Add managed Linux TUN and REDIRECT capture with independent DNS interception, protected bootstrap and outbound sockets, best-effort systemd-resolved integration, and retained-ingress reload and recovery. Include configuration documentation, service integration, and kernel coverage.
Add opt-in fallback groups that route new flows through the first healthy eligible path and fail closed when no path remains, without overriding manual selections or replaying traffic. Reuse the shared probe engine with bounded generation-owned scheduling, resolver-aware path identity and reload cleanup, and reject transport combinations that cannot reliably attribute health to a concrete path.
Make configuration failures easier to locate without weakening validation: add configuration-entry and rule context, preserve native YAML error locations, and identify input files in validation errors. Reject previously ignored unknown fields in named PEM entries and TCP settings, clarify diagnostic limits and upgrade requirements, and add coverage for strict parsing, representative configurations, and offline validation behavior.
Move file I/O onto dedicated per-sink workers so slow storage does not stall relay threads. Bound pending records and escaped bytes, drop newest records on overload with health counters, and preserve FIFO ordering and flush barriers. Integrate bounded shutdown and reusable file-sink ownership with CLI and mobile FFI while preserving sanitization and existing log formatting.
Retain fixture ports until listener handoff, await Shoes readiness before starting dependent peers, and settle native watcher setup notifications before activation assertions. Pin Hickory 0.26.3 to a connection-close recovery backport that preserves typed H3 errors and healthy-upstream failover without widening retry limits.
Add URL-scoped health and delay-based upstream selection so new connections can use healthy, transport-compatible proxies without requiring a controller listener. This introduces strict client_group.type configuration in place of strategy, bounded automatic probes with lazy activity tracking and reload fencing, controller reporting, and configuration documentation. It also preserves local failure attribution through outbound HTTP/2 adapters so local resource limits do not incorrectly penalize proxy health.
Add shared file and ACME certificate sources for automatic issuance, renewal, and live TLS/QUIC rotation without interrupting existing connections. Support HTTP-01 and TLS-ALPN-01, durable retry and account state, and CLI/FFI lifecycle handoffs. Extend live rotation to existing file-backed identities and document stricter certificate validation requirements.
Make Clash controller endpoints visible at startup and allow dashboards from any origin when explicitly configured with `cors_origins: ["*"]`. Startup messages include TCP addresses or Unix socket paths, while wildcard CORS preserves authentication and preflight restrictions; controller configuration changes still require a restart.
Expose runtime proxy selection and connection visibility without restarting Shoes. This adds an opt-in authenticated Clash-compatible TCP/Unix API, persistent selector choices, traffic and connection statistics, delay probes, live logs, and per-flow cancellation, with reload-aware integration across proxy protocols, DNS, and TUN.
Compile routing rules into shared indexes while preserving ordered policy evaluation and DNS decisions. Add typed predicates and bounded local SRS, sing-box JSON, Mihomo YAML/text/MRS, and GeoSite/GeoIP DAT sources through named rule groups or inline masks, with format detection, source caching, pre-activation compilation, and source-aware reloads. Include configuration examples, regression coverage, benchmark tooling, and dependency notices.
Add opt-in Fake DNS and TLS SNI routing for clients that connect by IP. Restore synthetic destinations across TCP, UDP, and TUN while preserving reply identities; prefer sniffed SNI for hostname rules without rewriting connection targets. Add persistent fake-IP mappings, stable WireGuard server identities through optional names or public keys, upstream-address guards, deadline-aware DNS fallback, configuration documentation, and examples.
Make WireGuard use the same inline client and server protocol syntax as other proxies, replacing named endpoints before release. Add automatic sharing of equivalent clients, encrypted peer chains, explicit server routing policy, and validation that rejects conflicting settings while keeping unused clients inactive. Update examples, configuration documentation, and lifecycle and interoperability coverage.
Expand WireGuard coverage for TCP and UDP forwarding, peer isolation, transport outages, rekeying, reloads, DNS routing, native TUN, and FFI lifecycle behavior to catch failures that affect real deployments. Add macOS lifecycle coverage and portable fixtures, and fix IPv6 DNS upstream literals being misclassified as hostnames.
cfal