ショタ",
+    ];
+    const TAGSET_FEMALE = [
+      "女", "女性", "女の子", "少女", "女子", "乙女", "お姉さん", "お姉ちゃん", "美少女", "ロリ", "幼女",
+    ];
+
+    function clampInt(n, min, max) {{
+      const x = Number(n);
+      if (!Number.isFinite(x)) return min;
+      return Math.max(min, Math.min(max, Math.trunc(x)));
+    }}
+
+    function optionalInt(raw, min, max) {{
+      const s = raw == null ? "" : String(raw).trim();
+      if (!s) return 0;
+      const n = Number.parseInt(s, 10);
+      if (!Number.isFinite(n)) return 0;
+      return clampInt(n, min, max);
+    }}
+
+    function normalizeGender(raw) {{
+      const v = String(raw || "").trim().toLowerCase();
+      if (v === "girls" || v === "girl" || v === "female" || v === "f") return "girls";
+      if (v === "boys" || v === "boy" || v === "male" || v === "m") return "boys";
+      return "";
+    }}
+
+    function normalizeRatioStr(raw) {{
+      const v = String(raw || "").trim();
+      if (!v) return "";
+      if (v === "auto") return "";
+      const s = v.replace(/\\s+/g, "");
+      const m = s.match(/^(\\d+(?:\\.\\d+)?)\\/(\\d+(?:\\.\\d+)?)$/);
+      if (!m) return "";
+      const w = Number(m[1]);
+      const h = Number(m[2]);
+      if (!Number.isFinite(w) || !Number.isFinite(h) || w <= 0 || h <= 0) return "";
+      return String(m[1]) + " / " + String(m[2]);
+    }}
+
+    function ratioToCompact(r) {{
+      return String(r || "").trim().replace(/\\s+/g, "");
+    }}
 
     const allItems = [];
     let masonryCols = [];
     let masonryHeights = [];
     let masonryCount = 0;
+    let generation = 0;
+    let selectedItem = null;
+
+    let wtfGender = "";
+    let masonryColsOverride = 0; // 0 = auto
+    let masonryGapOverride = 0; // px
+    let tileColsOverride = 0; // 0 = auto
+    let tileGapOverride = 0; // 0 = auto
+    let tileRatioOverride = ""; // "" = auto, else "w / h"
 
     function normalizeView(raw) {{
       const v = String(raw || "").trim().toLowerCase();
@@ -417,6 +785,7 @@ def _build_wtf_html(*, base_url: str) -> str:
     }}
 
     function desiredMasonryCount() {{
+      if (Number.isInteger(masonryColsOverride) && masonryColsOverride > 0) return masonryColsOverride;
       const w = Math.max(0, document.documentElement.clientWidth || window.innerWidth || 0);
       if (w <= 520) return 1;
       if (w <= 980) return 2;
@@ -431,7 +800,8 @@ def _build_wtf_html(*, base_url: str) -> str:
     function masonryEstimateHeight(item) {{
       const ratio = Number(item && item.dataset ? item.dataset.ratio : NaN);
       const r = Number.isFinite(ratio) && ratio > 0 ? ratio : 0.75;
-      return masonryColWidth() * r;
+      const gap = Number.isFinite(Number(masonryGapOverride)) ? Number(masonryGapOverride) : 0;
+      return masonryColWidth() * r + Math.max(0, gap);
     }}
 
     function rebuildLayout() {{
@@ -511,17 +881,26 @@ def _build_wtf_html(*, base_url: str) -> str:
     let storedView = "";
     try {{ storedView = localStorage.getItem(VIEW_KEY) || ""; }} catch (e) {{}}
 
+    wtfGender = normalizeGender(qs.get(WTF_GENDER_KEY));
+    masonryColsOverride = optionalInt(qs.get(WTF_MCOLS_KEY), 1, 4);
+    masonryGapOverride = optionalInt(qs.get(WTF_MGAP_KEY), 0, 16);
+    tileColsOverride = optionalInt(qs.get(WTF_TCOLS_KEY), 2, 6);
+    tileGapOverride = optionalInt(qs.get(WTF_TGAP_KEY), 8, 28);
+    tileRatioOverride = normalizeRatioStr(qs.get(WTF_TRATIO_KEY));
+
     const baseParams = new URLSearchParams(qs);
     baseParams.delete("view");
     baseParams.delete("format");
     baseParams.delete("redirect");
     baseParams.delete("t");
+    baseParams.delete(WTF_GENDER_KEY);
+    baseParams.delete(WTF_MCOLS_KEY);
+    baseParams.delete(WTF_MGAP_KEY);
+    baseParams.delete(WTF_TCOLS_KEY);
+    baseParams.delete(WTF_TGAP_KEY);
+    baseParams.delete(WTF_TRATIO_KEY);
     if (!baseParams.has("adaptive")) baseParams.set("adaptive", "1");
 
-    const showParams = new URLSearchParams(baseParams);
-    const baseQuery = showParams.toString();
-    info.textContent = baseQuery ? ("当前过滤: ?" + baseQuery) : "当前过滤: （无）";
-
     let paused = false;
     let viewMode = normalizeView(qs.get("view") || storedView || "single");
     let seq = 0;
@@ -530,6 +909,147 @@ def _build_wtf_html(*, base_url: str) -> str:
     let target = 0;
     let failStreak = 0;
 
+    function applyLayoutVars() {{
+      try {{
+        const root = document.documentElement.style;
+        if (masonryGapOverride > 0) root.setProperty("--masonry-gap", String(masonryGapOverride) + "px");
+        else root.removeProperty("--masonry-gap");
+        if (tileColsOverride > 0) root.setProperty("--tile-cols", String(tileColsOverride));
+        else root.removeProperty("--tile-cols");
+        if (tileGapOverride > 0) root.setProperty("--tile-gap", String(tileGapOverride) + "px");
+        else root.removeProperty("--tile-gap");
+      }} catch (e) {{}}
+
+      try {{
+        if (mgapVal) mgapVal.textContent = String(masonryGapOverride || 0) + "px";
+      }} catch (e) {{}}
+      try {{
+        if (tgapVal) {{
+          const raw = getComputedStyle(document.documentElement).getPropertyValue("--tile-gap");
+          const v = tileGapOverride > 0 ? tileGapOverride : (Number.parseInt(String(raw || "").trim(), 10) || 0);
+          tgapVal.textContent = String(v) + "px";
+        }}
+      }} catch (e) {{}}
+    }}
+
+    function buildUrlParams() {{
+      const p = new URLSearchParams(baseParams);
+
+      if (viewMode && viewMode !== "single") p.set("view", viewMode);
+      else p.delete("view");
+
+      if (wtfGender) p.set(WTF_GENDER_KEY, wtfGender);
+      else p.delete(WTF_GENDER_KEY);
+
+      if (masonryColsOverride > 0) p.set(WTF_MCOLS_KEY, String(masonryColsOverride));
+      else p.delete(WTF_MCOLS_KEY);
+      if (masonryGapOverride > 0) p.set(WTF_MGAP_KEY, String(masonryGapOverride));
+      else p.delete(WTF_MGAP_KEY);
+
+      if (tileColsOverride > 0) p.set(WTF_TCOLS_KEY, String(tileColsOverride));
+      else p.delete(WTF_TCOLS_KEY);
+      if (tileGapOverride > 0) p.set(WTF_TGAP_KEY, String(tileGapOverride));
+      else p.delete(WTF_TGAP_KEY);
+      if (tileRatioOverride) p.set(WTF_TRATIO_KEY, ratioToCompact(tileRatioOverride));
+      else p.delete(WTF_TRATIO_KEY);
+
+      return p;
+    }}
+
+    function updateUrlAndInfo() {{
+      try {{
+        const showParams = new URLSearchParams(baseParams);
+        const baseQuery = showParams.toString();
+        const extra = [];
+        if (wtfGender === "girls") extra.push("只看女生");
+        if (wtfGender === "boys") extra.push("只看男生");
+        info.textContent = (baseQuery ? ("当前过滤: ?" + baseQuery) : "当前过滤: （无）") + (extra.length ? (" · " + extra.join(" ")) : "");
+      }} catch (e) {{}}
+
+      try {{
+        const p = buildUrlParams();
+        const q = p.toString();
+        history.replaceState(null, "", q ? ("?" + q) : window.location.pathname);
+      }} catch (e) {{}}
+    }}
+
+    function parseTagLines(raw) {{
+      const text = String(raw || "");
+      const parts = text.split(/[\\n,]+/g);
+      const out = [];
+      const seen = new Set();
+      for (const part of parts) {{
+        const t = String(part || "").trim();
+        if (!t || seen.has(t)) continue;
+        seen.add(t);
+        out.push(t);
+      }}
+      return out;
+    }}
+
+    function expandMacroForInclude(token) {{
+      const key = String(token || "").trim().toLowerCase();
+      if (key === "@male" || key === "male") return [TAGSET_MALE.join("|")];
+      if (key === "@female" || key === "female") return [TAGSET_FEMALE.join("|")];
+      return [token];
+    }}
+
+    function expandMacroForExclude(token) {{
+      const key = String(token || "").trim().toLowerCase();
+      if (key === "@male" || key === "male") return TAGSET_MALE;
+      if (key === "@female" || key === "female") return TAGSET_FEMALE;
+      return [token];
+    }}
+
+    function setMultiParam(key, values) {{
+      baseParams.delete(key);
+      const seen = new Set();
+      for (const v of values) {{
+        const t = String(v || "").trim();
+        if (!t || seen.has(t)) continue;
+        seen.add(t);
+        baseParams.append(key, t);
+      }}
+    }}
+
+    function syncControlsFromParams() {{
+      try {{
+        const r18v = String(baseParams.get("r18") || "").trim();
+        if (r18Sel) r18Sel.value = (r18v === "1" || r18v === "2") ? r18v : "";
+      }} catch (e) {{}}
+      try {{
+        const ov = String(baseParams.get("orientation") || "").trim();
+        if (oriSel) oriSel.value = ov || "";
+      }} catch (e) {{}}
+      try {{
+        const pv = String(baseParams.get("min_pixels") || "").trim();
+        if (minPixels) minPixels.value = pv || "";
+      }} catch (e) {{}}
+      try {{ if (genderSel) genderSel.value = wtfGender || ""; }} catch (e) {{}}
+      try {{ if (mcolsSel) mcolsSel.value = masonryColsOverride > 0 ? String(masonryColsOverride) : ""; }} catch (e) {{}}
+      try {{ if (mgap) mgap.value = String(masonryGapOverride || 0); }} catch (e) {{}}
+      try {{ if (tcolsSel) tcolsSel.value = tileColsOverride > 0 ? String(tileColsOverride) : ""; }} catch (e) {{}}
+      try {{
+        if (tgap) {{
+          const raw = getComputedStyle(document.documentElement).getPropertyValue("--tile-gap");
+          const v = tileGapOverride > 0 ? tileGapOverride : (Number.parseInt(String(raw || "").trim(), 10) || 16);
+          tgap.value = String(v);
+        }}
+      }} catch (e) {{}}
+      try {{
+        if (tratioSel) {{
+          tratioSel.value = tileRatioOverride ? ratioToCompact(tileRatioOverride) : "";
+        }}
+      }} catch (e) {{}}
+      try {{ if (incTags) incTags.value = baseParams.getAll("included_tags").join("\\n"); }} catch (e) {{}}
+      try {{ if (excTags) excTags.value = baseParams.getAll("excluded_tags").join("\\n"); }} catch (e) {{}}
+
+      applyLayoutVars();
+      updateUrlAndInfo();
+    }}
+
+    syncControlsFromParams();
+
     function isMobile() {{
       return window.matchMedia && window.matchMedia("(max-width: 520px)").matches;
     }}
@@ -547,6 +1067,10 @@ def _build_wtf_html(*, base_url: str) -> str:
       return isMobile() ? "3 / 4" : "16 / 9";
     }}
 
+    function pickTileRatio() {{
+      return tileRatioOverride ? tileRatioOverride : pickRatioFromParams();
+    }}
+
     function cfg() {{
       const mobile = isMobile();
       const conn = navigator.connection || navigator.mozConnection || navigator.webkitConnection;
@@ -587,7 +1111,7 @@ def _build_wtf_html(*, base_url: str) -> str:
       }}
 
       if (viewMode === "tiles") {{
-        document.documentElement.style.setProperty("--tile-ar", pickRatioFromParams());
+        document.documentElement.style.setProperty("--tile-ar", pickTileRatio());
       }} else {{
         document.documentElement.style.removeProperty("--tile-ar");
       }}
@@ -602,6 +1126,7 @@ def _build_wtf_html(*, base_url: str) -> str:
       target = Math.max(target, c.initial);
       ensure();
       updateSentinel();
+      updateUrlAndInfo();
     }}
 
     for (const b of viewButtons) {{
@@ -611,8 +1136,54 @@ def _build_wtf_html(*, base_url: str) -> str:
     }}
     applyView(viewMode, false);
 
-    function buildRandomJsonUrl() {{
+    function buildRandomParamsForRequest() {{
       const p = new URLSearchParams(baseParams);
+
+      try {{
+        const inc = p.getAll("included_tags");
+        if (inc && inc.length) {{
+          p.delete("included_tags");
+          for (const t of inc) {{
+            const expanded = expandMacroForInclude(t);
+            for (const v of expanded) {{
+              const s = String(v || "").trim();
+              if (!s) continue;
+              p.append("included_tags", s);
+            }}
+          }}
+        }}
+      }} catch (e) {{}}
+
+      try {{
+        const rawExc = p.getAll("excluded_tags");
+        const out = [];
+        const seen = new Set();
+        const pushOne = (v) => {{
+          const s = String(v || "").trim();
+          if (!s || seen.has(s)) return;
+          seen.add(s);
+          out.push(s);
+        }};
+        for (const t of rawExc) {{
+          const expanded = expandMacroForExclude(t);
+          for (const v of expanded) pushOne(v);
+        }}
+        if (wtfGender === "girls") {{
+          for (const v of TAGSET_MALE) pushOne(v);
+        }} else if (wtfGender === "boys") {{
+          for (const v of TAGSET_FEMALE) pushOne(v);
+        }}
+        if (out.length || rawExc.length) {{
+          p.delete("excluded_tags");
+          for (const v of out) p.append("excluded_tags", v);
+        }}
+      }} catch (e) {{}}
+
+      return p;
+    }}
+
+    function buildRandomJsonUrl() {{
+      const p = buildRandomParamsForRequest();
       p.set("format", "simple_json");
       p.set("t", String(Date.now()) + "_" + String(seq++));
       return "/random?" + p.toString();
@@ -620,14 +1191,247 @@ def _build_wtf_html(*, base_url: str) -> str:
 
     function buildProxyQuery() {{
       const qp = new URLSearchParams();
-      const pc = String(baseParams.get("pixiv_cat") || "").trim();
-      if (pc === "1") qp.set("pixiv_cat", "1");
-      const mh = String(baseParams.get("pximg_mirror_host") || "").trim();
-      if (mh) qp.set("pximg_mirror_host", mh);
+      const pr = String(baseParams.get("proxy") || "").trim();
+      if (pr) {{
+        qp.set("proxy", pr);
+      }} else {{
+        const pc = String(baseParams.get("pixiv_cat") || "").trim();
+        if (pc === "1") qp.set("pixiv_cat", "1");
+        const mh = String(baseParams.get("pximg_mirror_host") || "").trim();
+        if (mh) qp.set("pximg_mirror_host", mh);
+      }}
       const s = qp.toString();
       return s ? ("?" + s) : "";
     }}
 
+    function selectItem(item) {{
+      try {{
+        if (selectedItem && selectedItem !== item) selectedItem.classList.remove("selected");
+      }} catch (e) {{}}
+      selectedItem = item;
+      try {{
+        if (selectedItem) selectedItem.classList.add("selected");
+      }} catch (e) {{}}
+    }}
+
+    function openModalForItem(item) {{
+      if (!modal || !modalImg) return;
+      if (!item) return;
+      const img = item.querySelector("img");
+      if (!img || !img.src) return;
+      selectItem(item);
+
+      try {{
+        modalImg.src = img.src;
+      }} catch (e) {{}}
+
+      try {{
+        if (modalMeta) {{
+          modalMeta.textContent = "";
+          const meta = item.querySelector(".meta");
+          if (meta) {{
+            for (const n of Array.from(meta.childNodes)) {{
+              modalMeta.appendChild(n.cloneNode(true));
+            }}
+          }}
+        }}
+      }} catch (e) {{}}
+
+      try {{
+        modal.classList.add("open");
+        modal.setAttribute("aria-hidden", "false");
+        document.body.style.overflow = "hidden";
+      }} catch (e) {{}}
+    }}
+
+    function closeModal() {{
+      if (!modal) return;
+      try {{
+        modal.classList.remove("open");
+        modal.setAttribute("aria-hidden", "true");
+      }} catch (e) {{}}
+      try {{ document.body.style.overflow = ""; }} catch (e) {{}}
+    }}
+
+    try {{
+      if (modalBackdrop) modalBackdrop.addEventListener("click", () => closeModal());
+      if (modalClose) modalClose.addEventListener("click", () => closeModal());
+      window.addEventListener("keydown", (e) => {{
+        if (!modal || !modal.classList.contains("open")) return;
+        const k = e && e.key ? String(e.key) : "";
+        if (k === "Escape") closeModal();
+      }});
+    }} catch (e) {{}}
+
+    try {{
+      feed.addEventListener("click", (ev) => {{
+        const t = ev && ev.target ? ev.target : null;
+        const img = t && t.closest ? t.closest("img") : null;
+        if (!img) return;
+        const item = img.closest ? img.closest(".item") : null;
+        if (!item || item.classList.contains("pending")) return;
+        openModalForItem(item);
+      }});
+    }} catch (e) {{}}
+
+    function syncParamsFromControls(opts) {{
+      const reset = opts && opts.reset === true;
+
+      const prevMCols = masonryColsOverride;
+      const prevMG = masonryGapOverride;
+      const prevTCols = tileColsOverride;
+      const prevTG = tileGapOverride;
+      const prevTR = tileRatioOverride;
+      const prevGender = wtfGender;
+
+      try {{
+        const v = String(r18Sel && r18Sel.value || "").trim();
+        if (!v || v === "0") baseParams.delete("r18");
+        else baseParams.set("r18", v);
+      }} catch (e) {{}}
+      try {{
+        const v = String(oriSel && oriSel.value || "").trim();
+        if (!v) baseParams.delete("orientation");
+        else baseParams.set("orientation", v);
+      }} catch (e) {{}}
+      try {{
+        const raw = String(minPixels && minPixels.value || "").trim();
+        const n = raw ? Number.parseInt(raw, 10) : 0;
+        if (!raw || !Number.isFinite(n) || n <= 0) baseParams.delete("min_pixels");
+        else baseParams.set("min_pixels", String(Math.max(0, Math.trunc(n))));
+      }} catch (e) {{}}
+
+      try {{ wtfGender = normalizeGender(genderSel && genderSel.value); }} catch (e) {{}}
+
+      try {{
+        const inc = parseTagLines(incTags && incTags.value);
+        setMultiParam("included_tags", inc);
+      }} catch (e) {{}}
+      try {{
+        const exc = parseTagLines(excTags && excTags.value);
+        setMultiParam("excluded_tags", exc);
+      }} catch (e) {{}}
+
+      try {{ masonryColsOverride = optionalInt(mcolsSel && mcolsSel.value, 1, 4); }} catch (e) {{}}
+      try {{ masonryGapOverride = optionalInt(mgap && mgap.value, 0, 16); }} catch (e) {{}}
+      try {{ tileColsOverride = optionalInt(tcolsSel && tcolsSel.value, 2, 6); }} catch (e) {{}}
+      try {{ tileGapOverride = optionalInt(tgap && tgap.value, 8, 28); }} catch (e) {{}}
+      try {{ tileRatioOverride = normalizeRatioStr(tratioSel && tratioSel.value); }} catch (e) {{}}
+
+      applyLayoutVars();
+      if (viewMode === "tiles") {{
+        try {{ document.documentElement.style.setProperty("--tile-ar", pickTileRatio()); }} catch (e) {{}}
+      }}
+      updateUrlAndInfo();
+
+      try {{
+        if (quickTags) {{
+          const incSet = new Set(parseTagLines(incTags && incTags.value));
+          const excSet = new Set(parseTagLines(excTags && excTags.value));
+          for (const b of Array.from(quickTags.querySelectorAll("button[data-kind][data-tag]"))) {{
+            const kind = String(b.dataset.kind || "");
+            const tag = String(b.dataset.tag || "");
+            b.classList.toggle("active", (kind === "exc" ? excSet : incSet).has(tag));
+          }}
+        }}
+      }} catch (e) {{}}
+
+      if (reset) {{
+        resetFeed();
+        return;
+      }}
+
+      if (viewMode === "masonry" && (prevMCols !== masonryColsOverride)) {{
+        rebuildLayout();
+      }}
+      if (prevMG !== masonryGapOverride || prevTCols !== tileColsOverride || prevTG !== tileGapOverride || prevTR !== tileRatioOverride || prevGender !== wtfGender) {{
+        updateSentinel();
+      }}
+    }}
+
+    try {{
+      if (applyBtn) applyBtn.addEventListener("click", () => syncParamsFromControls({{ reset: true }}));
+      if (clearTagsBtn) clearTagsBtn.addEventListener("click", () => {{
+        try {{ if (incTags) incTags.value = ""; }} catch (e) {{}}
+        try {{ if (excTags) excTags.value = ""; }} catch (e) {{}}
+        syncParamsFromControls({{ reset: true }});
+      }});
+      if (copyLinkBtn) copyLinkBtn.addEventListener("click", async () => {{
+        const text = String(window.location.href || "");
+        try {{
+          if (navigator.clipboard && navigator.clipboard.writeText) {{
+            await navigator.clipboard.writeText(text);
+            copyLinkBtn.textContent = "已复制";
+            setTimeout(() => {{ copyLinkBtn.textContent = "复制当前链接"; }}, 1200);
+            return;
+          }}
+        }} catch (e) {{}}
+        try {{ window.prompt("复制链接：", text); }} catch (e) {{}}
+      }});
+
+      const quickToggle = (ta, tag) => {{
+        if (!ta) return;
+        const vals = parseTagLines(ta.value);
+        const idx = vals.indexOf(tag);
+        if (idx >= 0) vals.splice(idx, 1);
+        else vals.push(tag);
+        ta.value = vals.join("\\n");
+      }};
+
+      if (quickTags) quickTags.addEventListener("click", (ev) => {{
+        const t = ev && ev.target ? ev.target : null;
+        const b = t && t.closest ? t.closest("button[data-kind][data-tag]") : null;
+        if (!b) return;
+        const kind = String(b.dataset.kind || "");
+        const tag = String(b.dataset.tag || "");
+        if (!tag) return;
+        if (kind === "exc") quickToggle(excTags, tag);
+        else quickToggle(incTags, tag);
+        syncParamsFromControls({{ reset: true }});
+      }});
+
+      const onFastChange = (el) => {{
+        if (!el) return;
+        el.addEventListener("change", () => syncParamsFromControls({{ reset: true }}));
+      }};
+      onFastChange(r18Sel);
+      onFastChange(oriSel);
+      onFastChange(genderSel);
+
+      if (minPixels) {{
+        minPixels.addEventListener("change", () => syncParamsFromControls({{ reset: true }}));
+        minPixels.addEventListener("keydown", (e) => {{
+          if (!e) return;
+          if (e.key === "Enter") syncParamsFromControls({{ reset: true }});
+        }});
+      }}
+
+      const onLayout = (el) => {{
+        if (!el) return;
+        el.addEventListener("change", () => syncParamsFromControls({{ reset: false }}));
+      }};
+      onLayout(mcolsSel);
+      onLayout(tcolsSel);
+      onLayout(tratioSel);
+      if (mgap) mgap.addEventListener("input", () => syncParamsFromControls({{ reset: false }}));
+      if (tgap) tgap.addEventListener("input", () => syncParamsFromControls({{ reset: false }}));
+
+      const bindCtrlEnter = (ta) => {{
+        if (!ta) return;
+        ta.addEventListener("keydown", (e) => {{
+          if (!e) return;
+          if ((e.ctrlKey || e.metaKey) && e.key === "Enter") {{
+            syncParamsFromControls({{ reset: true }});
+          }}
+        }});
+      }};
+      bindCtrlEnter(incTags);
+      bindCtrlEnter(excTags);
+
+      // Init quick-tag highlight / labels.
+      syncParamsFromControls({{ reset: false }});
+    }} catch (e) {{}}
+
     async function fetchRandomData() {{
       const url = buildRandomJsonUrl();
       const resp = await fetch(url, {{ cache: "no-store" }});
@@ -651,6 +1455,27 @@ def _build_wtf_html(*, base_url: str) -> str:
       sentinel.textContent = status + " · 已显示 " + String(rendered) + " 张 · in-flight " + String(inflight);
     }}
 
+    function resetFeed() {{
+      generation += 1;
+      try {{ closeModal(); }} catch (e) {{}}
+      try {{ selectItem(null); }} catch (e) {{}}
+
+      paused = false;
+      try {{ toggle.textContent = "暂停加载"; }} catch (e) {{}}
+
+      inflight = 0;
+      rendered = 0;
+      target = 0;
+      failStreak = 0;
+
+      try {{ allItems.length = 0; }} catch (e) {{}}
+      rebuildLayout();
+
+      target = cfg().initial;
+      ensure();
+      updateSentinel();
+    }}
+
     function setMeta(meta, data) {{
       try {{
         meta.textContent = "";
@@ -698,6 +1523,7 @@ def _build_wtf_html(*, base_url: str) -> str:
       if (inflight >= c.maxInflight) return;
       if ((rendered + inflight) >= target) return;
 
+      const myGen = generation;
       inflight += 1;
       updateSentinel();
 
@@ -725,6 +1551,11 @@ def _build_wtf_html(*, base_url: str) -> str:
 
       const finishOk = () => {{
         if (done) return;
+        if (myGen !== generation) {{
+          done = true;
+          try {{ item.remove(); }} catch (e) {{}}
+          return;
+        }}
         done = true;
         inflight = Math.max(0, inflight - 1);
         rendered += 1;
@@ -737,6 +1568,11 @@ def _build_wtf_html(*, base_url: str) -> str:
 
       const finishFail = (reason) => {{
         if (done) return;
+        if (myGen !== generation) {{
+          done = true;
+          try {{ item.remove(); }} catch (e) {{}}
+          return;
+        }}
         done = true;
         inflight = Math.max(0, inflight - 1);
         failStreak += 1;
@@ -770,8 +1606,20 @@ def _build_wtf_html(*, base_url: str) -> str:
 
       const attempt = async () => {{
         tries += 1;
+        if (done) return;
+        if (myGen !== generation) {{
+          done = true;
+          try {{ item.remove(); }} catch (e) {{}}
+          return;
+        }}
         try {{
           const data = await fetchRandomData();
+          if (done) return;
+          if (myGen !== generation) {{
+            done = true;
+            try {{ item.remove(); }} catch (e) {{}}
+            return;
+          }}
           setMeta(meta, data);
           try {{
             const iw = data && data.image ? Number(data.image.width) : NaN;
@@ -789,6 +1637,11 @@ def _build_wtf_html(*, base_url: str) -> str:
           img.src = proxy + buildProxyQuery();
         }} catch (e) {{
           if (done) return;
+          if (myGen !== generation) {{
+            done = true;
+            try {{ item.remove(); }} catch (e) {{}}
+            return;
+          }}
           const name = e && e.name ? String(e.name) : "";
           const msg = e && e.message ? String(e.message) : "";
           if (name === "NO_MATCH" || msg === "NO_MATCH") {{
@@ -805,6 +1658,12 @@ def _build_wtf_html(*, base_url: str) -> str:
 
       img.onload = () => {{
         try {{
+          if (done) return;
+          if (myGen !== generation) {{
+            done = true;
+            try {{ item.remove(); }} catch (e) {{}}
+            return;
+          }}
           if ((!img.hasAttribute("width") || !img.hasAttribute("height")) && img.naturalWidth > 0 && img.naturalHeight > 0) {{
             img.setAttribute("width", String(img.naturalWidth));
             img.setAttribute("height", String(img.naturalHeight));
@@ -817,6 +1676,11 @@ def _build_wtf_html(*, base_url: str) -> str:
       }};
       img.onerror = () => {{
         if (done) return;
+        if (myGen !== generation) {{
+          done = true;
+          try {{ item.remove(); }} catch (e) {{}}
+          return;
+        }}
         if (tries < 3) {{
           setTimeout(() => attempt(), 250 * tries);
           return;
diff --git a/backend/app/core/pximg_reverse_proxy.py b/backend/app/core/pximg_reverse_proxy.py
index 9011501..35713ea 100644
--- a/backend/app/core/pximg_reverse_proxy.py
+++ b/backend/app/core/pximg_reverse_proxy.py
@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 from collections.abc import Mapping
+import ipaddress
+import re
 from urllib.parse import urlparse, urlunparse
 
 
@@ -15,18 +17,30 @@ ALLOWED_PXIMG_MIRROR_HOSTS: tuple[str, ...] = (
 _PXIMG_MIRROR_ALIASES: dict[str, str] = {
     # pixiv.cat
     "cat": "i.pixiv.cat",
+    "pixiv-cat": "i.pixiv.cat",
     "pixiv.cat": "i.pixiv.cat",
+    "i-pixiv-cat": "i.pixiv.cat",
     "i.pixiv.cat": "i.pixiv.cat",
     # pixiv.re (often recommended for CN mainland)
     "re": "i.pixiv.re",
+    "pixiv-re": "i.pixiv.re",
     "pixiv.re": "i.pixiv.re",
+    "i-pixiv-re": "i.pixiv.re",
     "i.pixiv.re": "i.pixiv.re",
     # pixiv.nl (often recommended for CN mainland)
     "nl": "i.pixiv.nl",
+    "pixiv-nl": "i.pixiv.nl",
     "pixiv.nl": "i.pixiv.nl",
+    "i-pixiv-nl": "i.pixiv.nl",
     "i.pixiv.nl": "i.pixiv.nl",
 }
 
+_CUSTOM_HOST_RE = re.compile(
+    r"^(?=.{1,253}$)"
+    r"(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)"
+    r"(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$"
+)
+
 
 _REQUEST_COUNTRY_HEADERS: tuple[str, ...] = (
     # Cloudflare
@@ -133,6 +147,80 @@ def normalize_pximg_mirror_host(value: object) -> str | None:
     return None
 
 
+def normalize_pximg_custom_mirror_host(value: object) -> str | None:
+    """
+    Normalize a *custom* pximg mirror host. This does NOT enforce an allowlist.
+
+    Intended to be used for admin-configured allowlists (trusted) or after an allowlist check
+    is performed at the request boundary.
+    """
+    if value is None:
+        return None
+    if isinstance(value, bool):
+        return None
+
+    raw = str(value or "").strip().lower()
+    if not raw:
+        return None
+
+    if raw.startswith("http://") or raw.startswith("https://"):
+        try:
+            parsed = urlparse(raw)
+        except Exception:
+            return None
+        raw = (parsed.hostname or "").strip().lower()
+        if not raw:
+            return None
+
+    raw = raw.strip().strip(".")
+    if not raw:
+        return None
+
+    if raw in {"localhost"}:
+        return None
+
+    try:
+        ipaddress.ip_address(raw)
+    except Exception:
+        pass
+    else:
+        return None
+
+    if not _CUSTOM_HOST_RE.match(raw):
+        return None
+
+    return raw
+
+
+def normalize_pximg_proxy(value: object, *, extra_hosts: list[str] | tuple[str, ...] | None) -> str | None:
+    """
+    Normalize pximg mirror selection from a public `proxy=` query param.
+
+    - Built-in hosts/aliases are always allowed.
+    - Custom hosts are only allowed if present in `extra_hosts` allowlist.
+    """
+    built_in = normalize_pximg_mirror_host(value)
+    if built_in is not None:
+        return built_in
+
+    candidate = normalize_pximg_custom_mirror_host(value)
+    if candidate is None:
+        return None
+
+    if not extra_hosts:
+        return None
+
+    allow: set[str] = set()
+    for item in extra_hosts:
+        norm = normalize_pximg_custom_mirror_host(item)
+        if norm:
+            allow.add(norm)
+
+    if candidate in allow:
+        return candidate
+    return None
+
+
 def rewrite_pximg_to_mirror(url: str, *, mirror_host: str) -> str:
     try:
         parsed = urlparse(url)
@@ -142,7 +230,7 @@ def rewrite_pximg_to_mirror(url: str, *, mirror_host: str) -> str:
     if not is_pximg_image_url(url):
         return url
 
-    mirror = normalize_pximg_mirror_host(mirror_host) or ""
+    mirror = normalize_pximg_mirror_host(mirror_host) or normalize_pximg_custom_mirror_host(mirror_host) or ""
     if not mirror:
         return url
 
diff --git a/backend/app/core/runtime_settings.py b/backend/app/core/runtime_settings.py
index b364607..3b6c746 100644
--- a/backend/app/core/runtime_settings.py
+++ b/backend/app/core/runtime_settings.py
@@ -8,7 +8,11 @@ from sqlalchemy.dialects.sqlite import insert as sqlite_insert
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncEngine
 
-from app.core.pximg_reverse_proxy import DEFAULT_PXIMG_MIRROR_HOST, normalize_pximg_mirror_host
+from app.core.pximg_reverse_proxy import (
+    DEFAULT_PXIMG_MIRROR_HOST,
+    normalize_pximg_custom_mirror_host,
+    normalize_pximg_mirror_host,
+)
 from app.core.logging import get_logger
 from app.core.time import iso_utc_ms
 from app.db.models.runtime_settings import RuntimeSetting
@@ -57,6 +61,7 @@ class RuntimeConfig:
     proxy_default_pool_id: int | None
     image_proxy_use_pixiv_cat: bool
     image_proxy_pximg_mirror_host: str
+    image_proxy_extra_pximg_mirror_hosts: list[str]
     random_defaults: dict[str, Any]
     hide_origin_url_in_public_json: bool
     rate_limit: dict[str, Any]
@@ -72,6 +77,7 @@ class RuntimeConfig:
             proxy_default_pool_id=None,
             image_proxy_use_pixiv_cat=False,
             image_proxy_pximg_mirror_host=str(DEFAULT_PXIMG_MIRROR_HOST),
+            image_proxy_extra_pximg_mirror_hosts=[],
             random_defaults={},
             hide_origin_url_in_public_json=True,
             rate_limit={},
@@ -140,6 +146,16 @@ def runtime_config_from_values(values: dict[str, Any]) -> RuntimeConfig:
     mirror_host_raw = values.get("image_proxy.pximg_mirror_host")
     mirror_host = normalize_pximg_mirror_host(mirror_host_raw)
 
+    extra_mirrors_raw = _as_str_list(values.get("image_proxy.extra_pximg_mirror_hosts"))
+    extra_mirrors: list[str] = []
+    seen_extra: set[str] = set()
+    for item in extra_mirrors_raw:
+        host = normalize_pximg_custom_mirror_host(item)
+        if not host or host in seen_extra:
+            continue
+        seen_extra.add(host)
+        extra_mirrors.append(host)
+
     random_defaults_raw = values.get("random.defaults")
     random_defaults = defaults.random_defaults
     if isinstance(random_defaults_raw, dict):
@@ -164,6 +180,7 @@ def runtime_config_from_values(values: dict[str, Any]) -> RuntimeConfig:
         if image_proxy_use_pixiv_cat is not None
         else defaults.image_proxy_use_pixiv_cat,
         image_proxy_pximg_mirror_host=str(mirror_host or defaults.image_proxy_pximg_mirror_host),
+        image_proxy_extra_pximg_mirror_hosts=extra_mirrors,
         random_defaults=random_defaults,
         hide_origin_url_in_public_json=hide_origin_url
         if hide_origin_url is not None
diff --git a/frontend/src/pages/SettingsPage.test.tsx b/frontend/src/pages/SettingsPage.test.tsx
index 7a799ec..c94b2f0 100644
--- a/frontend/src/pages/SettingsPage.test.tsx
+++ b/frontend/src/pages/SettingsPage.test.tsx
@@ -29,6 +29,7 @@ describe("SettingsPage", () => {
           expect(body.settings.proxy.default_pool_id).toBe("");
           expect(body.settings.image_proxy.use_pixiv_cat).toBe(false);
           expect(body.settings.image_proxy.pximg_mirror_host).toBe("i.pixiv.cat");
+          expect(body.settings.image_proxy.extra_pximg_mirror_hosts).toEqual([]);
           expect(body.settings.random.default_attempts).toBe(3);
           expect(body.settings.random.default_r18_strict).toBe(true);
           expect(body.settings.random.fail_cooldown_ms).toBe(600000);
@@ -37,7 +38,7 @@ describe("SettingsPage", () => {
           expect(body.settings.security.hide_origin_url_in_public_json).toBe(true);
           expect(body.settings.rate_limit.pixiv_hydrate_min_interval_ms).toBe(800);
           expect(body.settings.rate_limit.pixiv_hydrate_jitter_ms).toBe(200);
-          return new Response(JSON.stringify({ ok: true, updated: 9, request_id: "req_save" }), {
+          return new Response(JSON.stringify({ ok: true, updated: 10, request_id: "req_save" }), {
             status: 200,
             headers: { "Content-Type": "application/json" },
           });
@@ -54,7 +55,7 @@ describe("SettingsPage", () => {
                   allowlist_domains: ["pixiv.net"],
                   default_pool_id: "",
                 },
-                image_proxy: { use_pixiv_cat: false, pximg_mirror_host: "i.pixiv.cat" },
+                image_proxy: { use_pixiv_cat: false, pximg_mirror_host: "i.pixiv.cat", extra_pximg_mirror_hosts: [] },
                 random: { default_attempts: 3, default_r18_strict: true, fail_cooldown_ms: 600000, strategy: "quality", quality_samples: 5 },
                 security: { hide_origin_url_in_public_json: true },
                 rate_limit: {},
@@ -98,7 +99,7 @@ describe("SettingsPage", () => {
     fireEvent.click(screen.getByRole("button", { name: /保存设置/ }));
 
     expect(await screen.findByText("保存成功")).toBeInTheDocument();
-    expect(await screen.findByText(/更新条目数:\s*9/)).toBeInTheDocument();
+    expect(await screen.findByText(/更新条目数:\s*10/)).toBeInTheDocument();
     expect(await screen.findByText(/请求ID:\s*req_save/)).toBeInTheDocument();
   });
 });
diff --git a/frontend/src/pages/SettingsPage.tsx b/frontend/src/pages/SettingsPage.tsx
index 2a2bab1..dc15218 100644
--- a/frontend/src/pages/SettingsPage.tsx
+++ b/frontend/src/pages/SettingsPage.tsx
@@ -37,6 +37,7 @@ type SettingsFormValues = {
   proxy_default_pool_id: number;
   image_proxy_use_pixiv_cat: boolean;
   image_proxy_pximg_mirror_host: "i.pixiv.cat" | "i.pixiv.re" | "i.pixiv.nl";
+  image_proxy_extra_pximg_mirror_hosts: string[];
   random_default_attempts: number;
   random_default_r18_strict: boolean;
   random_fail_cooldown_ms: number;
@@ -147,6 +148,7 @@ export function SettingsPage() {
       proxy_default_pool_id: asInt(proxy.default_pool_id, 0),
       image_proxy_use_pixiv_cat: asBool(imageProxy.use_pixiv_cat, false),
       image_proxy_pximg_mirror_host: asPximgMirrorHost(imageProxy.pximg_mirror_host, "i.pixiv.cat"),
+      image_proxy_extra_pximg_mirror_hosts: asStrList(imageProxy.extra_pximg_mirror_hosts),
       random_default_attempts: asInt(random.default_attempts, 3),
       random_default_r18_strict: asBool(random.default_r18_strict, true),
       random_fail_cooldown_ms: asInt(random.fail_cooldown_ms, 600_000),
@@ -174,6 +176,7 @@ export function SettingsPage() {
             image_proxy: {
               use_pixiv_cat: values.image_proxy_use_pixiv_cat,
               pximg_mirror_host: values.image_proxy_pximg_mirror_host,
+              extra_pximg_mirror_hosts: values.image_proxy_extra_pximg_mirror_hosts,
             },
             random: {
               default_attempts: values.random_default_attempts,
@@ -312,6 +315,13 @@ export function SettingsPage() {
                 ]}
               />
             </Form.Item>
+            <Form.Item
+              label="自定义镜像白名单"
+              name="image_proxy_extra_pximg_mirror_hosts"
+              extra="用于公开接口的 proxy= 参数：仅允许这里配置的自定义域名被用作图片上游镜像（防止 SSRF）。示例：i.mirror.example.com"
+            >
+              <Select mode="tags" style={{ maxWidth: 520 }} tokenSeparators={[",", "\n", " "]} placeholder="例如：i.mirror.example.com" />
+            </Form.Item>
 
             <Typography.Title level={5} style={{ marginTop: 12 }}>
               随机接口设置