Chute tvOS Release Note

Version 1.4 (75)

New Features:

• Added a Web UI Address row to the Control Panel: it appears once the console's listener is actually up, and opening it shows a QR code whose URL carries the access token — scanning it with a phone signs in without transcribing an address and 32 hex characters with the remote
• Added an Offline Diagnostic Bundle under Settings, built by the app with no tunnel running: device and app details, the VPN profile as tvOS holds it, a summary of the selected configuration and its parse errors, a network section (reachability, link type, DNS servers, local addresses and interfaces), the redacted head of the configuration, how the previous run ended, the newest session's log shards and any pending crash reports. Since tvOS has no share sheet, the archive is served by a one-shot local HTTP server on an unguessable path and shown as a QR code; the link stops working when the screen closes
• Added a severity filter to the session log — All, Notify+, Warning+, Fatal — so "show me the warnings" is one click rather than a search typed on an on-screen keyboard; lines the parser cannot classify are never hidden
• Added rewrite attribution to the session detail: a REWRITES section names the URL Rewrite, Header Rewrite, Body Rewrite, Map Local, Map Remote or Mock rule that changed a request, beside the rule and policy that routed it
• Added an Allow WiFi Access row to the configuration editor — the key a Surge http-listen = 0.0.0.0:… or a sing-box allow-lan import produces, and a state the editor previously could not display at all; while it is on the two listener rows show On and are locked, because the engine widens both listeners itself
• Added French as a built-in language, and declared all eight built-in languages to the App Store
• Added Current and History tabs, an inspect view (matched rule, rule source, policy, adapter, DNS source, close reason, request and response bodies), a Rules page that shows which rewrite rules have fired, and a Diagnostics page (footprint, CPU, uptime, flows, how the previous run ended, refusal tally, event log, Tailscale snapshot, and ping / DNS / egress / URL-test probes) to the web console, which is now complete in all nine languages — the console is also where a tvOS user downloads a Runtime Diagnostic Bundle or a HAR export, since the TV itself has nowhere to put a file
• Added HTTP Control API endpoints: /api/health, /api/events, /api/tailscale, the /api/diagnostics/ probes, /api/connections/export?format=har, /api/diagnostics/bundle, rewrite and MitM host management under /api/rewrites and /api/mitm/hosts, POST /api/rules/match to dry-run a request against the rule table (both DNS passes reported), GET|PUT /api/loglevel to change the log level and subsystem sections without a reload, and POST /api/config/validate to check a profile without applying it

Improves:

• The HTTP Control API no longer serves open when the configuration names no external-http-secret: the engine generates a token, which the Web UI Address QR code carries; set external-http-secret = none to keep anonymous access, and a wildcard listen address is no longer treated as loopback
• Rule matching is much faster on large lists: RULE-SET and DOMAIN-SET payloads are indexed when downloaded or restored instead of being streamed per connection, and a rule table made only of domain rules is matched through a hashed plan — a 50k-line list goes from about 94 ms to under 2 ms per lookup, at roughly 100 KB of memory per index
• UDP flows are matched once: a flow's decision is remembered for 60 seconds, so repeat datagrams skip both matching passes and the DNS query between them
• Better recovery after a network change: tunnels whose upstream source address no longer exists on any interface are closed instead of hanging apps until the idle timeout, and a path that accepts connections but moves no data is reported as a black hole
• Session logs are written in 8 MB shards (up to eight per run, oldest dropped); the log view takes the newest shards up to one shard's worth instead of reading a whole run into memory, says when older shards were left out, and keeps following the shard being written across a rotation
• The engine keeps a run marker while it runs and, on the next start, reports whether the previous run stopped cleanly or was killed — in the log header, /api/status and both diagnostic bundles
• HAR export is now built by the engine from the recorded frames, so status codes, timestamps and timings are real, and every entry carries the chosen policy, matched rule and rewrite hits under _kl
• Only the three features the purchase page sells require a license — Multiple Configurations, Local Proxy Server Control and Traffic Recorder; the HTTP API and Web UI switches, Protocol Sniffing, Optimus DNS, Purge DNS Cache and the Web UI Address row no longer ask for one, and a free user with the tunnel down is told to start it rather than shown a purchase sheet
• A console bound to a loopback address now says that it opens only on this Apple TV, and what to set instead, rather than offering a QR code that leads nowhere; the access token is no longer printed on a screen the whole room can read
• The purchase notice now says that one purchase covers three Apple TV devices and three iPhone or iPad devices; when Restore IAP Purchase finds nothing, the alert offers View Manual and presents a QR code for the cross-platform licensing instructions in the app's language
• At loglevel = info, a bulk flow that moved at least 1 MiB logs one line at close saying how long it waited on the remote leg and on the app leg

Bug Fixes:

• Fixed MitM in TUN mode: a host matched by a MitM rule stalled until timeout, so HTTPS Header Rewrite, Body Rewrite, Map Local, Mock and decrypted captures never took effect for app traffic (traffic through the local HTTP/SOCKS5 proxy was unaffected)
• Fixed allow-wifi-access having no effect: the local HTTP and SOCKS5 listeners stayed on loopback, so nothing on the Wi-Fi could reach them; the flag (and sing-box allow-lan on import) now widens both listeners, and turning it off rebinds them
• Fixed toggling any switch in the Control Panel's second section crashing the app once the Web UI Address row could appear, because the table's row count changed under a per-row reload
• Fixed the session view showing an arbitrary slice of a run, and a session losing its date after the eighth rotation, once the engine began rotating its log at a fixed size; shards are now ordered by index and the live view no longer freezes at a rotation
• Fixed the log view reading every shard of a session into memory at once — up to 64 MB of text on an Apple TV — and the severity filter letting a multi-line entry's continuation lines through the filter that hid the entry they belong to
• Fixed a response Header Rewrite over MitM HTTP/1.1 being recorded as applied while the client received the original header, and never matching a rule written against the full URL
• Fixed Mock Response building its reply from the request header — request line where the status line belongs, request headers carried over, wrong Content-Length — and, on plain HTTP, sending the origin's header in front of it
• Fixed no-resolve IP rules (IP-CIDR, GEOIP, IP-ASN) skipping a connection made to an IP literal when protocol sniffing had supplied a Host header or a reverse-DNS name for it; a sniffed IP literal no longer matches DOMAIN rules either
• Fixed RULE-SET payload lines that carry options after the content (GEOIP,CN,no-resolve, DOMAIN,example.com,force-remote-dns) being dropped or matching nothing, and AND/OR/NOT sub-rules losing no-resolve
• Fixed HOSTNAME-TYPE never matching: the record type is now A for a connection dialed over IPv4 and AAAA over IPv6. The rule editor's placeholder for it read http | https, which belongs to PROTOCOL, and IN-TYPE's read TCP | UDP; both now say what the rule accepts
• Fixed a bracketed IPv6 literal in a sniffed Host header ([2001:db8::1]:8080) being read as the hostname [2001
• Fixed starting the tunnel with a select group set to anything but its first member posting a "policy group switched" notification, and the rebuilds that follow a start tripping the flapping warning; a group with no remembered pick now honours the profile's default= instead of being forced onto its first member
• Fixed external-http-controller = *:9090 and :::9090 — both documented spellings — being rejected, so the controller silently did not start
• Fixed an occasional crash in the XHTTP transport under load
• Fixed the license screen labelling another product's certificate as a Chute bundle; anything this app cannot legitimately hold now reads Unknown, and the Android label was added
• Fixed the About screen's Chute iOS QR code pointing at a dead App Store ID, and Rate opening the iOS listing instead of this app's
• Fixed the layout of the Wi-Fi upload page
• Corrected the Chinese and Thai names of the rewrite families so that they match the manual and the configuration file's own section names
• Various stability and performance improvements

Version 1.3 (62)

New Features:

• Added XHTTP transport to the policy editor — enable toggle, mode (auto, packet-up, stream-up, stream-one), path, and host — for Trojan, VMess, and VLESS
• Added AEGIS-128L and AEGIS-256 Shadowsocks encryption methods
• Added the previously missing Shadowsocks 2022 (SS2022) encryption methods: 2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm, and 2022-blake3-chacha20-poly1305
• Added ECH (Encrypted Client Hello) settings for TLS policies — enable toggle, pinned ECH config (ech-config), and cover-name override (ech-public-name)
• Added client fingerprint (uTLS) per policy, plus a profile-wide default
• Added AmneziaWG protocol support, a WireGuard variant with traffic obfuscation
• Added a configuration error report screen with tvOS focus navigation to replace the alert that blocks interaction
• Added X25519MLKEM768 post-quantum hybrid key exchange for TLS 1.3

Improves:

• When saving, the policy editor now preserves existing options that are not available for editing (ECH, ALPN, certificate pinning, test-url, underlying-proxy, udp-relay)

Bug Fixes:

• Fixed a tunnel crash caused by malformed IP-CIDR rules
• Fixed the SSH idle-timeout and REALITY spiderx settings being written under the wrong keys and discarded on save
• Fixed a crash when switching languages
• Fixed display issues affecting on-screen controls
• Various stability and performance improvements

Version 1.2 (45)

New Features:

• Added Tailscale as a built-in proxy type: configure a Tailscale account, join a tailnet, and route Apple TV traffic through Tailscale nodes — no separate client required
• Added a Tailscale control panel that shows real-time node status (online/offline, IP, last seen) and lets you switch exit nodes from the remote
• Added a full-screen Dashboard and Sessions view with a dark, per-level session log
• Added a tunnel detail panel for inspecting active tunnels
• Added the MASQUE proxy type to the policy editor

Improves:

• Improved TUN throughput on Apple TV
• Improved Tailscale and WireGuard connection stability and throughput
• Refined the home-screen focus navigation across lists, the power button, and the About row to feel more predictable
• Aligned Settings with the iOS layout (removed the Always On entry, Twitter → X, and polished APNs, Rate, and Language rows)
• Showed the device IP on the home right-side list only when the VPN is off

Bug Fixes:

• Fixed false "VPN not running" status and stale "Running" labels on the dashboard
• Fixed focus loss and jumps when opening Dashboard/Sessions and when returning from the Tailscale node list
• Fixed the Menu button behavior so it dismisses lists and returns focus reliably
• Fixed session-list footer text to say "long press to delete" instead of "swipe"
• Various stability and performance improvements

Version 1.0 (35)

• First release