v1.6.8 - DNS inside the tunnel, XHTTP tuning, virtual node knobs

Fixes

• sing-box: encrypted DNS is dialed through the proxy, and
  oute.default_domain_resolver is set resolution no longer leaks past the tunnel, and sing-box 1.14 accepts outbounds addressed by hostname.
• sing-box: the selector choice now survives a core restart (cache_file is no longer tied to rule sets), direct is out of the picker, and switching a node drops stale connections.
• Rule sets are validated against the tags SagerNet actually publishes, so one unsupported value no longer 404s and discards the whole config. geoip:private becomes ip_is_private.
• Node labels are deduplicated across every format, and the panel, REST API and MCP reject a new node whose flag+name collides with an existing one.

Features

• Virtual nodes: latency tolerance, idle timeout and interrupt-existing-connections are configurable.
• Xray inbounds: XHTTP padding length, upload chunk size, gRPC header and XMUX settings. The values reach clients through �less:// URIs, and the node widens its own accepted ranges to a superset of the client defaults so clients that never receive them stay connected.

CC Agent binaries

Lightweight Go agent for managing Xray on nodes.
Downloaded automatically during node auto-setup from the panel.

File	Architecture
cc-agent-linux-amd64	x86_64 (most VPS)
cc-agent-linux-arm64	ARM64

Celerity Probe binaries

External diagnostic probe. Installed by the operator on their own
host; holds only client subscription credentials and no node access.
The install command with a single-use token is generated in the panel.

File	Platform
celerity-probe-linux-amd64	Linux x86_64
celerity-probe-linux-arm64	Linux ARM64
celerity-probe-darwin-amd64	macOS Intel
celerity-probe-darwin-arm64	macOS Apple Silicon
celerity-probe-windows-amd64.exe	Windows x86_64
celerity-probe-windows-arm64.exe	Windows ARM64

Panel source code is distributed via Docker Hub: clickdevtech/hysteria-panel

Full Changelog: v1.6.7...v1.6.8