v1.0.6 -- "到最后遗憾的是我，还是你。"

• fix(ci): survive the flaky hdiutil detach that fails the macOS dmg

• The v1.0.6 build produced Avalon.app fine and then died in appdmg's last

• steps: hdiutil detach /Volumes/Avalon returned "No such file or directory",

• appdmg treated that as fatal and deleted both the temporary image and the

• target dmg. Twelve seconds passed between "Blessing image" and the failure,

• so appdmg had been retrying: the first detach reported an error, the volume

• went away underneath it anyway, and every retry after that found nothing left

• to unmount. The image was complete the whole time.

• This is the runner, not the build - a volume held a moment too long by a

• background process, or unmounted asynchronously by DiskArbitration. appdmg

• gives us no way to tell it that an already-unmounted volume is a success, so

• put a shim in front of hdiutil on the PATH of the packaging process. It only

• touches detach: an absent mount point exits 0, a busy one is retried, and

• the last attempts sync and force it out so the image content is still

• flushed. Five failed attempts still exit non-zero, so a genuinely stuck

• volume is not swallowed.

• The shim is only prepended for macOS packaging, so no other platform's

• environment changes.

• Co-Authored-By: Claude Opus 5 noreply@anthropic.com

• Claude-Session: https://claude.ai/code/session_013ChdTt9BG4wAfqY35MDr1o

• chore(release): bump version to 1.0.6

• Co-Authored-By: Claude Opus 5 noreply@anthropic.com

• Claude-Session: https://claude.ai/code/session_01NSAj59bHG8PDrWLncUW8fC

• fix(nodes): default udp on, the real cause of the WebRTC leak

• The virtual adapter was never the problem. With the tun up and its routes

• installed, a STUN probe still left through the physical interface carrying the

• real address, and 1.0.4's strict-route did nothing about it.

• mihomo gates UDP on a per-outbound flag: adapter/outbound/*.go declares it as

• UDP bool with the proxy:"udp,omitempty" tag, so a proxy that omits the key

• is parsed as not supporting UDP. tunnel.go's match() then skips every rule that

• resolves to such an outbound and, once the rules run out, returns

• proxies["DIRECT"]. The packet leaves through the physical interface with the

• real source address and nothing is logged. WebRTC's STUN probes and QUIC both

• take that path, which is why ipcheck.ing kept reporting the real address while

• everything else went through the proxy.

• Share links do not carry udp; only Clash YAML subscriptions write it. So this

• hit exactly the nodes this app exists for - the ones imported by URI and

• combined into relay chains - and left subscription users untouched.

• Default it to true, in the URI codec so the value is visible in the node editor

• and travels with exported links, and again in effectiveNodeConfig and

• effectiveStoredNodeConfig so nodes already in the library are covered without a

• migration. Profile proxies get the same treatment in the chain runtime: a

• subscription that omits the key leaks the same way and never reaches the node

• library. Only the fifteen types the core actually reads the key for; hysteria,

• hysteria2, tuic and shadowquic set UDP in Base themselves, http and ssh are

• always false. The default is applied before the overlay merge, so an explicit

• udp: false and an explicit removal both still win.

• A server that cannot carry UDP now fails to dial instead of quietly going

• direct, which is the failure this needs.

• Drop the plain udp flag from the relay-hop compatibility check. It is the

• default now and carries no signal; leaving it in would have put a warning on

• every multi-hop chain, and setup.dart logs each one on every apply.

• Hide the strict-route switch on macOS. sing-tun implements it in tun_linux.go

• as unreachable rules and in tun_windows.go as WFP filters; tun_darwin.go never

• reads the field. The switch and its description promised a protection that does

• not exist there. The field, the bridge and the config writer stay - they are

• real on the other two desktops.

• Turn the tun switch back off when authorization fails. The state stayed at

• unauthorized, _getEffectiveTunEnable rewrote tun.enable to false for the core,

• and the switch kept showing on: the user believes traffic is going through the

• virtual adapter while only the system proxy is running. Log it too, because the

• state was otherwise invisible from outside the process. Authorization is still

• asked for once per app lifecycle.

• Stop escaping spaces in checkIsAdmin's core path. It goes to Process.run as an

• argv element, not through a shell, so an escaped path makes stat miss the file

• and the app reports itself as unauthorized.

• Verified on device: importing a share link without a udp parameter now stores

• udp: true, while nodes imported before this change still have the key absent.

• For anyone reading the 1.0.4 notes: "stop DNS and WebRTC leaking the real

• address" was wrong about WebRTC. strict-route is a no-op on macOS and the leak

• had a different cause entirely. The IPv6 takeover and fake-ip-range6 changes

• from that release are unrelated and still stand.

• Co-Authored-By: Claude Opus 5 noreply@anthropic.com

• Claude-Session: https://claude.ai/code/session_01NSAj59bHG8PDrWLncUW8fC

Download based on your OS:

OS	Download
Android
Windows
macOS
Linux