Surge TestFlight Feed

Incoming Connections for Tailscale and WireGuard

Surge can now accept connections that come in through Tailscale and WireGuard, not just send traffic out. Incoming requests are handled like any other request: they go through your rules and policies and show up in the request list.

Tailscale
- accept-incoming = true: other devices on your tailnet can connect to this device through its tailnet address. For example, they can use Surge's HTTP/SOCKS5 proxy or other services running on this device.
- advertise-exit-node = true: offer this device as an exit node. Other tailnet devices that select it send all their internet traffic through Surge's rules.
- advertise-routes = 192.168.1.0/24, ...: offer this device as a subnet router for the listed networks.
- Exit nodes and subnet routes take effect after you approve them in the Tailscale admin console.

WireGuard
- accept-incoming = true: the peer side can open connections to this device through an existing tunnel.
- listen-port = 51820: Surge acts as a WireGuard server that phones, laptops, and other clients can connect to. A peer can leave out endpoint; Surge learns the client's address when it connects and keeps up when the address changes.
- Clients can set Surge's tunnel address as their DNS server, and Surge's DNS will answer their queries.

Note: Surge does not apply your Tailscale access control policy to incoming connections. Use rules such as SRC-IP to limit who can reach which destination.

Requires iOS 5.24.0+ / Mac 6.11.0+. See the Tailscale and WireGuard pages in the manual for details and example configurations.

Beta Updates

Adaptive QUIC Block

- Added block-quic=adaptive for proxy policies. Surge blocks QUIC at first so the app falls back to HTTPS over TCP. If the app does not fall back within 1 second, as with apps that only support QUIC, QUIC is allowed for that host. Results are remembered per host. The option is also available in the proxy editor on Mac and iOS.
- block-quic=auto now uses adaptive mode for every policy except DIRECT, so QUIC-only apps keep working through proxies. Policies that cannot relay UDP still block QUIC.
- QUIC hostname detection now works when the TLS ClientHello spans several packets, which is common in recent browsers using post-quantum key exchange. QUIC v2 and draft-29 are now supported as well. Rules, MITM and request records can now see the hostname of more QUIC connections.

HTTP API
- GET /v1/policies of the HTTP API now accepts the include_external=true query parameter. The response then contains an additional external-policies field that lists the policies loaded from external policy groups (policy-path). Each entry includes the policy name, the group it belongs to, and an identifier. Pass the identifier as the policy option of $httpClient to send a request through that policy, since external policies cannot be referenced by name.

We’re pleased to announce that Surge Mac 6.10.0, Surge iOS 5.23.0, and Surge tvOS 5.23.0 are now available.

VS Code Extension (Mac)
Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open.

This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded.

https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support

IP Rewrite
Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. This can provide on-device loopback functionality for certain iOS developer toolchains. Available actions:
- reflect: Swaps the source and destination addresses and sends the packet back to its sender.
- reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately.
- drop: Silently discards the packet.

Other New Features
- Added a category parameter to policy groups for grouped display, useful when there are many policy groups.
- All test-url parameters now support HTTPS URLs. The result still measures the latency of a single HTTP round trip, but TLS handshakes may significantly increase the overall test duration when there are many policies.
- Added an option to proactively update the configuration of a linked profile. URL-based linked profiles can now be updated manually.
- Added external resource management and other helper endpoints to the HTTP API.
- Added a device communication takeover option for Include All mode. (iOS)

UI and Rules
- Updated UI layouts and details for iPhone Duo support. (iOS)
- Improved the Add Rule page: domain rules can now be created from SNI-sniffed requests, and rule-specific options can be selected directly.
- Inline rule sets with the same name now merge across the main profile and modules instead of replacing one another, preserving the rules contributed by each source.
- Fixed logical rules incorrectly parsing policy names containing parentheses.

Networking and Reliability
- Improved Tailscale and WireGuard behavior when switching networks.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- The previous version strengthened MITM security by generating a separate key pair for each distinct domain, which caused noticeable delays when intercepting many different domains concurrently. After evaluation, this change has been reverted.
- Removed an erroneous Ponte notification when using a Ponte policy in a policy group.
- Fixed a scripting-engine compatibility issue.
- Added a workaround for a system bug in macOS 27.2 beta to prevent Dashboard from crashing. (Mac)
- Improved performance and memory usage, fixed rare crashes, and resolved other minor issues.

VS Code Extension

Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open.

This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded.

https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support

Beta Updates

New Features - IP Rewrite
- Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. Available actions:- reflect: Swaps the source and destination addresses and sends the packet back to its sender.
- reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately.
- drop: Silently discards the packet.

For example, you can use the following module to make Surge work as LocalDevVPN, allowing you to use certain developer toolchains on iOS devices.

#!name=Local Device Loopback
#!desc=Reflect 10.7.0.1 back to this device for on-device developer tools.
[General]
ipv6-vif = disabled // Some tools only recognize utun interfaces without an IPv6 address.
tun-included-routes = %INSERT% 10.7.0.1/32

[IP Rewrite]
10.7.0.1 = reflect

A new guide has been added to the Surge Knowledge Base, covering how to remotely manage a Surge instance.

https://kb.nssurge.com/surge-knowledge-base/guidelines/remote-management

Beta Updates

- A category parameter has been added to policy groups for grouped display. It can be used when there are many policy groups.
- All test-url parameters now support configuring HTTPS URLs for testing. The test result remains the latency of a single HTTP RTT, but due to the TLS handshake, the test duration may increase significantly when there are many policies.
- In the previous version, MITM security was strengthened by generating a separate key pair for each distinct domain name. This caused noticeable delays when performing MITM concurrently on a large number of different domains. After evaluation, this change has been reverted.

Surge Mac 6.9.1 & Surge iOS 5.22.1 are now available.

New Features
- [iOS] Policy group widgets now support the extra-large size on iOS 27.
- [iOS] Added a medium-sized iOS widget with start/stop controls, running status, and one-tap switching between Rule-Based Proxy, Direct Outbound, and Global Proxy.
- Added UNKNOWN support to GEOIP and IP-ASN rules, allowing IP addresses without matching country or ASN database entries to be matched. This works in both individual rules and rule sets.

Fixes and Improvements
- Fixed lower-than-expected results under extreme throughput performance testing.
- Fixed failed cellular backup connections in Wi-Fi Assist or Hybrid mode prematurely aborting an ongoing Wi-Fi connection attempt.
- Fixed Pre-Matching remaining enabled after changing a rule to a non-reject policy or unsupported rule type.
- Fixed Hysteria UDP forwarding with servers where HTTP/3 Datagram negotiation interfered with UDP traffic.
- Fixed missing traffic statistics for UDP connections through proxies and tunnels, including WireGuard and Tailscale.
- Fixed a rare issue where closing a UDP proxy connection during packet reception could stall other Surge traffic.
- Fixed SF Symbol policy-group icons not responding correctly to appearance changes on iOS.
- [iOS] Improved resource updates on iOS: pending automatic updates resume when the app becomes active, duplicate downloads are avoided, and stale errors are cleared after a successful background refresh.
- [Mac] Fixed macOS Smart policy group context menus showing outdated usage or incorrect priority adjustments.
- [Mac] Fixed unnecessary Surge Helper installation or upgrade alerts at startup when the enabled features do not require the helper.

iOS TestFlight Updates

New Feature: Terminal
You can now operate Surge directly through the CLI on Surge iOS.
- CLI mode includes a comprehensive set of debugging and diagnostic tools for troubleshooting. For example, the rule explain command can be used to inspect how rules are evaluated and how policy groups make their decisions.
- The new virtual Terminal provides a full interactive experience, including command auto-completion and history. For details on available commands, refer to the Surge Manual or simply run help in the Terminal.

Other reasons why you might want to use Surge from the CLI:
- It’s cool. Maybe even cooler when you’re using it on an iPhone Fold later this year.
- Bringing full CLI capabilities to iOS also lays the groundwork for future AI Agent features on Surge iOS.

New Icons: Arctic & Pulse
- The former Surge Enterprise icon now has a new name: Arctic, and is available for everyone to use.
- Added a new icon: Pulse.

Channel photo updated

Prometheus Metrics Endpoint

Surge now provides a Prometheus-compatible metrics endpoint at GET /v1/metrics, making it easy to integrate Surge with Prometheus and Grafana for long-term monitoring and visualization. This is particularly useful for gateway deployments that run continuously.

The endpoint exposes cumulative traffic counters for each network interface and policy (surgeinterface_bytes_total and surge_policy_bytestotal), which can be combined with PromQL functions such as rate() for real-time throughput or increase() for traffic usage over any time window.

It also provides metrics for the Surge engine’s memory footprint (surgememorybytes), in-flight requests, DNS cache size, active unauthorized-access bans, uptime, and build information. The memory metric can be especially useful on iOS for monitoring Network Extension memory usage over time.

The metrics endpoint uses the same authentication mechanism as the rest of the Surge HTTP API. Since Prometheus does not send custom authentication headers by default, the API key can also be supplied through the x-key query parameter:

scrape_configs:
- job_name: surge
metrics_path: /v1/metrics
params:
x-key: ["<your-http-api-key>"]
static_configs:
- targets: ["192.168.1.1:6171"]

Group-Level Proxy Chaining

Surge now supports the group-level underlying-proxy parameter, allowing you to configure a proxy chain for an entire policy group in one place. Every member of the group will connect through the specified policy, including members imported via policy-path, include-all-proxies, and include-other-group.

Chained members are represented as derived policies such as Name (via Relay), each with its own independent latency test result. This means automatic policy groups can select the best node based on its actual performance through the complete proxy chain, rather than the performance of the node alone.

The new option is also fully integrated into the policy group editor UI.

Previously, similar behavior could be achieved with external-policy-modifier="underlying-proxy=...", but that approach only applied to members loaded through policy-path. The new group-level parameter works with members from all sources, provides explicit misconfiguration reporting, and is available as a first-class option in the UI. The existing external-policy-modifier syntax remains supported for backward compatibility.

Please refer to the manual for a detailed comparison and configuration examples:
https://manual.nssurge.com/policy-groups/parameters.html

Protocol Updates

- Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP for UDP datagrams.
- Added UDP relay support to HTTP/2 CONNECT proxies with udp-relay=true.
- Added HTTP/3 transport support to TrustTunnel with h3=true.

New Surge Beta Feed on X

We’ve launched https://t.me/SurgeBeta, a new X account for detailed updates on the latest Surge Beta releases. It will stay in sync with our existing Telegram Channel.

Follow https://t.me/SurgeBeta to keep up with the latest Beta changes and improvements.

Surge CLI Updates

As Surge CLI becomes a key foundation for integrating AI capabilities with Surge, we are continuing to expand and refine it.

The interactive CLI now supports command history and auto-completion, making it significantly more convenient for both everyday use and exploratory workflows.

We’ve also added a new set of useful commands, including rule match and rule explain, which let Surge answer a common debugging question without generating any real traffic: “Why would this request go through that policy?”

rule match

rule match performs a dry-run evaluation against the active rule set and reports the matched rule and final policy.

All relevant matching attributes — including hostname or URL, port, process path, source address, client MAC, protocol, and more — can be supplied as key=value options. This makes it possible to reproduce exactly how a specific request or client would be routed.

Combined with --raw, it can also be used in scripts to audit an entire list of domains against your current rules.

rule explain

rule explain goes a step further by showing why a particular policy was selected.

It traces the complete policy-group resolution path and reports every decision along the way, including manual selections, automatic test results, overrides, load-balancing decisions, Smart Group selections, the underlying proxy chain, DNS evaluation notes, and timing information.

Use rule match for quick checks and scripting, and rule explain when you need to inspect the complete decision path.

And there’s more coming: starting with the next iOS TestFlight build, Surge CLI will be able to operate Surge directly on iOS. Stay tuned.

* [Host] domain aliases can specify a dedicated DNS server.
* Updated the IPv6 fake-IP range to avoid unnecessary browser local-network permission prompts.
* Fixed rare crashes when proxy or QUIC connections close synchronously during data processing.
* Fixed recursive HTTP/3 timer processing that could cause a stack overflow.
* Fixed QUIC connections stalling after receive-side backpressure.
* Fixed long-running Ponte and Vector sessions eventually exhausting their ability to open relayed streams.
* Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections.
* Improved stability during heavy connection churn and local-port exhaustion.
* Improved MITM certificate generation and certificate-chain handling.
* Fixed several additional crashes and minor issues.

Surge iOS 5.22.0 is now available on the App Store.

New Features

* Added a full-featured Terminal to Surge iOS, providing CLI-based diagnostics, rule explanations, policy-group inspection, command completion, and command history.
* Added MASQUE proxy support using HTTP/3 CONNECT and CONNECT-UDP.
* HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true.
* TrustTunnel can now use HTTP/3 transport with h3=true.
* Added group-level proxy chaining. Policy groups can connect concrete proxy members through an underlying proxy.
* Added a Prometheus-compatible /metrics endpoint to the HTTP Controller.
* Added a graphical Policy Priority editor for Smart Groups.
* Added event-script support for engine-started and profile-reloaded.
* Added notification controls for proxy clients, scripts, and rule matches.
* Added Arctic and Pulse app icons.

Tailscale

* Added peer-relay support through eligible tailnet devices, with Direct → Peer Relay → DERP priority and runtime latency information.
* Interactive sign-in now supports tailnets that require administrator device approval.
* Improved recovery from interrupted sign-in by reconnecting and continuing the existing authorization flow.
* Improved compatibility with the Tailscale administration console and version-gated operations.
* Fixed connectivity issues after the control server assigns a new tailnet address.
* Improved recovery after network changes, UDP binding failures, expired connections, and in multi-peer configurations.

Profiles, Includes, and Rulesets

* #include directives can now be freely combined with regular section content.
* Sections using multiple or mixed includes are presented as read-only when their write-back destination is ambiguous.
* Added wildcard detached-section includes for [Ruleset *], [WireGuard *], and [Tailscale *].
* Added DEVICE_NAME to the profile environment for use in #!REQUIREMENT.
* Added diagnostics for missing WireGuard and Tailscale configuration sections and clarified named-include behavior.
* Local and inline rulesets can now be edited graphically on macOS and iOS.
* Rulesets can reference other inline rulesets as well as external RULE-SET or DOMAIN-SET sources.
* Circular ruleset references are rejected with a clear reference chain.
* The ruleset editor now better preserves blank lines, comments, disabled rules, and source locations.
* Fixed rules created inside rulesets or logical rules retaining an unintended hidden policy value.
* Improved selection of the appropriate write-back target when mixed includes are used.
* Fixed [General] values containing #, //, or ; being altered after saving.
* Profiles changed on disk or through iCloud now reload automatically, while invalid updates leave the working configuration active.
* Module installation state is no longer governed directly by iCloud.
* Cloud synchronization now excludes .git and node_modules.

UI and Editing

* The bottom tab bar remains visible during navigation to avoid UIKit transition glitches.
* The Script Editor now uses a dedicated modal interface with an improved toolbar and keyboard layout.
* Remote Controller and Ponte Diagnostics are available for all Ponte devices, including shared devices.
* Improved policy-group icon handling across themes and profile reloads.
* Improved iOS 26 context menus, previews, and module presentation.
* Virtual IP records and search results now use self-sizing rows.
* Fixed policy groups using an underlying proxy being unavailable from the UI.
* Improved module error reporting for download, parsing, writing, and installation failures.

Networking and Reliability

Surge Mac 6.9.0 is Now Available

* MASQUE & HTTP/3 — Added MASQUE proxy support with HTTP/3 CONNECT and CONNECT-UDP, plus HTTP/3 transport for TrustTunnel.
* Tailscale Peer Relay — Added Peer Relay support with Direct → Peer Relay → DERP path selection, plus improved sign-in and connectivity recovery.
* Surge CLI — Significantly expanded the CLI with rule explanations, DNS tracing, HTTP probing, runtime diagnostics, VM Gateway inspection, and more.
* Proxy Chaining — Policy groups can now route their proxy members through an underlying proxy.
* Profile System — #!include can now be freely mixed with inline content, with wildcard includes for Ruleset, WireGuard, and Tailscale sections.
* New Editors — Redesigned major configuration interfaces and added graphical editors for rulesets and Port Forwarding.
* Prometheus Metrics — Added a Prometheus-compatible /metrics endpoint for runtime and traffic monitoring.
* Gateway & Reliability — Improved IPv6 Gateway Mode and reliability across QUIC, DNS, Ponte, Vector, and high-connection-load scenarios.

For the complete release notes, please visit:
https://nssurge.com/support/mac/release-notes

Surge Mac 6.8.0 Surge Mac 6.8.0 has been officially released. This is one of our most substantial updates yet, combining major new capabilities with extensive improvements throughout the networking stack. Highlights include: - Initial adaptation for macOS…

Surge Mac 6.8.0
Surge Mac 6.8.0 has been officially released. This is one of our most substantial updates yet, combining major new capabilities with extensive improvements throughout the networking stack.

Highlights include:

- Initial adaptation for macOS 27
- Interactive Tailscale sign-in and automatic routing
- MTProto server mode for Telegram
- Built-in Snell v6 server support
- A significantly expanded Surge CLI and new AI Skills
- Reworked ECN handling across QUIC, WireGuard, Tailscale, Ponte, and nested UDP tunnels
- DNS-over-TCP and improved IPv4/IPv6 connection establishment
- UDP-aware Smart Group policy selection
- Major improvements to Gateway Mode, Ponte, profiles, cloud sync, external resources, and diagnostics

The release also delivers wide-ranging security, correctness, and reliability enhancements across core components—covering everything from malformed-data handling and connection recovery to memory usage, concurrency, and long-running stability.

Read the full release notes:
https://nssurge.com/support/mac/release-notes

Beta Updates

Improved

- Nested rulesets now work reliably: inline rulesets can reference other inline rulesets or external RULE-SET and DOMAIN-SET sources. Circular references are rejected with a clear reference chain instead of causing recursive matching.
- The local ruleset editor now preserves blank lines, standalone and trailing comments, and disabled rules more accurately. Invalid entries report their source file and line number, while comment rows use the same readable presentation as the main rule editor.
- Virtual IP records and search results on iOS now use self-sizing rows, preventing longer domains and usage details from being clipped.

Fixed

- Fixed rules added inside a ruleset or logical rule on iOS incorrectly retaining a hidden policy value when saved.

Beta Updates

- Tailscale can now establish peer-relay paths through eligible tailnet devices when a direct connection is unavailable, with Direct > Peer Relay > DERP path priority. Runtime details identify Peer Relay connections and display their latency.
- Local-file and inline rulesets can now be edited graphically on macOS and iOS. Add or modify standard rules, logical rules, nested rulesets, and comments, then reorder or remove entries as needed. Create new inline rulesets directly from the rule editor and store them as named [Ruleset ...] sections in the profile.
- The previously added mixed use of #include will no longer affect UI write-back for the corresponding sections. Surge will automatically select the write-back target as accurately as possible based on the changes.

Beta Updates

macOS Interface

- Reworked the proxy editor, policy-group editors, parameter dialogs, and the General, Interface, DNS, Profile, and License pages using a new System Settings-style card interface.

Surge CLI & Remote Control

- Added restart-engine, which completely restarts the engine, closes active connections, and clears caches and temporary rules.
- reload continues to apply only changed profile sections whenever possible, preserving unaffected runtime state.
- Restart Engine is also available from Surge Dashboard and the iOS Remote Controller maintenance menu.

Tailscale

- Improved compatibility with the Tailscale administration console. Surge devices are no longer incorrectly reported as using an outdated client, enabling version-gated operations such as editing the device IP address.

iOS

- Fixed managed-profile icon-url icons being hidden by automatically generated placeholder icons.
- Custom policy-group icons now behave consistently across Lucid and Gradient themes, with a Default option available in both.
- Module download, parsing, file-writing, and installation-information failures are now reported instead of failing silently.
- Refined the Script Editor toolbar and file-selection layout on iOS 26.
- Improved context-menu previews on iOS 26 by following the system’s native corner styling.

Profile System Updates

The #include directive can now be freely combined with other content within a section. The following usage patterns are supported:

1. Dedicated Include

[Proxy]
#include proxy.dconf

When a section consists of a single #include directive, it remains fully editable in the UI. Any changes made through the UI will be correctly written back to proxy.dconf.

2. Multiple Includes

[Proxy]
#include a.dconf, b.dconf

This combines content from multiple files into a single section. Since the UI cannot determine how changes should be written back to the individual files, the section becomes read-only and cannot be modified through the UI.

3. Mixed Content and Includes (New)

[Rule]
#include common-rule-a.dconf
DEST-PORT,123,DIRECT
#include common-rule-b.dconf

#include directives can now be freely mixed with regular content within the same section. As with multiple includes, the UI cannot determine the appropriate write-back behavior, so the section will be read-only.

Note: When using this feature in the [Rule] section, keep in mind that a FINAL rule immediately terminates rule matching. Any rules included or defined after it will therefore never be evaluated.

Beta Updates

Smart Group

- Added a graphical Policy Priority editor for Smart Groups on macOS and iOS.

Tailscale

- Interactive sign-in now supports tailnets that require administrator device approval. Surge clearly indicates when sign-in has completed but the device is still awaiting approval.
- Fixed Tailscale traffic becoming unavailable when the control server assigned the device a new tailnet address.
- Improved recovery after network changes by retrying temporarily failed UDP bindings and refreshing direct-connect endpoints.
- Improved WireGuard and Tailscale handling of multiple peers and expired connections.

Profile and Automation

- On iOS, profile changes made on disk or received through iCloud now reload automatically. If the updated profile is invalid, Surge keeps the working configuration active and reports the error.
- Event scripts can now respond to engine-started and profile-reloaded, in addition to network-changed.

Notifications

- Added notification controls for new proxy clients, script notifications, and rule-matched notifications.
- Local and remote notification category settings now correctly apply to dynamically generated alerts.
- Disabling policy-group change notifications now also suppresses temporary group-override alerts.

Fixed

- Improved MITM certificate generation by using separate keys for generated leaf certificates and correcting the transmitted certificate chain.
- Fixed QUIC connections potentially stalling after receive-side backpressure.
- Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections, including Ponte traffic.
- Improved stability under heavy connection churn and local-port exhaustion.
- Other small UI issues.

UniFi Controller Integration (Beta)

When Surge is operating in DHCP mode, Dashboard device management can integrate with the UniFi Controller. You can directly view the corresponding device’s SSID, AP, Wi-Fi version, and other information in Surge’s Dashboard. You can also force a specific device to reconnect.

Meanwhile, this feature is provided entirely by a new, extensible plugin mechanism, allowing plugins to be written to support any AP Controller or router.

This feature is currently in beta, so no UI configuration interface is provided yet. It can only be configured through surge-cli or the AI Skill. After installing the Surge AI Skill, simply ask the AI to help integrate your UniFi AP Controller. Alternatively, ask the AI to write a new plugin based on your router.

Plugin System (Beta)

- Added the Surge Plugin System on macOS. Plugins run as isolated JavaScript extensions independent of the active profile.
- The first supported plugin type is ap-controller, which can supply Wi-Fi information for the device panel and reconnect wireless clients. The existing UniFi Controller integration is now provided as a built-in plugin.

As it is still in the beta phase, the mechanism for installing plugins remotely via plugin install has not yet been enabled. Currently, only loading and running local content via plugin load is supported.

Profile System Updates
- Added wildcard detached-section includes for [Ruleset *], [WireGuard *], and [Tailscale *]. A single #!include can now load all matching named sections from another local or remote profile file.
- Added DEVICE_NAME to the profile environment, enabling device-specific conditions in #!REQUIREMENT.
- [Mac] The current Reload Profile option will compare the differences between the old and new profiles and apply only the changes. It will not terminate existing active connections unless necessary. (Same behavior as editing through the UI previously.)
- [Mac] Added a Restart Engine option, which behaves like Reload Profile in the previous version and completely restarts the core once.

Beta Updates

### Surge CLI

- Added vmnet status to inspect the VMNET interface configuration, including addresses, prefixes, MTU, and diagnostic table sizes.
- Added vmnet arp to inspect IPv4 neighbors learned from Gateway Mode clients.
- Added vmnet ndp to inspect the IPv6 neighbor table.
- Added vmnet ra to inspect IPv6 Router Advertisement takeover status, including clients, known routers, RA lifetimes, and blacklisted devices.

### macOS

- Added a graphical Port Forwarding editor for creating and managing incoming TCP forwarding rules. Listening address, listening port, destination, and outbound policy can all be configured without editing the profile manually.
- Gateway-related device actions are now hidden when Gateway Mode is unavailable.
- Fixed system proxy settings being applied when using VIF mode without a default route.

### iOS UI

- When navigating to a new page, the bottom tab bar is no longer hidden. This change was made to avoid triggering known UIKit UI glitches that can occur when the tab bar is hidden during push transitions.
- The Script Editor now opens in a dedicated modal interface, with an updated toolbar, close action, and improved keyboard layout.
- Remote Controller and Ponte Diagnostics are now available for all Ponte devices, including devices shared by another iCloud account.
- Other UI improvements.

### Other Improvements

- Updated the IPv6 fake-IP range to avoid unnecessary browser local-network permission prompts, while retaining compatibility with previously cached addresses.
- Proxy connections closed during the protocol handshake now provide a clearer error message, with guidance to verify credentials, encryption methods, and protocol settings.
- Fixed rare crashes that could occur when proxy connections were synchronously closed while data was being written.
- Fixed recursive HTTP/3 timer processing that could cause a stack overflow under certain conditions.

DNS Updates

Host rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query.