Chute iOS Release Note

Version 1.2.0 (351)

New Features:

• Added the web console's address to the Control Panel: the Web UI row shows the host, and tapping it offers Open, Copy Address and Copy Access Token — Open carries the token in the URL, so it signs in without typing it
• Added a Runtime Diagnostic Bundle as the last row of the Control Panel's LOCAL PROXY section: the running engine builds a redacted archive (configuration, health snapshot, this run's events, loaded rules and policies, DNS, traffic and the log shards) and hands it to the share sheet; it needs the tunnel to be connected, but no external-http-controller
• Added an Offline Diagnostic Bundle under Settings → DIAGNOSIS, built by the app with no tunnel running: device and app details, the VPN profile as iOS holds it, a summary of the selected configuration and its parse errors, the three diagnosis pages as text, the redacted head of the configuration, how the previous run ended, the newest session's log tails and any pending crash reports
• Added Share Log to the session view, offering every shard of the session's log
• Added rewrite attribution to the session detail: the POLICY section now names the URL Rewrite, Header Rewrite, Body Rewrite, Map Local, Map Remote or Mock rule that changed a request, beside the rule and policy that routed it
• Added a Network Address Changed notification, replacing Exit IP Changed: it shows this device's own IPv4 and IPv6 on the physical link, one line per family, and marks an IPv4 that sits behind NAT; IPv6 and a routable IPv4 are read locally, and only a NAT-local IPv4 costs a single STUN request
• Added French as a built-in language
• Added a redesigned Wi-Fi upload page in the web console's style, localized in nine languages
• Added Current and History tabs, an inspect view (matched rule, rule source, policy, adapter, DNS source, process, close reason, request and response bodies), a Rules page that shows which rewrite rules have fired, and a Diagnostics page (footprint, CPU, uptime, flows, how the previous run ended, refusal tally, event log, Tailscale snapshot, and ping / DNS / egress / URL-test probes) to the web console, which is now complete in all nine languages
• Added HTTP Control API endpoints: /api/health, /api/events, /api/tailscale, the /api/diagnostics/ probes, /api/connections/export?format=har, /api/diagnostics/bundle, rewrite and MitM host management under /api/rewrites and /api/mitm/hosts, POST /api/rules/match to dry-run a request against the rule table (both DNS passes reported), GET|PUT /api/loglevel to change the log level and subsystem sections without a reload, and POST /api/config/validate to check a profile without applying it

Improves:

• The HTTP Control API no longer serves open when the configuration names no external-http-secret: the engine generates a token, which the Control Panel shows and copies; set external-http-secret = none to keep anonymous access, and a wildcard listen address is no longer treated as loopback
• Rule matching is much faster on large lists: RULE-SET and DOMAIN-SET payloads are indexed when downloaded or restored instead of being streamed per connection, and a rule table made only of domain rules is matched through a hashed plan — a 50k-line list goes from about 94 ms to under 2 ms per lookup, at roughly 100 KB of memory per index
• UDP flows are matched once: a flow's decision is remembered for 60 seconds, so repeat datagrams skip both matching passes and the DNS query between them
• Better recovery after a network change: tunnels whose upstream source address no longer exists on any interface are closed instead of hanging apps until the idle timeout, a same-type path change (a cellular reattach) is now noticed, and a path that accepts connections but moves no data is reported as a black hole
• Session logs are written in 8 MB shards (up to eight per run, oldest dropped), each opening with a header that names the run and its start time, so a long session no longer produces one file too large to retrieve; the log viewer loads every shard in order and keeps following the one being written
• The engine keeps a run marker while it runs and, on the next start, reports whether the previous run stopped cleanly or was killed — in the log header, /api/status and both diagnostic bundles
• HAR export is now built by the engine from the recorded frames, so status codes, timestamps and timings are real, and every entry carries the chosen policy, matched rule and rewrite hits under _kl; Export as HAR on the Dashboard and the connection detail both use it
• Only the three features the purchase page sells require a license — Advanced Server Control, MitM and Traffic Recorder; Protocol Sniffing, Optimus DNS, External Access, HTTP API, Web UI and Purge DNS Cache no longer ask for one
• The Control Panel follows the tunnel: it resets its state when the tunnel stops, re-queries on reconnect, and offers the console address only while the page is actually served
• The configuration editor locks the two listener switches while allow-wifi-access is on, since the engine widens both listeners itself, and restores the configured interfaces when the flag is turned off
• When Restore IAP Purchase finds nothing, the alert offers View Manual, which opens the cross-platform licensing instructions in the app's language; the purchase notice now says that one purchase covers three iPhone or iPad devices and three Apple TV devices
• The tailnet node list now matches the other lists — inset-grouped, with a No Item row for an empty section — and re-queries node status each time it appears
• At loglevel = info, a bulk flow that moved at least 1 MiB logs one line at close saying how long it waited on the remote leg and on the app leg
• The Diagnosis pages offer Copy only on rows that have something to copy

Bug Fixes:

• Fixed MitM in TUN mode: a host matched by a MitM rule stalled until timeout, so HTTPS Header Rewrite, Body Rewrite, Map Local, Mock and decrypted captures never took effect for app traffic (traffic through the local HTTP/SOCKS5 proxy was unaffected)
• Fixed allow-wifi-access having no effect: the local HTTP and SOCKS5 listeners stayed on loopback, so nothing on the Wi-Fi could reach them; the flag (and sing-box allow-lan on import) now widens both listeners, and turning it off rebinds them
• Fixed a response Header Rewrite over MitM HTTP/1.1 being recorded as applied while the client received the original header, and never matching a rule written against the full URL
• Fixed Mock Response building its reply from the request header — request line where the status line belongs, request headers carried over, wrong Content-Length — and, on plain HTTP, sending the origin's header in front of it
• Fixed no-resolve IP rules (IP-CIDR, GEOIP, IP-ASN) skipping a connection made to an IP literal when protocol sniffing had supplied a Host header or a reverse-DNS name for it; a sniffed IP literal no longer matches DOMAIN rules either, so the verdict no longer depends on whether sniffing is on
• Fixed RULE-SET payload lines that carry options after the content (GEOIP,CN,no-resolve, DOMAIN,example.com,force-remote-dns) being dropped or matching nothing, and AND/OR/NOT sub-rules losing no-resolve
• Fixed HOSTNAME-TYPE never matching: the record type is now A for a connection dialed over IPv4 and AAAA over IPv6, and the rule editor's placeholder says so
• Fixed a domain routed to a proxy by an AND/OR/NOT rule with a domain sub-rule still being resolved for real by the DNS server, so the DNS answer and the routing decision disagreed
• Fixed a bracketed IPv6 literal in a sniffed Host header ([2001:db8::1]:8080) being read as the hostname [2001
• Fixed starting the tunnel with a select group set to anything but its first member posting a "policy group switched" notification, and the rebuilds that follow a start tripping the flapping warning; a group with no remembered pick now honours the profile's default= instead of being forced onto its first member
• Fixed the Control Panel freezing the app at 100% CPU with memory climbing when opened after the tunnel had been up for a while
• Fixed HAR export writing wrong status codes and 1970 timestamps, and the connection detail export producing a file no HAR reader could open
• Fixed [Replica] hide-crashlytics-request being parsed but never applied to captures
• Fixed external-http-controller = *:9090 and :::9090 — both documented spellings — being rejected, so the controller silently did not start
• Fixed $klne.startURLTest() never triggering a latency test, and a URL test on a policy that does not exist reporting a plausible failure instead of an error
• Fixed an occasional crash in the XHTTP transport under load
• Fixed re-serialized HTTP/1.1 responses going out with an empty reason phrase
• Fixed the license screen labelling a tvOS- or Android-issued license as Unknown, and a certificate this app cannot hold as an iOS & macOS & tvOS bundle
• Fixed the dead App Store link on the About screen; Rate now opens the review sheet
• Various stability and performance improvements

Version 1.1.9 (322)

New Features:

• Added XHTTP transport to the policy editor — enable toggle, mode (auto, packet-up, stream-up, stream-one), path, and host — for Trojan, VMess, and VLESS
• Added AEGIS-128L and AEGIS-256 Shadowsocks encryption methods
• Added ECH (Encrypted Client Hello) settings for TLS policies — enable toggle, pinned ECH config (ech-config), and cover-name override (ech-public-name)
• Added client fingerprint (uTLS) per policy, plus a profile-wide default
• Added AmneziaWG protocol support, including a parameter editor for this WireGuard variant with traffic obfuscation
• Added Clash and sing-box profile import from subscription URLs, files, and Wi-Fi uploads
• Added a configuration error report page with copyable contents to replace alerts that block interaction
• Added X25519MLKEM768 post-quantum hybrid key exchange for TLS 1.3

Improves:

• When saving, the policy editor now preserves existing options that are not available for editing (ECH, ALPN, certificate pinning, test-url, underlying-proxy, udp-relay)

Bug Fixes:

• Fixed a tunnel crash caused by malformed IP-CIDR rules
• Fixed the SSH idle-timeout setting being written under the wrong key and discarded on save
• Fixed onboarding rules placing the policy name after no-resolve, which could break IP-based rules
• Various stability and performance improvements

Version 1.1.8 (300)

New Features:

• Added Tailscale as a built-in proxy type: configure a Tailscale account directly in Chute, join a tailnet, and route traffic through Tailscale nodes — no separate client required
• Added Tailscale section editor: enter the auth key securely, verify the connection, list tailnet nodes, and switch exit nodes from within the app
• Added a Tailscale control panel that shows real-time node status (online/offline, IP, last seen) and lets you switch exit nodes on the fly
• Added system notifications for proxy diagnostics, including egress-IP changes and Tailscale connection events, with per-type toggles in settings
• Added the MASQUE proxy type to the policy editor

Improves:

• Improved TUN throughput on iOS
• Improved Tailscale and WireGuard connection stability and throughput
• Improved UDP tunnel stability and the accuracy of traffic statistics
• Improved stability when stopping the VPN, reducing cases where the system terminates the connection abnormally
• Improved language switching reliability
• Sanitized configuration file names to prevent invalid path characters from causing load failures

Bug Fixes:

• Fixed an issue where on-demand rules could become inconsistent between VPN start and stop
• Fixed a rare crash caused by concurrent language switching
• Fixed network-change handling to avoid unnecessary VPN reconnections
• Various stability and performance improvements

Version 1.1.7 (290)

New Features:

• Added JavaScript Scripting system: run custom scripts for request/response modification, DNS resolution, custom rule matching, and scheduled tasks
• Added Body Rewrite: search and replace HTTP request/response body content using regex (with capture group support) or JSONPath expressions
• Added ShadowTLS protocol support
• Added gRPC transport for VMess and VLESS protocols
• Added DNS-over-QUIC (DoQ) and DNS-over-HTTP/3 (DoH3) support
• Added DNS-over-TLS (DoT) support
• Added HTTP Control API and Web UI for monitoring and controlling the proxy runtime
• Added Module system (.sgmodule) for modular configuration management
• Added Proxy Provider for dynamic proxy list updates
• Added Notification Reporting: detects connection failures, proxy unavailability, traffic surges, config update failures, and policy group switches; dispatches events for system notifications
• Added Mock Response: return mock data to matched requests without reaching the real server
• Added LoadBalance policy group with round-robin, consistent-hashing, and sticky-sessions strategies
• Added URL Rewrite new modes: reject-200, reject-img, reject-dict
• Added Header Rewrite response direction support
• Added PROTOCOL rule type with 10 protocol type values
• Added SCRIPT rule type for JavaScript-based custom matching
• Added extended-matching and requires-resolve options for rules
• Added AnyTLS multi-layer padding scheme
• Added SS2022 encryption methods (2022-blake3-aes-128/256-gcm, chacha20-poly1305)
• Added Managed Configuration support
• Added Replica support for configuration replication
• Added WireGuard configuration UI
• Added interrupt-exist-connections global option

Improves:

• Policy groups now support expected-status, hidden, idle-timeout, and lazy options
• Enhanced URL Rewrite with template variable support in Map Local format
• Improved DNS server with DoQ, DoH3, and DoT protocol support
• Expanded rule system from 6 to 30+ rule types with full coverage

Bug Fixes:

• Fixed IPv6 default value (false → true)
• Fixed log level default value (notify → warning), added none and fatal levels
• Fixed Shadowsocks/ShadowsocksR naming consistency throughout documentation
• Various stability and performance improvements

Version 1.1.6 (256)

New Features:

• Added Hysteria2 protocol support
• Added WireGuard protocol support
• Added VLESS REALITY protocol support
• Added protocol sniffer for TUN traffic
• Added IP-ASN rule support
• Added AND/OR/NOT logical rule support

Bug Fixes:

• Fixed UDP adapter memory issues
• Optimized performance for Rule-Set and Domain-Set matching
• Resolved other minor bugs and stability issues
• Fix license view crash

Version 1.1.5 (245)

New Features:

• Added TUIC protocol support
• Added Shadowsocks 2022 (SS2022) support
• Introduced tunnel configuration
• Improved log display in session

Bug Fixes:

• Fixed UDP adapter issue
• Optimized performance for Rule-Set and Domain-Set matching
• Resolved other minor bugs and stability issues

Version 1.1.2 (231)

New Features:

• iOS 26 UI

Bug Fixes:

• Fix DNS IPv6 response for Gemini App
• RULE-SET with comment content support
• Widget center switch button status fix

Version 1.1.1 (218)

New Features:

• AnyTLS Policy support
• Domain-Set support
• Remote Rule-set support

Improves:

• Tunnel rebuild for better performance
• Full-tested UDP tunnel

Bug Fixes:

• Fix memory leaks

Version 1.1.0 (210)

Bug Fixes:

• Fix some bug

Version 1.0.9 (199)

New Features:

• iOS 18 control center switch button

Bug Fixes:

• TUN with IPv6 now redirect to IPv6 tunnel, to fix some service issues

Version 1.0.8 (188)

New Features:

• SSH Policy support
• Add remote dashboard connect

Improves:

• Change TUN network to 198.18.0.0/15 to avoid IPv4 internal address issue
• Some text updated

Bug Fixes:

• Fix DNS issues

Version 1.0.7 (167)

New Features:

• PIP mode
• iCloud sync for configuration files
• Add remote configuration manager tvOS

Bug Fixes:

• Fix Vmess with Websocket

Version 1.0.6 (160)

New Features

• New UI
• Add upload configuration via Wi-Fi
• Add Network Diagnosis & Proxy Diagnosis
• Add reset VPN configuration function
• Add ICMP(Ping) packet support
• Add VPN status check

Improves:

• Improve configuration edit UI/UX
• Update MTU to 4000

Bug Fixes

• Bug fix
• Fix IPv6 TUN setting

Version 1.0.5 (147)

New Features

• Add VLESS protocol support
• Add XTLS support with VLESS
• Add Session Viewer to review proxy sessions and logs
• You can review your UDP connection with Chute Dashboard macOS application

Improves:

• Improve configuration edit
• Improve local DNS server to avoid DNS pollution
• Improve UDP relay

Bug Fixes

• Fix IPv6 display
• Fix DNS server

Version 1.0.4 (143)

New Features

• Support local HTTP/Socks5 proxy server
• Full IPv6 support
• Add syslib support for DNS server

Improves:

• Improve configuration edit
• Add Optimistic DNS switch
• Improve local DNS server

Bug Fixes

• Fix iOS local proxy server address could stop application to access the network
• Fix DNS server

Version 1.0.3 (138)

New Features

• Fake IP to avoid DNS cache poisoning
• Download configuration file from internet or QR code

Bug Fixes

• Fix FINAL rule edit issue

Version 1.0.2 (130)

New Features

• iPad support
• Support for chute:// scheme & x-callback-url
• Dashboard action
• iPhone 12 support
• Rebuild DNS server for better performance & stability

Bug Fixes

• Improve TCP stability
• Rebuild TCP lock to improve performance
• Improve UDP stability
• Configuration crash fix

Version 1.0.1 (111)

• Fix WeChat Share Extension failure
• Fix IPv6 Support
• Update HTTP complete check

Version 1.0.0 (101)

• First release