* feat(config): add conditions while preserving mask rules
Accept conditions alongside the existing masks and mask spellings, rejecting conflicting matching fields and flat-source combinations. Normalize all forms into the existing predicate engine.
Add explicit masks leaves for composed expressions and source groups. Keep simple address exports compact and serialize richer rules under conditions.
Cover round-trips, nested source discovery, controller payloads, warning-free compatibility, and routing across accepted and rejected reloads.
* docs(routing): explain conditions and compatible mask syntax
Document expression composition, conflicting fields, source shorthand, and canonical serialization in English and Chinese. Record the controller diagnostic shape in the changelog.
Add a complete conditions example, validate it through the native configuration pipeline, and show conditions in the rule-source example.
* fix(config): clarify invalid rule conditions diagnostics
Name the mutually exclusive matching fields explicitly, including legacy aliases, instead of reporting an unwritten duplicate conditions key.
Explain that nested masks leaves accept only strings or nonempty string lists, with regression tests for JSON/YAML conflicts and invalid leaf shapes.
* refactor(tests): simplify rule conditions coverage
Stage all spelling and format variants before checking their shared canonical form. Restore that form once while preserving per-variant compilation and the complete decision matrix.
Remove conflict inputs already covered by stronger diagnostic assertions, clarify controller payload names, and validate all five rule forms in one fixture per CLI mode.
* fix(rules): correct source-group predicate guidance
Recommend the rule_source_group predicate without a masks wrapper so the rename hint works in nested expressions and source groups. Cover the suggested syntax and diagnostic in regression tests.
Update both documentation locales to describe source-group references under conditions or masks, including boolean composition.
Report shared selector and group ancestry once per selected occurrence while preserving reverse hop order, independently repeated references, routing behavior, and catalog identities. Cover nested selections and pinned TCP/UDP flows, simplify reporting metadata assembly, and clarify chain ordering, client naming, and DIRECT-to-proxy semantics in both controller guides.
Allow rule caches in directories accessible through group permissions or ACLs without requiring directory ownership, and create missing cache directories and parents automatically. Existing ownership and permissions remain unchanged, while world-writable directories, unsafe cache files, and conflicting cache leases remain rejected. Clarify the startup and cache-save permission requirements.
Add optional NTP synchronization for hosts where shoes cannot set the system clock. Share the corrected time across REALITY, VMess, Shadowsocks 2022, and TLS certificate validation, using protected direct UDP with bounded synchronization, periodic refresh, and reload-safe ownership. Preserve timestamp windows and replay protection, retain the last correction on refresh failure, and document configuration and clock limitations.
Expand regression coverage for whole-path routing across forwarding, DNS, rule downloads, probes, and session reuse to guard against route changes affecting established flows or shared state. Add native Caddy and WireGuard cases plus dual-stack kernel-TUN coverage, strengthen routing boundaries and controller assertions, enable routing and consumer suites on macOS, and make test fixtures portable across platforms.
Close regression gaps in message framing, AnyTLS recovery and UoT interoperability, routing limits, and reload retention. Harden test helpers to reject empty child runs, verify HTTP response integrity, and terminate curl on failure or cancellation; tighten CI test selection and simplify the supporting fixtures.
Allow client groups to select complete paths of different lengths consistently across forwarding, DNS, downloads, and carrier routes. Separate source configuration from bounded runtime plans, preserve selection boundaries and per-flow path pinning, and keep TCP/UDP rotation and automatic selection independent. Unify chain syntax while retaining legacy proxy-list alternatives, and cache up to 16 NaiveProxy sessions by selected prefix, pruning closed entries before LRU eviction without interrupting active tunnels. Add routing measurements, lifecycle coverage, and updated English and Chinese configuration guidance.
Filter delayed macOS filesystem notifications when watched regular-file metadata is unchanged, avoiding unnecessary configuration reloads after startup. Preserve observations across watcher rebuilds and registration failures, keep recovery channels independent, and retain genuine edits and explicit reloads while leaving uncertain metadata and other platforms unfiltered.
Add reusable rule-source groups and config-driven remote downloads with explicit proxy and DNS routing, in-memory retention, and optional private atomic disk caching. Preserve active traffic across download and reload failures while keeping configuration checks offline. Consolidate process-wide limits and rule_cache_dir under global_settings, retain global_limits as a warning-emitting alias, and remove ordered fallback groups and health_check configuration.
Add managed Linux TUN and REDIRECT capture with independent DNS interception, protected bootstrap and outbound sockets, best-effort systemd-resolved integration, and retained-ingress reload and recovery. Include configuration documentation, service integration, and kernel coverage.
Add opt-in fallback groups that route new flows through the first healthy eligible path and fail closed when no path remains, without overriding manual selections or replaying traffic. Reuse the shared probe engine with bounded generation-owned scheduling, resolver-aware path identity and reload cleanup, and reject transport combinations that cannot reliably attribute health to a concrete path.
Make configuration failures easier to locate without weakening validation: add configuration-entry and rule context, preserve native YAML error locations, and identify input files in validation errors. Reject previously ignored unknown fields in named PEM entries and TCP settings, clarify diagnostic limits and upgrade requirements, and add coverage for strict parsing, representative configurations, and offline validation behavior.
Move file I/O onto dedicated per-sink workers so slow storage does not stall relay threads. Bound pending records and escaped bytes, drop newest records on overload with health counters, and preserve FIFO ordering and flush barriers. Integrate bounded shutdown and reusable file-sink ownership with CLI and mobile FFI while preserving sanitization and existing log formatting.
Retain fixture ports until listener handoff, await Shoes readiness before starting dependent peers, and settle native watcher setup notifications before activation assertions. Pin Hickory 0.26.3 to a connection-close recovery backport that preserves typed H3 errors and healthy-upstream failover without widening retry limits.
Add URL-scoped health and delay-based upstream selection so new connections can use healthy, transport-compatible proxies without requiring a controller listener. This introduces strict client_group.type configuration in place of strategy, bounded automatic probes with lazy activity tracking and reload fencing, controller reporting, and configuration documentation. It also preserves local failure attribution through outbound HTTP/2 adapters so local resource limits do not incorrectly penalize proxy health.
Add shared file and ACME certificate sources for automatic issuance, renewal, and live TLS/QUIC rotation without interrupting existing connections. Support HTTP-01 and TLS-ALPN-01, durable retry and account state, and CLI/FFI lifecycle handoffs. Extend live rotation to existing file-backed identities and document stricter certificate validation requirements.
Make Clash controller endpoints visible at startup and allow dashboards from any origin when explicitly configured with `cors_origins: ["*"]`. Startup messages include TCP addresses or Unix socket paths, while wildcard CORS preserves authentication and preflight restrictions; controller configuration changes still require a restart.
Expose runtime proxy selection and connection visibility without restarting Shoes. This adds an opt-in authenticated Clash-compatible TCP/Unix API, persistent selector choices, traffic and connection statistics, delay probes, live logs, and per-flow cancellation, with reload-aware integration across proxy protocols, DNS, and TUN.
Compile routing rules into shared indexes while preserving ordered policy evaluation and DNS decisions. Add typed predicates and bounded local SRS, sing-box JSON, Mihomo YAML/text/MRS, and GeoSite/GeoIP DAT sources through named rule groups or inline masks, with format detection, source caching, pre-activation compilation, and source-aware reloads. Include configuration examples, regression coverage, benchmark tooling, and dependency notices.
Add opt-in Fake DNS and TLS SNI routing for clients that connect by IP. Restore synthetic destinations across TCP, UDP, and TUN while preserving reply identities; prefer sniffed SNI for hostname rules without rewriting connection targets. Add persistent fake-IP mappings, stable WireGuard server identities through optional names or public keys, upstream-address guards, deadline-aware DNS fallback, configuration documentation, and examples.
Make WireGuard use the same inline client and server protocol syntax as other proxies, replacing named endpoints before release. Add automatic sharing of equivalent clients, encrypted peer chains, explicit server routing policy, and validation that rejects conflicting settings while keeping unused clients inactive. Update examples, configuration documentation, and lifecycle and interoperability coverage.
Expand WireGuard coverage for TCP and UDP forwarding, peer isolation, transport outages, rekeying, reloads, DNS routing, native TUN, and FFI lifecycle behavior to catch failures that affect real deployments. Add macOS lifecycle coverage and portable fixtures, and fix IPv6 DNS upstream literals being misclassified as hostnames.
cfal