diff --git a/bin/clean.sh b/bin/clean.sh
index 1bf498c..e28d382 100755
--- a/bin/clean.sh
+++ b/bin/clean.sh
@@ -34,8 +34,6 @@ declare -a DEFAULT_WHITELIST_PATTERNS=(
     "$HOME/.cache/huggingface*"
     "$HOME/.m2/repository/*"
     "$HOME/.ollama/models/*"
-    "$HOME/Library/Caches/com.nssurge.surge-mac/*"
-    "$HOME/Library/Application Support/com.nssurge.surge-mac/*"
 )
 declare -a WHITELIST_PATTERNS=()
 WHITELIST_WARNINGS=()
@@ -241,6 +239,18 @@ safe_clean() {
     local -a existing_paths=()
     for path in "${targets[@]}"; do
         local skip=false
+
+        # Hard-coded protection for critical apps (cannot be disabled by user)
+        case "$path" in
+            *clash*|*Clash*|*surge*|*Surge*|*mihomo*)
+                skip=true
+                ((skipped_count++))
+                ;;
+        esac
+
+        [[ "$skip" == "true" ]] && continue
+
+        # Check user-defined whitelist
         if [[ ${#WHITELIST_PATTERNS[@]} -gt 0 ]]; then
             for w in "${WHITELIST_PATTERNS[@]}"; do
                 # Match both exact path and glob pattern
@@ -1201,7 +1211,7 @@ perform_cleanup() {
 
         # Skip system and protected apps
         case "$app_name" in
-            com.apple.* | Adobe* | 1Password | Claude)
+            com.apple.* | Adobe* | 1Password | Claude | *ClashX* | *clash* | mihomo* | *Surge*)
                 continue
                 ;;
         esac
diff --git a/lib/common.sh b/lib/common.sh
index 99b9ae2..d5b2a28 100755
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -1269,6 +1269,12 @@ readonly DATA_PROTECTED_BUNDLES=(
     "com.telerik.Fiddler"      # Fiddler
     "com.usebruno.app"         # Bruno (API client)
 
+    # Network Proxy & VPN Tools (protect all variants)
+    "*clash*"                  # All Clash variants (ClashX, ClashX Pro, Clash Verge, etc)
+    "*Clash*"                  # Capitalized variants
+    "com.nssurge.surge-mac"    # Surge
+    "mihomo*"                  # Mihomo Party and variants
+
     # ============================================================================
     # Development Tools - Git & Version Control
     # ============================================================================
diff --git a/mole b/mole
index 107754e..74212eb 100755
--- a/mole
+++ b/mole
@@ -22,7 +22,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/lib/common.sh"
 
 # Version info
-VERSION="1.9.6"
+VERSION="1.9.7"
 MOLE_TAGLINE="can dig deep to clean your Mac."
 
 # Get latest version from remote repository