Import

Chute can import proxy configuration written for other clients. Two kinds of input are accepted: single-node share links (ss://, vmess://, …), and whole profiles in Clash/mihomo YAML or sing-box JSON. Both are converted into native Chute configuration — what you get afterwards is an ordinary Chute profile with [Proxy], [Proxy Group] and [Rule] sections, not a foreign file that Chute keeps interpreting.

http:// and https:// addresses are never treated as share links. They are subscription addresses: the content is downloaded first, then imported according to what the body turns out to be.

Share Links

Share links — a single link, or a subscription whose body is a list of them — are imported by Chute Mac only. Chute iOS has no share-link import: its first-run guide can set up one server from a scanned QR code carrying an ss://, vmess://, vless://, trojan://, hysteria2://, socks5:// or ssh:// link, and takes little more than the server address, port and credentials from it — a link without a port gets the default from the table below. Chute tvOS and Chute Android do not read share links.

Most links use the userinfo@host:port?query#name shape. Two are different: vmess:// carries a base64-encoded JSON object (the v2rayN format, with the add / ps / scy / net / aid field names), and ss:// accepts both SIP002 (base64(method:password)@host:port) and the older whole-body base64(method:password@host:port) form. Base64 payloads may be unpadded and may use the URL-safe alphabet.

trojan://password@example.com:443?sni=example.com&alpn=h2,http/1.1#Tokyo%20Node

converts to:

[Proxy]
Tokyo Node = trojan, example.com, 443, password=password, tls=true, sni=example.com, alpn=h2|http/1.1

The text after # is percent-decoded and becomes the policy name; vmess:// takes it from the ps field instead. A link with no name is named host:port. Characters the configuration format reserves — =, ,, [, ], ", tab and newline — are replaced with spaces in the name.

Trojan, Hysteria2, TUIC and AnyTLS are TLS-only protocols, so tls=true is added even when the link does not spell it out.

Multiple links. A payload can be many share links separated by newlines, optionally wrapped in one outer layer of base64. Every line that parses becomes a policy, and repeated names get a 2, 3 … suffix so that rules and groups can still address each node individually. Lines that cannot be parsed are reported as warnings while the rest of the payload is still imported; the import only fails when nothing at all could be converted.

A link whose scheme is not in the table above is not recognized as a share link. A link with a known scheme but missing required fields is rejected with a message naming that scheme.

Supported Parameters

Only the query parameters below are read; anything else in a link is ignored.

"Query links" below means every scheme that carries its settings in a query string: vless://, trojan://, hysteria2://, tuic://, anytls://, socks5:// and ssh://. ss:// and vmess:// are read by their own parsers and are covered after the table.

ss:// reads plugin and nothing else from the query, so sni, alpn, fp, allowInsecure, security and type= written into a Shadowsocks link are ignored. vmess:// has no query at all: it takes the same settings from the sni, host, alpn, fp, net, path and tls fields of its JSON body. And the three transport rows — ws, grpc, xhttp — never reach a hysteria2://, tuic:// or anytls:// link: those policies are written with their own options and the TLS ones only, since each protocol carries its own transport.

A Shadowsocks plugin value is read as name;key=value;…. obfs-local / simple-obfs / obfs become obfs and obfs_param. v2ray-plugin becomes Shadowsocks over WebSocket: ws=true, path as ws-path, host as the Host in ws-headers, and tls as tls=true with sni set to that host; a mux of 0, false, no or off becomes ws-mux=false, and any other value keeps the default. Its quic mode has no equivalent: the plugin is dropped with the warning <path>.plugin: Shadowsocks plugin 'v2ray-plugin' in quic mode has no KLNEKit equivalent; the proxy will not connect without it. Any other option of it is dropped with <path>.plugin-opts.<key>: option has no KLNEKit equivalent and was dropped. Any other plugin produces a warning and is dropped: the policy is still written, but it will not connect to a server that requires the plugin.

Notice: A non-zero VMess aid (alterId) is reported as a warning. Chute speaks VMess AEAD only, and a server still requiring the legacy MD5 handshake will not authenticate.

Profile Import

Three formats are recognized:

The format is detected from the content, with the filename used only as a hint. Content starting with { is treated as sing-box JSON whatever the file is called (a sing-box profile saved as .yaml still parses as YAML, so the name alone cannot be trusted). Otherwise a .conf extension means native, .json means sing-box, and .yaml / .yml means Clash. When there is no usable filename — a subscription body, for instance — the first meaningful line decides: #!MANAGED-CONFIG or a [Section] header means native, and proxies:, proxy-groups:, rules:, proxy-providers: or rule-providers: means Clash. Anything else is treated as native. What an address serves — a download or a subscription — is judged by its body: the name taken from the address counts only when the body shows none of these markers, so an address ending in .conf that serves Clash is still converted.

A document that parses but contains none of the sections that define its dialect is rejected rather than reported as a successful import of nothing: Clash YAML needs at least one of proxies, proxy-groups, rules, proxy-providers or rule-providers, and sing-box JSON needs outbounds, endpoints or route.

A single unconvertible entry never fails the import. Each proxy, group and rule is converted on its own; the ones with no Chute equivalent are skipped and reported. The result carries the converted configuration, a list of warnings, and a list of the source fields that were skipped. The same warnings are also written into the converted text as comments, next to the section they came from:

[Proxy]
HK 01 = ss, example.com, 8388, aes-128-gcm, password
# KL-CONVERT-WARNING [proxies[3]]: proxy type 'snell' was skipped — Snell is a Surge-proprietary protocol KLNEKit does not implement

Finally, the converted text is re-parsed with Chute's own parser. Any line the parser rejects is commented out as # KL-CONVERT-DROPPED: … and reported, so a profile that is 95% convertible still imports and runs.

Node names are rewritten where they would break the configuration format: , becomes a space and = becomes -, and a name that then collides with another one gets a numeric suffix. Group members and rule destinations are rewritten to match, so every reference keeps pointing at the same node. direct proxies/outbounds are mapped onto the built-in DIRECT, and reject / block / dns onto REJECT.

Notice: A converted profile is a static snapshot. Chute re-downloads a subscription and parses it as a native profile, so a profile that had to be converted is saved without an auto-update URL and will not refresh itself.

Clash / mihomo Conversion Notes

Notice: dialer-proxy is converted to underlying-proxy. The imported reference is active: the policy's connections — TCP, and UDP where the protocols allow it — are opened through the named upstream, and nested references create multiple hops. Missing or cyclic references fail closed and are reported in the log. A dialer-proxy naming a type: direct alias is a direct dial. A proxy provider's override: dialer-proxy becomes the provider's underlying-proxy; the other override keys are still dropped with a warning. A rule or proxy provider's proxy: becomes its policy=, so the provider is downloaded through that policy, as in mihomo.

• Proxy types converted: ss, ssr, vmess, vless, trojan, http, socks5, hysteria2, tuic, anytls, wireguard, ssh. Types Chute has no implementation for — snell, hysteria (v1), mieru, juicity, shadowquic, trusttunnel, openvpn, sudoku, vmess-http — are skipped with a warning naming the protocol. Two more are skipped although Chute supports the protocol: a masque proxy, because the mihomo field layout differs, and a tailscale proxy, which is configured once in the [Tailscale] section and used through the built-in TAILSCALE policy. There is no type: https: an HTTPS proxy is type: http with tls: true, as mihomo writes it, and type: https is reported as an unsupported proxy type.
• mihomo's two fingerprint keys mean different things and are kept apart: client-fingerprint becomes fingerprint (the uTLS ClientHello profile) and fingerprint becomes cert-fingerprint-sha256 (a certificate pin).
• udp: false becomes udp-relay=false and tfo becomes tfo=true. An enabled smux block is not carried over — Chute's mux uses a framing of its own, which a mihomo or sing-box server cannot read — and the import says so: <path>.smux: multiplexing (smux) has no KLNEKit equivalent; mux is left off.
• An ss proxy's plugin is converted from its plugin-opts: obfs (also simple-obfs, obfs-local) into obfs and obfs_param, and v2ray-plugin as for a share link — mode, tls, host, path and mux as described there, headers into ws-headers, where a Host takes the place of host, and skip-cert-verify into skip-cert-verify=true. mihomo's default Host, bing.com, is not copied: without a host, the policy's own default applies. Any other plugin is reported and dropped.
• An ss proxy's udp-over-tcp: true becomes udp-over-tcp=true, always with a version: udp-over-tcp-version as given, or 1 when it is left out, because mihomo's default is the legacy framing while Chute's is 2. With udp: false the proxy still relays no UDP, as in mihomo.
• A trojan proxy always gets tls=true: mihomo's Trojan is always TLS, so a tls: false in the profile is ignored. A wireguard proxy keeps its allowed-ips, which Chute enforces — see WireGuard Configuration.
• An ssh proxy's host-key becomes a quoted server-fingerprint. A list becomes one server-fingerprint="…" holding every key; an entry containing a quote or a comma cannot be written into the policy line and is reported and dropped.
• A field that takes one value but is written as a list or a mapping is treated as absent; when the field is required, the entry is reported and skipped.
• Group types select, url-test, fallback and load-balance are converted with their health-check options. A relay group stays a relay group with its members in the same order: the first is dialled directly and the last connects to the destination. use: members become policy-provider:<name> references, and include-all / include-all-proxies / include-all-providers are expanded into an explicit member list.
• filter and exclude-filter are carried over quoted, but a pattern containing a comma or a quote cannot survive the configuration line format and is dropped with a warning.
• A group's exclude-type is carried over as exclude-type=: the named proxy types are kept out of the members a provider contributes. tcp-concurrent has no switch of its own — Chute races up to five resolved addresses of a destination where the platform allows it, and connects to the first elsewhere — and the import says so rather than reporting it as a plain loss.
• Rule types are renamed where the names differ: MATCH → FINAL, DST-PORT → DEST-PORT, SRC-IP-CIDR → SRC-IP. REJECT-DROP and REJECT-TINYGIF are kept, since both are Chute built-ins with their own behavior; a rule targeting PASS or COMPATIBLE is skipped.
• An inline rule-provider (type: inline with a payload list) is expanded into the equivalent concrete rules, since a Chute [Rule Provider] line cannot embed a payload.
• A SUB-RULE,(condition),name rule and the sub-rules: mapping it names are expanded into ordinary rules: each rule of the branch name becomes AND,((condition),(rule)),POLICY, and the branch's MATCH,X becomes condition,X. A SUB-RULE inside a branch stacks its condition on the ones around it, up to 8 levels deep. A branch that is missing, or that leads back to one being expanded, is skipped with a conversion warning.
• General keys are mapped where an equivalent exists: mixed-port becomes the HTTP port (SOCKS5 needs its own socks-port), allow-lan becomes allow-wifi-access, log-level is mapped onto loglevel, external-controller/secret become the external HTTP controller options, and an enabled sniffer becomes sniffing-enabled.
• bind-address becomes interface and socks-interface — the address the two listeners bind to. * means every address. If allow-lan is also on, Chute's allow-wifi-access widens the bind to every address anyway, and the import says so: drop allow-wifi-access to keep the narrower one.
• authentication becomes one http-auth line per credential, guarding the same two listeners. An entry with no : between user and password is reported and dropped.
• external-controller-cors becomes external-http-cors only when the allowed origins are already "any" (*, or no list at all). Chute's switch is all-or-nothing, so a profile naming specific origins keeps it off and is told why — turning it on would hand every origin the access the profile granted one. allow-private-network has no equivalent and the header is not sent.
• mihomo splits exact and glob process matching into two rule types; Chute has one, and it is the glob one. PROCESS-NAME-WILDCARD and PROCESS-PATH-WILDCARD therefore become PROCESS-NAME and PROCESS-PATH, which read * and ? the same way. A literal with neither in it still matches exactly.
• tun maps where Chute has the same key: dns-hijack becomes hijack-dns (mihomo's any:53 is rewritten to *:53), route-address becomes tun-included-routes and route-exclude-address becomes tun-excluded-routes. stack, auto-route, auto-detect-interface, auto-redirect, mtu, strict-route, endpoint-independent-nat, device, inet4-address, inet6-address, udp-timeout and gso are reported instead — Chute decides those itself.
• The DNS block maps as follows. hosts becomes [Host] entries, keeping every address of a list. nameserver and fallback are merged into one set and written as dns-server, doh, dot, doq or doh3 according to each entry's spelling — Chute queries every configured resolver at once, so a separate fallback pool has nothing to fall back from, and the import says so. direct-nameserver and proxy-server-nameserver become direct-dns-server and proxy-dns-server. fake-ip-filter becomes always-real-ip. nameserver-policy becomes one [Host] entry per key; a rule-set: key becomes the set-keyed form RULE-SET:<provider> = server:… when the provider is an http or file one, and a geosite: key is dropped with a warning.
• Also in the DNS block: use-system-hosts: false becomes read-etc-hosts = false. use-hosts: false has no equivalent — the [Host] table is always consulted — and is reported. fake-ip-filter-mode: whitelist inverts the filter, which always-real-ip cannot express, so the list is kept as a blacklist and the import says so. default-nameserver bootstraps the resolvers' own hostnames; Chute resolves those through the system resolver, and the import points at the [Host] line that pins them instead.

sing-box Conversion Notes

• Outbound types converted: shadowsocks, vmess, vless, trojan, hysteria2, tuic, anytls, shadowtls, wireguard, http, socks, ssh. selector and urltest become select and url-test policy groups. A shadowsocks plugin is converted for obfs-local (also spelled simple-obfs or obfs), into obfs and obfs_param, and for v2ray-plugin, whose plugin_opts string (tls;host=…;path=…) converts as a share link's does, its warnings naming plugin_opts rather than plugin-opts; any other plugin is reported and dropped, and the outbound is still written but will not connect to a server that requires the plugin. A trojan outbound gets tls=true only when its tls.enabled is set, as in sing-box; without it the outbound is imported as plaintext Trojan — add tls=true unless the server really speaks plaintext.
• Inside an outbound: a transport of type xhttp or splithttp becomes xhttp=true with xhttp-path, xhttp-host, xhttp-mode and xhttp-headers. An enabled tls.ech becomes ech=true, and its config becomes ech-config=. REALITY's public_key becomes public-key; an outbound without one is converted with a warning, since its REALITY handshake cannot succeed. An SSH host_key list becomes one quoted server-fingerprint="…" holding every key; an entry containing a quote or a comma is reported and dropped. A legacy wireguard outbound keeps its local_address list as self-ip and self-ip-v6 (the first address of each family), its pre_shared_key as preshared-key and its reserved as a quoted reserved="a,b,c"; a peers list is reported and dropped, since Chute configures a single peer.
• endpoints (sing-box 1.11 and later) are converted too: a wireguard endpoint becomes a wireguard policy with its own [WireGuard <tag>] section, its peer's allowed_ips becoming the section's allowed-ips, and the first tailscale endpoint becomes the [Tailscale] section, used through the built-in TAILSCALE policy. Other endpoint types are skipped with a warning. The section name is the policy name with whitespace and square brackets stripped out, because the configuration line format drops spaces when it matches section-name=; two policies that would collide after stripping get a -2, -3 … suffix.
• Dial fields map as on the mihomo path: tcp_fast_open becomes tfo=true and network: tcp becomes udp-relay=false. A shadowsocks outbound's udp_over_tcp — true, or {"enabled": true, "version": 1} — becomes udp-over-tcp=true, with udp-over-tcp-version=1 written only for version 1: sing-box's default, version 2, is Chute's too. An enabled multiplex is deliberately not carried over: sing-box negotiates smux / yamux / h2mux with its own padding, while Chute's mux uses a framing of its own that a sing-box server cannot read, so the outbound is converted without multiplexing and a warning says so. detour becomes an active underlying-proxy= reference; nested detours form multiple hops, while cycles and missing references fail closed. A wireguard endpoint's detour is kept as well, and its tunnel goes through that upstream's UDP relay; a tailscale endpoint with a detour other than direct is not imported, and references to it fail closed, with a warning.
• route.rule_set: an inline rule set becomes a [Ruleset <tag>] section, and remote and local rule sets become [Rule Provider] lines (type=http / type=file) with format=sing-box-source. A rule set in a compiled binary format is skipped with a warning: point it at the source (.json or YAML) form of the same set. On this path the compiled format is .srs, detected from format: binary or from a path ending in .srs when format is omitted; .mrs is sniffed only on the Clash rule-provider path, where mihomo infers the format from the extension the same way. On macOS the importer rewrites the URL to the source payload beside it where the publisher offers one; on iOS, Apple TV and Android it does not, because the sets published in binary are far past what those platforms will load anyway. Profiles imported by earlier versions wrote these rule sets as format=mihomo-yaml and loaded no rules from them; they now load without being imported again. A remote rule set is downloaded the way sing-box downloads it: through its download_detour, its http_client (a tag from http_clients, or an inline client) or route.default_http_client, and, with none of these, through the default outbound (route.final). That route becomes the provider's policy=; one that resolves to direct adds nothing.
• A sing-box duration keeps its unit: update_interval: 3d is three days, and d, h, m, s and ms are all read. An interval whose unit did not parse fell back to the default of one day, which is not what a profile asking for 7d wanted.
• Route rules follow the action key: route/bypass use the named outbound, reject becomes REJECT (method: drop becomes REJECT-DROP), and hijack-dns, sniff and resolve emit nothing because Chute controls those from [General]. Within a rule, matchers of the same kind are alternatives and different kinds must all match, as in sing-box: domain, domain_suffix, domain_keyword, domain_regex, ip_cidr, geoip and ip_is_private are one kind; port and port_range are another, as are source_ip_cidr and source_ip_is_private, and source_port and source_port_range; every other matcher is a kind of its own. A rule of one kind becomes one line per value, and a rule of several kinds becomes one AND rule — {"network": "udp", "port": 443} becomes AND,((DEST-PORT,443),(PROTOCOL,udp)). A domain_suffix written with a leading dot (.cn) becomes DOMAIN-SUFFIX,cn. type: logical rules become AND / OR / NOT, invert wraps the whole rule in NOT, and port_range (a:b) and source_port_range become port ranges. A rule_set is one more condition of the rule wherever it appears, including inside a type: logical or inverted rule (see Logical Rule); several tags on one rule are alternatives of each other. When one of those tags names a set that could not be imported, the tag is dropped with a notice and the rule keeps the rest — it then matches less. The whole rule is dropped only when every tag it names failed, or when the rule_set sits inside a type: logical or inverted rule, where dropping one alternative would change what the rest of the expression matches. A matcher with no Chute equivalent is dropped with a warning when another matcher of its kind remains (the rule then matches less); otherwise the whole rule is dropped, with a warning, rather than converted into a rule that matches more.
• The DNS server that answers every name no DNS rule claims — dns.final, or the first server when final is not set — becomes the [General] DNS key for its kind, with its detour written as a #proxy=<policy> suffix and a local server as system; proxy-dns-server is not written. The other servers are reached through the [Host] entries that dns.rules become, with the local server written as server:system and a plain, DoH, DoQ or DoH3 server's detour as a #proxy=<policy> suffix; a DoT server's [Host] entry cannot carry one, so its detour is dropped there with a warning. A DNS rule that routes a whole rule_set to one resolver becomes the set-keyed form, RULE-SET:<tag> = server:… — but only when rule_set is the rule's only matcher, because sing-box requires matchers of different kinds to all match and a [Host] key holds one condition. A rule naming a set that could not be imported gets no entry, for the same reason its route rule would not.

Surge and Shadowrocket Profiles

A Surge or Shadowrocket profile is read directly, with no conversion step. Chute accepts each dialect's own spellings, so a pasted profile keeps working; these are the ones that differ from Chute's native keys or were added for compatibility:

• Subscription groups. Surge's policy-path=<url> (with update-interval= and policy-regex-filter=) loads a group's members from a URL; include-all-proxies=true and include-other-group=<name> add every proxy, or another group's members. Group parameters Chute does not use, such as no-alert or icon-url, are kept when the profile is saved. Shadowrocket's use=true marks a group whose listed names are subscriptions rather than proxies, and each name is read as a proxy provider. Shadowrocket's random becomes a random group. A group of a type Chute does not implement, such as Surge's external, keeps its members and runs as select, with a notice. See Policy Group.
• Built-in policies. Shadowrocket's PROXY stands for the policy selected in global proxy mode, unless the profile defines its own Proxy; each REJECT variant (REJECT-DROP, REJECT-TINYGIF, REJECT-DICT, …) behaves as its name says. See Built-in Policy.
• Rules. DST-PORT, port ranges, HOSTNAME-TYPE with IPv4 / IPv6 / DOMAIN / SIMPLE, IP-ASN,AS…, FINAL,<policy>,dns-failed, notification-text= and [Ruleset <name>] sections — see Rule. Module rules come ahead of the profile's own rules, as in Surge.
• General (Shadowrocket). update-url names the profile's own update address, which is what Surge writes in the #!MANAGED-CONFIG header; Chute reads either. A file carrying both keeps the header, since only the header can also carry interval and strict. The update-url line itself survives the save, so a Shadowrocket profile still saves as a Shadowrocket profile. close-if-proxy-chain-missing is kept, but Chute always refuses a chained policy whose upstream is missing, as its true does. Shadowrocket's front proxy (前置代理), set only in its app, is written as global-underlying-proxy in Chute.
• DNS. Shadowrocket's direct-dns-server, proxy-dns-server, fallback-dns-server, dns-direct-system, dns-fallback-system (which appends system to fallback-dns-server, merging with one the profile also declares) and always-ip-address, and [Host] lines of the form ssid:<name> = server:…; Surge's encrypted-dns-server, allow-dns-svcb, [Host] <domain> = script:<name> and server:force-syslib. See DNS Server and Local DNS Mapping.
• General. proxy-test-url and test-timeout (the defaults for url-test, fallback and load-balance groups), udp-policy-not-supported-behaviour, encrypted-dns-skip-cert-verification, and http-api / http-api-web-dashboard, which map onto the external HTTP controller keys. See Misc Options.
• Proxies. The tuic-v5 keyword, and a [WireGuard <name>] section written with peer = (…). See Proxy Server and WireGuard Configuration.
• HTTP. header-replace-regex, the http-request / http-response form of Body Rewrite, [Map Local] with data-type=, status-code= and header="Key: value|…", URL Rewrite reject-array / reject-tinygif, and [MITM] h2, hostname-disabled and auto-quic-block. See Header Rewrite, Body Rewrite, Mock Response, URL Rewrite and HTTPS Decryption.
• Scripts and modules. cronexp=, type=generic and event-name= in [Script]; #!system_version, #!REQUIREMENT, #!IOS-ONLY / #!MACOS-ONLY / #!TVOS-ONLY, and %APPEND% / %INSERT% in a module's [General]. #!system_version and #!REQUIREMENT are only recorded: Chute reads them off the module, no app displays them, and neither gates whether the module loads. See JS Scripting and Module.
• Sections Chute does not implement — [Keystore], [Port Forwarding], [Testing], [DHCP], [Snell Server], [Panel], [Ponte], [MTProto] — load with one notice each and are saved back unchanged; [Tailscale <name>] is read as [Tailscale]. See Configuration.

Not available: a [Proxy] line naming a protocol Chute does not implement is not a configuration error. The policy is dropped with a notice, the line survives the save exactly as written, and references to that policy become dangling — they fail closed to REJECT at runtime rather than leaking to DIRECT. The protocols recognised this way are Surge's snell, external, h2-connect and trust-tunnel; Shadowrocket's hysteria (v1), juicity, sudoku, openconnect, mieru, brook, lua, http2, http3, relay and subscribe; and tailscale, which Chute configures once in the [Tailscale] section and uses through the built-in TAILSCALE policy. A [General] key with no Chute equivalent is likewise ignored with a notice while its line is kept as written.

Limitations

• Proxy chaining carries TCP and UDP. mihomo dialer-proxy and sing-box detour become underlying-proxy references, Clash relay groups stay relay groups with the same hop order, and a provider's download route (mihomo proxy:, sing-box download_detour or http_client) becomes its policy=. Cycles, missing references and a QUIC or WireGuard leg over an upstream without UDP are rejected and logged rather than sent directly; a Shadowsocks node with udp-over-tcp carries its UDP over such an upstream as well.
• Options with no Chute equivalent are dropped with a warning rather than silently: per-proxy ip-version, interface-name, routing-mark, mptcp, packet-encoding, global-padding, authenticated-length and encryption, and udp-over-tcp / udp-over-tcp-version on any proxy other than ss; per-group disable-udp, interface-name and routing-mark; and the General keys geodata-mode, geox-url, find-process-mode, unified-delay, tproxy-port, redir-port and others. A group's icon is the exception: it is artwork, it changes no traffic, and it is dropped in silence.
• Rule types with no equivalent are skipped: IP-SUFFIX, SRC-IP-SUFFIX, SRC-GEOIP, SRC-IP-ASN, DSCP, UID, PROCESS-PATH-REGEX, IP-ACCEPT and REMATCH-NAME. A rule carrying mihomo's src modifier is skipped as well, rather than matching on the wrong endpoint.
• GEOSITE and the GEOIP categories that are not ISO country codes name sets in mihomo's geo data files, which Chute does not carry. GEOIP,private and GEOIP,lan become RULE-SET,LAN, the built-in private-address set, on every platform — no download. The rest depend on where the import runs: on macOS the rule becomes RULE-SET,geosite-<tag> (or geoip-<tag>) and a [Rule Provider] line is synthesized alongside it, pointing at the YAML payload published for that set, which you can repoint or delete like any other line. On iOS, Apple TV and Android the rule is dropped with a message saying so, because those sets are larger than the platform will convert — import the profile on a desktop to keep them. An ISO country code still goes to the bundled GeoIP database and needs no set at all.
• Protocol details that Chute manages itself are not carried over: Hysteria2 port hopping (ports), TUIC heartbeat, AnyTLS session-pool tuning, WireGuard peers lists (a single peer is configured) and workers.
• Transports Chute does not implement are reported instead of converted: h2, http obfuscation, httpupgrade, the v2ray-http-upgrade WebSocket variant, WebSocket max-early-data, and XHTTP extra (XMUX / download-settings). A sing-box outbound whose transport.type is httpupgrade or quic is the exception: nothing is emitted for it and nothing is reported either, so check those outbounds by hand after the import.
• Clash's operating mode is a runtime switch in Chute, not a configuration key; a profile in global or direct mode converts to rule mode with a warning.
• YAML is read with a standard parser, so anchors and the << merge key work. A value written as a multi-line scalar is folded onto one line, because a newline would split the configuration line it lands on.
• A profile whose policy names are {...} placeholders — what a subscription generator emits before its own substitution step — is named as a template: the import says so once, rather than only reporting every reference to a placeholder as an undefined policy.