en | data ` - MCP tools `list_capture_sessions`, `list_capture_session_requests` and `get_capture_session_body` - `GET /v1/capture/sessions`, `/v1/capture/sessions/requests` and `/v1/capture/sessions/data` - New capture sessions now also record their start and end time, limits, filter and why they ended. ### Improvements - Snell v6: UDP data is now sent right after the tunnel command, without waiting a round trip for the server's response. QUIC over Snell v6 connects noticeably faster. This requires a v6 server. - Ponte: a device no longer stays stuck in "LAN-only mode" when its record was captured while its remote channels were restarting. Surge refreshes the device list before giving up, and the error message now explains why. - When a SOCKS5 proxy rejects a connection, Surge now shows the reason the server gave (such as connection refused or host unreachable) instead of an "invalid response" error. - Resolved the issue of needing to repeatedly reactivate when using multiple users or multiple operating systems on the same device. For details, please refer to the knowledge base licensing FAQ to learn about the corresponding methods. - Tailscale: the admin console no longer shows an update warning for devices running Surge. - Tailscale: a DERP connection that receives no data for 120 seconds is now treated as dead and reconnected. Before, a silently dropped connection could lose all relayed traffic until Surge restarted. - Tailscale: Surge now finds a direct path to a peer that is behind NAT on the local network, such as a tailscaled container on a Docker bridge. Before, such a peer kept using DERP or a distant peer relay. - Tailscale and WireGuard: connections from this device to its own tunnel address or MagicDNS name now reach the device itself. Before, they timed out. - Ponte: a device is no longer wrongly treated as being on the same LAN when both sides have the same virtual machine bridge address (OrbStack, Parallels, UTM and similar). - Ponte: when a LAN connection attempt fails, Surge now falls back to Internet mode and refreshes the device record, instead of ending in a ping timeout. - Ponte: device records in logs no longer include the PSK or controller key. - Traffic statistics: Tailscale MagicDNS hosts (`*.ts.net`) are now shown by their full hostname instead of all being grouped under `ts.net`. The per-host report now adds up entries for the same host instead of keeping only one of them. - HTTP proxy: the `Proxy-Authorization` header is no longer forwarded to the upstream server. It carries the credentials for Surge's own proxy. - HTTP/2: a malformed request now resets only its own stream instead of the whole connection. - HTTP/2: when the upstream server closes the connection in the middle of a response, Surge now reports it as truncated instead of as a complete response. - `$httpClient`: percent-encoded usernames and passwords in the URL are now decoded before they are sent as Basic auth. A response body that cannot be decoded is now reported as an error. - Removed the 1,000,000 entry limit on rule sets and domain sets. - `socks5-listen` now supports `username:password@` authentication, the same way as `http-listen`. - Profile errors now explain why a line is invalid, not only where it is. ### Fixes - Fixed an issue where an `external` policy used directly as the `underlying-proxy` of another policy did not start its process automatically. The process only started after a latency test. - Fixed requests failing with 503 when a server sends a body after a 304 or another response that should have no body (for example, ASUSWRT-Merlin routers). - Fixed HTTP/2 responses with no body (304, 204, or a response to HEAD) not being handled correctly when both a response script and a body rewrite rule matched. - Fixed `$surge.retestGroup` failing in scripts that use the WebView engine when no policy list was returned. - Fixed pipelined HTTP/1 requests sent after a chunked request body being forwarded as part of that body instead of being handled as separate requests. - Fixed several edge cases in HTTP/1 connection reuse and closing that could mix up responses or leave connections open. - Fixed HEAD, 204 and 304 requests over HTTP/2 failing with some servers since 6.8.0. - Fixed `no-resolve` and `extended-matching` not applying to rule sets nested in a `[Ruleset]` section. - Fixed DNS lookups waiting for a timeout with some carrier DNS servers that send malformed AAAA responses. - Fixed `PROCESS-NAME` rules missing short-lived processes in Enhanced Mode. - Fixed a crash related to incoming Tailscale and WireGuard connections. - Fixed Surge Ponte repeatedly dropping its WAN connection in some LAN setups. - Fixed HTTP/2 pseudo-headers being exported to HAR with an empty name. - Fixed responses through Hysteria 2 policies sometimes missing their last part, most often HTTP/1.1 responses that end by closing the connection, on slow or lossy networks. - Fixed a `load-balance` group with a manual override being scored as the average of its options instead of as the overridden policy, so groups that include it could choose differently from the actual route. ]]> 1793716216 12.0 1791818674 12.0 1788968251 12.0 Peer Relay > DERP path priority. Runtime details identify Peer Relay connections and display their latency. - Interactive sign-in now supports tailnets that require administrator device approval. Surge clearly indicates when sign-in has completed but the device is still awaiting approval. - Fixed Tailscale traffic becoming unavailable when the control server assigned the device a new tailnet address. - Improved recovery after network changes by retrying temporarily failed UDP bindings and refreshing direct-connect endpoints. - Improved WireGuard and Tailscale handling of multiple peers and expired connections. - Improved compatibility with the Tailscale administration console. Surge devices are no longer incorrectly reported as using an outdated client, enabling version-gated operations such as editing the device IP address. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added `profile diff` to compare the original profile with the effective profile after modules have been applied. - Added `rule match` to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added `rule explain` to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added `rule temp` commands to list, add, remove, modify, or clear temporary rules. - Added `dns lookup` to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added `dns trace` to include the complete resolver trace, with optional lookup through a specified network interface. - Added `geoip` to query the local GeoIP and ASN databases used by `GEOIP` and `IP-ASN` rules. - Added `http probe` to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added `dump performance` to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added `dump rule-usage` to inspect per-rule match counters without clearing them. - Added targeted `dump virtual-ip` queries by IP address or domain substring. - Added `benchmark rule-matching` to measure the matching performance of the active rule set. - Added `watch speed` to continuously display real-time upload and download speeds. - Added `security ban list` and `security ban clear` to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. - Added `vmnet status` to inspect the VMNET interface configuration, including addresses, prefixes, MTU, and diagnostic table sizes. - Added `vmnet arp` to inspect IPv4 neighbors learned from Gateway Mode clients. - Added `vmnet ndp` to inspect the IPv6 neighbor table. - Added `vmnet ra` to inspect IPv6 Router Advertisement takeover status, including clients, known routers, RA lifetimes, and blacklisted devices. ### Profile System - Profile sections can now combine inline content with `#!include` directives. Surge preserves the original ordering and mixed content when saving the profile. - Added wildcard detached-section includes for [Ruleset *], [WireGuard *], and [Tailscale *]. A single #!include can now load all matching named sections from another local or remote profile file. - Added DEVICE_NAME to the profile environment, enabling device-specific conditions in #!REQUIREMENT. - The current Reload Profile option will compare the differences between the old and new profiles and apply only the changes. It will not terminate existing active connections unless necessary. (Same behavior as editing through the UI previously.) - Added a Restart Engine option, which behaves like Reload Profile in the previous version and completely restarts the core once. ### Script - Event scripts can now respond to `engine-started` and `profile-reloaded`, in addition to `network-changed`. ### Improvements - Reworked the proxy editor, policy-group editors, parameter dialogs, the rule and ruleset editors, and the General, Interface, DNS, Profile, and License pages using a new System Settings-style card interface. - Local-file and inline rulesets can now be edited graphically on macOS and iOS. Add or modify standard rules, logical rules, nested rulesets, and comments, then reorder or remove entries as needed. - Added a graphical Port Forwarding editor for creating and managing incoming TCP forwarding rules. Listening address, listening port, destination, and outbound policy can all be configured without editing the profile manually. - Proxy connections closed during the protocol handshake now provide a clearer error message, with guidance to verify credentials, encryption methods, and protocol settings. - Improved MITM certificate generation by using separate keys for generated leaf certificates and correcting the transmitted certificate chain. - Improved stability under heavy connection churn and local-port exhaustion. ### Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. - Fixed system proxy settings being applied when using VIF mode without a default route. - Fixed QUIC connections potentially stalling after receive-side backpressure. - Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections, including Ponte traffic. - Fixed long-running Ponte and Vector sessions eventually failing to open new relayed connections after handling many connections over the same QUIC session. ]]> 1788186888 12.0 1786372688 12.0 1786025565 12.0 1784125661 12.0 ``` Custom headers support the `` and `` placeholders. A URL-safe random string will be generated automatically when connecting, suitable for scenarios that require dynamic padding or request fingerprint perturbation. - HTTP/2 CONNECT and the TrustTunnel proxy now support multiplexing. Because too many sub-connections multiplexed over the same TCP connection may cause performance issues, by default up to 3 sub-connections are allowed. This can be adjusted via the policy parameter `max-streams`. ### Policy Group Icon - You can now edit the policy group icons directly via the UI. - In addition to URL icons, you can also use Emoji, Surge’s built-in icon library, and SF Symbols. - Policy group icons are now written directly into the profile in a way that is shared with the Surge iOS version. ### Agent Skill - Add a wizard page for Agent Skill usage to the Help menu ### Other - Fixed an issue where sending SNI did not strictly comply with RFC6066. Now, when an IP address is used as the hostname, the IP address will not be sent as SNI. - Fixed an issue where crashes could occur when using ShadowTLS with certain servers. ]]> 1780324303 12.0 1776215936 12.0 1759632949 1773121709 12.0 1768277870 12.0 1765091860 12.0 1762312415 12.0 1761209690 12.0 1759632949 12.0 1757559226 12.0 1754535032 12.0 1753601015 12.0 1752668628 12.0 1752374885 12.0 1751299200 12.0 12.0 12.0 12.0