Added: • Chained servers, with Proxa Premium. A server can now be reached *through* one of your networks or through another server: open the server, and under Connect Via choose what carries it. A proxy that only exists inside your tailnet or your ZeroTier network becomes usable, and the connection to it never crosses the open internet. If whatever carries it is off or unreachable, that server is not used — traffic is refused rather than quietly sent out directly. The screen says so before you save, and a server that cannot be carried at all is not offered the choice. Fixed: • AirDrop stopped working while Proxa was running. • A connection refused by a network now says the network could not reach the address, instead of blaming the server it never got to. A server that refused for its own reasons says which reason. • A network that has not finished connecting no longer holds a request for twenty seconds before giving up on it. Known issues: • Snell v6 needs a separate program the App Store cannot carry, and v1-v5 are TCP-only. Such nodes stay visible; a v6 node or a UDP flow is rejected. • RULE-SET rules pointing at web-hosted lists are imported but not downloaded, so they never match. They are labelled "not fetched". • The app is English-only.

Added: • WireGuard and SSH servers. Both were discarded at import before. • Snell servers, versions 1 through 5 — pooled v2, HTTP and TLS obfuscation, per-user keys. Checked against Surge's own server. Dropped at import before. • WireGuard tunnels can be typed in: Config ▸ Networks ▸ Add Tunnel takes the keys and endpoint your provider gave you. A .conf import fills the same form. • Custom DNS: the system's resolver, servers you name, DNS-over-HTTPS or DNS-over-TLS, with [Host] overrides and a cache. An unreachable one falls back to the system's. "Override DNS" is off by default, which leaves Proxa's own lookups following your rules. • Fake IP, under DNS ▸ Enhanced Mode. Proxa answers lookups with a stand-in address, so a connection arrives knowing its domain and domain rules match QUIC. Local names and captive portals still get real answers. • HTTPS decryption, with a guided setup that installs Proxa's certificate through Safari. Only hosts you list are decrypted. • Networks, with Proxa Premium. Route traffic through WireGuard, Tailscale or ZeroTier, chosen per rule. One purchase, not a subscription. • A home-screen and lock-screen widget: status, node in use, traffic moved, connections allowed or refused. Its switch starts and stops Proxa without opening the app. • Control Center switches (iOS 18) for Proxa and the traffic log. • A node picker on the Dashboard, so choosing where traffic goes needs no policy group. • Bulk cleanup in Config ▸ Servers: delete many nodes, or a whole subscription, at once. • Plain HTTP and ws:// now show their requests and frames in Traffic. • "Add Rule…" on a long press in Traffic, filled in with the domain and the node that served it. Changed: • Subscription import takes the routing rules too, not only the servers — from a Clash or Surge link, or a plain node list. • Import reports what arrived, and what it could not use. • "Start Capture" is now "Start Proxa", and the switch that records traffic is "Log traffic". • Section headings no longer let rows scroll through them. • Bigger touch targets on the controls hardest to hit: add, refresh, the ⋯ menus, and the Dashboard's Active Node rows. • A traffic row leads with where the flow went: the node that carried it and the rule that chose it, where the method used to sit. That method was always CONNECT. It appears with the path only when the request was decrypted. Fixed: • Sites your rules send through a proxy could fail where the network answers DNS incorrectly — usually Google and X, while the rest worked. Proxa takes the name from the connection now, so a domain rule matches on iPhone. • IPv6 did not work: requests to an IPv6 address stalled and no IP-CIDR6 rule matched. Proxa announced IPv6 on networks that have none, too. • WebSocket connections went silent after connecting — nothing you sent reached the far end. • Requests that only answer HEAD, and uploads using Expect: 100-continue, never finished. • The Dashboard read 0 req/s while traffic was flowing. • A [Host] override answered only the IPv4 lookup, so an iPhone could still reach the real host. It covers the whole name now. • A custom DNS server with a port — 1.1.1.1:5335 — made Start fail silently. • Proxa quitting unexpectedly could leave the iPhone with no internet until it restarted. Opening Proxa clears a stuck tunnel, and Settings can reset it. • Choosing the IP-CIDR rule type crashed the app, since 1.0. • A hosted Clash subscription imported zero servers, warning about a missing FINAL rule. • A Surge subscription imported its servers but none of its routing. • "Import Config" and the button beside it did not line up. Known issues: • Snell v6 needs a separate program the App Store cannot carry, and v1-v5 are TCP-only. Such nodes stay visible; a v6 node or a UDP flow is rejected. • RULE-SET rules pointing at web-hosted lists are imported but not downloaded, so they never match. They are labelled "not fetched". • The app is English-only.