v0.5.0

Added

• Show the generated WireGuard client profile as an importable QR code in the empty TUI and authenticated web GUI, and at terminal startup.
• Add versioned native sessions, HAR import/export, curl and raw HTTP export, default secret redaction, and body truncation metadata.
• Add shared boolean flow filters, decoded content-aware body views, and lossless text/hex request-body editing across the TUI, web GUI, and REST API.
• Add privilege-free WireGuard, SOCKS5, UDP DNS, and fixed-target raw UDP modes, raw TCP observation, and upstream HTTP CONNECT/SOCKS5 chaining.
• Add lossless structured Protobuf wire-field and MessagePack JSON editors in the TUI and web intercept flows.
• Add declarative local/remote maps, redirects, mocks, and request-header rules.
• Add a bearer-token headless API for sessions, filtering, content, replay, clearing traffic, and intercept decisions.
• Add automatic Lua hot reload, optional WebSocket frame modification, and an isolated Chromium-family proxy profile launcher.
• Add versioned Lua addon manifests, complete SHA-256 package verification, safe atomic local installation, catalog discovery, and CLI inspect/verify/install/list/select workflows.

Changed

• Use the Android-compatible proxelar-wg.conf client-profile name instead of a tunnel name longer than WireGuard's 15-character limit.
• Restore proxyapi's #![forbid(unsafe_code)] guarantee by removing the unsafe native-Lua-module runtime and its separate Windows distribution; Lua addons remain portable and pure Lua.
• Use distinct ECDSA private keys for generated leaf certificates instead of reusing the root CA key.
• Reconcile stale transfer/content encoding headers and Content-Length after intercepted or replayed body edits.
• Produce SHA-256 checksums, SPDX SBOMs, and GitHub provenance attestations for release artifacts.
• Document the session compatibility policy, capture topology, architecture, and security threat model.

Fixed

• Keep web GUI credentials out of query strings and downloadable assets by exchanging a URL-fragment bootstrap token for an HttpOnly, SameSite=Strict session cookie.
• Detect extension HTTP methods such as PROPFIND when classifying inspected streams.