Chute Mac Release Note

Version 1.1.3 (230)

New Features:

• Added a Setup Assistant: a first launch now walks you from nothing to a working configuration — import a subscription or a share link, set up a server by hand, or point at a configuration file you already have — then installs the privileged helper, applies the traffic mode you choose, and verifies the connection before finishing. It can be reopened at any time from the menu
• Added share-link import (vmess://, ss://, ssr://, trojan://, vless://, hysteria2://, shadowtls://): links are converted locally, and a subscription that returns a list of share links — including base64-wrapped lists — is accepted as well
• Added clipboard detection to the import sheet: a link found on the clipboard is offered behind a Use button rather than filled in silently
• Added the chute:// URL scheme, so an import link on a web page opens in Chute; the address is shape-checked and confirmed before anything is fetched
• Added AmneziaWG protocol support, including an editor for its obfuscation parameters (Jc/Jmin/Jmax, S1–S4, H1–H4, I1–I5)
• Added XHTTP transport to the policy editor for Trojan, VMess and VLESS — mode, path, host, request headers and padding, the post-size and interval limits, the four XMUX bounds, and a separate download endpoint
• Added gRPC transport to the policy editor, with service name and multi-mode
• Added ECH (Encrypted Client Hello) settings for TLS policies: enable toggle, a pinned ech-config, and an ech-public-name cover-name override
• Added a per-policy client fingerprint (uTLS), plus a profile-wide default in General settings
• Added AEGIS-128L and AEGIS-256 Shadowsocks encryption methods
• Added X25519MLKEM768 post-quantum hybrid key exchange for TLS 1.3
• Added the VMess cipher selector, MASQUE certificate-fingerprint pinning, a UDP opt-out on every policy, and multiplexing switches for the HTTP family, Shadowsocks, ShadowsocksR, Trojan, ShadowTLS and Hysteria2
• Added Tailscale exit-node and subnet-router serving: advertise this Mac and the networks behind it, toggle serving from the menu bar, get a notification when an administrator approves it, and optionally keep the Mac awake while it is carrying traffic
• Added profile deletion to the Profiles list: profiles Chute manages are moved to the Trash, while files imported in place are only deregistered and stay where they are
• Added a configuration error report window — a resizable list of line number, severity, message and the original line, with ⌘C on rows and a Copy All button — replacing an alert that could grow taller than the screen
• Added Map Remote to [URL Rewrite]: a header rule now rewrites the request line and the upstream host, with capture-group expansion
• Added module arguments (#!arguments), so one module can be reused with different values

Improves:

• Rebuilt the policy editor around per-protocol forms: each protocol now owns its own fields instead of sharing text fields with unrelated protocols, and the type list can grow without renumbering the ones below it
• When saving, the policy editor now preserves options it has no field for (ECH, ALPN, certificate pinning, test-url, underlying-proxy, udp-relay, tfo)
• Removed the TCP Fast Open switch from TUIC, Hysteria2, MASQUE, AnyTLS and SSH, whose adapters never read it; a policy that already carries tfo keeps it
• Improved import of published Clash, sing-box and Surge profiles, including Surge's MitM/Panel/Ponte sections, REJECT variants, module lines and the [SSID Setting] selector
• Chute now explains what the privileged helper is for before macOS asks for authorization, instead of the system prompt arriving with no context
• Sequenced the first-launch surfaces: the license is read before any window is shown, and the notification-permission prompt waits until the setup assistant closes
• With nothing configured, the menu bar now offers Preferences, the main window and the import entry points instead of a lone file picker; the dashboard toggles say what is missing instead of failing a minute later; and such an install starts in the new main window
• The Profiles empty state and the URL import item now name share links, and the Help window says what actually has to happen before anything is proxied
• Improved relay throughput and CPU use across the data path, rule matching and UDP handling
• Connections are no longer reused across a superseded network path after the Mac changes network

Bug Fixes:

• Fixed a valid license being reported as illegal after a reboot, where a single transient verification failure stopped the proxy and opened the License window
• Fixed the Revoke License confirmation doing nothing when confirmed
• Fixed Cancel on the configuration-error prompt still loading and starting the broken configuration, and the discard action sitting on the default button
• Fixed VLESS flow being dropped whenever REALITY was enabled, and made the client actually speak XTLS Vision framing instead of only advertising it
• Fixed a policy whose type the editor cannot display being rewritten as HTTP on save
• Fixed WireGuard and AmneziaWG policies that name a configuration section acquiring a literal port of 0
• Fixed ws-path and ws-headers being written while the WebSocket switch was off
• Fixed the Interface settings page not scrolling
• Fixed Shadowsocks obfs=http sending a malformed request line, which left the tunnel connected but carrying nothing
• Fixed Shadowsocks 2022 losing sync when a payload was split across socket reads, and corrected the chacha20-poly1305 UDP wire format
• Fixed a [Host] alias never matching, so an A lookup for the aliased name fell through to the upstream and came back NXDOMAIN
• Fixed QUIC connection migration slipping past PROTOCOL,QUIC rules and the block-quic option
• Fixed WireGuard dropping packets queued while a session was being re-established
• Fixed a module's #!arguments description line overwriting the argument defaults beside it
• Various stability and performance improvements

Version 1.1.2 (210)

New Features:

• Added Tailscale as a built-in proxy type: configure a Tailscale account directly in Chute, join a tailnet, and route traffic through Tailscale nodes — no separate client required
• Added a Tailscale configuration pane: enter the auth key securely, verify the connection, list tailnet nodes, and switch exit nodes
• Added a Tailscale status widget to the dashboard and a menu-bar shortcut for switching exit nodes
• Added system notifications for proxy diagnostics, including dangling policy references, egress-IP changes, and Tailscale events, with per-type toggles in settings
• Added the MASQUE proxy type to the policy editor
• Added a bypass-list table editor with a simple-hostnames default and automatic no_proxy export
• Added grouping of connections by application in the Traffic panel
• Raised the minimum supported macOS version to 10.14 (Mojave)

Improves:

• Improved TUN throughput on macOS
• Improved stability of the privileged helper, system proxy, and DNS/TUN lifecycle
• Improved Tailscale and WireGuard connection stability and throughput
• Improved reliability of the system extension and VPN auto-continue
• Improved license verification to avoid treating transient server errors as revocation
• Sanitized configuration file names to prevent invalid path characters from causing load failures

Bug Fixes:

• Fixed an issue where the helper could re-attach to an already-running VPN tunnel
• Fixed a crash caused by concurrent language switching
• Fixed an issue where the VPN tunnel could fail on the second start
• Fixed the upload-speed sparkline plotting download data instead
• Various stability and performance improvements

Version 1.1.1 (202)

• New Main UI with Dashboard: redesigned 4-tab window (Dashboard, Traffic, Config, Log) featuring glass-morphism design, real-time speed sparkline charts, customizable widget cards, and micro-interaction animations
• New Dashboard widgets: proxy status, TUN mode, uptime, active connections, download/upload throughput, and current configuration profile
• New Profiles management tab for switching and organizing configuration profiles
• Upgraded Traffic Inspector with enhanced session filtering and log viewing
• New VPN Enhanced Mode: PacketTunnel system extension option alongside legacy helper utun, selectable in Preferences
• Migrate privileged helper daemon from SMJobless to SMAppService (macOS 13+)
• Migrate Network Extension to System Extension with OSSystemExtensionRequest activation flow
• Add configuration editors for Body Rewrite, Script, Module, and WireGuard sections
• Add Rules DNS diagnostics tool
• Update KLNEKit kernel with major feature expansion
• Add AnyTLS protocol support with multi-layer padding obfuscation
• Add TUIC protocol support (QUIC-based multiplexed TCP/UDP relay)
• Add Hysteria2 protocol support with Brutal congestion control
• Add WireGuard protocol support (inline and section-based configuration)
• Add ShadowTLS protocol support with TLS fingerprint camouflage
• Add VLESS REALITY anti-censorship support
• Add Shadowsocks 2022 encryption methods (2022-blake3-aes-128/256-gcm, chacha20-poly1305)
• Add gRPC transport for VMess and VLESS protocols
• Add DNS-over-TLS (DoT), DNS-over-QUIC (DoQ), and DNS-over-HTTP/3 (DoH3) support
• Add per-domain DoT/DoQ/DoH3 assignment in Local DNS Mapping
• Add JavaScript Scripting system (7 script types: rule, dns, request, response, generic, scheduled, dns-ttl)
• Add Body Rewrite: search and replace HTTP request/response bodies via regex (with capture groups) or JSONPath
• Add Mock Response: return mock data or Map Local content to matched requests
• Add Protocol Sniffing: detect actual connection protocol and apply rules accordingly
• Add Notification Reporting with 5 event types (connection-failure, proxy-unavailable, traffic-surge, config-update-failure, policy-group-switch)
• Add HTTP Control API and embedded Web UI for runtime monitoring and management
• Add Module system (.sgmodule) for modular configuration management
• Add Proxy Provider for dynamic proxy list updates
• Add LoadBalance policy group with round-robin, consistent-hashing, and sticky-sessions strategies
• Add Fallback policy group support
• Add IP-ASN rule type (built-in MaxMind GeoLite2 ASN database)
• Add Logical Combination rules: AND, OR, NOT
• Add Advanced Matching rules: SUBNET, HOSTNAME-TYPE, IN-TYPE, IN-USER, IN-NAME
• Add new domain-based rule types: DOMAIN-WILDCARD, DOMAIN-REGEX, DOMAIN-SET
• Add PROTOCOL rule type (match by detected protocol: HTTP, HTTPS, TLS, TCP, UDP, QUIC, STUN, DNS, DOH, DOQ)
• Add SCRIPT rule type for JavaScript-based custom matching
• Add new process rule types: PROCESS-PATH, PROCESS-NAME-REGEX
• Add SRC-PORT rule type
• Add extended-matching and requires-resolve options for rules
• Add URL Rewrite reject modes: reject-200, reject-img, reject-dict
• Add Header Rewrite response direction support (header-response-add/del/replace)
• Add URL Rewrite Map Local template variable support
• Add Replica support for selective traffic recording
• Add Managed Configuration support with auto-update interval
• Add exclude-simple-hostnames option
• Add Bypass TUN option for direct-routing specified IP ranges
• Add interrupt-exist-connections global option
• Add network-framework option
• Add disable-db-record option
• Expand policy group options: expected-status, hidden, idle-timeout, lazy
• Expand rule system from 6 to 37 rule types
• Optimize TUN throughput (UTUN_OPT_MAX_PENDING_PACKETS)
• Fix IPv6 default value (false → true)
• Fix log level defaults, add none and fatal levels
• Fix Shadowsocks/ShadowsocksR naming consistency
• Various stability and performance improvements

Version 1.0.7 (163)

• Update KLNEKit
• Add SSH policy support
• Fix UDP issue
• Bug Fixes

Version 1.0.5 (155)

• Update KLNEKit
• Change TUN network to 198.18.0.0/15 to avoid IPv4 internal address issue
• Add help function for menu icon
• Implementate IPv6 support for TUN
• Enable ping support for TUN
• Fix Dock menu disappear issue
• Fix proxy configuraiton not restore after Chute is closed
• Fix TUN network
• Fix app update component
• Bug Fixes

Version 1.0.4 (145)

• Add VLESS protocol support
• Add XTLS for VLESS
• Add display for local IPs
• Add UDP Tunnel support for Chute Dashboard
• Improve build-in DNS server
• Fix FINAL rule process
• Fix UDP Tunnel
• Bug Fixes

Version 1.0.3 (132)

• Support for macOS 10.13 (Without Network.framework Support)
• Fix Config Windows Proxy Section Load
• Fix HTTP Request Error
• Bug Fixes

Version 1.0.2 (102)

• Rebuild DNS Server
• Rebuild Extension installation
• Bug Fixes

Version 1.0.0 (88)

• First release version
• Add TUN support

[Beta] Version 0.4.9 (53)

• Rule order fixed.
• Add support for scan QR code on screen.
• Policy grouop fixed.

[Beta] Version 0.4.5 (32)

• Bug fixes.

[Beta] Version 0.3.5 (25)

• Bug fixes.

[Beta] Version 0.3.0 (20)

• Bug fixes.

[Beta] Version 0.2.0 (8)

• First release.