Incognito-Coder/tx-ui v0.9.4

on GitHub

[v0.9.4] - 2026-10-23

🚀 Features & Enhancements

• AmneziaWG Protocol Support (AWG 3.1):

  • Native Runner & Kernel Integration: Added full support for AmneziaWG (AWG 3.1) inbounds and outbounds alongside WireGuard.
  • DPI-Resistant Obfuscation: Implemented configurable handshake obfuscation parameters (jc, jmin, jmax, s1, s2, s3, s4, h1, h2, h3, h4) designed to evade Deep Packet Inspection (DPI) while preserving high wire-speed performance.
  • Downloadable Client Configurations: Built one-click .conf file download generator creating complete [Interface] and [Peer] configuration profiles with custom DNS, MTU, client private keys, server public keys, and obfuscation parameters.
  • Mobile & Desktop Share Links: Added support for standard vpn:// (AmneziaWG format) and wireguard:// share links, client QR codes, and clipboard export.

• MTProto Proxy Integration with FakeTLS (mtg):

  • Integrated mtg Sidecar: Embedded process supervisor for mtg-multi (v1.16.0) across all Linux architectures (amd64, arm64, armv7, armv6, armv5, 386, s390x) and Darwin with automatic lifecycle and process monitoring.
  • FakeTLS Domain Camouflage: Built generator and validator for FakeTLS secrets (ee... / dd... + 32-hex secret + hex-encoded domain) enabling Telegram traffic to masquerade as standard TLS traffic to camouflage hosts (e.g., Cloudflare).
  • One-Click Telegram Connection Links: Direct tg://proxy and t.me/proxy link generation, interactive QR codes, and clipboard actions for seamless mobile integration.
  • Multi-Tenant User Accounting: Support for multiple Telegram clients under a single inbound with independent credentials, email identifiers, and status tracking.

• External Proxy Endpoint Application Across Client Configs & URIs:

  • Dynamic Ingress Endpoint Overrides: Extended streamSettings.externalProxy (dest, port, remark, forceTls, clientTlsSettings) to override client connection endpoints without changing local server listening ports.
  • WireGuard & AmneziaWG .conf Export: Configured external proxy host and port are automatically populated as Endpoint = dest:port in generated client .conf downloads, QR codes, and vpn:// / wireguard:// links.
  • Telegram Proxy Share Links: Applied external proxy host and port to tg://proxy?server=dest&port=port&secret=... links across frontend modals (inbound_info_modal.html, qrcode_modal.html, clients.html) and backend subscription services (subService.go, subJsonService.go).
  • Automated Unit Testing: Created comprehensive test suite in internal/sub/sub_external_proxy_test.go verifying endpoint overrides for AmneziaWG, WireGuard, and MTProto subscriptions and config downloads.

• Curve25519 Cryptographic Keypair Architecture:

  • RFC 7748 Standard Clamping: Implemented native GenerateWireguardKeypair(), DerivePublicKey(), and GenerateWireguardPSK() in internal/util/wireguard/wireguard.go.
  • Client Credential Decoupling: Fixed client private key generation for AmneziaWG and WireGuard to ensure standard 32-byte Base64-encoded Curve25519 keys are always produced, resolving issues where Trojan password strings were previously reused.
  • Automatic Public Key Derivation: Automatically calculates and validates the Curve25519 public key from the private key if omitted during client creation or update.

• Finalmask Obfuscation & Stream-Masking System Overhaul:

  • Modular Reusable Templates: Created stream_finalmask_fields.html consolidating shared mask components (xdnsDomains, noiseFields, fragmentFields, sudokuFields, filterFields, udpHopFields, headerCustomTcp, headerCustomUdp).
  • Inbound & Outbound Parity: Unified stream_finalmask.html, stream_settings.html, and outbound.html with support for all mask types across TCP and UDP (including filter IP ACLs, realm, and QUIC parameters for masque and hysteria).
  • Standalone QUIC Parameters: Fixed hasFinalMask and toJson in both inbound.js and outbound.js so QUIC parameters (congestion, brutal upload/download, window sizes) are saved and retained without requiring non-empty TCP/UDP mask arrays.
  • Core Compatibility & udpHop Migration: Stripped server-side quicParams.udpHop in GenXrayInboundConfig and BuildInboundConfig via xray.TakeUDPHop to prevent Xray-core rejection; transformed client udpHop to the required udphop UDP mask in subService.go and subJsonService.go.
  • Safe Client Distribution: Implemented getClientFinalMaskString and deep-cloning in subscription services to strip server-side filter IP ACLs and prevent leaking internal filters to client links.
  • Expanded Share Links: Added fm query/JSON export to VMess and Masque share links and link parsers.
  • Unit Test Coverage: Created xray/finalmask_test.go verifying TakeUDPHop, MoveUDPHopToMask, UpgradeXDNSMasks, and StripFilterMasks.

• Telegram Bot Multi-Protocol Credential Architecture:

  • Upgraded client addition handler in internal/web/service/tgbot.go to support Shadowsocks 2022 (correct key length calculation and generation), traditional Shadowsocks AEAD, Trojan, Hysteria (Auth), and Masque (MasquePass).
  • Synced client credential fields with database models and node client services.

• Bash Management Scripts & Aliases:

  • Command Alias: Added /usr/bin/tx-ui symlink in install.sh and x-ui.sh, allowing users to manage the panel using either tx-ui or x-ui.
  • Version Tag Normalization: Enhanced install.sh and legacy_version in x-ui.sh to automatically normalize version inputs with or without the v prefix.
  • Menu Option Range: Fixed main menu selection prompt and error validation in x-ui.sh from [0-25] to [0-26] to fully include Theme Management.
  • Branch Sync: Fixed uninstall script URL to use the main branch instead of deprecated master.