v1.3.18 — refresh over VPN + installer taskbar fix

Stable release: refresh over VPN + installer taskbar fix

Promotes v1.3.18.1-beta after successful Steam Deck testing with no regressions. Adds update servers while the VPN is connected (the long-requested #13 catch-22 for geo-blocked users) and fixes the installer hiding buttons under the taskbar (#12).

Thanks again to everyone who tested the betas — especially the on-device verification of the zero-drop reload.

Added

• Update servers while the VPN is connected (#13). Pressing the ↻ refresh button while connected now downloads the subscription through the active tun0 and hot-applies the new servers immediately with no VPN drop. sing-box reloads via its Clash-compatible control API (PUT /configs?force=true on 127.0.0.1:16756) without tearing down the TUN interface — verified on sing-box 1.13.1, tun0 stayed UP across the reload. This finally solves the geo-blocked catch-22 (a subscription that is only reachable through the VPN itself): you can refresh it while the VPN is up and the new servers take effect right away. The toast reports the real status: “Servers updated and applied: N” when applied live, “Servers updated: N” when applied offline.
• Rollback safety. The previous current-config.json is backed up before the reload. If the Clash reload fails or tun0 drops, the backup is restored and reloaded so the active session keeps working — toast: “Update downloaded, but hot-reload failed — reverted to the previous config.”

Fixed

• Installer no longer hides buttons under the taskbar (#12). On SteamOS, Gdk.Monitor.get_workarea() returns the full screen (the compositor does not expose panel positions to clients), so neither workarea-based sizing nor maximize() alone can keep the window clear of a taskbar on an arbitrary side. The Already-Installed window’s Reinstall/Uninstall radio list is now wrapped in a ScrolledWindow, so Next/Cancel stay reachable at the bottom of the window regardless of which side the panel is on. Both windows are also maximize()d so KWin places them inside its real work area when it can.

Preserved

• v1.3.17’s server-selector pills, the v1.3.16 HTTPS subscription-download fix (SteamOS CA bundle), the controller-first Focusable focus highlight, and all SteamOS authorization fixes for DNS/domain/default-route changes after reinstall or reboot.

⚠️ Requires Decky Loader 3.2.6+ — v1.3.16+ uses the Decky Focusable component for gamepad focus, which is undefined on Decky 3.2.3 and crashes the QAM with React error #130. If you’re on Decky 3.2.3, update Decky first, then install this release.

Install (from Konsole, Desktop Mode)

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.18.bin \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.18/Hiddify-linux-x64-v1.3.18.bin
chmod +x Hiddify-linux-x64-v1.3.18.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.18.bin

Manual plugin-only install (debug):

cd ~/Downloads
curl -L -o decky-hiddify-v1.3.18.zip \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.18/decky-hiddify-v1.3.18.zip
sudo rm -rf /home/deck/homebrew/plugins/decky-hiddify
sudo unzip -o decky-hiddify-v1.3.18.zip -d /home/deck/homebrew/plugins/
sudo systemctl restart plugin_loader

Assets

• Hiddify-linux-x64-v1.3.18.bin — full installer
• decky-hiddify-v1.3.18.zip — Decky plugin bundle (manual/debug install)

v1.3.18.1-beta — hot-apply ↻ over an active VPN (zero drop)

v1.3.18.1-beta — hot-apply ↻ over an active VPN (zero drop)

Beta build for on-device testing. Final piece for #13: refreshing a subscription now applies the new servers to the running VPN immediately, with no VPN drop, while keeping the geo-blocked catch-22 fix from v1.3.18-beta.

What's new

• ↻ now hot-applies while the VPN is on. Pressing the refresh button while connected downloads the subscription through the active tun0, parses it, rebuilds current-config.json, and hot-reloads the running sing-box via its Clash-compatible control API (PUT /configs?force=true on 127.0.0.1:16756). Verified on sing-box 1.13.1: tun0 stays UP across the reload — the box is re-created in-process without tearing down the TUN interface, so the active session switches to the fresh servers immediately. The toast reports the real status: “Servers updated and applied: N” when applied live, “Servers updated: N” when applied offline.
• Rollback safety. The previous current-config.json is backed up before the reload. If the Clash reload fails or tun0 drops, the backup is restored and reloaded so the active session keeps working — toast: “Update downloaded, but hot-reload failed — reverted to the previous config.”
• Preserves #12 from v1.3.18-beta (installer Already-Installed window wrapped in a ScrolledWindow, so Next/Cancel stay reachable with a taskbar on any side — SteamOS get_workarea() returns the full screen, so size-based adaptation alone can't help).

Why Clash API instead of gRPC Stop+Start

The earlier deferred-apply (v1.3.18-beta) was the safe default because the alternative — Core.Stop then Core.Start via gRPC — tears down tun0 and recreates it (a 2–5 s drop), and if the fresh config is broken the VPN can't come back, which is worst-case for a geo-blocked user whose subscription is only reachable through the VPN. The Clash API PUT /configs reloads the box without recreating the TUN interface, so there's no drop and no “can't reconnect” trap — it's the zero-risk way to apply a refresh live. On-device testing confirmed tun0 stayed UP 172.19.0.1 across two consecutive reloads.

Verified on a Steam Deck (Decky Loader 3.2.6, sing-box 1.13.1)

• ↻ with VPN on: apply_now=True, downloaded=True (271 bytes via tun0), tls_verified=True, Clash PUT /configs → HTTP 204, tun0 stayed UP 172.19.0.1 across the reload, applied=True. Two consecutive refreshes, both zero-drop. current-config.json rewritten; backup retained for rollback.

⚠️ Requires Decky Loader 3.2.6+ — v1.3.16+ uses the Decky Focusable component for gamepad focus, which is undefined on Decky 3.2.3 and crashes the QAM with React error #130. If you're on Decky 3.2.3, update Decky first, then install this beta.

Install (from Konsole, Desktop Mode)

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.18.1-beta.bin \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.18.1-beta/Hiddify-linux-x64-v1.3.18.1-beta.bin
chmod +x Hiddify-linux-x64-v1.3.18.1-beta.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.18.1-beta.bin

Manual plugin-only install (debug):

cd ~/Downloads
curl -L -o decky-hiddify-v1.3.18.1-beta.zip \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.18.1-beta/decky-hiddify-v1.3.18.1-beta.zip
sudo rm -rf /home/deck/homebrew/plugins/decky-hiddify
sudo unzip -o decky-hiddify-v1.3.18.1-beta.zip -d /home/deck/homebrew/plugins/
sudo systemctl restart plugin_loader

⚠️ Pre-release for testing. Please report how ↻ feels while the VPN is connected (does the subscription update, does the toast say "applied", does the VPN stay up with no drop?) before this is promoted to a stable v1.3.18.

Assets

• Hiddify-linux-x64-v1.3.18.1-beta.bin — full installer
• decky-hiddify-v1.3.18.1-beta.zip — Decky plugin bundle (manual/debug install)

v1.3.18-beta — refresh over VPN + installer taskbar fix

v1.3.18-beta — refresh over VPN + installer taskbar fix

Beta build for on-device testing. Two fixes for issues reported in #12 and #13.

What's new

• Update servers while the VPN is connected (#13). Pressing ↻ no longer blocks when the VPN is running. The plugin downloads the subscription through the active tun0 (exactly what geo-blocked users need — a subscription that is only reachable via the VPN itself), parses it, and saves the refreshed servers to configs/<id>.json + bumps the profile last_update. The running session is not dropped or mutated — current-config.json is rebuilt only when the VPN is stopped, and start_vpn already applies the fresh config automatically on the next start. The toast now reports status clearly: “Servers updated: N · saved (applies on next VPN start)” when deferred, replacing the old “Stop VPN before updating” / “restart VPN to apply” wording that read as an instruction to turn the VPN off.
• Installer no longer hides buttons under the taskbar (#12). On SteamOS, Gdk.Monitor.get_workarea() returns the full screen (the compositor does not expose panel positions to clients), so neither workarea-based sizing nor maximize() alone can keep the window clear of a taskbar on an arbitrary side. The Already-Installed window’s Reinstall/Uninstall radio list is now wrapped in a ScrolledWindow, so Next/Cancel stay reachable at the bottom of the window regardless of which side the panel is on. Both windows are also maximize()d so KWin places them inside its real work area when it can.

The backend contract is unchanged — refresh_profile(id) still returns {success, message, server_count, selectable} and now also applied (true when the live config was rebuilt, false when deferred until the next VPN start).

Verified on a Steam Deck (Decky Loader 3.2.6)

• Refresh over active VPN: downloaded=True, tls_verified=True, profile config rewritten, DB last_update updated, tun0 stayed up, applied=false.
• Installer Already-Installed window renders correctly with a taskbar on any side; the radio list scrolls and Next/Cancel are always reachable.

⚠️ Requires Decky Loader 3.2.6+ — v1.3.16+ uses the Decky Focusable component for gamepad focus, which is undefined on Decky 3.2.3 and crashes the QAM with React error #130. If you’re on Decky 3.2.3, update Decky first (Decky Loader → Updates, or re-run the official installer), then install this beta.

Install (from Konsole, Desktop Mode)

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.18-beta.bin \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.18-beta/Hiddify-linux-x64-v1.3.18-beta.bin
chmod +x Hiddify-linux-x64-v1.3.18-beta.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.18-beta.bin

Manual plugin-only install (debug):

cd ~/Downloads
curl -L -o decky-hiddify-v1.3.18-beta.zip \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.18-beta/decky-hiddify-v1.3.18-beta.zip
sudo rm -rf /home/deck/homebrew/plugins/decky-hiddify
sudo unzip -o decky-hiddify-v1.3.18-beta.zip -d /home/deck/homebrew/plugins/
sudo systemctl restart plugin_loader

⚠️ Pre-release for testing. Please report how ↻ over a connected VPN feels (does the subscription update, does the toast read clearly, does the VPN stay up?) and whether the installer window fits your taskbar layout before this is promoted to a stable v1.3.18.

Assets

• Hiddify-linux-x64-v1.3.18-beta.bin — full installer
• decky-hiddify-v1.3.18-beta.zip — Decky plugin bundle (manual/debug install)

v1.3.17 — server selector pills + refresh warning

Stable release: Game Mode server selector polish

Promotes v1.3.17-beta after a day of Steam Deck testing with no regressions. Reworks the Game Mode server selector to match the profile row and fixes two UX issues.

Thanks again to @SRMUFA01 — this release resolves the off-style server layout you flagged in #8.

Changed

• Server selector → profile-style pills. The server list used stock Decky ButtonItem, which left a strong empty offset on the left (the "old design" in #8). It now uses the same compact Focusable pills as the profile row — green active dot, white active pill, gamepad focus highlight, Hiddify default · auto plus one pill per server with a type badge.

Fixed

• Refresh warning while VPN is on. Pressing ↻ while connected now shows a toast — "Turn the VPN off first, then update the server list" — instead of silently doing nothing; the button keeps its inactive look.
• Duplicated toasts/actions. Decky Focusable fires both onActivate and onClick on one gamepad press, so refresh / switch-profile / switch-server ran twice. Added a per-control dedupe guard.

The backend contract is unchanged — server pills call the same switch_server(id, "auto"|"manual", tag), and the v1.3.16 HTTPS subscription-download fix is preserved.

Install (from Konsole, Desktop Mode)

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.17.bin \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.17/Hiddify-linux-x64-v1.3.17.bin
chmod +x Hiddify-linux-x64-v1.3.17.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.17.bin

Tip: after downloading, verify the file is complete with
sha256sum ~/Downloads/Hiddify-linux-x64-v1.3.17.bin — it should match the hash below.

Assets

• Hiddify-linux-x64-v1.3.17.bin — full installer (Desktop GUI + Decky plugin + CLI + SteamOS auth rules) · sha256 17a90b1761c1dc4d13f5bbb439ba68b3b63fc3a7fe92cf6aec2fab85f55224d9
• decky-hiddify-v1.3.17.zip — Decky plugin bundle (manual/debug install) · sha256 cd6b0ad9d86af944cb2fb05f7f94c66ac37f9dcec8bed07fa5139cc7913bc699

v1.3.17-beta — server selector pills + refresh warning

v1.3.17-beta — Game Mode server selector polish

Beta build for on-device testing. Reworks the Game Mode server selector to match the profile row and fixes two UX issues.

What's new

• Server selector → profile-style pills. The server list used stock Decky ButtonItem, which left a strong empty offset on the left (the "old design" @SRMUFA01 showed in #8). It now uses the same compact Focusable pills as the profile row — green active dot, white active pill, gamepad focus highlight, Hiddify default · auto plus one pill per server with a type badge.
• Refresh warning while VPN is on. Pressing ↻ while connected now shows a toast — "Turn the VPN off first, then update the server list" — instead of silently doing nothing. The button keeps its inactive look.
• Fixed duplicated toasts/actions. Decky Focusable fires both onActivate and onClick on one gamepad press, so refresh / switch-profile / switch-server ran twice. Added a per-control dedupe guard.

The backend contract is unchanged — pills call the same switch_server(id, "auto"|"manual", tag), and the SSL subscription-download fix from v1.3.16 is preserved.

Install (from Konsole, Desktop Mode)

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.17-beta.bin \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.17-beta/Hiddify-linux-x64-v1.3.17-beta.bin
chmod +x Hiddify-linux-x64-v1.3.17-beta.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.17-beta.bin

⚠️ Pre-release for testing. Please report how the new server pills, the ↻ warning, and gamepad navigation feel before this is promoted to a stable v1.3.17.

Assets

• Hiddify-linux-x64-v1.3.17-beta.bin — full installer
• decky-hiddify-v1.3.17-beta.zip — Decky plugin bundle (manual/debug install)

v1.3.16 - Game Mode subscription refresh (#8)

Game Mode subscription refresh — update your servers without leaving Steam

This release adds a server update button to the Decky plugin, implementing the feature requested in #8.

Huge thanks to @SRMUFA01 for filing the request with a clear HAPP example, and for the continued Steam Deck testing. 🙌

⭐ New: refresh subscription from Game Mode (#8)

• New circular ↻ refresh button next to each remote profile. It re-downloads the latest subscription and rebuilds the server list without leaving Game Mode — handy when your VPN starts to slow down and you just want fresh servers.
• The button appears only for remote (subscription) profiles, and is disabled while the VPN is connected so it never mutates a live config.

🔒 Fixed: HTTPS subscription download (CERTIFICATE_VERIFY_FAILED)

• Decky runs the plugin on its own bundled Python, which did not resolve the SteamOS system CA store — so HTTPS subscription downloads failed TLS verification.
• The plugin now loads the SteamOS CA bundle explicitly, so subscriptions verify correctly. Verified on-device: downloaded=True · tls_verified=True.

🎮 Fixed: controller focus highlight

• Custom Game Mode controls (the ↻ button and the profile pill) now show a clear focus highlight when selected with the D-pad / stick (border + glow + slight scale), so it's obvious which control is active. Touch input keeps working too.

Under the hood

• Works around HiddifyCli parse <URL> treating the URL as a local path by downloading the subscription to a temp file first, then parsing it.
• Subscription source is redacted as <SUBSCRIPTION> in logs.
• Preserves all prior fixes: first-start config rebuild, Desktop runtime/TUN cleanup on start, IPv6 disable on tun0, server selection for multi-server profiles, and the SteamOS polkit/sudoers rules so DNS/route changes never prompt for a password.

---

What this is

Hiddify for Steam Deck is a SteamOS VPN setup that works in both Game Mode and Desktop Mode — useful when internet access is blocked, filtered, or unstable and you want your Deck to keep working through a VPN without leaving Game Mode. It combines the Hiddify desktop client for profile management with a Decky Loader plugin for Game Mode connect/disconnect, profile switching, server selection, and now subscription refresh. Supports VLESS, Reality, VMess, Trojan, Shadowsocks, Hysteria2, and TUIC profiles via Hiddify/sing-box.

Install (from Konsole, Desktop Mode)

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.16.bin \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.16/Hiddify-linux-x64-v1.3.16.bin
chmod +x Hiddify-linux-x64-v1.3.16.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.16.bin

After installing, open the Hiddify VPN plugin in Game Mode, and use ↻ next to a remote profile to pull fresh servers.

Assets

• Hiddify-linux-x64-v1.3.16.bin — full installer (Desktop GUI + Decky plugin + CLI + SteamOS auth rules)
• decky-hiddify-v1.3.16.zip — Decky plugin bundle (debug/manual install only)

v1.3.15.3 - SteamOS auth prompt hotfix

Hotfix

This release fixes the repeated SteamOS authorization dialogs after reinstall/reboot:

• Authentication is required to set domains.
• Authentication is required to set default route.
• Authentication is required to set DNS servers.

Fixed

• Installer now writes the Hiddify polkit rule to both /etc/polkit-1/rules.d and /usr/share/polkit-1/rules.d when possible.
• Polkit permissions now include both org.freedesktop.resolve1.* and org.freedesktop.network1.* DNS/domain/default-route actions.
• Decky plugin re-applies the same expanded polkit rules on load and restarts polkit after writing them.
• Bundled Decky plugin is v1.3.15.3 and still includes package.json.

Checksums

• Hiddify-linux-x64-v1.3.15.3.bin: d9e426b6e9d275697119134861097ba9d4856162eb375700edec3b9f6a968832
• decky-hiddify-v1.3.15.3.zip: 259becc94857c824a0ec9b82bbeb8d177dd1db82654711b081bf69ebbc8b3e07

Install

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.15.3.bin https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.15.3/Hiddify-linux-x64-v1.3.15.3.bin
chmod +x Hiddify-linux-x64-v1.3.15.3.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.15.3.bin

v1.3.15.2 - Installer uninstall menu hotfix

Hotfix

Thanks to @SEVENID for reporting #7. The previous v1.3.15.1 installer package was built with the clean-install entrypoint, so running the .bin again could immediately start a clean reinstall instead of showing the documented reinstall/uninstall menu.

Fixed

• Rebuilt the installer with setup.sh as the Makeself entrypoint.
• Running the .bin again now shows the menu with Reinstall / Update and Uninstall completely.
• The bundled Decky plugin archive is included as v1.3.15.2 and still contains both plugin.json and package.json.

Checksums

• Hiddify-linux-x64-v1.3.15.2.bin: 57dfd0b43935fad6b2c8ed13eb7d8ac67a40ae219790519640df2e649433ca5c
• decky-hiddify-v1.3.15.2.zip: 3a68e005a3a39a351c2b7e707c2cc24ba010fdb24eecf22535f0affb8b1d8fab

Install

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.15.2.bin https://github.com/denmrnngp-cloud/hiddify-steam-deck-vpn/releases/download/v1.3.15.2/Hiddify-linux-x64-v1.3.15.2.bin
chmod +x Hiddify-linux-x64-v1.3.15.2.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.15.2.bin

v1.3.15.1 - Reboot autostart hotfix

Hotfix: prevent VPN autostart after Steam Deck reboot

This hotfix addresses issue #5 reported by @SRMUFA01:
#5

Thank you @SRMUFA01 for the fast logs and clear reproduction steps.

Fixed

• Fixed VPN starting automatically after Steam Deck reboot.
• The Hiddify systemd service is now installed as manual-start only.
• The Decky plugin no longer runs systemctl --user enable hiddify on plugin load.
• stop_vpn() now also runs systemctl --user disable hiddify, so older installs upgraded from v1.3.15-test or v1.3.15 have their legacy autostart symlink removed.
• The installer now disables old autostart state while keeping manual start through the Decky plugin and systemctl --user start hiddify.
• Improved plugin zip verification so package.json checks do not fail falsely under pipefail.

Preserved

• Game Mode server selector for multi-server profiles.
• Single-server profile behavior.
• Manual server mode.
• Hiddify default mode with balancer-strategy: round-robin.
• Multi-server VLESS Game Mode startup fix.

Install from Konsole

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.15.1.bin \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck/releases/download/v1.3.15.1/Hiddify-linux-x64-v1.3.15.1.bin
chmod +x Hiddify-linux-x64-v1.3.15.1.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.15.1.bin

Manual plugin install (debug only)

cd ~/Downloads
curl -L -o decky-hiddify-v1.3.15.1.zip \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck/releases/download/v1.3.15.1/decky-hiddify-v1.3.15.1.zip
sudo rm -rf /home/deck/homebrew/plugins/decky-hiddify
sudo unzip -o decky-hiddify-v1.3.15.1.zip -d /home/deck/homebrew/plugins/
sudo systemctl restart plugin_loader

v1.3.15 - Game Mode server selection

Stable release: Game Mode server selection and multi-server VLESS fix

This stable release promotes v1.3.15-test after successful Steam Deck testing by @SRMUFA01.

Thank you @SRMUFA01 for detailed logs, screenshots, fast retesting, and confirming that:

• multi-server VLESS connects in Game Mode;
• server switching works;
• switching connection types works;
• single-server profiles continue to work.

New functionality

• Added Decky plugin server selector for VPN profiles with multiple real selectable servers.
• Hidden server selector for single-server profiles.
• Added Manual server mode.
• Added Hiddify default mode with balancer-strategy: round-robin.
• Added per-profile server memory outside the Hiddify database.
• Hidden internal/generated outbounds from UI: select, balance, lowest, direct, block, dns.
• Game Mode runtime config can now be built for the selected server only.
• Decky/systemd now starts HiddifyCli with -d decky-hiddify-settings.json.

Fixed

• Fixed multi-server VLESS Game Mode startup failure caused by unknown load balance strategy:.
• Preserved previous fixes: duplicate tags, reserved tags, first-start rebuild, TUN cleanup, and package.json inside the plugin zip.

Install from Konsole

cd ~/Downloads
curl -L -o Hiddify-linux-x64-v1.3.15.bin \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck/releases/download/v1.3.15/Hiddify-linux-x64-v1.3.15.bin
chmod +x Hiddify-linux-x64-v1.3.15.bin
bash ~/Downloads/Hiddify-linux-x64-v1.3.15.bin

Manual plugin install (debug only)

cd ~/Downloads
curl -L -o decky-hiddify-v1.3.15.zip \
  https://github.com/denmrnngp-cloud/hiddify-steam-deck/releases/download/v1.3.15/decky-hiddify-v1.3.15.zip
sudo rm -rf /home/deck/homebrew/plugins/decky-hiddify
sudo unzip -o decky-hiddify-v1.3.15.zip -d /home/deck/homebrew/plugins/
sudo systemctl restart plugin_loader