Add opt-in fallback groups that route new flows through the first healthy eligible path and fail closed when no path remains, without overriding manual selections or replaying traffic. Reuse the shared probe engine with bounded generation-owned scheduling, resolver-aware path identity and reload cleanup, and reject transport combinations that cannot reliably attribute health to a concrete path.
Add advisory selector/reload performance reports, optional Linux unit/process coverage with changed-line summaries, and bounded rule-parser property tests to make regressions and verification gaps easier to spot. Reports reject invalid measurements and account for timing noise without introducing hard performance gates; existing tests and production behavior remain unchanged.
Make configuration failures easier to locate without weakening validation: add configuration-entry and rule context, preserve native YAML error locations, and identify input files in validation errors. Reject previously ignored unknown fields in named PEM entries and TCP settings, clarify diagnostic limits and upgrade requirements, and add coverage for strict parsing, representative configurations, and offline validation behavior.
Move file I/O onto dedicated per-sink workers so slow storage does not stall relay threads. Bound pending records and escaped bytes, drop newest records on overload with health counters, and preserve FIFO ordering and flush barriers. Integrate bounded shutdown and reusable file-sink ownership with CLI and mobile FFI while preserving sanitization and existing log formatting.
Retain fixture ports until listener handoff, await Shoes readiness before starting dependent peers, and settle native watcher setup notifications before activation assertions. Pin Hickory 0.26.3 to a connection-close recovery backport that preserves typed H3 errors and healthy-upstream failover without widening retry limits.
Add shared file and ACME certificate sources for automatic issuance, renewal, and live TLS/QUIC rotation without interrupting existing connections. Support HTTP-01 and TLS-ALPN-01, durable retry and account state, and CLI/FFI lifecycle handoffs. Extend live rotation to existing file-backed identities and document stricter certificate validation requirements.
Expose runtime proxy selection and connection visibility without restarting Shoes. This adds an opt-in authenticated Clash-compatible TCP/Unix API, persistent selector choices, traffic and connection statistics, delay probes, live logs, and per-flow cancellation, with reload-aware integration across proxy protocols, DNS, and TUN.
Broadens unit and integration coverage of WebSocket framing, ShadowTLS and REALITY ClientHello parsing, VLESS fallback, Hysteria2 and TUIC authentication, DNS, and connection budgets across reloads, and fixes the defects it exposed: WebSocket streams now accept control frames up to RFC 6455's 125-byte limit, no longer report EOF into partly filled read buffers, and flush buffered frames before shutting down; the shared ClientHello parser reassembles hellos split across TLS records, as Go TLS stacks do; and message-stream shutdown after EOF is bounded like the stream relay's. It also builds the binary on the library crate instead of compiling every module twice, removes the unused UdpMessageStream, moves ShadowTLS interop tests to local handshake servers, makes filtered CI test steps fail when they select no tests, consolidates the WebSocket payload-reading code, and documents how to measure coverage along with the remaining gaps, including why WebSocket Close frames stay unanswered.
Prevent TUN startup resets and orphaned connections by deferring inbound TCP publication until handshakes complete, bounding half-open admission, and propagating worker failures while preserving Linux link-down and Apple queue-backpressure recovery. Fix Naive HTTP/2 writes that stall despite available credit and improve transfer diagnostics. Preserve full-payload and clean-EOF Mihomo REALITY coverage with reply-first sequencing, retaining early half-close as an opt-in peer regression. Upgrade Xray test peers to the 26.10.21 security release after upstream withdrew the previous releases.
Compile routing rules into shared indexes while preserving ordered policy evaluation and DNS decisions. Add typed predicates and bounded local SRS, sing-box JSON, Mihomo YAML/text/MRS, and GeoSite/GeoIP DAT sources through named rule groups or inline masks, with format detection, source caching, pre-activation compilation, and source-aware reloads. Include configuration examples, regression coverage, benchmark tooling, and dependency notices.
Add opt-in Fake DNS and TLS SNI routing for clients that connect by IP. Restore synthetic destinations across TCP, UDP, and TUN while preserving reply identities; prefer sniffed SNI for hostname rules without rewriting connection targets. Add persistent fake-IP mappings, stable WireGuard server identities through optional names or public keys, upstream-address guards, deadline-aware DNS fallback, configuration documentation, and examples.
Make WireGuard use the same inline client and server protocol syntax as other proxies, replacing named endpoints before release. Add automatic sharing of equivalent clients, encrypted peer chains, explicit server routing policy, and validation that rejects conflicting settings while keeping unused clients inactive. Update examples, configuration documentation, and lifecycle and interoperability coverage.
Expand WireGuard coverage for TCP and UDP forwarding, peer isolation, transport outages, rekeying, reloads, DNS routing, native TUN, and FFI lifecycle behavior to catch failures that affect real deployments. Add macOS lifecycle coverage and portable fixtures, and fix IPv6 DNS upstream literals being misclassified as hostnames.
Add named userspace WireGuard endpoints so Shoes can route inbound and outbound traffic through WireGuard without a kernel interface. Includes TCP/UDP forwarding, proxy-chain transports, reload lifecycle management, configuration validation, documentation, and dependency notices for release artifacts.
Add opt-in native VLESS Encryption with X25519 and ML-KEM key chains, authenticated record encryption, bounded session resumption, and native Vision support while preserving legacy TLS/REALITY behavior and outer transports. Include validated configuration, credential generation, examples, interoperability fixtures, and regression coverage.
Adds Xray-compatible XHTTP/SplitHTTP with packet-up, stream-up, and stream-one modes over HTTP/1.1, HTTP/2, and HTTP/3, including REALITY and existing proxy chains. Bounded buffering, flow-control-aware admission, connection pooling, and inactivity-based timeouts maintain backpressure without imposing a minimum upload rate. Preserves TLS key-exchange and ML-DSA policies, adds configuration examples and interoperability coverage, and vendors an h3 fix to prevent empty DATA frames from truncating streams.
Prefer X25519MLKEM768 with X25519 fallback for modern REALITY compatibility, and add optional pinned ML-DSA-65 authentication with configuration fields and key generation. Harden handshake validation and preserve transparent forwarding for incompatible targets or clients, with migration documentation and pinned Xray interoperability coverage.
Add ordered native rustls key-exchange allowlists for TLS and QUIC. Hybrid-only configurations require TLS 1.3 without classical fallback or early data; omitted settings preserve existing defaults. Reject incompatible or ignored security settings, document configuration, and cover transport and Xray/sing-box interoperability.
Disable unused TCP TLS early data while preserving resumption and QUIC behavior. Bound h2mux errors, reject invalid protocol placement and authentication secrets before startup or reload, validate Shadowsocks 2022 key lengths, replace configuration-triggered panics with credential-free errors, and escape untrusted controls in file logs.
Prevent malformed traffic and replayed authentication from corrupting proxy sessions, preserve buffered handshake data and protocol compatibility, and report connection failures accurately. Validate replacement configurations before retiring listeners, handle process signals reliably, and make QUIC socket setup and synchronous FFI lifecycle calls safer across platforms.
cfal