* feat(config): add conditions while preserving mask rules
Accept conditions alongside the existing masks and mask spellings, rejecting conflicting matching fields and flat-source combinations. Normalize all forms into the existing predicate engine.
Add explicit masks leaves for composed expressions and source groups. Keep simple address exports compact and serialize richer rules under conditions.
Cover round-trips, nested source discovery, controller payloads, warning-free compatibility, and routing across accepted and rejected reloads.
* docs(routing): explain conditions and compatible mask syntax
Document expression composition, conflicting fields, source shorthand, and canonical serialization in English and Chinese. Record the controller diagnostic shape in the changelog.
Add a complete conditions example, validate it through the native configuration pipeline, and show conditions in the rule-source example.
* fix(config): clarify invalid rule conditions diagnostics
Name the mutually exclusive matching fields explicitly, including legacy aliases, instead of reporting an unwritten duplicate conditions key.
Explain that nested masks leaves accept only strings or nonempty string lists, with regression tests for JSON/YAML conflicts and invalid leaf shapes.
* refactor(tests): simplify rule conditions coverage
Stage all spelling and format variants before checking their shared canonical form. Restore that form once while preserving per-variant compilation and the complete decision matrix.
Remove conflict inputs already covered by stronger diagnostic assertions, clarify controller payload names, and validate all five rule forms in one fixture per CLI mode.
* fix(rules): correct source-group predicate guidance
Recommend the rule_source_group predicate without a masks wrapper so the rename hint works in nested expressions and source groups. Cover the suggested syntax and diagnostic in regression tests.
Update both documentation locales to describe source-group references under conditions or masks, including boolean composition.
Add optional NTP synchronization for hosts where shoes cannot set the system clock. Share the corrected time across REALITY, VMess, Shadowsocks 2022, and TLS certificate validation, using protected direct UDP with bounded synchronization, periodic refresh, and reload-safe ownership. Preserve timestamp windows and replay protection, retain the last correction on refresh failure, and document configuration and clock limitations.
Add optional global_settings.default_dns so listeners, TUN entries, and WireGuard inbounds can share DNS configuration without repetition. Omitted or null inbound DNS inherits the default, while explicit objects override it completely. Inline fake-IP defaults share one pool, and independent bootstrap and service lookups remain unchanged. Includes validation, regression coverage, and English and Chinese documentation.
Allow client groups to select complete paths of different lengths consistently across forwarding, DNS, downloads, and carrier routes. Separate source configuration from bounded runtime plans, preserve selection boundaries and per-flow path pinning, and keep TCP/UDP rotation and automatic selection independent. Unify chain syntax while retaining legacy proxy-list alternatives, and cache up to 16 NaiveProxy sessions by selected prefix, pruning closed entries before LRU eviction without interrupting active tunnels. Add routing measurements, lifecycle coverage, and updated English and Chinese configuration guidance.
* Validate published configuration examples
* Move configuration reference into Starlight site
* Check documentation site in CI
* Complete optional docs dependency lock entries
Removes historical benchmark output while preserving links to archived results, refreshes benchmark documentation, and keeps test scratch files outside the checkout. Moves the manual desktop systemd unit into examples and updates deployment instructions without changing release packaging or mobile integration.
Add reusable rule-source groups and config-driven remote downloads with explicit proxy and DNS routing, in-memory retention, and optional private atomic disk caching. Preserve active traffic across download and reload failures while keeping configuration checks offline. Consolidate process-wide limits and rule_cache_dir under global_settings, retain global_limits as a warning-emitting alias, and remove ordered fallback groups and health_check configuration.
Adds native Hysteria2 and TUIC v5 outbound clients so proxy routes can use either protocol directly for TCP and UDP. Includes pooled QUIC connections with bounded resource use, cancellation-safe TUIC commands, Hysteria2 Salamander obfuscation and port hopping, hardened HTTP/3 authentication, TLS verification, configuration examples, and interoperability coverage in CI.
Add managed Linux TUN and REDIRECT capture with independent DNS interception, protected bootstrap and outbound sockets, best-effort systemd-resolved integration, and retained-ingress reload and recovery. Include configuration documentation, service integration, and kernel coverage.
Support server-key:user-key and longer identity chains for Shadowsocks 2022 AES clients, allowing connections to multi-user servers and identity relays. Add the required identity headers, configuration validation, and usage documentation while preserving existing single-key and legacy configurations. This is client-only support; native SS2022 UDP and server-side multi-user support remain out of scope.
Add a system-only native_cache_secs option for configurable OS/NSS application memoization while preserving the existing 60-second implicit default and uncached explicit system behavior. Disable completed-cache reads and writes for zero windows, reject invalid DNS options, and document freshness and lookup-sharing semantics.
Add URL-scoped health and delay-based upstream selection so new connections can use healthy, transport-compatible proxies without requiring a controller listener. This introduces strict client_group.type configuration in place of strategy, bounded automatic probes with lazy activity tracking and reload fencing, controller reporting, and configuration documentation. It also preserves local failure attribution through outbound HTTP/2 adapters so local resource limits do not incorrectly penalize proxy health.
Share native resolver cache entries across destination ports and coalesce concurrent misses with bounded, cancellation-safe ownership. Preserve ordered address candidates, caller ports, and error details while using a conservative 60-second result-age policy rather than a DNS record TTL. Cover cancellation, expiry, failure, and capacity limits with deterministic tests and document the default behavior and trade-offs.
Add shared file and ACME certificate sources for automatic issuance, renewal, and live TLS/QUIC rotation without interrupting existing connections. Support HTTP-01 and TLS-ALPN-01, durable retry and account state, and CLI/FFI lifecycle handoffs. Extend live rotation to existing file-backed identities and document stricter certificate validation requirements.
Expose runtime proxy selection and connection visibility without restarting Shoes. This adds an opt-in authenticated Clash-compatible TCP/Unix API, persistent selector choices, traffic and connection statistics, delay probes, live logs, and per-flow cancellation, with reload-aware integration across proxy protocols, DNS, and TUN.
Compile routing rules into shared indexes while preserving ordered policy evaluation and DNS decisions. Add typed predicates and bounded local SRS, sing-box JSON, Mihomo YAML/text/MRS, and GeoSite/GeoIP DAT sources through named rule groups or inline masks, with format detection, source caching, pre-activation compilation, and source-aware reloads. Include configuration examples, regression coverage, benchmark tooling, and dependency notices.
Extend opt-in TCP sniffing to use cleartext HTTP/1.0 and HTTP/1.1 Host headers alongside TLS SNI for hostname-based routing. Preserve original destinations, byte replay, sniff limits, Fake DNS precedence, and one route per connection. Add strict parsing, transport and lifecycle coverage, documentation, and an authenticated example with local-address safeguards.
Add opt-in Fake DNS and TLS SNI routing for clients that connect by IP. Restore synthetic destinations across TCP, UDP, and TUN while preserving reply identities; prefer sniffed SNI for hostname rules without rewriting connection targets. Add persistent fake-IP mappings, stable WireGuard server identities through optional names or public keys, upstream-address guards, deadline-aware DNS fallback, configuration documentation, and examples.
Make WireGuard use the same inline client and server protocol syntax as other proxies, replacing named endpoints before release. Add automatic sharing of equivalent clients, encrypted peer chains, explicit server routing policy, and validation that rejects conflicting settings while keeping unused clients inactive. Update examples, configuration documentation, and lifecycle and interoperability coverage.
Add named userspace WireGuard endpoints so Shoes can route inbound and outbound traffic through WireGuard without a kernel interface. Includes TCP/UDP forwarding, proxy-chain transports, reload lifecycle management, configuration validation, documentation, and dependency notices for release artifacts.
Add opt-in native VLESS Encryption with X25519 and ML-KEM key chains, authenticated record encryption, bounded session resumption, and native Vision support while preserving legacy TLS/REALITY behavior and outer transports. Include validated configuration, credential generation, examples, interoperability fixtures, and regression coverage.
Add standard HTTP/2 CONNECT to HTTP and mixed listeners and opt-in HTTP proxy clients, allowing concurrent TCP tunnels to share a connection while preserving legacy HTTP/1 and NaiveProxy behavior. Keep the H2 transport independent of NaiveProxy, preserve route isolation and per-stream authentication, require matching TLS ALPN for explicit H2 clients, and handle flow control, cancellation, and graceful shutdown. Include configuration documentation, an example, compatibility regressions, and interoperability coverage for sing-box, Mihomo, and the native Caddy-based Naive server.
Improve XHTTP transfer reliability under slow destinations and resource pressure with bounded packet pipelining, admission before body reads, queue-acceptance acknowledgements, and cancellation-safe session handling. Preserve reusable H1 uploads, correct H2/H3 finalization, add configurable receive windows and download-tail timeouts, validate effective request capacity, and expand Xray/Mihomo interoperability coverage with pinned peers in CI.
Adds Xray-compatible XHTTP/SplitHTTP with packet-up, stream-up, and stream-one modes over HTTP/1.1, HTTP/2, and HTTP/3, including REALITY and existing proxy chains. Bounded buffering, flow-control-aware admission, connection pooling, and inactivity-based timeouts maintain backpressure without imposing a minimum upload rate. Preserves TLS key-exchange and ML-DSA policies, adds configuration examples and interoperability coverage, and vendors an h3 fix to prevent empty DATA frames from truncating streams.
* examples/named_certificates.yaml: update for named pems
* config: update for named pems
* thread_util.rs: allow re-setting
* CONFIG.md: updated for named pem
* main.rs: update for new validation flow
* Cargo.toml: add tempfile for tests
* inline format args for cargo clippy
cfal