SURGE PRO NEWS

Profile System Updates - Added wildcard detached-section includes for [Ruleset *], [WireGuard *], and [Tailscale *]. A single #!include can now load all matching named sections from another local or remote profile file. - Added DEVICE_NAME to the profile environment, enabling device-specific conditions in #!REQUIREMENT. - [Mac] The current Reload Profile option will compare the differences between the old and new profiles and apply only the changes. It will not terminate existing active connections unless necessary. (Same behavior as editing through the UI previously.) - [Mac] Added a Restart Engine option, which behaves like Reload Profile in the previous version and completely restarts the core once.

#iOS #TestFlight Surge 5 5.102.0 (3819) is ready to test on iOS. What to Test ### Profile Format - Added wildcard detached-section includes for `[Ruleset *]`, `[WireGuard *]`, and `[Tailscale *]`. A single `#!include` can now load all matching named sections from another local or remote profile file. - Added `DEVICE_NAME` to the profile environment, enabling device-specific conditions in `#!REQUIREMENT`. - Fixed `[General]` values containing `#`, `//`, or `;` being truncated or changed after the profile was saved and reloaded. ### Tailscale - Improved interactive Tailscale sign-in reliability. Interrupted or silently disconnected login sessions now reconnect and continue the existing browser authorization flow instead of becoming stuck. ### Fixed - Fixed a rare crash when an HTTP/3 or other QUIC session closed synchronously while pending data was being processed. - Other fixes Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3818) is ready to test on iOS. What to Test ### UI - When navigating to a new page, the bottom tab bar is no longer hidden. This change was made to avoid triggering known UIKit UI glitches that can occur when the tab bar is hidden during push transitions. - The Script Editor now opens in a dedicated modal interface, with an updated toolbar, close action, and improved keyboard layout. - Remote Controller and Ponte Diagnostics are now available for all Ponte devices, including devices shared by another iCloud account. - Other UI improvements. ### Other Improvements - Updated the IPv6 fake-IP range to avoid unnecessary browser local-network permission prompts, while retaining compatibility with previously cached addresses. - Proxy connections closed during the protocol handshake now provide a clearer error message, with guidance to verify credentials, encryption methods, and protocol settings. - Fixed rare crashes that could occur when proxy connections were synchronously closed while data was being written. - Fixed recursive HTTP/3 timer processing that could cause a stack overflow under certain conditions. Official Channel: @SurgeTestFlightFeed

Beta Updates ### Surge CLI - Added vmnet status to inspect the VMNET interface configuration, including addresses, prefixes, MTU, and diagnostic table sizes. - Added vmnet arp to inspect IPv4 neighbors learned from Gateway Mode clients. - Added vmnet ndp to inspect the IPv6 neighbor table. - Added vmnet ra to inspect IPv6 Router Advertisement takeover status, including clients, known routers, RA lifetimes, and blacklisted devices. ### macOS - Added a graphical Port Forwarding editor for creating and managing incoming TCP forwarding rules. Listening address, listening port, destination, and outbound policy can all be configured without editing the profile manually. - Gateway-related device actions are now hidden when Gateway Mode is unavailable. - Fixed system proxy settings being applied when using VIF mode without a default route. ### iOS UI - When navigating to a new page, the bottom tab bar is no longer hidden. This change was made to avoid triggering known UIKit UI glitches that can occur when the tab bar is hidden during push transitions. - The Script Editor now opens in a dedicated modal interface, with an updated toolbar, close action, and improved keyboard layout. - Remote Controller and Ponte Diagnostics are now available for all Ponte devices, including devices shared by another iCloud account. - Other UI improvements. ### Other Improvements - Updated the IPv6 fake-IP range to avoid unnecessary browser local-network permission prompts, while retaining compatibility with previously cached addresses. - Proxy connections closed during the protocol handshake now provide a clearer error message, with guidance to verify credentials, encryption methods, and protocol settings. - Fixed rare crashes that could occur when proxy connections were synchronously closed while data was being written. - Fixed recursive HTTP/3 timer processing that could cause a stack overflow under certain conditions.

#Mac #Beta Version 6.9.0-12090 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. - Updated the IPv6 fake IP range to avoid unnecessary browser local network permission prompts, with compatibility for previously cached addresses. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### DNS - Host rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3815) is ready to test on iOS. What to Test - Fix the issue where groups configured with an underlying proxy cannot be operated in the UI. - [Host] rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. Official Channel: @SurgeTestFlightFeed

DNS Updates Host rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query.

#Mac #Beta Version 6.9.0-12080 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. - Updated the IPv6 fake IP range to avoid unnecessary browser local network permission prompts, with compatibility for previously cached addresses. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### DNS - Host rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.9.0-12070 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3813) is ready to test on iOS. What to Test We’ve launched https://x.com/SurgeBeta, a new X account for detailed updates on the latest Surge Beta releases. It will stay in sync with our existing Telegram Channel. Follow to keep up with the latest Beta changes and improvements. -------------- New Feature: Terminal You can now operate Surge directly through the CLI on Surge iOS. - CLI mode includes a comprehensive set of debugging and diagnostic tools for troubleshooting. For example, the rule explain command can be used to inspect how rules are evaluated and how policy groups make their decisions. - The new virtual Terminal provides a full interactive experience, including command auto-completion and history. For details on available commands, refer to the Surge Manual or simply run help in the Terminal. Other reasons why you might want to use Surge from the CLI: - It’s cool. Maybe even cooler when you’re using it on an iPhone Fold later this year. - Bringing full CLI capabilities to iOS also lays the groundwork for future AI Agent features on Surge iOS. New Icons: Arctic & Pulse - The former Surge Enterprise icon now has a new name: Arctic, and is available for everyone to use. - Added a new icon: Pulse. ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. PS：新的订阅功能： * Pulse 图标 * Terminal 终端 Official Channel: @SurgeTestFlightFeed

iOS TestFlight Updates New Feature: Terminal You can now operate Surge directly through the CLI on Surge iOS. - CLI mode includes a comprehensive set of debugging and diagnostic tools for troubleshooting. For example, the rule explain command can be used to inspect how rules are evaluated and how policy groups make their decisions. - The new virtual Terminal provides a full interactive experience, including command auto-completion and history. For details on available commands, refer to the Surge Manual or simply run help in the Terminal. Other reasons why you might want to use Surge from the CLI: - It’s cool. Maybe even cooler when you’re using it on an iPhone Fold later this year. - Bringing full CLI capabilities to iOS also lays the groundwork for future AI Agent features on Surge iOS. New Icons: Arctic & Pulse - The former Surge Enterprise icon now has a new name: Arctic, and is available for everyone to use. - Added a new icon: Pulse.

Surge iOS 更新了系统版本的兼容性：iOS 最低要求是 iOS 16，此前是 iOS 15 iPhone 设备需装有 iOS 16.0 或更高版本。 iPad 设备需装有 iPadOS 16.0 或更高版本。 Mac 需要 macOS 13.0 或更高版本以及装有 Apple M1 或更高版本芯片的 Mac。 Apple TV 设备需装有 Apple tvOS 17.0 或更高版本。 Apple Vision 设备需装有 visionOS 1.0 或更高版本。 说明：iOS < 16.0…

#iOS #AppStore Version: 5.21.1 Release Date: 2026-08-11 What’s New: Surge as MTProto Server - Surge now can operate as an incoming MTProto proxy server for Telegram. Please read manual for more information: https://manual.nssurge.com/features/mtproto.html Tailscale - Added interactive Tailscale sign-in on iOS and macOS. Resolve the issue where some enterprise users are unable to obtain the auth key. - Added automatic Tailscale routing. Surge can discover the tailnet’s MagicDNS suffix and peer IPv4/IPv6 addresses, then automatically route matching domains and peer IP traffic through the corresponding Tailscale policy. - Automatic Tailscale routing is enabled by default and can be disabled with auto-add-magic-dns-rule = false. - Improved Tailscale session warm-up and recovery. Sessions now retry MagicDNS discovery after startup failures and network changes without requiring matching traffic to arrive first. - Tailscale sessions now stay active by default. An omitted idle-keepalive, 0, or -1 keeps the session always active; set a positive value to enable idle teardown. - Tailscale can now begin handling traffic as soon as a valid network map is received, without waiting for the home DERP connection to be established. - Improved recovery after network changes and control-server reconnections by preserving the last known home DERP region and retrying peer handshakes at the appropriate time. - Aligned DERP measurement and selection behavior with official Tailscale client, improving compatibility with custom DERP maps, STUN-only nodes, fallback probes, and temporarily unavailable control connections. - Sensitive values such as authentication keys and authorization URLs are now redacted from verbose Tailscale control logs. TLS - Added server-cert-verify-name to independently specify the hostname used for proxy server certificate verification without changing SNI. This parameter applies to all TLS- and QUIC-based proxy protocols. ECN - Reworked ECN configuration and packet handling across QUIC, WireGuard, Tailscale, Ponte, and nested UDP tunnels. - Correctly preserves ECN and DSCP/TOS metadata across IPv4 and IPv6 encapsulation and decapsulation. - For QUIC-based proxy protocols, when ECN is enabled, anomalies will be automatically detected and fallback to non-ECN handling. - ECN is now enabled by default for QUIC-based proxy protocols on supported systems. WireGuard and Tailscale remain disabled by default. Use ecn=false or ecn=true to override the default explicitly. - Surge Ponte now also has ECN enabled by default, and the client-use-ecn parameter has been removed. DNS - Optimized TCP connection establishment for prefer-v4 and prefer-v6. In earlier versions, these two parameters indicated which record to use when a domain name had both A and AAAA records. Now, during the TCP handshake, A or AAAA records are used preferentially; if the handshake cannot be completed within 3 seconds, other records will start to be tried. - Added DNS-over-TCP support. DNS server settings now accept tcp://hostname[:port]. iOS - Raised the minimum system requirement to iOS 17. - Reworked Shortcuts and App Intent support and improved the reliability of App Intent operations. - Added manual Suspend and Bypass Suspension controls. The Ponte management page, scripts, and local proxy services remain available while Surge is suspended. - Snell Server can now be configured and used on iOS and tvOS. Codebase Refactoring After more than a decade of development, the Surge codebase has grown into a large and complex project. To further improve reliability, we have introduced AI-assisted code review across the entire codebase. Every code change is independently reviewed by Fable 5, GPT-5.6 Sol, and a human developer before being merged, helping us identify potential security issues, rare crash scenarios, and subtle correctness problems. Due to the large number of updates, please refer to the Mac version release notes for details: https://nssurge.com/support/mac/release-notes Official Channel: @SurgeTestFlightFeed

Prometheus Metrics Endpoint Surge now provides a Prometheus-compatible metrics endpoint at GET /v1/metrics, making it easy to integrate Surge with Prometheus and Grafana for long-term monitoring and visualization. This is particularly useful for gateway deployments that run continuously. The endpoint exposes cumulative traffic counters for each network interface and policy (surgeinterface_bytes_total and surge_policy_bytestotal), which can be combined with PromQL functions such as rate() for real-time throughput or increase() for traffic usage over any time window. It also provides metrics for the Surge engine’s memory footprint (surgememorybytes), in-flight requests, DNS cache size, active unauthorized-access bans, uptime, and build information. The memory metric can be especially useful on iOS for monitoring Network Extension memory usage over time. The metrics endpoint uses the same authentication mechanism as the rest of the Surge HTTP API. Since Prometheus does not send custom authentication headers by default, the API key can also be supplied through the x-key query parameter: scrape_configs: - job_name: surge metrics_path: /v1/metrics params: x-key: ["<your-http-api-key>"] static_configs: - targets: ["192.168.1.1:6171"]

Group-Level Proxy Chaining Surge now supports the group-level underlying-proxy parameter, allowing you to configure a proxy chain for an entire policy group in one place. Every member of the group will connect through the specified policy, including members imported via policy-path, include-all-proxies, and include-other-group. Chained members are represented as derived policies such as Name (via Relay), each with its own independent latency test result. This means automatic policy groups can select the best node based on its actual performance through the complete proxy chain, rather than the performance of the node alone. The new option is also fully integrated into the policy group editor UI. Previously, similar behavior could be achieved with external-policy-modifier="underlying-proxy=...", but that approach only applied to members loaded through policy-path. The new group-level parameter works with members from all sources, provides explicit misconfiguration reporting, and is available as a first-class option in the UI. The existing external-policy-modifier syntax remains supported for backward compatibility. Please refer to the manual for a detailed comparison and configuration examples: https://manual.nssurge.com/policy-groups/parameters.html

Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP for UDP datagrams. - Added UDP relay support to HTTP/2 CONNECT proxies with udp-relay=true. - Added HTTP/3 transport support to TrustTunnel with h3=true.

New Surge Beta Feed on X We’ve launched @SurgeBeta, a new X account for detailed updates on the latest Surge Beta releases. It will stay in sync with our existing Telegram Channel. Follow @SurgeBeta to keep up with the latest Beta changes and improvements.

Surge CLI Updates As Surge CLI becomes a key foundation for integrating AI capabilities with Surge, we are continuing to expand and refine it. The interactive CLI now supports command history and auto-completion, making it significantly more convenient for both everyday use and exploratory workflows. We’ve also added a new set of useful commands, including rule match and rule explain, which let Surge answer a common debugging question without generating any real traffic: “Why would this request go through that policy?” rule match rule match performs a dry-run evaluation against the active rule set and reports the matched rule and final policy. All relevant matching attributes — including hostname or URL, port, process path, source address, client MAC, protocol, and more — can be supplied as key=value options. This makes it possible to reproduce exactly how a specific request or client would be routed. Combined with --raw, it can also be used in scripts to audit an entire list of domains against your current rules. rule explain rule explain goes a step further by showing why a particular policy was selected. It traces the complete policy-group resolution path and reports every decision along the way, including manual selections, automatic test results, overrides, load-balancing decisions, Smart Group selections, the underlying proxy chain, DNS evaluation notes, and timing information. Use rule match for quick checks and scripting, and rule explain when you need to inspect the complete decision path. And there’s more coming: starting with the next iOS TestFlight build, Surge CLI will be able to operate Surge directly on iOS. Stay tuned.

#Mac #Beta Version 6.9.0-12040 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Improvements - Proxy and policy-group editors now more clearly distinguish selecting a group as an underlying proxy from selecting one of its current members. - Saved and favorite requests are now consistently sorted by their actual start time. - HTTP proxy requests now preserve the original Host header when the absolute-form request target uses a different authority. - Reduced encryption benchmark memory usage by processing data in bounded batches. - Updated Simplified Chinese localizations for the new proxy, Terminal, and diagnostic features. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. Official Channel: @SurgeTestFlightFeed