WireGuard: Add WireGuard proxies, importable from wireguard:// links and Clash or Surge profiles, with pre-shared keys and Cloudflare WARP's reserved bytes; WireGuard proxies connect directly and can't be part of a proxy chain Modules: jq rewrites support the full jq 1.7 language; Loon plugins' JSON rewrites, including request bodies and jq_file, are no longer ignored, and installed modules are parsed again automatically Rule Sets: Add built-in service rule sets for Grok and Twitter that you can route on their own, like ChatGPT and Claude Proxy Chains: Any hop can be a policy group of any of the five kinds; a group after the first hop connects through the hops before it wherever it is used; policy group members can again be picked from your proxy chains MITM: When an app refuses the MITM certificate, for example because it pins certificates, its host keeps the original TLS connection for an hour, and Never Decrypt can resume decryption; choose which devices are decrypted with Client Source Addresses; the MITM Inspector shows both reasons Auto Select: Proxies you add yourself are no longer included automatically; select them to include them. When every member is unavailable for a while, for example after signing out, one of your proxies is used without being tested, and Auto Select turns back on once the subscription proxies return Node Filter: If the subscription changes while you edit, saving reloads the filter instead; the preview lists kept nodes first Connections: Improve proxy transport efficiency and make connection errors clearer Fixes: Binary TCP protocols that start with a letter no longer wait for the sniffing timeout while MITM is on; fix the request method label in the MITM Inspector; a request an app cancels is no longer taken for a refused certificate, which stopped MITM modules and scripts on that host; deleting the last item while editing rule set, DNS, MITM or module lists no longer hides Done or loses the changes; number fields such as ports accept Arabic, Persian and other local digits; the Proxy Service port can no longer be the Local Controller's; an item deleted on another device while you edit it now says your changes can't be saved; the oixCloud subscription no longer updates every time the app opens and follows its Auto Update setting and interval

WireGuard: Add WireGuard proxies, importable from wireguard:// links and Clash or Surge profiles, with pre-shared keys and Cloudflare WARP's reserved bytes; WireGuard proxies connect directly and can't be part of a proxy chain Modules: jq rewrites support the full jq 1.7 language; Loon plugins' JSON rewrites, including request bodies and jq_file, are no longer ignored, and installed modules are parsed again automatically Rule Sets: Add built-in service rule sets for Grok and Twitter that you can route on their own, like ChatGPT and Claude Proxy Chains: Any hop can be a policy group of any of the five kinds; a group after the first hop connects through the hops before it wherever it is used; policy group members can again be picked from your proxy chains MITM: When an app refuses the MITM certificate, for example because it pins certificates, its host keeps the original TLS connection for an hour, and Never Decrypt can resume decryption; choose which devices are decrypted with Client Source Addresses; the MITM Inspector shows both reasons Auto Select: Proxies you add yourself are no longer included automatically; select them to include them. When every member is unavailable for a while, for example after signing out, one of your proxies is used without being tested, and Auto Select turns back on once the subscription proxies return Node Filter: If the subscription changes while you edit, saving reloads the filter instead; the preview lists kept nodes first Connections: Improve proxy transport efficiency and make connection errors clearer Fixes: Binary TCP protocols that start with a letter no longer wait for the sniffing timeout while MITM is on; fix the request method label in the MITM Inspector; a request an app cancels is no longer taken for a refused certificate, which stopped MITM modules and scripts on that host; deleting the last item while editing rule set, DNS, MITM or module lists no longer hides Done or loses the changes; number fields such as ports accept Arabic, Persian and other local digits; the Proxy Service port can no longer be the Local Controller's; an item deleted on another device while you edit it now says your changes can't be saved

WireGuard: Add WireGuard proxies, importable from wireguard:// links and Clash or Surge profiles, with pre-shared keys and Cloudflare WARP's reserved bytes; WireGuard proxies connect directly and can't be part of a proxy chain Modules: jq rewrites support the full jq 1.7 language; Loon plugins' JSON rewrites, including request bodies and jq_file, are no longer ignored, and installed modules are parsed again automatically Rule Sets: Add built-in service rule sets for Grok and Twitter that you can route on their own, like ChatGPT and Claude Proxy Chains: Any hop can be a policy group of any of the five kinds; a group after the first hop connects through the hops before it wherever it is used; policy group members can again be picked from your proxy chains MITM: When an app refuses the MITM certificate, for example because it pins certificates, its host keeps the original TLS connection for an hour, and Never Decrypt can resume decryption; choose which devices are decrypted with Client Source Addresses; the MITM Inspector shows both reasons Auto Select: Proxies you add yourself are no longer included automatically; select them to include them. When every member is unavailable for a while, for example after signing out, one of your proxies is used without being tested, and Auto Select turns back on once the subscription proxies return Node Filter: If the subscription changes while you edit, saving reloads the filter instead; the preview lists kept nodes first Fixes: Binary TCP protocols that start with a letter no longer wait for the sniffing timeout while MITM is on; fix the request method label in the MITM Inspector; a request an app cancels is no longer taken for a refused certificate, which stopped MITM modules and scripts on that host; deleting the last item while editing rule set, DNS, MITM or module lists no longer hides Done or loses the changes; number fields such as ports accept Arabic, Persian and other local digits; the Proxy Service port can no longer be the Local Controller's; an item deleted on another device while you edit it now says your changes can't be saved

Rule Sets: Add built-in service rule sets for Grok and Twitter that you can route on their own, like ChatGPT and Claude Proxy Chains: Any hop can be a policy group of any of the five kinds; a group after the first hop connects through the hops before it wherever it is used MITM: When an app refuses the MITM certificate, for example because it pins certificates, its host keeps the original TLS connection for an hour, and Never Decrypt can resume decryption; choose which devices are decrypted with Client Source Addresses; the MITM Inspector shows both reasons Auto Select: Proxies you add yourself are no longer included automatically; select them to include them. When every member is unavailable for a while, for example after signing out, one of your proxies is used without being tested, and Auto Select turns back on once the subscription proxies return Fixes: Binary TCP protocols that start with a letter no longer wait for the sniffing timeout while MITM is on; fix the request method label in the MITM Inspector; a request an app cancels is no longer taken for a refused certificate, which stopped MITM modules and scripts on that host

Rule Sets: Add built-in service rule sets for Grok and Twitter that you can route on their own, like ChatGPT and Claude Proxy Chains: Any hop can be a policy group of any of the five kinds; a group after the first hop connects through the hops before it wherever it is used MITM: When an app refuses the MITM certificate, for example because it pins certificates, its host keeps the original TLS connection for 24 hours, and Never Decrypt can resume decryption; choose which devices are decrypted with Client Source Addresses; the MITM Inspector shows both reasons Fixes: Binary TCP protocols that start with a letter no longer wait for the sniffing timeout while MITM is on; fix the request method label in the MITM Inspector

Connection: Reconnect automatically when the tunnel drops while the app is open, with limited retries for a tunnel that keeps failing; fix a failed restart right after connecting, such as when switching Always On; fix a disconnect when resetting statistics Policy Groups: Keep the full chain when a Smart group retries on the Proxy Service ports, stop unanswered UDP from re-testing every Smart member, re-test a failed Auto Select member after the current round, and stop empty groups that evaluate before use from stalling connections Rule Sets: Import RULE-SET and DOMAIN-SET lines with remote lists from Surge profiles as subscribed rule sets in their original order; managed profile updates keep installed lists and no longer fail when a new list cannot be downloaded Subscriptions: Keep each node's test URL and timeout after an update, read profiles with Windows line endings, and accept apostrophes in node and group names Latency Tests: Keep the previous results when the tunnel stops during a test, and let tests started without the tunnel finish Stability: Keep a proxy server's last known address when a lookup fails after it expires, never resend TLS early data on a retry, and end route diagnostics on time Performance: Install the IP and ASN databases in the background and refresh proxy lists and pickers with less work

Stability: Improve data writes and resource cleanup during background transitions, and fix stability issues involving connection cancellation and malformed input Rule Matching: Fix missed matches involving composite and negated conditions, DNS failures, and missing HTTP request fields, and improve routing after destination rewrites iCloud Sync: Improve cancellation and retries during account changes, data restoration, and background reloads to prevent expired work from continuing to write or overwrite current state Proxy Chains: Support eligible Smart policy groups as the first hop, with improved entry validation and handling of unavailable members Settings: Add Restore Defaults for the IP database, ASN database, custom DNS, and proxy service ports

MITM and modules: Fix response script errors that could prevent rules from taking effect and improve connection handling after module updates Proxy chains: Eligible Manual, URL Test, and Fallback policy groups can be used as the first hop; missing or unavailable entries no longer bypass the group and connect directly Policy groups: Improve group-level underlying proxies for concrete proxies expanded from subscriptions and includes, while nested policy groups and DIRECT/REJECT keep their routes Profile import: Add node-level underlying-proxy with clear reporting for missing, cyclic, and invalid references; missing policy groups no longer degrade to bare proxies, and existing configurations are retained when a Managed Profile provider partially fails Subscriptions: Remove subscription update history and simplify update status while preserving failure and recovery details

MITM and modules: Improve jq selection deletion and Loon request JSON rewrite compatibility, restore affected rules previously omitted during import, correct protocol negotiation for fragmented TLS handshakes, and report body modification limits accurately DNS and connections: Improve DNS compatibility for Apple software updates, prevent empty AAAA answers from consuming Fake-IP addresses, and prevent stale domain mappings from returning after address reuse and an unexpected restart History and stability: Improve third-party subscription history search, failure records and node order changes, and hide the history entry for oixCloud account subscriptions. Allow Apple Watch status synchronization to retry after a failed submission

Configuration and Compatibility: Add update previews and automatic refresh for managed complete profiles while preserving local edits, deletions and selections. Support FINAL, MATCH and no-resolve rules. Update related devices together when using these new features Policies and Recovery: Improve nested groups, dynamic membership and linked source updates. Preserve node health settings and independent check intervals. Evaluate the selected path before first use and refine Smart observation expiry and failure recovery MITM and Scripts: Fix delayed, fragmented and non-standard-port requests bypassing processing. Improve TLS handshakes, module arguments and exclusions, Host/SNI matching, full headers and streaming scripts. Preserve HTTP method case, handle compressed and oversized bodies correctly, and keep rewrites, trailers and script requests consistent with routing and connection lifetimes Resources and Performance: Schedule updates at each resource's actual deadline. Share compatible rule downloads and parsed content, reduce repeated membership expansion and memory estimation, and improve DNS stream reuse and cache processing Interface and Stability: Refresh widgets when existing long-lived connections resume traffic. Preserve recent edits when toggling ad blocking, prevent stale automation history and canceled local-control actions from updating the interface, and protect device headers across redirects. Refine rule editing, profile merging and translations on iOS and Apple TV

Connections and Recovery: Improve failover, network transitions and connection cleanup while preserving active connections. Refine gRPC reuse, TLS session resumption and Hysteria port hopping Protocols and Compatibility: Support Trojan WebSocket and gRPC transports and SOCKS5 TLS. Improve TLS handshake retries, security parameter validation and protocol capability descriptions Configuration and Import: Extend Clash imports with linked subscription filters, overrides and update intervals, nested policy groups, DNS and hosts settings. Improve rule resource imports, change previews and atomic saving Routing and Resources: Optimize DNS domain matching, runtime configuration building and batched saves. Reduce repeated computation, background probes and idle caches while retaining priority failover checks and complete manual checks Scripts and Diagnostics: Fix script requests bypassing routing rules when no policy is specified, along with nested policy group names and script selection. Improve script cancellation, execution budgets and resource cleanup. Add offline route comparisons and performance recording on demand Interface and Stability: Improve configuration application, recovery and local control on iOS and Apple TV. Refine startup checks and translations, and fix asynchronous state updates

Connections and recovery: Improved failover, network changes and connection cleanup while preserving connections still in use. Refined gRPC multiplexing, TLS session resumption and Hysteria port hopping. Protocols and compatibility: Added Trojan WebSocket and gRPC transports and SOCKS5 TLS. Improved TLS handshake retries, security option validation and protocol capability information. Configuration and imports: Added Clash configuration previews and linked imports, plus proxy-chain and policy-group sharing. Preserved node references and user choices, with improved subscription change details and history restoration. Routing and resources: Optimized routing index loading, DNS connection reuse and rule resource parsing. Added MRS rule sets and reduced repeated downloads, idle caches and background wakeups. Scripts and diagnostics: Improved script cancellation, streaming, execution budgets and resource cleanup. Added performance recording and refined route diagnostics and configuration status. Interface and stability: Completed translations for new features. Fixed delayed state updates after leaving Apple TV control settings and improved configuration application and recovery on iOS and Apple TV.

Home and Interface: A redesigned status card combines connection controls, exit IP and network speed, with separate visibility settings. Charts collapse and animations follow Reduce Motion. Network Overview is now Dashboard; adjust Home Layout from the top-right button. Improved foldable layouts, larger text and scanning. The Proxies page remembers collapsed subscriptions. Folders and Watch: Organize servers and chains in folders, reorder and test groups, or test the current list or all entries. Routing, node selection and Apple Watch follow folders. Deleting folders keeps their nodes. Folders sync through iCloud; older versions prompt for an update when reading this data. Connections and Devices: Chains support URL Test or Fallback groups as their first hop, with fixed later hops. Policy groups can connect their members through an underlying proxy, each tested through the full route. Improved protocol implementations, dialing, cancellation, cleanup and network recovery. Fixed XHTTP uploads and response reads, IPv4 UDP fragmentation on smaller-MTU paths, and excessive memory use from misbehaving servers. Switching nodes preserves connections when routes stay unchanged. Tailscale uses device models as default names, preserves names after reinstalling and keeps device edits independent. DNS and Routing: Separate resolvers for nodes, subscription downloads, ECH and local requests, plus default forwarding servers. Matching queries share work with independent cancellation. Fixed suffix rules, module host entries and local IPv4 subnet detection. Rules switch together after background preparation. The IPv6 DNS setting syncs through iCloud, and DNS pages retain unsaved edits. Modules and Scripts: Import Anywhere .amod files and installation links, edit routing and MITM groups, and preserve valid choices on update. Improved module conversion, script concurrency, cancellation and memory management, with HTTP connection reuse. Native script top-level code runs separately per request, matching Anywhere and Surge; use oixCloud.store for cross-request data. Latency and Battery: Auto Select and policy groups share probes, with results dated by their actual round. Background Auto Select retests after proxied traffic and keeps results when settings stay unchanged. Reduced background polling, widget writes, timer wakeups and extra preconnections during probes. Usage combines same-name nodes within each subscription and retains history after refreshes. Local Control: Apple TV settings now include a local control panel with HTTPS addresses, access keys and QR codes. Use a browser on the same network to view status and logs or switch nodes. Import and Maintenance: Import add-proxy links by pasting, scanning or entering them on Apple TV, and share nodes from their menu. External Resources reports completion after saving. Improved local-control retries, settings sync, diagnostic redaction and translations. Logs hide duplicates and internal buffer-reclamation messages. Added Personal Hotspot IPv4 compatibility guidance.

Upgrade Compatibility: NaiveProxy has been removed; saved nodes remain but cannot connect. HTTP and HTTPS proxies use RFC CONNECT. Sudoku HTTP Mask Stream, Poll and Auto modes require v0.5 servers; other modes are unchanged. Nowhere supports version 3 only, including older 3.0 links; version 2 servers are unsupported. Add self-signed certificate SHA-256 values under Trusted Certificates. Home: A redesigned status card combines the connect button, exit IP and network speed, with visibility controls. Charts are smoother and collapsible, animations follow Reduce Motion, and Tools adds Proxy Service status. Network Overview is now Dashboard. Open Home Layout from the top-right button. Account: Google sign-in for existing accounts on iPhone and iPad, alongside email and password, Access Token and password recovery. Restoring node filters applies on Save; saved lines and regions remain visible. Subscription updates try a direct connection before another route. Folders and Watch: Organize servers and chains in folders, reorder and test groups, or test the current list or all entries. Routing, node selection and Apple Watch follow folders. Deleting a folder keeps its nodes. Folders sync through iCloud; older versions prompt for an update when reading folder data. Connections: Updated SOCKS5, Trojan, Shadowsocks, AnyTLS, Hysteria, VLESS, Sudoku and Nowhere, plus Reality 26.9.9. Improved chain dialing, Smart retries and network recovery. Fixed pending dial, pool and preconnection cleanup during stop/restart. Closing a sender stops queued writes and rejects late success; cancelled timers release their captures. Fixed Tailscale peer-window failures and IPv4 UDP fragmentation on smaller-MTU paths. DNS: Separate resolvers for nodes, subscriptions, ECH and local requests, plus default forwarding servers. Strict DNS retrieves missing ECH configuration over encrypted DNS. Matching queries share work; cancelling one leaves others running. Local requests wait up to four seconds. On iPhone and iPad, DNS settings now show mode, source and servers in standard information rows. Rules: Updates are prepared in the background and replaced together; outdated work cannot overwrite newer settings. With ad blocking off, other rules apply. Cross-host MITM rewrites match IP, GeoIP and ASN rules using cached destination addresses. Include APNs requires Include All Networks. Modules and Scripts: Import Anywhere .amod files and installation links, edit routing and MITM groups, and preserve valid selections during updates. Host exclusions apply across modules. Improved script concurrency, cancellation and memory budgets, with HTTP connection reuse and cleanup. Consecutive configuration updates are combined. Fixed script handling of split HTTP/2 Cookie headers. Latency and Statistics: Background Auto Select retests after proxied traffic and keeps results when settings are unchanged. Fixed interim-response mismatches; each dial has its own timing. Stale statistics are discarded after reconnecting or resetting counters. Reduced idle connection and timer wakeups. Usage combines same-name nodes within each subscription, retaining totals when refreshes replace node IDs. Local Control: Failed listeners retry automatically. Per-device connection and request limits close unfinished handshakes promptly. Fixed selection mismatches between the app and extension after a failed control-page or Shortcuts change. Import and Updates: Import add-proxy links by pasting, scanning or entering them on Apple TV, and share nodes from their menu. Subscription updates show progress and Retry inline; External Resources updates up to four items at once. Cancelling database updates no longer consumes the failure cooldown. Memory-postponed rule updates are reported and retried. Improved diagnostic redaction and translations.

Upgrade and Compatibility: Existing configurations and custom features are retained. Added Clash-format XHTTP node imports, separate download settings and share-link compatibility. Connections and Protocols: Added Nowhere v3 support while retaining compatibility with existing v2 nodes. Fixed WebSocket and HTTPUpgrade cancellation, late callbacks and closure handling so pending operations finish and resources are released. Enforced capacity limits for draining HTTP/3 sessions while retaining active connections and admitting new ones when capacity becomes available. Memory and Background Tasks: Reduced retained storage in receive queues, idle connections and request logs, and released resources promptly when tasks are cancelled. Reduced DNS cache scans, duplicate certificate generation and idle timer wakeups. Request lists use incremental updates with less work when unchanged. Rule updates check available memory and retain working rules when headroom is insufficient. Security and Stability: MITM skips domains with no applicable rules and offers device-local decryption exclusions and scope inspection. Complex rules retain their compatibility scope. Module and subscription updates cannot override exclusions. Failed saves show an error and retain the previous setting. Fixed stale state after connection startup failures. Sync and Storage: Preserved user choices for module categories and parameters across subscription refreshes. Protected sync records containing unsupported MITM parameters from losing content during merging. Reduced repeated saves and rule rebuilds while editing parameters. Interface and Resources: Added an optional local HTTPS control page for status, logs and node selection, protected by an access key. Improved the Proxies menu and manual node editor presentation on Mac. Completed translations while keeping Apple TV controls simple. Modules and Scripts: Fixed rule composition and script state isolation when multiple modules match the same domain. Rename module categories while retaining their order and collapsed state, or delete a category and move its modules to Uncategorized. Improved native module parameter imports and editing. Fixed original URL propagation and consistency in HTTP/1 and HTTP/2 scripts. Diagnostics and Feedback: Added load and UDP/STUN checks over an explicit route, with cancellation and stale-result cleanup after network changes. STUN addresses are temporary and excluded from diagnostic exports. Distinguished missing DNS names, absent address records and query failures. Improved connection history, actual outbound routes and routing/error correlation while keeping sensitive data redacted.

Upgrade and Compatibility: Existing configurations and custom features are retained. Improved node imports and module parsing; affected modules are reparsed and their required resources refreshed after upgrading. Connections and Protocols: Connections now use a distinct traffic profile. Improved cancellation, flow control, connection reuse and cleanup for Hysteria, Naive, AnyTLS and HTTP/3 to reduce stalled requests and truncated transfers. Fixed XHTTP connection rotation, server response handling and ECH edge cases, and improved Tailscale retries and WireGuard packet handling. Security and Stability: Connection state now reflects certificate trust changes promptly. Fixed stale callbacks interfering with rapid VPN disconnects and reconnects. Strengthened DNS address mapping recovery after unexpected exits, reduced unnecessary reconnects during roaming within the same Wi-Fi network, and improved network recovery and error handling. Sync and Storage: Fixed edge cases involving restored items, policy group members and sync status. MITM, reflection, excluded-route and network-profile editors preserve newer synced values in unedited fields. Improved Apple TV mirroring, local saves and asynchronous refresh cleanup. Interface and Resources: On iPhone and iPad, added Home card visibility and ordering controls and improved daily traffic display. Unified external resource management for rules, modules and IP databases, including the missing IP Databases section title. Improved cancellation, loading states and error feedback while keeping Apple TV controls simple. Modules and Scripts: Fixed path and query handling in URL rewrites and improved MITM wildcard, all-port and exclusion matching. Improved Loon script cancellation compatibility while preserving existing module parameters and script interfaces. Subscription Management: On iPhone and iPad, added a subscription editor with automatic updates, a custom update interval and renaming for ordinary subscriptions. The oixCloud subscription keeps its fixed name and gains an optional TFO switch for new TLS connections. Subscriptions can be deleted without background updates adding them back.

Upgrade and Compatibility: Preserve existing configurations and custom features. Fix RFC link imports and compatibility with several node parameters. Reject unavailable direct IPv6 connections sooner on IPv4-only networks so apps can fall back to IPv4. Improve network-state handling for loopback reflection and keep it available while offline. Connections and Protocols: Add Snell ECH over HTTP/3 transport support, race HTTP/3 and TCP in automatic mode and use whichever connects first, and improve receive flow control, cancellation cleanup, send-buffer reclamation and session limits. Fix send ordering, cancellation, half-close handling and recovery across proxy protocols to reduce stalled connections and truncated data. Validate gRPC stream endings while preserving complete received data. Correct system DNS matching in Enhanced Compatibility Mode and improve HTTPUpgrade response-header compatibility. Security and Stability: Strengthen TLS handshake, proxy request and response-header limits. Keep MITM origin certificate verification independent while preserving Trusted Certificates settings. Fix crashes caused by repeated synchronous reads of buffered data and improve SOCKS5 control-connection reads and cancellation handling. Sync and Storage: Fix sync conflicts between concurrent Tailscale configuration and policy edits, and complete Apple TV mirror updates after committed writes are cancelled. Remove retained content from previously deleted modules and rules to reduce storage use and save delays. Retry failed recovery-copy writes for recently deleted items on foreground activation. Allow GeoIP and ASN updates to retry promptly after cancellation while preserving update intervals and failure cooldowns. Background and Devices: Pause address and status polling and deep-link presentation checks in the background and stop maintenance scans for empty connection pools. Refresh when returning to the foreground while preserving VPN traffic, required subscription updates, sync and committed writes. Reduce repeated Watch queries while inactive. Interface and Scripts: Add WLOC cellular connection guidance with simpler first-time setup and daily steps. Match iOS DNS Inspector styling to its Activity or Settings entry point. Preserve edits during deep-link imports and open queued links after the current sheet closes. Improve cancelled node checks, stale-result handling and certificate error hints. Release the camera when scanning closes and preserve capture ownership when the view is recreated. Refine Exit IP caching, isolate script invocation state and release network requests left by unfinished scripts.

Upgrade and Compatibility: Preserve existing configurations and custom features. Fix RFC link imports and compatibility with several node parameters. Reject unavailable direct IPv6 connections sooner on IPv4-only networks so apps can fall back to IPv4. Connections and Protocols: Add Snell ECH over HTTP/3 transport support and improve receive flow control. Fix send ordering, cancellation, half-close handling and recovery across proxy protocols to reduce stalled connections and truncated data. Validate gRPC stream endings while preserving complete received data. Correct system DNS matching in Enhanced Compatibility Mode. Security and Stability: Strengthen TLS handshake, proxy request and response-header limits. Keep MITM origin certificate verification independent while preserving Trusted Certificates settings. Fix crashes caused by repeated synchronous reads of buffered data. Sync and Storage: Fix sync conflicts between concurrent Tailscale configuration and policy edits, and complete Apple TV mirror updates after committed writes are cancelled. Remove retained content from previously deleted modules and rules to reduce storage use and save delays. Retry failed recovery-copy writes for recently deleted items on foreground activation. Background and Devices: Pause address and status polling on background pages and stop maintenance scans for empty connection pools. Refresh when returning to the foreground while preserving VPN traffic, required subscription updates, sync and committed writes. Reduce repeated Watch queries while inactive. Interface and Scripts: Improve cancelled node checks, stale-result handling and certificate error hints. Release the camera when scanning closes and preserve capture ownership when the view is recreated. Refine Exit IP caching, isolate script invocation state and release network requests left by unfinished scripts.

Upgrade and Compatibility: Restored automatic and manual IPv6 controls, with separate settings for DNS IPv6 answers and proxy server IP versions. Disabling the app IPv6 interface or enabling Local Device Compatibility may let native IPv6 traffic bypass the VPN. Settings show the effective policy and its source. Home and Network Checks: Added an Exit IP card with IP, country or region, organization and ASN, manual refresh, and updates after connection or network changes. Ad blocking is hidden in Global and Direct modes. Cancelling node checks preserves completed results and marks cancelled tests. DNS and Routing: Added Strict DNS and system fallback controls with clearer lookup paths, failures and cache information. Policy changes discard old replies, and chains resolve only the local first hop. Failed rule saves retain input for retry without duplicate additions, overwriting synced changes or editing the wrong duplicate rule. Connections and Protocols: Fixed XHTTP path and query compatibility and improved HTTP/3 fragmented parsing, critical-stream closure and receive flow control. Existing connections survive node IP-version changes, and recovery of one session no longer interrupts unrelated connections. Hardened shutdown admission and IPv6 packet validation. Stability and Diagnostics: Exports retain precise times, time zones, session duration, sampling gaps, memory peaks and pressure counts to connect evidence across restarts. Improved crash-signal attribution, export cancellation, temporary-file cleanup and redaction. Imports and Modules: Confirm saves for subscriptions, rules, modules and full profiles before completion. Failed saves remain retryable without duplicate imports or false success after capacity rejection. Discard late results after leaving or changing input, and coalesce automatic refreshes. Preserve module conflict checks, interval rollback and Loon storage-key migration. Device Sync: Apple TV custom rules follow the publishing iPhone or iPad by default; manual choices stay local and can be reset to follow the source. Nodes sync their effective IP-version policy. Watch sync failures offer retry, unconfirmed changes roll back, and old replies cannot override newer commands. Interface and Settings: Clarified routing and settings wording, improved large text and TV wrapping, added User Guide and completed translations.

Upgrade: Version 2.0 requires iOS 18, tvOS 18 and watchOS 11 or later. Versions 1.34 and later cannot sync with 1.33 or earlier; update all syncing devices to compatible versions. Save local modules again or refresh subscription modules to apply QUIC rule, JQ operator and quoted-rule parsing fixes. Home and Network Check: Redesigned iPhone and iPad Home brings connection, traffic and routing together and hides empty policy group sections. Check router, direct, proxy and DNS connectivity; direct and proxy latency now use the node list's request timing. Batch TCP and UDP node diagnostics report when network or configuration changes require a new check. DNS and Routing: Refined DNS settings, lookup results and cache display with separate lines for addresses and formats, cache filtering and pasted address lists. Improved failures, cache lifetimes, IPv6 rules and domain matching. Fixed module rule priority, rule assignments and policy group names while preserving LAN access with DNS leak prevention and compatibility mode. Network and Performance: Improved TCP, QUIC and multiplexed connection buffers and memory recovery so slow readers do not block other connections. Optimized large policy groups, batch refreshes and script node catalogs, reduced background and large-module memory use, and improved cancellation, idle cleanup and network recovery. Protocol Compatibility: Fixed multiplexing, flow control and stream endings in XHTTP, gRPC, AnyTLS, Hysteria, Naive, Nowhere and Sudoku. Improved Shadowsocks UDP and TLS validation. Share links preserve VLESS Vision UDP/443 options; build 490 and earlier read them as ordinary Vision. Improved Tailscale discovery, DNS updates, session recovery and TCP closure, including legacy Headscale map compatibility. Modules and Scripts: Improved argument, quotation and rewrite parsing for Surge, Loon, Stash and Egern formats, preserving commas and comment markers inside quoted rules. Kept the Keli category and repeated-import behavior. Fixed defaults, enabled states and draft saving; improved large MITM transfers, HTTP/2 flow control and script cancellation. iCloud and Subscriptions: Preserved local edits during sync and improved Apple TV recovery order. New deletion records omit module bodies, scripts and subscription links. Fixed subscription titles, expiry information and refresh after clock changes. Cancellation stops further downloads and failed automatic retries are limited. Interface and Settings: Improved landscape, large text, iPad sidebars and page restoration; fixed Apple TV connection button focus. Times follow the system's 12/24-hour setting. Unsaved theme colors and port edits survive sync, MITM and Reflection settings save promptly, and localization and redundant UI code are cleaned up. Apple Watch and Shortcuts: Prevented older messages and requests from replacing current connection or node choices. Explicit disconnects remain effective; shortcuts wait for disconnection before reconnecting and correctly display and change the active mode.

Upgrade Notice: 1.34+ cannot sync with 1.33 or earlier. Update all devices, including Apple TV, to 1.34+. The first upgrade from an older version reuploads local data and merges by modification time, preserving sync choices. Sync and Recovery: Added sync status, Sync Now, Recently Deleted and Delete Data from iCloud. After cloud deletion, merge local data, use cloud data or leave sync off. Fixed sync turning off, stale settings overwriting cloud data and account switching. Refreshes retain subscription edits and module enabled state; reordering keeps newer synced content. Deletion and recovery complete after saving. Routing Rules: Rules default to list order: earlier keywords can precede later suffixes. Routing Guide lets you reorder sources, choose Most Specific mode and sync these settings separately. Request details update routes, correct Final Route labels and show searchable connected IPs; proxy-resolved addresses remain unknown. Improved profile rule sources and dotted-suffix matching, sources and counts. Updated ChatGPT, Claude, Telegram and domestic rules; corrected Siri region routing. Real-IP connections match domain rules via SNI/Host. Modules and Scripts: Added Kelee Module Hub with Loon parsing. Manage categories and execution order separately, with sorting and undo. Added script history and notifications with sensitive data hidden. Activity aligns search fields and keeps each query. Google Redirect preserves paths and queries. Plain HTTP modules need no hostname entries; installed modules recover rules. Fixed missed rewrites on preconnected sockets. Proxies and Protocols: Include or exclude nodes by line, region and name, save filters during refresh and retry failed previews. Improved Clash import, fingerprints and skipped-node details. Improved VLESS Vision, NaiveProxy, XHTTP, Trojan and Shadowsocks UDP; fixed Shadowsocks connections to server-first services, WebSocket, gRPC and SOCKS5 authentication. Improved Snell idle connection recovery. Home and Data Usage: Redesigned iOS Home: uptime, collapsible traffic chart and routing controls. Sizes and rates use KB/MB units. Offline usage by subscription, with 7/30-day trends, search, sort and reset. Nodes up to 10 MB stay in totals but are hidden. Reconnects retain history; no daily backfill. Tailscale: Automatic Routing covers approved subnets and names resolving to them, respecting custom rules and its switch. Overlapping LANs follow routing rules; exit nodes resolve names at the exit; connected tailnet ranges use the tunnel. Added self-hosted DERP; certificate verification changes apply immediately. Improved approval waits, first connections, idle power use, subnet status and failure details; reduced VPN configuration updates and fixed Smart group fallback. Proxy Service and Apple TV: Fixed Wi-Fi, hotspot and IPv6 access; added a usage guide. Apple TV supports HTTP/SOCKS5 sharing and independent sync with a chosen publisher, including when iCloud Sync is off. Improved publishing and account switching; fixed large-subscription Auto Select, sign-in retries and disappearing tabs. Performance and Stability: Faster startup and loading; smoother lists, latency tests, group selection and search. Simpler launch screens retain progress. Reduced rule reloads, test interruptions and memory use in background transfers, MITM downloads and large modules. Improved regex waits under load and fixed script, subscription and module crashes. Fixed foreground detection and old VPN records causing false error or disconnect reports. Security: Turning off Allow Insecure takes effect immediately. LAN proxy clients cannot access this device's loopback services. Improved certificate trust and validation of imported links and proxy requests.

Upgrade Notice: 1.34 cannot sync with 1.33 or earlier. Update every device, including Apple TV, to 1.34. The first upgrade uploads local data again and merges changes by modification time. Existing sync choices are preserved. Sync and Recovery: Added sync status, Sync Now, Recently Deleted and Delete Data from iCloud. After cloud data is deleted, choose to merge local data, use iCloud data or leave sync off. Fixed sync turning itself off, old settings overriding cloud data and account-switching issues. Subscription refreshes keep edits; module refreshes keep enabled state. Reordering keeps newer synced content; deletion and recovery finish after saving succeeds. Routing Rules: Rule sets now default to list order: an earlier keyword rule can take priority over a later suffix rule. Routing Guide lets you reorder sources, choose Most Specific mode and sync these settings separately. Open the source of a matched rule from request details. Modules and Scripts: Manage module categories and execution order separately, with reordering and undo. Google Redirect keeps the original path and search query. Added script run history and notifications, with sensitive data hidden in logs and results. Activity now places request and script search fields consistently and keeps each query when switching sections. Proxies and Protocols: Filter nodes by line, region and name, save during refresh and retry failed previews. Improved Clash import, certificate fingerprint checks and skipped-node explanations. Improved VLESS Vision, NaiveProxy, XHTTP, Trojan and Shadowsocks UDP. Fixed Shadowsocks connections to server-first services, WebSocket, gRPC and SOCKS5 authentication issues. Tailscale: Automatic Routing supports approved subnets and public names resolving to them, respecting custom rules and the routing switch. Overlapping local networks still follow routing rules; exit nodes resolve names at the exit. Improved approval waiting, first connections, idle power use and subnet status. Connected tailnet ranges use the tunnel. Reduced repeated VPN configuration updates, added specific failure reasons and fixed Smart group fallback. Added self-hosted DERP support; certificate verification changes take effect immediately. Apple TV: Added LAN HTTP and SOCKS5 proxy sharing. Sync to Apple TV has its own switch and publishing-device choice; published content remains available when iCloud Sync is off. Improved multi-device publishing and account changes. Fixed failed connections after Auto Select with large subscriptions, repeated updates after refused sign-in and the tab bar disappearing on return to a list. Performance and Stability: Faster startup and large-data loading, with smoother lists, latency tests, group selection and node searches. Removed the launch skeleton while keeping progress for slow startup. Reduced unnecessary rule reloads and test interruptions, plus memory use during background transfers, MITM downloads and large module imports or reloads. Improved regex waits under load and fixed crashes involving some scripts, subscriptions and modules. Reopening the app correctly signals the foreground state to a running VPN; normal endings of older VPN sessions no longer appear as errors. Corrected timestamps for previous VPN session endings so reconnecting no longer looks like an immediate disconnection. Security: Turning off Allow Insecure takes effect immediately. LAN proxy clients cannot access this device's loopback services. Improved certificate trust and validation of imported links and proxy requests.

Tailscale: Join your tailnet without the Tailscale app, with MagicDNS, subnet routes, exit nodes and self-hosted Headscale. Launch and Responsiveness: Faster launch that stays smooth with many proxies. Faster rule matching, and SSH and similar connections no longer wait. Stability: Much lower VPN memory use, fewer unexpected disconnections and fixes for several VPN crashes. Protocols and Modules: Shadowsocks, Trojan, NaiveProxy, XHTTP, WebSocket, gRPC and SOCKS5 connect more reliably, and VLESS Vision uploads use less power. Clash subscriptions import more proxies and explain any left out. Import Stash and Egern modules and Loon plug-ins. Apple TV: Sync proxies, subscriptions and your sign-in from iPhone or iPad through iCloud, and choose which device Apple TV follows. Faster launch, and fixed connecting with very large subscriptions. iCloud Sync: Reorganized sync categories. New setups sync only proxies and your account, and existing choices are kept. See the sync status, restore recently deleted proxies, or delete your data from iCloud. Update all your devices: much older versions can no longer sync. Security: Turning off Allow Insecure takes effect immediately, Allow Wi-Fi Access is safer, and certificate fingerprints on imported proxies are verified.

Rules and Routing: On iOS, import rule sets in bulk, edit built-in rules, and change routes directly. Improve excluded routes, reflection, and LAN matching. Connections and Subscriptions: Add RFC, Nowhere V2, and Morph support. Set separate update intervals for rule sets and modules. Modules and Scripts: Improve imports for Loon, Quantumult X, and modules embedded in script comments. Make module toggles, reordering, and saving more reliable. Improve rewrite destinations and diagnostic consistency. Import modules from files or URLs. Interface: On iOS, search nodes, collapse the traffic chart, and view clearer connection details and rule sources. Unify time displays and automatic updates. Complete Traditional Chinese translations. Stability: Fix unexpected Apple TV disconnects and cloud sync issues. Improve DNS handling, memory management, request matching with many modules, and faulty-script protection. Compatibility: Nowhere V2 requires a V2 server and newly generated share links. V1 servers and old links are not supported.

Recent Activity: View routing decisions and rule sources, save custom rules, or remove source rules. Subscriptions: Set separate update intervals for rule sets and modules, with improved imports, refreshes, and format detection. Modules: Browse and install from module hubs. Improve Loon plugin support, port-specific decryption, and script compatibility across modules. Home: Add node search, latency indicators, and a collapsible traffic chart. Improve announcement layout and startup speed. Stability: Fix unexpected Apple TV disconnects and improve LAN access, rule matching, and protocol parsing.