Release notes

This page lists officially published HypoMux versions from v2.5.7 onward. Draft and pre-release versions are excluded automatically using their GitHub Releases status. Visit GitHub Releases for the full history and latest published notes.

v2.7.0 Release notes

This release brings together the features, fixes, and maintenance changes since v2.6.0. It adds an AI assistant and Mux companion, experimental aggregation hotspot, rule-set subscriptions, adaptive speed and latency-first scheduling, MTU diagnostics, and stable/preview update channels. It also improves Steam download node optimization, TUN compatibility, configuration persistence, and desktop interactions.

AI assistant and external MCP

• Added a dedicated assistant workspace for conversations, model configuration, external AI connections, and companion appearance. It shares conversations and task state with the in-app floating Mux companion.
• Supports OpenAI-compatible Chat Completions and Responses, plus Anthropic Messages, with selectable authentication. Accepts host roots, custom prefixes, and complete endpoint URLs. Remote services require HTTPS; loopback services may use HTTP.
• Fetch and search model lists or enter a model ID manually. Save and test tool calling verifies the model capabilities needed to operate the application.
• The assistant can inspect status, adapters, connection summaries, and redacted diagnostics; configure mode, participating adapters, four scheduling strategies, and weights; manage individual routing rules; and start or stop aggregation. Tools also cover NAT/STUN, Steam optimization, starting/stopping a saved hotspot, and WFP/BFE repair. Capability reporting identifies functions that still require the UI.
• Messages include the current page name and selected routing-rule context. Navigating away neither changes an already submitted task's target nor stops its background work.
• Distinguishes routine operations from actions requiring confirmation. External MCP writes retain in-app confirmation. Configuration changes invalidate pending approvals based on stale state.
• Added a local Streamable HTTP MCP service, disabled and read-only by default. When enabled, it uses loopback networking and a temporary access key. It does not configure other AI clients automatically or expose general command execution or arbitrary file access.
• API keys and local conversation history are encrypted for the current Windows user. Changing the service address, protocol, authentication, model, or key isolates the new context so old conversations are not automatically sent to a new service.
• Improved multi-step tool calling with reasoning models by preserving the protocol fields required within a task. Improved configuration recovery and errors without automatically retrying operations that could execute twice.
• Unified assistant configuration and conversation layouts, Markdown rendering, tool progress, and approval cards. Fixed replayed replies after navigation, misaligned reply/thinking states, input remaining open after approval, and returning to an outdated chat position.

Mux companion and personalization

• Added a draggable in-app companion with message input, reply summaries, access to full conversations, processing state, and approval prompts. Its visibility can be controlled in settings.
• Added the Mux wardrobe to import, preview, apply, and export .muxskin/ZIP packages, or create a skin from a transparent PNG. Includes size, animation, speech-bubble anchor, and reset controls.
• Supports PNG/sprite animations, layered characters, and Cubism 3/4 Live2D models, with idle, thinking, approval, reply, hover, and drag states. Images provide a fallback when model loading fails.
• Moved skin parsing to a background Worker and preserve character instances across navigation. Improved resource handling for hidden pages, disabled animations, and WebGL context restoration to reduce repeated loading and UI stalls.
• Refined light/dark themes, built-in and local backgrounds, materials, and appearance settings, including local preference persistence and navigation state retention.

Aggregation hotspot (experimental)

• Added a Toolbox hotspot that shares an active TUN aggregation session through Windows Mobile Hotspot. Phones and other devices connect normally over Wi-Fi without a proxy configuration or client application.
• Added quick controls and a detail page for saved SSID, password, and band settings, random password generation, password copying, locally generated Wi-Fi QR codes, connected devices, and sharing diagnostics.
• Hotspot passwords are encrypted for the current Windows user and excluded from command lines and general logs. Fixed stale UI drafts showing a different password or QR code when AI or another entry point starts the saved hotspot.
• Automatic band selection prefers 5 GHz when supported and may retry with Windows automatic selection after specific failures when the hotspot is confirmed off. Explicit 5 GHz requests report failures without silently changing bands.
• Improved TUN profile discovery on Windows 10, recognition of Wi-Fi 7 and vendor-named wireless adapters, and compatibility with older band APIs.
• Distinguishes hotspot readiness from verified sharing egress. A ready hotspot remains available with an unverified-egress indication when legacy ICS enumeration is temporarily unavailable. Added gateway, sharing-interface, configured-band, and link-rate diagnostics.
• Improved startup waits, failure retries, shutdown confirmation, and restoration of the original configuration. Shared operation locks prevent duplicate actions across the card and detail page. Fixed late status results overwriting shutdown state and failures preventing subsequent retries.
• Stops the hotspot before stopping aggregation. Missing TUN, an invalid gateway, or a confirmed wrong egress ends sharing instead of falling back to another physical adapter. Existing Windows hotspots or other ICS sessions are not automatically taken over.

Scheduling and forwarding performance

• Scheduling strategies and adapter weights can be changed while running, preserving established connections' egress bindings. Persistence failures attempt to restore the previous scheduling configuration, and unsupported Core capabilities are reported explicitly.
• Added Adaptive speed: starts with even allocation, gradually adjusts new-connection shares using sustained throughput and actual connection turnover, and retains a minimum share per eligible adapter. Insufficient demand keeps allocation balanced; a significant aggregate-throughput drop triggers rollback and cooldown.
• Fixed excessive preference for one adapter, starvation of low-share adapters, and temporary IPv4/IPv6 or health-filter candidate changes repeatedly resetting global learning. Existing round-robin and manual-weight strategies retain their own behavior.
• Added Low latency first: selects links using target-probe latency, jitter, and loss, with reference probes as fallback estimates. Hold times and improvement thresholds reduce unnecessary switching.
• Under latency-first scheduling, UDP can rebuild its upstream after missing replies when repeated probe failures and a usable alternative provide supporting evidence. Historical packets are not replayed; healthy flows and established TCP connections are not actively migrated.
• Improved scheduling state, learning-phase, effective-strategy, and allocation-share reporting, distinguishing connection shares from bandwidth shares.
• Reused UDP reply buffers and improved TCP relay buffer lifetimes to reduce allocations. Fixed pool updates disrupting the original rotation order.

Routing and rule-set subscriptions

• Added reject rules for processes, domains, and IP addresses, including priority handling, enable/disable controls, and hot reload.
• Added TUN rule-set subscriptions that bind a whole domain/IP category to an outbound. Supported match types can be imported from Clash payload YAML and sing-box source JSON instead of entering every rule manually.
• Subscription management supports creation, editing, enable/disable, deletion, updates, and priorities, with update state, entry counts, and ignored-entry counts. Entries can be searched and paginated; forms, action feedback, and list refresh behavior were refined.
• Subscription downloads require public HTTPS endpoints, with redirect, size, and time limits, conditional requests, normalization, and deduplication. Redirects and DNS resolution cannot redirect downloads into localhost or private networks.
• External rules with unsupported inversion, port conditions, or logical nesting are ignored as a whole and counted, instead of stripping conditions and changing their routing meaning.
• Content and priority changes support hot reload. Changes requiring main-configuration declarations, including new subscriptions or outbound rebinding, prompt for a restart. Improved failed-update rollback, deleted/disabled rule publication, and adapter-specific outbounds.
• Fixed null empty lists crashing the panel, empty IP arrays failing parsing, and premature removal of disabled subscriptions' cached content preventing re-enablement.
• Quick-add routing from active connections now preserves custom match order and checks configuration revisions to avoid overwriting concurrent AI/MCP or UI edits. New outbound conflicts require renewed confirmation; save errors stay inside the dialog and preserve the draft.
• Improved focus retention during batch previews, routing tables and toolbars, and selection/scroll state after saving, deleting, or navigating.

Steam download node optimization

• Validates a small number of candidate nodes concurrently so verified candidates can start trials without waiting for earlier slow nodes. Probe traffic, concurrency, and candidate limits remain bounded.
• Added conditional early trials for verified candidates while retaining original-route comparison connections. Original-node changes, expired samples, and connection failures clear stale scores so pre-pause throughput does not bias later decisions.
• Added cooldown protection for sustained moderate degradation while retaining severe-slowdown fallback. Existing candidates can be revalidated when the pool is full, without interrupting established downloads.
• The detail page distinguishes disabled, waiting for engine, incompatible Core, waiting for downloads, validating, learning, and preferred-node states.
• Added node search/filtering, valid-sample and failure details, recent overall/switched throughput, cumulative traffic, cache state, update time, and Core version information.
• Improved refresh, retry, and re-evaluation feedback. Stale requests cannot overwrite a new learning session, and traffic statistics are not presented as speed-improvement percentages.

TUN, DNS, and network diagnostics

• Updated the bundled official Windows sing-box to 1.14.2, including source and checksum records.
• TUN shutdown first requests a graceful sing-box exit before bounded forced cleanup, preserving FakeIP metadata during immediate restarts and cached-only resolution.
• Improved TUN address and route checks to reduce false conflicts from backup VPN routes, Windows IPv6 transition interfaces, and unrelated networks. Expanded local-network and route-change diagnostics.
• Normal startup treats overlapping third-party tunnel routes and unreachable public test sites as diagnostic information. Public-probe failures after startup or during operation no longer independently stop the engine.
• Improved force-start behavior by skipping external connectivity tests and some environmental inference while still avoiding known local interface addresses. Missing runtime files, no valid adapter, duplicate source addresses, insufficient permissions, and actual TUN creation failures still fail explicitly.
• DNS fallback reads the running Core configuration and preserves encrypted-DNS policy and egress binding. Fixed resolution not retaining an explicitly selected adapter. Elevated desktop compatibility is now informational, reducing unnecessary startup blocks.
• Added MTU probing, confirmed application, and original-value restoration to network diagnostics, requiring network services to be stopped first. Probes use a selected adapter and IPv4 target; expired results or changed adapter configuration cannot be applied. Original values are saved before changes and remain available after reopening the application.
• MTU changes run through the elevated Core with read-back verification and affect only the current IPv4 active configuration. Improved diagnostic status, cancellation, and error feedback.

Desktop interactions, stability, and maintenance

• Active connections can be grouped by process or adapter, with improved summaries, expansion, sorting, and quick routing. Virtualized large lists reduce rendering overhead at high connection counts.
• Navigation preserves searches, selections, drafts, and scroll positions. Inactive pages pause unnecessary polling, and stale asynchronous results no longer overwrite newer state after returning.
• Refined Home adapter cards, allocation feedback, speed displays, and English layouts to reduce shifting as values change. Improved virtual-adapter recognition, including Radmin VPN.
• Improved tray window styling, typography, spacing, keyboard focus, and placement near the click. Fixed touch popup positioning and added touchscreen title-bar dragging.
• Unified notification, dropdown, dialog, and hotspot-form layouts across narrow windows and themes. Settings-load failures now show an explicit error and retry action.
• Settings preferences merge by field so language/appearance changes do not overwrite unsaved network edits or another service's recent changes. Improved adapter/settings save queues and concurrent-write protection.
• Fixed Windows Core named-pipe handle races and communication stability issues. Extended capability negotiation and protocol regression coverage for scheduling, hotspot, and MTU operations.
• In-place installation prioritizes the user's existing custom install directory instead of unexpectedly reverting to the default path.
• Fixed website submodule mapping and synchronized its source reference. Added documentation for AI, hotspot, scheduling, MTU, skin authoring, and release versioning.
• Updated frontend dependencies and lockfiles. Expanded tests for subscriptions, FakeIP restarts, concurrent saves, skin lifetimes, hotspot recovery, and UI interactions, and stabilized several asynchronous tests on Windows CI.

Versions and update channels

• Added Stable / Preview (Beta / RC) in settings, defaulting to Stable with a persisted preference. Preview checks both stable and prerelease feeds and selects the newest version.
• Supports numeric prerelease ordering through beta.N → rc.N → stable. Switching back to Stable does not automatically downgrade; updates resume when a stable release with the same base version or a higher version is available.
• Beta/RC releases use a separate signed update channel and are marked as prereleases without replacing stable latest. Older clients continue using the original stable feed.
• Added a shared version-setting and consistency-check command for the UI, Core, updater, and Windows metadata. Release builds inject the tag version and keep display versions separate from four-part numeric Windows versions.

Upgrade and usage notes

• This is the v2.7.0 stable release for Windows 10/11 x64. Use the official installer to update both desktop and Core, then restart aggregation/TUN to apply the new runtime and main configuration.
• AI features require a user-configured model service with tool calling; providers may charge for API use. Conversations and necessary tool results are sent to the selected service. Mux currently appears only inside HypoMux.
• Aggregation hotspot remains experimental and requires Windows Mobile Hotspot support and an active TUN session. Drivers, radio bands, sharing state, and upstream networks affect results.
• Aggregation, adaptive scheduling, and Steam optimization do not guarantee faster downloads or split one TCP connection across links. Latency-first failover may change the public egress and cannot guarantee uninterrupted game sessions. MTU results apply only to the selected adapter-to-target path.
• Rule-set content and priorities support hot reload. Restart TUN when prompted after operations such as adding a subscription or changing its outbound. Older versions differ in support for new configuration features; back up settings and rules before planning a rollback.
• Official GitHub and Tencent CNB downloads continue to distribute the same signed installer. Automatic updates retain Ed25519 manifest, installer size, SHA-256, and Windows Authenticode verification.

Thanks to SignPath.io for providing Windows code-signing services for HypoMux, and to SignPath Foundation for issuing the project's open-source code-signing certificate.

Contributors

• @Hypostasis-Cat
• @a742987

---

v2.6.0 Release notes

This release introduces Toolbox with experimental Steam download node optimization, individual routing rule toggles, configurable match order, and automatic Wi-Fi connection at startup. It also refines the desktop interface and network diagnostics, with fixes for TUN address conflicts, DNS fallback, and routing priority.

Toolbox and Steam download node optimization

• Added Toolbox to the sidebar, with Steam download node optimization as its first tool. It supports system proxy and TUN modes and is disabled by default.
• Discovers and validates Steam download candidates per outbound adapter, using bounded short tests and real download observations to gradually prefer better-performing nodes. Supports discovery across adapters, IPv4 and IPv6 candidates, and recognition of more Steam CDN hosts and redirect targets.
• Candidates must pass validation before trials and are continuously evaluated. Slow or failing nodes stop receiving new connections, while content mismatches revoke eligibility. Traffic, request, and concurrency limits keep probing from generating separate large-file speed tests.
• Added a dedicated detail page with candidate nodes, switched connections, actual download traffic, short-test reference rates, fallback counts, and diagnostics. Re-evaluate restarts learning.
• Separates client interruptions from upstream failures so interrupted downloads are not incorrectly counted as node failures. Connection switches and effective transfers are reported separately to show whether optimization is carrying download traffic.
• Toggle changes apply to new connections without actively interrupting existing downloads. Disabling cancels probes and clears rankings. Only supported Steam download hosts over TCP 80/443 are handled; system DNS, hosts, and Steam files are unchanged. HTTPS remains end-to-end encrypted without installing certificates.

Routing rules

• Added an individual enable switch to each rule. Disabled rules remain in the list but are excluded from traffic matching and egress availability checks, with their status shown inline.
• Added configurable match order for process, domain, and IP rules, defaulting to process → domain → IP. The setting is saved even when the rule list is empty.
• Added a one-click action to disable rules referencing unavailable adapters, making it easier to recover after adapters are changed or disconnected. Rules can be re-enabled when needed.
• Routing backups now use format version 3 and preserve match order. Version 1 and 2 backups can still be imported, with type order derived from their existing priorities.
• Fixed broad adapter-specific IP rules taking precedence over DNS, process, and domain traffic in TUN mode. Refined third-party proxy exceptions so adapter rules do not override more specific non-adapter rules, while retaining live rule updates.
• Improved the rules toolbar, type tabs, and action layout for narrow windows.
• Fixed third-party proxy compatibility bypassing explicit IP egress rules before domain/FakeIP destinations were resolved. More specific subdomains now take precedence over parent domains at the same priority, including disabling, restoring, and hot-reloading subdomain exceptions.
• Added real routing regression tests using the bundled sing-box for all six match orders, compatibility mode, and hot reload. Fixed CI allowing later successful checks to mask an earlier test failure.
• Batch egress updates preserve disabled rules. Saved priority normalization now preserves row selection, fixing selected rules becoming impossible to delete.

Desktop and interface

• Unified button, dropdown, and input borders, corners, and focus styles across light, dark, and frosted themes.
• Home now explicitly offers Maximum speed first and Schedule by weight. Clarified that weights control new-connection allocation, not bandwidth shares or rate limits; weight editing is disabled while running or degraded.
• Virtual adapters are hidden on Home by default, with a setting to show them. Improved detection of renamed virtual adapters and added hidden and selected counts while preserving existing selections.
• Added detection of Meta Tunnel, Mihomo, and Clash virtual adapters so they follow Home's virtual adapter visibility setting.
• Improved alignment of the runtime status area and start button, reducing layout shifts as values change.
• Fixed inflated or erratic Home speed readings during frequent refreshes and improved throughput sampling stability.
• When Core cannot be connected, the connections list returns an empty stopped state, reducing repeated error notifications during polling.

Network and startup

• Added Connect Wi-Fi at startup under Settings → Startup. Before automatic acceleration, selected wireless adapters try saved Windows networks that allow automatic connection and wait for connectivity within a bounded period.
• Fixed startup waits continuing with outdated settings. Disabling automatic startup, changing mode, or changing selected adapters cancels the pending attempt.
• TUN startup now checks interface subnets and selects an available address, addressing startup failures caused by the fixed address conflicting with Hyper-V, VPN, or other interfaces. Dual-stack and IPv4 fallback use the same selected address.
• Fixed DoH timeouts exhausting the fallback budget in automatic DNS mode, preserving time for subsequent DNS servers. Explicitly selected DoH providers retain their encrypted resolution policy.
• Improved startup preflight to retain completed diagnostic results when later checks time out or output is truncated. Extended the check window and report virtual adapters, IPv4 forwarding, and network sharing as environment information to reduce unnecessary risk prompts.
• Both system proxy and TUN startup check selected adapters for duplicate source IPs and identify the affected adapters and addresses before starting.
• Failed startup after a mode change restores the previously saved mode so the next automatic start does not reuse the failed attempt's mode.
• Added a read timeout for elevated Core authentication and clear it after successful authentication so it cannot disconnect subsequent normal communication.
• Added a cross-process lock around system proxy settings and recovery records to reduce conflicts between the desktop, recovery tool, and installer. Lock waits are bounded, and Windows releases the lock when its owning process exits.
• Preserve the WFP DNS exemption session handle when cleanup fails, allowing later cleanup attempts to retry.

Stability and maintenance

• Network diagnostics now preserve actual ICMP system errors instead of reporting local binding or API failures as 100% packet loss. Unavailable measurements display as “—”.
• Classify local connection errors per operating system, including additional network reset and host reachability errors, to avoid mixing platform error numbers in adapter health decisions.
• Treat non-positive adapter weights as the minimum valid weight, prevent state-change timestamps from moving backward after a clock adjustment, and centralize domain isolation defaults.
• Expanded support logs for automatic startup waits, Wi-Fi connection attempts, DNS validation, and TUN address selection. Windows Core builds now include the Git commit to identify the source revision.
• Improved DNS and health-check cache indexing to reduce frequent lookup and status-read overhead.
• Improved legacy configuration migration errors with the actual input file, conflicting ports, and repair examples.
• Remove the current migration's unusable rollback backup if committing the legacy configuration fails.
• Added an upgrade check and repair tool under the repository's tools/support directory. It provides environment checks and confirmed repair cleanup for process locks, service state, and file writability while preserving user configuration and rules.
• Extended desktop–Core communication with Steam optimization configuration and capability detection, including recognition of unsupported older Core builds.
• Added regression coverage for Steam optimization, rule order, unavailable-rule disabling, startup Wi-Fi, TUN address selection, DNS fallback, and throughput sampling. Improved IPv6 test handling for unsupported environments.
• Added regression coverage for bidirectional communication after the authentication deadline, proxy locks, certificate revocation error classification, platform network errors, and backward clock adjustments.

Upgrade notes

• Supports Windows 10/11 x64. Install the official signed package over an existing installation; the installer safely stops HypoMux and the independent Core service before replacing files.
• After upgrading, stop and restart aggregation/TUN once to apply the new routing configuration and TUN address selection. Re-saving rules alone does not update an older TUN main configuration.
• Steam download node optimization is experimental and disabled by default. Results depend on available CDN nodes and network conditions; faster downloads or full bandwidth are not guaranteed. Compare sustained download speeds for the same game and download region. The share of traffic carried by switched nodes is not a speed improvement percentage.
• Older routing backups can be imported into this release, but v2.5.9 cannot directly import format version 3 backups. If rollback is planned, export and retain a rule backup using the old version before upgrading.
• If an in-place upgrade is blocked, follow the instructions for the check and repair tool under the repository's tools/support directory, then run the official installer again.
• GitHub Releases and Tencent CNB Release continue to distribute the same SignPath-signed installer. Automatic updates still verify the Ed25519 manifest, file size, SHA-256, and Windows Authenticode signature.
• Added an online installer signing certificate revocation check. Definitively revoked certificates block installation; if the server is unreachable or the check times out, installation still requires the existing signature and integrity checks to pass.

Thanks to SignPath.io for providing Windows code-signing services for HypoMux, and to SignPath Foundation for issuing the project's open-source code-signing certificate.

Contributors

• @Hypostasis-Cat
• @a742987

---

v2.5.9 Release notes

QQ Group: 1002583295

This release adds quick routing actions, live rule updates, persistent FakeIP caching, TUN stack selection, and daily startup-warning dismissal. It also redesigns global notifications and improves automatic startup, installation, updates, and long-running reliability.

Active connections and routing rules

• Added a context menu to active connections for creating process, domain, or IP rules. Connection details and the current egress policy are filled in automatically, with an option to choose another egress before saving.
• Rules are checked for duplicates and conflicts before saving. Existing identical rules are not duplicated; changing the egress replaces only the matching rule and preserves other rules. The menu also supports the keyboard menu key and Shift + F10.
• TUN routing now uses local rule sets that reload automatically after saving when the running configuration already includes the required outbounds and DNS capabilities. Existing connections keep their current path; new connections use the updated rules. Rules that reference an outbound not loaded by the current TUN session, or new domain rules when FakeIP is not enabled, require stopping and restarting TUN to take full effect.
• Updated the routing page and quick-add dialog to distinguish live updates, changes applied at the next start, and changes requiring a restart, instead of always showing a restart-required warning.

TUN and proxy modes

• Enabled persistent sing-box caching by default, storing domain-to-virtual-IP mappings when FakeIP is in use. TUN restarts and IPv4 fallback reuse the same cache to improve mapping continuity.
• Added TUN stack selection under Settings → Advanced network: system, mixed (system TCP + gVisor UDP), and gvisor (a full userspace stack). The default remains system; changes apply the next time TUN starts.
• Added a system-proxy takeover switch. When disabled, HypoMux provides local SOCKS5 and HTTP/HTTPS proxy ports without changing Windows system proxy settings, allowing manual application setup or use alongside other proxy tools. Automatic takeover remains the default.

Notifications and interaction

• Fixed the release-notes dialog jumping down after checking for updates. It now starts at the top on both initial and subsequent opens for natural top-to-bottom reading.
• Redesigned global notifications as a Dynamic Island-style surface for saved settings, acceleration start/stop events, link changes, diagnostic results, and failures, reducing scattered feedback across pages.
• Repeated notifications are grouped with an occurrence count. Notifications support expanded details, dismissal, and retry actions where available; errors include clearer summaries and error codes.
• Improved light/dark theme integration and frosted-glass rendering, fixing ineffective background blur and mismatched surface colors.
• Added “Don't remind me again today” to startup risk prompts. Check it and choose Continue to keep advisory prompts hidden for the local calendar day, including after restarting the app. Reminders return the next day; startup checks and blocking errors remain enabled.
• Improved diagnostic feedback and page-state handling to avoid covering controls, unnecessary reloads after language changes, and stale updates after leaving a page.
• Added an official website button to About and linked hypomux.com in the project documentation.

Stability and compatibility

• Fixed automatic acceleration failing when selected adapters had not yet been enumerated during Windows startup. HypoMux now waits for them to appear within a bounded time before starting.
• Fixed races between Core startup, stop, and shutdown. Improved cleanup of background tasks, event listeners, and communication resources during repeated starts and exits.
• Fixed abnormal active-connection counts caused by repeated connection cleanup, and improved concurrent DNS-status access.
• Improved cancellation and timeout handling in network diagnostics and corrected probe accounting. SOCKS5 UDP now accepts IPv4-mapped addresses carried in IPv6 format.
• Reduced settings-save blocking caused by slow registry queries. Appearance-save failures now produce visible feedback, and failed cleanup of expired domain-isolation records preserves consistency between memory and storage.
• Improved Windows-version detection in the installer to avoid false rejections caused by compatibility-version reporting, while retaining architecture checks.
• Fixed upgrade checks treating harmless read-only access, such as security-software scans, as a locked Core executable. Failures now distinguish processes that remain running from genuine write locks.
• Hardened installer-path validation for automatic updates by rejecting special characters that could be misinterpreted by the command interpreter.

Dependencies and maintenance

• Fixed dialog focus timing in quick-add routing tests and added regression coverage for the release-notes dialog's initial position and repeated opening.
• Upgraded sing-box from 1.13.19 to 1.13.21, retaining gVisor support and adding TUN DNS-configuration compatibility handling for later versions.
• Added regression coverage for live rule updates, FakeIP recovery after restart, stack selection, daily warning dismissal, and Core lifecycle behavior. Removed obsolete qualification scripts.
• Added English release notes for earlier versions to support bilingual website changelogs.

Upgrade notes

• Supports Windows 10/11 x64. Install the official signed package over an existing installation; the installer safely stops HypoMux and the independent Core service before replacing files.
• Restart TUN after upgrading to enable live rule updates. Routine rule changes reload automatically; follow the restart prompt when a rule needs an outbound not loaded by the running configuration or a domain rule requires enabling FakeIP. Changing the TUN stack still requires a TUN restart. Rules saved while TUN is stopped apply at its next start.
• FakeIP mappings are stored in cache/sing-box.db under the configuration directory. Newly allocated mappings that have not yet been written may still be lost on forced termination. Remote rule subscriptions and automatic rule-pack updates are not included in this release.
• GitHub Releases and Tencent CNB Release continue to distribute the same SignPath-signed installer. Automatic updates still verify the Ed25519 manifest, file size, SHA-256, and Windows Authenticode signature.

Thanks to SignPath.io for providing Windows code-signing services for HypoMux, and to SignPath Foundation for issuing the project's open-source code-signing certificate.

Contributors

• @Hypostasis-Cat
• @a742987 (#70)

---

v2.5.8 Release notes

QQ Group: 1002583295

This release improves network diagnostics, active-connection visibility, batch routing, aggregation startup performance, and Windows TUN and update reliability.

Network diagnostics

• Added per-adapter NAT type detection based on RFC 5780, with mapping and filtering behavior, public endpoints, probe records, automatic selection, custom STUN servers, and Windows Firewall calibration.
• Renamed Network Health to Network Check, bringing link checks and NAT detection together. NAT detection is blocked while aggregation is running if it cannot reliably identify the physical adapter.
• Adapter scan results now stay in sync across Network Check, Connections, and Settings after an adapter disconnects or changes.

Active connections

• Improved process, destination domain, remote IP, actual outbound adapter, routing policy, session traffic, and duration data, including more accurate Core and Clash metadata matching.
• Added search, outbound-policy filters, and sorting by process, destination, policy, traffic, and duration.
• Adapter cards keep whole-card selection while their download, upload, and connection-count areas open the filtered Connections view.

Routing rules

• Added batch process, domain, and IP rule creation with validation, duplicate skipping, conflict replacement, invalid-value notices, multi-select deletion, and a 2,000-value limit per batch.
• The running-process picker now shows real process icons where available and a consistent generic icon otherwise.
• Fixed an issue where a compatibility direct rule could override an upstream proxy explicitly assigned to an adapter, and added verge-mihomo.exe compatibility detection.

Performance and experience

• Reduced aggregation and TUN startup wait by reusing short-lived preflight results, merging system checks, probing paths in parallel, and skipping cleanup where no residual device exists.
• Reduced Home telemetry interval to about 0.8 seconds and uses lighter summary data, with smoother throughput curves and gradient fills.

Dependencies and maintenance

• Upgraded sing-box to 1.13.19.

Upgrade notes

• Supports Windows 10/11 x64. Install the official signed package over an existing installation; the installer safely stops HypoMux and the independent Core service before replacing files.
• Routing-rule changes made while TUN is running are saved immediately, but require aggregation to be stopped and restarted before the current sing-box routing configuration uses them.
• GitHub Releases and Tencent CNB Release distribute the same SignPath-signed installer. Automatic updates continue to verify the Ed25519 manifest, size, SHA-256, and Windows Authenticode signature.

Contributors

• @Hypostasis-Cat
• @s3qazx (#64)

---

v2.5.7 Release notes

QQ Group: 1002583295

Installer compatibility and update security

• Fixed a failure where an inherited PSModulePath prevented Windows PowerShell from loading system modules while configuring the protected Core directory.
• Improved protected-directory ACL writes for both Windows PowerShell 5.1 and PowerShell 7.
• Fixed a case where navigating away from Home could reinitialize engine state and live information.
• Added Tencent CNB as a mainland-China update source, with GitHub/CNB dual-source updates and automatic fallback.
• Added Ed25519 signature verification to update manifests, alongside installer size, SHA-256, and Authenticode checks.
• GitHub and CNB distribute the same SignPath-signed installer.