feat: evolve rate-filter to a more generic filter

README.md

@@ -113,8 +113,8 @@ ssm config apply \
 
 `core-config.yaml` can carry an `ssm:` key — this tool's own automation config, applied when you run `config apply` and always stripped out of the generated config before it's written (mihomo never sees it). It supports three things:
 
-1. **`proxy-groups`** — build a new proxy-group from proxies matching a subscription and/or keyword filter.
-2. **`rate-filters`** — build a new proxy-group from proxies whose name encodes a rate/multiplier (e.g. `HK 01 | 1.5x`), extracted via a regexp and compared against a threshold.
+1. **`proxy-groups`** — build a new proxy-group from proxies matching a subscription and/or name-pattern (regexp) filter.
+2. **`filters`** — strip unwanted proxies out of every proxy-group's `proxies` list in the generated config (subscription-provided groups *and* ones built by a `proxy-groups` rule above) — a global denylist, not a new group.
 3. **`patches`** — append/prepend/replace an arbitrary value at any path in the generated config.
 
 ```yaml
@@ -124,16 +124,24 @@ ssm:
       type: select                     # any extra clash proxy-group fields (url, interval, tolerance...) pass through as-is
       match:
         subscriptions: ["home-sub"]    # optional; omit to match proxies from any subscription
-        name-contains: ["HK", "Hong Kong"]  # optional; OR-matched, case-insensitive, matched against the proxy's original (pre-prefix) name
+        name-pattern: '(?i)HK|Hong Kong'  # optional; regexp matched against the original (pre-prefix) name of either a proxy OR a proxy-group from the subscription (e.g. its own default selector); use "|" for alternatives and "(?i)" for case-insensitive matching. Never matches a builtin like DIRECT/REJECT — those aren't sourced from any subscription
 
-  rate-filters:
-    - name: "Cheap Nodes"
-      type: select
-      pattern: '([\d.]+)x'             # regexp; its first capture group is parsed as the rate
-      operator: "<="                   # one of <, <=, >, >=, ==, !=
-      value: 1.0                       # proxies whose name doesn't match `pattern` at all are excluded
+  filters:
+    - name: "Drop Blocked Nodes"       # optional; only used for logging
       match:
-        subscriptions: ["home-sub", "work-sub"]
+        name-pattern: '(?i)blocked|expired'  # proxies matching Match with no `compares` are unwanted outright — a plain denylist by name
+
+    - name: "Drop Expensive and Slow"
+      match:
+        subscriptions: ["home-sub", "work-sub"]  # optional; scopes which proxies this rule even considers
+        name-pattern: '^(HK|SG)'
+      compares:                        # optional (list); every entry must be satisfied (AND'd) for a scoped proxy to be considered unwanted and removed
+        - pattern: '([\d.]+)x'         # regexp whose first capture group is parsed as a float; proxies whose name doesn't match are left alone (can't be evaluated)
+          operator: ">"                # one of <, <=, >, >=, ==, !=
+          value: 2.0
+        - pattern: '(\d+)ms'
+          operator: ">"
+          value: 300
 
   patches:
     - path: dns.nameserver             # dot/bracket path: dots descend into maps, [N] indexes into lists
@@ -147,7 +155,7 @@ ssm:
       value: ["MATCH,PROXY"]
 ```
 
-`proxy-groups` and `rate-filters` run before `patches`, so patches can reference or further adjust the groups they created (e.g. `proxy-groups[-1]`-style indexing isn't supported — use the group's actual index, or patch `proxy-groups` itself with `append`/`prepend`).
+`proxy-groups` build new groups first, then `filters` scrub unwanted proxies out of every group present at that point (subscription-provided and newly built alike), then `patches` run last — so patches can reference or further adjust the (already-filtered) groups (e.g. `proxy-groups[-1]`-style indexing isn't supported — use the group's actual index, or patch `proxy-groups` itself with `append`/`prepend`).
 
 ### Core Management
 ```bash