Compile routing rules into shared indexes while preserving ordered policy evaluation and DNS decisions. Add typed predicates and bounded local SRS, sing-box JSON, Mihomo YAML/text/MRS, and GeoSite/GeoIP DAT sources through named rule groups or inline masks, with format detection, source caching, pre-activation compilation, and source-aware reloads. Include configuration examples, regression coverage, benchmark tooling, and dependency notices.
Extend opt-in TCP sniffing to use cleartext HTTP/1.0 and HTTP/1.1 Host headers alongside TLS SNI for hostname-based routing. Preserve original destinations, byte replay, sniff limits, Fake DNS precedence, and one route per connection. Add strict parsing, transport and lifecycle coverage, documentation, and an authenticated example with local-address safeguards.
Add opt-in Fake DNS and TLS SNI routing for clients that connect by IP. Restore synthetic destinations across TCP, UDP, and TUN while preserving reply identities; prefer sniffed SNI for hostname rules without rewriting connection targets. Add persistent fake-IP mappings, stable WireGuard server identities through optional names or public keys, upstream-address guards, deadline-aware DNS fallback, configuration documentation, and examples.
Make WireGuard use the same inline client and server protocol syntax as other proxies, replacing named endpoints before release. Add automatic sharing of equivalent clients, encrypted peer chains, explicit server routing policy, and validation that rejects conflicting settings while keeping unused clients inactive. Update examples, configuration documentation, and lifecycle and interoperability coverage.
Add named userspace WireGuard endpoints so Shoes can route inbound and outbound traffic through WireGuard without a kernel interface. Includes TCP/UDP forwarding, proxy-chain transports, reload lifecycle management, configuration validation, documentation, and dependency notices for release artifacts.
Add opt-in native VLESS Encryption with X25519 and ML-KEM key chains, authenticated record encryption, bounded session resumption, and native Vision support while preserving legacy TLS/REALITY behavior and outer transports. Include validated configuration, credential generation, examples, interoperability fixtures, and regression coverage.
Add standard HTTP/2 CONNECT to HTTP and mixed listeners and opt-in HTTP proxy clients, allowing concurrent TCP tunnels to share a connection while preserving legacy HTTP/1 and NaiveProxy behavior. Keep the H2 transport independent of NaiveProxy, preserve route isolation and per-stream authentication, require matching TLS ALPN for explicit H2 clients, and handle flow control, cancellation, and graceful shutdown. Include configuration documentation, an example, compatibility regressions, and interoperability coverage for sing-box, Mihomo, and the native Caddy-based Naive server.
Improve XHTTP transfer reliability under slow destinations and resource pressure with bounded packet pipelining, admission before body reads, queue-acceptance acknowledgements, and cancellation-safe session handling. Preserve reusable H1 uploads, correct H2/H3 finalization, add configurable receive windows and download-tail timeouts, validate effective request capacity, and expand Xray/Mihomo interoperability coverage with pinned peers in CI.
Adds Xray-compatible XHTTP/SplitHTTP with packet-up, stream-up, and stream-one modes over HTTP/1.1, HTTP/2, and HTTP/3, including REALITY and existing proxy chains. Bounded buffering, flow-control-aware admission, connection pooling, and inactivity-based timeouts maintain backpressure without imposing a minimum upload rate. Preserves TLS key-exchange and ML-DSA policies, adds configuration examples and interoperability coverage, and vendors an h3 fix to prevent empty DATA frames from truncating streams.
* examples/named_certificates.yaml: update for named pems
* config: update for named pems
* thread_util.rs: allow re-setting
* CONFIG.md: updated for named pem
* main.rs: update for new validation flow
* Cargo.toml: add tempfile for tests
* inline format args for cargo clippy
cfal