Highlights
- Preserves TCP half-close end to end: applications can finish uploads and continue reading complete responses across Freedom, VLESS, Trojan, VMess, Shadowsocks, SOCKS, HTTP, TLS, REALITY, and Vision paths.
- Adds opt-in negotiated logical half-close for Xray-to-Xray SMUX while retaining byte-identical legacy behavior and automatic fallback for sing-box and Mihomo.
- Hardens terminal payload and EOF handling in buffered readers and chained or masked connection wrappers.
Fork fixes
- Fixed the common upload-EOF lifecycle bug where successful copy completion did not propagate CloseWrite to the next TCP boundary. EOF-dependent origins could wait until the inactivity timeout and their late responses were then truncated with EOF or reset.
- Added explicit half-close propagation to Freedom, VLESS, Trojan, classic Shadowsocks, SOCKS, HTTP/1 CONNECT, HTTP/2 request bodies, VLESS encryption/statistics wrappers, chained CNC connections, and supported TCP header/final-mask wrappers.
- Made Vision select raw FIN only after the uplink writer has atomically completed its direct-copy transition, avoiding an early FIN race across the TLS/VLESS boundary.
- Fixed BufferedReader so payload returned with EOF or another terminal error is delivered before the deferred error across Read, ReadByte, ReadAtMost, and WriteTo.
- Added SMUX carrier version 2 capability negotiation and negotiated command 4 for directional write-close. Legacy command 1 remains a full logical-stream close.
- Added bounded auto downgrade on a fresh carrier and sticky per-client capability caching. Completed half-closed requests are not replayed after a carrier read failure.
Upstream changes
Merged the latest upstream/main dependency maintenance:
- github.com/stretchr/testify 1.12.1
- google.golang.org/grpc 1.83.1
- github.com/miekg/dns 1.1.73
- github.com/pion/stun/v3 3.1.7
Compatibility notes
- SMUX logicalHalfClose accepts off, auto, or require.
- The default is off: existing v0/v1 carrier bytes, command-1 semantics, and sing-box/Mihomo interoperability are unchanged.
- auto negotiates the Xray extension and opens one fresh legacy carrier when the peer does not support it. require rejects downgrade.
- H2MUX keeps its native request-body half-close path and does not accept the SMUX-only option.
- REALITY client-version bounds remain operator-configurable with no implicit minimum when omitted.
Validation
- 7-protocol TCP half-close process matrix, five runs: all passed.
- TLS/REALITY x no-flow/Vision process matrix, five runs: all passed.
- Negotiated SMUX TLS/REALITY x padding off/on plus automatic sing-box/Mihomo fallback, five runs: all passed.
- Ordinary Xray/sing-box/Mihomo SMUX and H2MUX interoperability: passed.
- Unit, race, strict checkptr, vet, Linux/amd64 static build, and protobuf/config gates: passed.
- All process gates preserved the active NetBird and Mihomo service PIDs and states.