Catch resource retention across failed setup, cancellation, reloads, and owner destruction with allocation, task, descriptor, and permit regressions, alongside deterministic matcher invariants. Strengthen reload measurements with committed-upstream verification, exact-byte live-session checks, bounded cleanup, and byte-exact provenance, and add the coverage to CI.
Add shared file and ACME certificate sources for automatic issuance, renewal, and live TLS/QUIC rotation without interrupting existing connections. Support HTTP-01 and TLS-ALPN-01, durable retry and account state, and CLI/FFI lifecycle handoffs. Extend live rotation to existing file-backed identities and document stricter certificate validation requirements.
Expose runtime proxy selection and connection visibility without restarting Shoes. This adds an opt-in authenticated Clash-compatible TCP/Unix API, persistent selector choices, traffic and connection statistics, delay probes, live logs, and per-flow cancellation, with reload-aware integration across proxy protocols, DNS, and TUN.
Prevent TUN startup resets and orphaned connections by deferring inbound TCP publication until handshakes complete, bounding half-open admission, and propagating worker failures while preserving Linux link-down and Apple queue-backpressure recovery. Fix Naive HTTP/2 writes that stall despite available credit and improve transfer diagnostics. Preserve full-payload and clean-EOF Mihomo REALITY coverage with reply-first sequencing, retaining early half-close as an opt-in peer regression. Upgrade Xray test peers to the 26.10.21 security release after upstream withdrew the previous releases.
Compile routing rules into shared indexes while preserving ordered policy evaluation and DNS decisions. Add typed predicates and bounded local SRS, sing-box JSON, Mihomo YAML/text/MRS, and GeoSite/GeoIP DAT sources through named rule groups or inline masks, with format detection, source caching, pre-activation compilation, and source-aware reloads. Include configuration examples, regression coverage, benchmark tooling, and dependency notices.
Add opt-in Fake DNS and TLS SNI routing for clients that connect by IP. Restore synthetic destinations across TCP, UDP, and TUN while preserving reply identities; prefer sniffed SNI for hostname rules without rewriting connection targets. Add persistent fake-IP mappings, stable WireGuard server identities through optional names or public keys, upstream-address guards, deadline-aware DNS fallback, configuration documentation, and examples.
Add named userspace WireGuard endpoints so Shoes can route inbound and outbound traffic through WireGuard without a kernel interface. Includes TCP/UDP forwarding, proxy-chain transports, reload lifecycle management, configuration validation, documentation, and dependency notices for release artifacts.
Prevent malformed traffic and replayed authentication from corrupting proxy sessions, preserve buffered handshake data and protocol compatibility, and report connection failures accurately. Validate replacement configurations before retiring listeners, handle process signals reliably, and make QUIC socket setup and synchronous FFI lifecycle calls safer across platforms.
cfal