Support WebSocket early data for compatibility with sing-box, Xray, and Mihomo. Add opt-in client sending through path or header carriers, automatic server reception of up to 2048 bytes from Sec-WebSocket-Protocol, strict handshake validation, and fixes for buffered data and stream metadata, with configuration documentation and interoperability coverage.
Adds native Hysteria2 and TUIC v5 outbound clients so proxy routes can use either protocol directly for TCP and UDP. Includes pooled QUIC connections with bounded resource use, cancellation-safe TUIC commands, Hysteria2 Salamander obfuscation and port hopping, hardened HTTP/3 authentication, TLS verification, configuration examples, and interoperability coverage in CI.
Adds an outermost sudoku_mask wrapper so TCP clients and servers can interoperate with Xray FinalMask, including configurable layouts and padding, stacked masks, and XHTTP carriers. Preserves explicit flush ownership and prevents Vision or raw TCP splice from bypassing the mask, with configuration validation and documentation for supported placements and limits. Native UDP/QUIC masking is not included.
Add managed Linux TUN and REDIRECT capture with independent DNS interception, protected bootstrap and outbound sockets, best-effort systemd-resolved integration, and retained-ingress reload and recovery. Include configuration documentation, service integration, and kernel coverage.
* Fix split-task readiness during TLS read-driven flushes
Preserve original reader and writer registrations behind a shared readiness dispatcher. Keep internal receive, drain and flush helpers non-registering, and wake parked writers on read-driven progress or fatal receive errors without adding write-side self-wakes.
Cover ordinary TLS, REALITY, raw handoff, vectored writes, control-operation readiness, reader cancellation and terminal errors. Extract the fix and later TLS test cleanups from 5f475063 and f83bc0f1 without the Sudoku-only test cases.
* Simplify TLS readiness regression tests
Preserve Hickory transport error kinds during hostname lookups so the existing resolver refresh and retry policy handles timeouts and unavailable connections. Reuse the shared error conversion and cover transport recovery, cached success, and NXDOMAIN responses without unnecessary refresh.
cfal