SURGE PRO NEWS

Dashboard Issue on macOS 27.2
Surge Mac users on macOS 27.2: you may find that Surge Dashboard quits immediately after launch. Surge itself and all network features are not affected.
This is caused by a system issue in macOS 27.2 that can affect other apps as well. We reported it to Apple, and Apple has confirmed the fix, which will ship with the next macOS update.
In the meantime:
• If your update subscription is active, update to Surge Mac 6.10.0 or later, which already works around the issue.
• If your subscription has expired, we've released Surge Dashboard Patcher, a free tool that replaces only the bundled Dashboard with a fixed build. Surge and your profiles are left untouched.
• Alternatively, you can simply wait for the next macOS update, which will resolve the issue.
Details and download:
https://kb.nssurge.com/surge-knowledge-base/faq/mac-dashboard-crash

#tvOS #TestFlight

Surge 5 5.102.0 (3873) is ready to test on tvOS.

What to Test

- You can now control Surge tvOS directly on the Apple TV. While Surge is running, the start screen has a new column with:
- An outbound mode button. Its menu also turns MitM, Rewrite and Scripting on or off.
- A policy group page. You can select policies, override auto groups, run latency tests and see smart group usage. Group icons set with `icon-url` show the same way as on iOS.
- An external resource page. You can update resources one at a time or all at once.

- Please note that before using the new tvOS version, you need to redeploy using the latest Surge iOS TestFlight version, otherwise it cannot be enabled.

Official Channel: @SurgeTestFlightFeed

Surge tvOS Beta

- You can now control Surge tvOS directly on the Apple TV. While Surge is running, the start screen has a new column with:
- An outbound mode button. Its menu also turns MitM, Rewrite and Scripting on or off.
- A policy group page. You can select policies, override auto groups, run latency tests and see smart group usage. Group icons set with icon-url show the same way as on iOS.
- An external resource page. You can update resources one at a time or all at once.
- Please note that before using the new tvOS version, you need to redeploy using the latest Surge iOS TestFlight version, otherwise it cannot be enabled.

#iOS #TestFlight

Surge 5 5.102.0 (3872) is ready to test on iOS.

What to Test

### Incoming Connections for Tailscale and WireGuard

- The old parameter `accept-incoming` has been renamed to `allow-peer-access`, but it will still be read for compatibility.
- Fixed the issue where incoming UDP packets could not be forwarded when the destination address is the local machine.
- Please note that due to its unusual communication mechanism, Apple Screen Sharing's high-performance mode cannot be used even if `allow-peer-access` is enabled. We are looking into a dedicated workaround for this.

### Ruleset Editor

- You can now disable individual rules in a ruleset with the Enable/Disable swipe action. Disabled rules are saved as commented-out lines.

### Improvements

- Snell v6: UDP data is now sent right after the tunnel command, without waiting a round trip for the server's response. QUIC over Snell v6 connects noticeably faster. This requires a v6 server.
- Adaptive QUIC Block: detection now starts only on new QUIC handshakes. Before, packets from QUIC connections that already existed (for example, ones opened before Surge started) could be wrongly remembered as allowed. They are now blocked so that the app starts a new handshake.
- DTLS, WireGuard, STUN and other non-QUIC UDP traffic on port 443 is no longer treated as QUIC, so `block-quic` no longer affects it.
- When a SOCKS5 proxy rejects a connection, Surge now shows the reason the server gave (such as connection refused or host unreachable) instead of an "invalid response" error.
- Ponte: a device no longer stays stuck in "LAN-only mode" when its record was captured while its remote channels were restarting. Surge refreshes the device list before giving up, and the error message now explains why.

### Fixes

- Fixed requests failing with 503 when a server sends a body after a 304 or another response that should have no body (for example, ASUSWRT-Merlin routers).
- Fixed high memory use on MITM HTTP/2 connections when the client reads slowly. This could push the network extension past its memory limit.
- Fixed a possible network extension crash when viewing the Logbook with very large script records.
- Fixed the external resource view sometimes being presented twice.
- Fixed text fields in sheets being covered by the keyboard in some sheet sizes, and the space left for the keyboard not always being removed after it was dismissed.
- Optimized the keyboard layout for iPhone Duo.

Official Channel: @SurgeTestFlightFeed

Snell 6.0.0

Snell 6.0.0 RC2 has been released as the final 6.0.0 version, and the download links have been updated. Additionally, a macOS arm64 binary has been added.

Please check: https://kb.nssurge.com/surge-knowledge-base/release-notes/snell

Beta Updates

Incoming Connections for Tailscale and WireGuard

- The old parameter accept-incoming has been renamed to allow-peer-access, but it will still be read for compatibility.
- Fixed the issue where incoming UDP packets could not be forwarded when the destination address is the local machine.
- Please note that due to its unusual communication mechanism, Apple Screen Sharing's high-performance mode cannot be used even if allow-peer-access is enabled. We are looking into a dedicated workaround for this.

Ruleset Editor

- You can now disable individual rules in a ruleset with the Enable/Disable swipe action. Disabled rules are saved as commented-out lines.

Improvements

- Snell v6: UDP data is now sent right after the tunnel command, without waiting a round trip for the server's response. QUIC over Snell v6 connects noticeably faster. This requires a v6 server.
- Adaptive QUIC Block: detection now starts only on new QUIC handshakes. Before, packets from QUIC connections that already existed (for example, ones opened before Surge started) could be wrongly remembered as allowed. They are now blocked so that the app starts a new handshake.
- DTLS, WireGuard, STUN and other non-QUIC UDP traffic on port 443 is no longer treated as QUIC, so block-quic no longer affects it.
- When a SOCKS5 proxy rejects a connection, Surge now shows the reason the server gave (such as connection refused or host unreachable) instead of an "invalid response" error.
- Ponte: a device no longer stays stuck in "LAN-only mode" when its record was captured while its remote channels were restarting. Surge refreshes the device list before giving up, and the error message now explains why.
- [Mac] Resolved the issue of needing to repeatedly reactivate when using multiple users or multiple operating systems on the same device. For details, please refer to the knowledge base licensing FAQ to learn about the corresponding methods.

Fixes

- Fixed requests failing with 503 when a server sends a body after a 304 or another response that should have no body (for example, ASUSWRT-Merlin routers).
- [iOS] Fixed high memory use on MITM HTTP/2 connections when the client reads slowly. This could push the network extension past its memory limit.
- [iOS] Fixed a possible network extension crash when viewing the Logbook with very large script records.
- [iOS] Fixed the external resource view sometimes being presented twice.
- [iOS] Fixed text fields in sheets being covered by the keyboard in some sheet sizes, and the space left for the keyboard not always being removed after it was dismissed.
- [iOS] Optimized the keyboard layout for iPhone Duo.

#iOS #TestFlight

Surge 5 5.102.0 (3871) is ready to test on iOS.

What to Test

### Incoming Connections for Tailscale and WireGuard

Surge can now accept connections that come in through Tailscale and WireGuard, not just send traffic out. Incoming requests are handled like any other request: they go through your rules and policies and show up in the request list.

**Tailscale**
- `accept-incoming = true`: other devices on your tailnet can connect to this device through its tailnet address. For example, they can use Surge's HTTP/SOCKS5 proxy or other services running on this device.
- `advertise-exit-node = true`: offer this device as an exit node. Other tailnet devices that select it send all their internet traffic through Surge's rules.
- `advertise-routes = 192.168.1.0/24, ...`: offer this device as a subnet router for the listed networks.
- Exit nodes and subnet routes take effect after you approve them in the Tailscale admin console.

**WireGuard**
- `accept-incoming = true`: the peer side can open connections to this device through an existing tunnel.
- `listen-port = 51820`: Surge acts as a WireGuard server that phones, laptops, and other clients can connect to. A peer can leave out `endpoint`; Surge learns the client's address when it connects and keeps up when the address changes.
- Clients can set Surge's tunnel address as their DNS server, and Surge's DNS will answer their queries.

Note: Surge does not apply your Tailscale access control policy to incoming connections. Use rules such as `SRC-IP` to limit who can reach which destination.

See the Tailscale and WireGuard pages in the manual for details and example configurations.

Official Channel: @SurgeTestFlightFeed

Incoming Connections for Tailscale and WireGuard

Surge can now accept connections that come in through Tailscale and WireGuard, not just send traffic out. Incoming requests are handled like any other request: they go through your rules and policies and show up in the request list.

Tailscale
- accept-incoming = true: other devices on your tailnet can connect to this device through its tailnet address. For example, they can use Surge's HTTP/SOCKS5 proxy or other services running on this device.
- advertise-exit-node = true: offer this device as an exit node. Other tailnet devices that select it send all their internet traffic through Surge's rules.
- advertise-routes = 192.168.1.0/24, ...: offer this device as a subnet router for the listed networks.
- Exit nodes and subnet routes take effect after you approve them in the Tailscale admin console.

WireGuard
- accept-incoming = true: the peer side can open connections to this device through an existing tunnel.
- listen-port = 51820: Surge acts as a WireGuard server that phones, laptops, and other clients can connect to. A peer can leave out endpoint; Surge learns the client's address when it connects and keeps up when the address changes.
- Clients can set Surge's tunnel address as their DNS server, and Surge's DNS will answer their queries.

Note: Surge does not apply your Tailscale access control policy to incoming connections. Use rules such as SRC-IP to limit who can reach which destination.

Requires iOS 5.24.0+ / Mac 6.11.0+. See the Tailscale and WireGuard pages in the manual for details and example configurations.

#Mac #Release

Version 6.10.0-12500

### VS Code Extension
Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open.

This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded.

https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support

### IP Rewrite
- Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. Available actions:
- reflect: Swaps the source and destination addresses and sends the packet back to its sender.
- reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately.
- drop: Silently discards the packet.

### Improvements
- A category parameter has been added to policy groups for grouped display. It can be used when there are many policy groups.
- All test-url parameters now support configuring HTTPS URLs for testing. The test result remains the latency of a single HTTP RTT, but due to the TLS handshake, the test duration may increase significantly when there are many policies.
- In the previous version, MITM security was strengthened by generating a separate key pair for each distinct domain name. This caused noticeable delays when performing MITM concurrently on a large number of different domains. After evaluation, this change has been reverted.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- Inline rule sets with the same name now merge across the main profile and modules instead of replacing one another, preserving rules contributed by each source.
- Optimized Tailscale and WireGuard behavior when switching networks.
- Added a new option to proactively update the configuration associated with a linked profile.
- External resource management and some other helper APIs have been added to the HTTP API.

### Fixes
- Fixed logical rules incorrectly parsing policy names containing parentheses.
- Add a workaround for a system bug in macOS 27.2 beta to prevent Dashboard from crashing.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 6.11.0-12510

### Adaptive QUIC Block

- Added block-quic=adaptive for proxy policies. Surge blocks QUIC at first so the app falls back to HTTPS over TCP. If the app does not fall back within 1 second, as with apps that only support QUIC, QUIC is allowed for that host. Results are remembered per host. The option is also available in the proxy editor on Mac and iOS.
- block-quic=auto now uses adaptive mode for every policy except DIRECT, so QUIC-only apps keep working through proxies. Policies that cannot relay UDP still block QUIC.
- QUIC hostname detection now works when the TLS ClientHello spans several packets, which is common in recent browsers using post-quantum key exchange. QUIC v2 and draft-29 are now supported as well. Rules, MITM and request records can now see the hostname of more QUIC connections.

### HTTP API
- GET /v1/policies of the HTTP API now accepts the include_external=true query parameter. The response then contains an additional external-policies field that lists the policies loaded from external policy groups (policy-path). Each entry includes the policy name, the group it belongs to, and an identifier. Pass the identifier as the policy option of $httpClient to send a request through that policy, since external policies cannot be referenced by name.

Official Channel: @SurgeTestFlightFeed

Beta Updates

Adaptive QUIC Block

- Added block-quic=adaptive for proxy policies. Surge blocks QUIC at first so the app falls back to HTTPS over TCP. If the app does not fall back within 1 second, as with apps that only support QUIC, QUIC is allowed for that host. Results are remembered per host. The option is also available in the proxy editor on Mac and iOS.
- block-quic=auto now uses adaptive mode for every policy except DIRECT, so QUIC-only apps keep working through proxies. Policies that cannot relay UDP still block QUIC.
- QUIC hostname detection now works when the TLS ClientHello spans several packets, which is common in recent browsers using post-quantum key exchange. QUIC v2 and draft-29 are now supported as well. Rules, MITM and request records can now see the hostname of more QUIC connections.

HTTP API
- GET /v1/policies of the HTTP API now accepts the include_external=true query parameter. The response then contains an additional external-policies field that lists the policies loaded from external policy groups (policy-path). Each entry includes the policy name, the group it belongs to, and an identifier. Pass the identifier as the policy option of $httpClient to send a request through that policy, since external policies cannot be referenced by name.

We’re pleased to announce that Surge Mac 6.10.0, Surge iOS 5.23.0, and Surge tvOS 5.23.0 are now available.

VS Code Extension (Mac)
Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open.

This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded.

https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support

IP Rewrite
Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. This can provide on-device loopback functionality for certain iOS developer toolchains. Available actions:
- reflect: Swaps the source and destination addresses and sends the packet back to its sender.
- reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately.
- drop: Silently discards the packet.

Other New Features
- Added a category parameter to policy groups for grouped display, useful when there are many policy groups.
- All test-url parameters now support HTTPS URLs. The result still measures the latency of a single HTTP round trip, but TLS handshakes may significantly increase the overall test duration when there are many policies.
- Added an option to proactively update the configuration of a linked profile. URL-based linked profiles can now be updated manually.
- Added external resource management and other helper endpoints to the HTTP API.
- Added a device communication takeover option for Include All mode. (iOS)

UI and Rules
- Updated UI layouts and details for iPhone Duo support. (iOS)
- Improved the Add Rule page: domain rules can now be created from SNI-sniffed requests, and rule-specific options can be selected directly.
- Inline rule sets with the same name now merge across the main profile and modules instead of replacing one another, preserving the rules contributed by each source.
- Fixed logical rules incorrectly parsing policy names containing parentheses.

Networking and Reliability
- Improved Tailscale and WireGuard behavior when switching networks.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- The previous version strengthened MITM security by generating a separate key pair for each distinct domain, which caused noticeable delays when intercepting many different domains concurrently. After evaluation, this change has been reverted.
- Removed an erroneous Ponte notification when using a Ponte policy in a policy group.
- Fixed a scripting-engine compatibility issue.
- Added a workaround for a system bug in macOS 27.2 beta to prevent Dashboard from crashing. (Mac)
- Improved performance and memory usage, fixed rare crashes, and resolved other minor issues.

#iOS #AppStore

Version: 5.23.0
Release Date: 2026-10-13

New Features

- Added the [IP Rewrite] section to process packets entering Surge VIF by destination address before rule matching. Supported actions include reflect, reject, and drop. This can provide on-device loopback functionality for certain iOS developer toolchains.
- Added a category parameter to policy groups for grouped display.
- All test-url parameters now support HTTPS URLs. Results still measure a single HTTP round-trip latency, although TLS handshakes may increase overall testing time.
- Added a device communication takeover option for Include All mode.
- Added external resource management and other helper endpoints to the HTTP API.
- URL-based linked profiles can now be updated manually.

UI and Rules

- Updated UI layouts and details for iPhone Duo support.
- Improved the Add Rule page: domain rules can now be created from SNI-sniffed requests, and rule-specific options can be selected directly.
- Inline rulesets with the same name now merge across the main profile and modules, preserving rules from each source.
- Fixed logical rules incorrectly parsing policy names containing parentheses.

Networking and Reliability

- Improved Tailscale and WireGuard behavior when switching networks.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- Removed an erroneous Ponte notification when using a Ponte policy in a policy group.
- Reverted per-domain MITM key-pair generation to address noticeable delays when intercepting many different domains concurrently.
- Fixed a scripting-engine compatibility issue.
- Improved performance and memory usage, fixed rare crashes, and resolved other minor issues.


#!name=Local Device Loopback
#!desc=Reflect 10.7.0.1 back to this device for on-device developer tools.
[General]
ipv6-vif = disabled // Some tools only recognize utun interfaces without an IPv6 address.
tun-included-routes = %INSERT% 10.7.0.1/32

[IP Rewrite]
10.7.0.1 = reflect

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3866) is ready to test on iOS.

What to Test

5.23.0 Release Candidate 3
- Fixed an issue where writing the configuration would fail after using the `#!REQUIREMENT` command in the [Proxy] section.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 6.10.0-12500

### VS Code Extension
Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open.

This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded.

https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support

### IP Rewrite
- Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. Available actions:
- reflect: Swaps the source and destination addresses and sends the packet back to its sender.
- reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately.
- drop: Silently discards the packet.

### Improvements
- A category parameter has been added to policy groups for grouped display. It can be used when there are many policy groups.
- All test-url parameters now support configuring HTTPS URLs for testing. The test result remains the latency of a single HTTP RTT, but due to the TLS handshake, the test duration may increase significantly when there are many policies.
- In the previous version, MITM security was strengthened by generating a separate key pair for each distinct domain name. This caused noticeable delays when performing MITM concurrently on a large number of different domains. After evaluation, this change has been reverted.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- Inline rule sets with the same name now merge across the main profile and modules instead of replacing one another, preserving rules contributed by each source.
- Optimized Tailscale and WireGuard behavior when switching networks.
- Added a new option to proactively update the configuration associated with a linked profile.
- External resource management and some other helper APIs have been added to the HTTP API.

### Fixes
- Fixed logical rules incorrectly parsing policy names containing parentheses.
- Add a workaround for a system bug in macOS 27.2 beta to prevent Dashboard from crashing.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3864) is ready to test on iOS.

What to Test

5.23.0 Release Candidate 2
- Fixed the issue preventing the newly added HTTP API from working properly.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 6.10.0-12480

### VS Code Extension
Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open.

This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded.

https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support

### IP Rewrite
- Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. Available actions:
- reflect: Swaps the source and destination addresses and sends the packet back to its sender.
- reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately.
- drop: Silently discards the packet.

### Improvements
- A category parameter has been added to policy groups for grouped display. It can be used when there are many policy groups.
- All test-url parameters now support configuring HTTPS URLs for testing. The test result remains the latency of a single HTTP RTT, but due to the TLS handshake, the test duration may increase significantly when there are many policies.
- In the previous version, MITM security was strengthened by generating a separate key pair for each distinct domain name. This caused noticeable delays when performing MITM concurrently on a large number of different domains. After evaluation, this change has been reverted.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- Inline rule sets with the same name now merge across the main profile and modules instead of replacing one another, preserving rules contributed by each source.
- Optimized Tailscale and WireGuard behavior when switching networks.
- Added a new option to proactively update the configuration associated with a linked profile.
- External resource management and some other helper APIs have been added to the HTTP API.

### Fixes
- Fixed logical rules incorrectly parsing policy names containing parentheses.
- Add a workaround for a system bug in macOS 27.2 beta to prevent Dashboard from crashing.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3862) is ready to test on iOS.

What to Test

5.23.0 Release Candidate 1
- External resource management and some other helper APIs have been added to the HTTP API.
- Other bug fixes.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 6.10.0-12470

### VS Code Extension
Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open.

This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded.

https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support

### IP Rewrite
- Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. Available actions:
- reflect: Swaps the source and destination addresses and sends the packet back to its sender.
- reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately.
- drop: Silently discards the packet.

### Improvements
- A category parameter has been added to policy groups for grouped display. It can be used when there are many policy groups.
- All test-url parameters now support configuring HTTPS URLs for testing. The test result remains the latency of a single HTTP RTT, but due to the TLS handshake, the test duration may increase significantly when there are many policies.
- In the previous version, MITM security was strengthened by generating a separate key pair for each distinct domain name. This caused noticeable delays when performing MITM concurrently on a large number of different domains. After evaluation, this change has been reverted.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- Inline rule sets with the same name now merge across the main profile and modules instead of replacing one another, preserving rules contributed by each source.
- Optimized Tailscale and WireGuard behavior when switching networks.
- Added a new option to proactively update the configuration associated with a linked profile.
- External resource management and some other helper APIs have been added to the HTTP API.

### Fixes
- Fixed logical rules incorrectly parsing policy names containing parentheses.
- Add a workaround for a system bug in macOS 27.2 beta to prevent Dashboard from crashing.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3861) is ready to test on iOS.

What to Test

- Ready for iPhone Duo
- Add device communication takeover option for include all mode
- Other minor improvements

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3823) is ready to test on iOS.

What to Test

- Tailscale can now establish peer-relay paths through eligible tailnet devices when a direct connection is unavailable, with Direct > Peer Relay > DERP path priority. Runtime details identify Peer Relay connections and display their latency.
- Local-file and inline rulesets can now be edited graphically on macOS and iOS. Add or modify standard rules, logical rules, nested rulesets, and comments, then reorder or remove entries as needed. Create new inline rulesets directly from the rule editor and store them as named `[Ruleset ...]` sections in the profile.
- The previously added mixed use of `#include` will no longer affect UI write-back for the corresponding sections. Surge will automatically select the write-back target as accurately as possible based on the changes.

Official Channel: https://t.me/SurgeTestFlightFeed

Beta Updates

- Tailscale can now establish peer-relay paths through eligible tailnet devices when a direct connection is unavailable, with Direct > Peer Relay > DERP path priority. Runtime details identify Peer Relay connections and display their latency.
- Local-file and inline rulesets can now be edited graphically on macOS and iOS. Add or modify standard rules, logical rules, nested rulesets, and comments, then reorder or remove entries as needed. Create new inline rulesets directly from the rule editor and store them as named [Ruleset ...] sections in the profile.
- The previously added mixed use of #include will no longer affect UI write-back for the corresponding sections. Surge will automatically select the write-back target as accurately as possible based on the changes.

#iOS #TestFlight

Surge 5 5.102.0 (3822) is ready to test on iOS.

What to Test

### Profile Diagnostics

- WireGuard and Tailscale policies now produce a clear warning when their referenced configuration section is missing.
- The warning also explains that a named `#!include` loads only the identically named section from the included file.

### Modules and Cloud Sync

- Module installation information is no longer governed by iCloud data, in order to avoid various issues caused by iCloud. iCloud is only used to synchronize installation information across devices.
- Cloud synchronization now excludes `.git` and `node_modules` directories and no longer interprets their absence in the cloud as a request to delete local content.

### iOS

- Fixed policy-group icon changes sometimes being lost after the profile reloaded.
- Refined module menus on iOS 26 to avoid overlapping context-menu animations and improve Liquid Glass presentation.

Official Channel: https://t.me/SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3821) is ready to test on iOS.

What to Test

### Profile System Updates

The #include directive can now be freely combined with other content within a section. The following usage patterns are supported:

1. Dedicated Include

[Proxy]
#include proxy.dconf

When a section consists of a single #include directive, it remains fully editable in the UI. Any changes made through the UI will be correctly written back to proxy.dconf.

2. Multiple Includes

[Proxy]
#include a.dconf, b.dconf

This combines content from multiple files into a single section. Since the UI cannot determine how changes should be written back to the individual files, the section becomes read-only and cannot be modified through the UI.

3. Mixed Content and Includes (New)

[Rule]
#include common-rule-a.dconf
DEST-PORT,123,DIRECT
#include common-rule-b.dconf

#include directives can now be freely mixed with regular content within the same section. As with multiple includes, the UI cannot determine the appropriate write-back behavior, so the section will be read-only.

Note: When using this feature in the [Rule] section, keep in mind that a FINAL rule immediately terminates rule matching. Any rules included or defined after it will therefore never be evaluated.### Tailscale

- Improved compatibility with the Tailscale administration console. Surge devices are no longer incorrectly reported as using an outdated client, enabling version-gated operations such as editing the device IP address.

### iOS

- Fixed managed-profile `icon-url` icons being hidden by automatically generated placeholder icons.
- Custom policy-group icons now behave consistently across Lucid and Gradient themes, with a **Default** option available in both.
- Module download, parsing, file-writing, and installation-information failures are now reported instead of failing silently.
- Refined the Script Editor toolbar and file-selection layout on iOS 26.
- Improved context-menu previews on iOS 26 by following the system’s native corner styling.

Official Channel: https://t.me/SurgeTestFlightFeed

Beta Updates

macOS Interface

- Reworked the proxy editor, policy-group editors, parameter dialogs, and the General, Interface, DNS, Profile, and License pages using a new System Settings-style card interface.

Surge CLI & Remote Control

- Added restart-engine, which completely restarts the engine, closes active connections, and clears caches and temporary rules.
- reload continues to apply only changed profile sections whenever possible, preserving unaffected runtime state.
- Restart Engine is also available from Surge Dashboard and the iOS Remote Controller maintenance menu.

Tailscale

- Improved compatibility with the Tailscale administration console. Surge devices are no longer incorrectly reported as using an outdated client, enabling version-gated operations such as editing the device IP address.

iOS

- Fixed managed-profile icon-url icons being hidden by automatically generated placeholder icons.
- Custom policy-group icons now behave consistently across Lucid and Gradient themes, with a Default option available in both.
- Module download, parsing, file-writing, and installation-information failures are now reported instead of failing silently.
- Refined the Script Editor toolbar and file-selection layout on iOS 26.
- Improved context-menu previews on iOS 26 by following the system’s native corner styling.

Profile System Updates

The #include directive can now be freely combined with other content within a section. The following usage patterns are supported:

1. Dedicated Include

[Proxy]
#include proxy.dconf

When a section consists of a single #include directive, it remains fully editable in the UI. Any changes made through the UI will be correctly written back to proxy.dconf.

2. Multiple Includes

[Proxy]
#include a.dconf, b.dconf

This combines content from multiple files into a single section. Since the UI cannot determine how changes should be written back to the individual files, the section becomes read-only and cannot be modified through the UI.

3. Mixed Content and Includes (New)

[Rule]
#include common-rule-a.dconf
DEST-PORT,123,DIRECT
#include common-rule-b.dconf

#include directives can now be freely mixed with regular content within the same section. As with multiple includes, the UI cannot determine the appropriate write-back behavior, so the section will be read-only.

Note: When using this feature in the [Rule] section, keep in mind that a FINAL rule immediately terminates rule matching. Any rules included or defined after it will therefore never be evaluated.

#iOS #TestFlight

Surge 5 5.102.0 (3820) is ready to test on iOS.

What to Test

### Smart Group

- Added a graphical Policy Priority editor for Smart Groups on.

### Tailscale

- Interactive sign-in now supports tailnets that require administrator device approval. Surge clearly indicates when sign-in has completed but the device is still awaiting approval.
- Fixed Tailscale traffic becoming unavailable when the control server assigned the device a new tailnet address.
- Improved recovery after network changes by retrying temporarily failed UDP bindings and refreshing direct-connect endpoints.
- Improved WireGuard and Tailscale handling of multiple peers and expired connections.

### Profile and Automation

- On iOS, profile changes made on disk or received through iCloud now reload automatically. If the updated profile is invalid, Surge keeps the working configuration active and reports the error.
- Event scripts can now respond to `engine-started` and `profile-reloaded`, in addition to `network-changed`.

### Notifications

- Added notification controls for new proxy clients, script notifications, and rule-matched notifications.
- Local and remote notification category settings now correctly apply to dynamically generated alerts.
- Disabling policy-group change notifications now also suppresses temporary group-override alerts.

### Fixed

- Improved MITM certificate generation by using separate keys for generated leaf certificates and correcting the transmitted certificate chain.
- Fixed QUIC connections potentially stalling after receive-side backpressure.
- Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections, including Ponte traffic.
- Improved stability under heavy connection churn and local-port exhaustion.
- Other small UI issues.

Official Channel: https://t.me/SurgeTestFlightFeed

Beta Updates

Smart Group

- Added a graphical Policy Priority editor for Smart Groups on macOS and iOS.

Tailscale

- Interactive sign-in now supports tailnets that require administrator device approval. Surge clearly indicates when sign-in has completed but the device is still awaiting approval.
- Fixed Tailscale traffic becoming unavailable when the control server assigned the device a new tailnet address.
- Improved recovery after network changes by retrying temporarily failed UDP bindings and refreshing direct-connect endpoints.
- Improved WireGuard and Tailscale handling of multiple peers and expired connections.

Profile and Automation

- On iOS, profile changes made on disk or received through iCloud now reload automatically. If the updated profile is invalid, Surge keeps the working configuration active and reports the error.
- Event scripts can now respond to engine-started and profile-reloaded, in addition to network-changed.

Notifications

- Added notification controls for new proxy clients, script notifications, and rule-matched notifications.
- Local and remote notification category settings now correctly apply to dynamically generated alerts.
- Disabling policy-group change notifications now also suppresses temporary group-override alerts.

Fixed

- Improved MITM certificate generation by using separate keys for generated leaf certificates and correcting the transmitted certificate chain.
- Fixed QUIC connections potentially stalling after receive-side backpressure.
- Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections, including Ponte traffic.
- Improved stability under heavy connection churn and local-port exhaustion.
- Other small UI issues.

UniFi Controller Integration (Beta)

When Surge is operating in DHCP mode, Dashboard device management can integrate with the UniFi Controller. You can directly view the corresponding device’s SSID, AP, Wi-Fi version, and other information in Surge’s Dashboard. You can also force a specific device to reconnect.

Meanwhile, this feature is provided entirely by a new, extensible plugin mechanism, allowing plugins to be written to support any AP Controller or router.

This feature is currently in beta, so no UI configuration interface is provided yet. It can only be configured through surge-cli or the AI Skill. After installing the Surge AI Skill, simply ask the AI to help integrate your UniFi AP Controller. Alternatively, ask the AI to write a new plugin based on your router.

Plugin System (Beta)

- Added the Surge Plugin System on macOS. Plugins run as isolated JavaScript extensions independent of the active profile.
- The first supported plugin type is ap-controller, which can supply Wi-Fi information for the device panel and reconnect wireless clients. The existing UniFi Controller integration is now provided as a built-in plugin.

As it is still in the beta phase, the mechanism for installing plugins remotely via plugin install has not yet been enabled. Currently, only loading and running local content via plugin load is supported.

Profile System Updates
- Added wildcard detached-section includes for [Ruleset *], [WireGuard *], and [Tailscale *]. A single #!include can now load all matching named sections from another local or remote profile file.
- Added DEVICE_NAME to the profile environment, enabling device-specific conditions in #!REQUIREMENT.
- [Mac] The current Reload Profile option will compare the differences between the old and new profiles and apply only the changes. It will not terminate existing active connections unless necessary. (Same behavior as editing through the UI previously.)
- [Mac] Added a Restart Engine option, which behaves like Reload Profile in the previous version and completely restarts the core once.