Aether Desktop 1.3.0 — Release notes

What's new in 1.3.0

The app version stays 1.3.0. This release brings three features over from Aether for Android 1.5.0 — Custom configs, Zero Trust sign-in and the redesigned LAN share — with the same behaviour and wording as on the phone, and bundles the unmodified Aether Core 2.3.0. Android's phone hotspot share mode is intentionally not part of the Windows edition. Saved profiles and the chosen backend are kept.

Custom configs (new, off by default)

Ported from Aether for Android 1.5.0. Settings → Custom configs. While the switch is off (the default) nothing changes: the six existing modes, profiles and the engine behave exactly as before.

• What you can import. Share links vless://, vmess://, trojan://, ss://, socks:// / socks5://, wireguard:// / wg://; a full Xray JSON config (any outbound Xray supports, e.g. Hysteria2, XHTTP, Reality); Base64 or plain subscription text; a subscription URL (https:// only, at most 5 redirects, 2 MB, 20 s; when connected it is fetched through the tunnel); and NapsternetV / Npv Tunnel .npvt files.
• How you import. Paste into the box and press Import, pick a file, or drag a file onto the drop zone. There is no QR scanning on Windows (no camera path in the desktop app); paste the link instead.
• .npvt locks are respected. The file is decoded byte-for-byte like Android. A config locked to another device, an expired one, or one marked mobile only is rejected with a clear reason; a password-protected file asks for its password. A locked config's raw link is never shown, copied or edited.
• Saved list. Select, rename, edit (unlocked only), copy link, delete, and a separate Delete all configs. The list is sealed with Windows DPAPI (custom_configs.bin in the data folder); the web UI never sees the raw outbound.
• 15 chain modes. The config can run alone, in front of, or behind the existing engines:

• Connection card. The protocol tile shows the real chain, e.g. VLESS → Tor or Tor → Psiphon → Trojan, and is shortened to fit (transport names such as MASQUE, WireGuard, Gool, MIM).
• Xray core v25.12.8, bundled as engine\xray\xray.exe (x64 and x86 zips and binaries pinned by SHA-256 in scripts/stage-xray.ps1). Version 26 rejects allowInsecure and the mKCP seed, which many existing configs and older .npvt files still use, so the app stays on 25.12.8 like Android.
• The Config → Tor fix. Client-side sniffing is disabled in every generated config, and the hop that carries tor.exe splits Tor's ClientHello into small TLS records so that the server's sniffer cannot replace the relay address with Tor's fake SNI either (details below); unit tests lock this for all three positions.
• Safety. xray runs as a hidden child in the app's Job Object (killed with the app), listens on loopback only, gets a config file that is deleted when it stops, and is restarted at most 5 times. DNS stays inside the tunnel; when xray dials through the engine or Tor the server name is passed unresolved. The leak guard only opens the extra egress xray needs while a custom config runs. Split tunnelling stays off by default and the MTU default stays 1280.

Custom configs: chain and ping fixes (1.3.0)

• Config → Psiphon now goes through the config. Psiphon was started without an upstream, so it dialled directly and the chain had "no tunnel underneath it". It now gets the config's local SOCKS port (AETHER_UPSTREAM); the log shows psiphon dials out through the upstream proxy.
• Psiphon WSAEACCES (10013). Psiphon → Config purges stale Aether firewall rules left by an earlier crash before it starts, and the egress filter lets the Psiphon/xray hop out. If Windows still answers forbidden by its access permissions, the app logs once which rule or profile (BlockOutbound) blocks it and what to do.
• Correct pipeline label. The log shows the real chain, e.g. Pipeline: Config → Psiphon (custom config chain), instead of the base mode name.
• Slow hops. Xray timeouts for chains are handshake 30 s, idle 1800 s, uplink 10 s, downlink 30 s. When the config is the exit behind Tor/Psiphon, Mux (8 streams) is enabled; it is never used for XTLS Vision (flow), WireGuard or Hysteria.
• Real ping. Each saved config has a Ping button and the list has Test all. The test runs the config in a temporary loopback-only xray (password-protected SOCKS, up to 32 configs per run) and fetches generate_204. Results: a delay in ms, or -1 with No response, Server off, Filtered, Invalid config or No network.
• Diagnostics ping. DoH / TLS checks always verify the certificate and the host name (no danger_accept_invalid_hostnames).
• Privacy in logs. Server addresses, host names, IPv6 and UUIDs from xray output are masked (1.2.x.x, <host>, <uuid>). Subscriptions are fetched through the tunnel when connected.
• Clean paste. Invisible characters (RLM/LRM, BOM, bidi marks, NBSP) that Telegram adds to copied links are removed on paste, import and subscription download.
• Leftovers from 1.2.5. scripts/clean-legacy-1.2.5.py removes files from 1.2.5 that no longer belong (old scripts, stale web bundles, files in native/aether not in UPSTREAM-SHA256SUMS); CI runs it before the core pristine check.

Custom configs: chain, label and speed fixes (this build)

Measured against Aether for Android 1.5.0, which uses the same method; healthy chains (Config, Config → Aether, Aether → Config, Tor → Config, Config → Psiphon and the regular six modes) are unchanged.

• Config → Tor, Config → Tor → Aether, Config → Tor → Psiphon — root cause fixed. tor.exe sends a made-up SNI (www.<random>.com) in every relay handshake. Most config servers (3x-ui / Marzban default: sniffing with destOverride: tls) read that name, replace the relay's IP with a domain that does not exist and drop the link — unexpected eof while reading, TLS_ERROR, Tor stuck at 10 % or never finishing. Android avoids it with a patched Arti that sends no SNI (AETHER_TOR_LINK_SNI=off). Windows now does the equivalent inside Xray: the hop that carries tor.exe (tor-link) splits Tor's ClientHello into 100–200 byte TLS records before it enters the config, so the server's sniffer cannot read a name and keeps the real relay address. Tested here with Tor 0.4.9 through the two attached .npvt sample configs: Bootstrapped 100 % in 9–12 s and IsTor: true, where the same configs stalled at 10 % before.
• No bridge stall behind a config. These chains logged trying bridges and waited the 420 s bridge window although bridges are never used when Tor already leaves through the config. They now use the normal window, like Android.
• Faster Tor start. A chained tor.exe no longer parses the GeoIP files (about 7 s on the reported PC before Bootstrapped 0 %); no country option is used in those torrc files.
• Psiphon → Config. The app probed Psiphon's SOCKS port with a connect/close every 200 ms, and Psiphon logged socksPeekByte() failed: EOF five times a second. The port is now latched once it is seen open. Psiphon's own direct-dial failures (no route, i/o timeout) come from the network, not the app.
• Protocol names instead of "Config". After import, the chain list, the Settings row and the connection card name the real protocol — VLESS → Tor, Npvt → Aether, Tor → Aether(MASQUE) → Npvt — in English in both languages. .npvt configs show Npvt, other links their protocol (VLESS, VMess, Trojan, SS, SOCKS, WireGuard, Hysteria).
• Custom configs page redesigned like Android. The native drop-down is replaced by a chain row that opens a sheet of rounded cards: the chain in large type, Single · the config alone / Double chain / Triple chain under it, the selected card with a blue frame and a check mark (keyboard: arrows, Enter, Esc). Saved configs are separate rounded cards; the selected one has a blue frame and a check.
• Instant disconnect. Removing the firewall rules and restoring the policies now run in parallel instead of one netsh call after another, also when stale rules are purged before a connection.
• Less CPU, RAM and disk. A line repeated in a row (e.g. a child process looping on one error) is written twice and then counted — (previous line repeated N more times) — and the log flusher writes each batch in one call.

Security audit — Windows 1.3.0 compared with Android 1.5.0

Source-level review of this repository with the same ten areas and weights as the Android 1.5.0 audit (docs/SECURITY_AUDIT_1.5.0.md), plus the tests run for this build: 399 Rust unit tests on the Windows target (run under Wine), the frontend jsdom suites, cargo check --target x86_64-pc-windows-gnu --all-targets, and a real Tor bootstrap through the sample configs. It is not a penetration test; no leak test was run on Windows hardware.

The one point between the two comes from Windows-specific design (plaintext non-secret state, administrator rights, system proxy instead of a VpnService route), not from a known open vulnerability. No change in this build widens what leaves the machine: the Tor fix only changes how the ClientHello is cut into records inside the config's own tunnel.

Updating a repository that is still on 1.2.5

Extract the ZIP, open the Aether_Windows_V1.3.0 folder, select everything in it and copy it into the repository folder; when Explorer asks, choose Replace the files in the destination. Then Commit and Push in GitHub Desktop. Files of 1.2.5 that 1.3.0 no longer has (old scripts, old web bundles, native/aether/quiche/fuzz corpus folders, …) may stay in the repository: every CI job removes them first (scripts/clean-legacy-1.2.5.py), before any check or build. The five quiche/fuzz/mayhem/*/testsuite links of core 2.3.0 are left out of the ZIP on purpose: in 1.2.5 they are folders, and Explorer cannot put a file over a folder ("There is already a folder with the same name…"). They are fuzz-test links, unused by the build, and ignored by the core pristine check.

Zero Trust: sign in before you connect

• Sign in first. Settings → Zero Trust → Email code → Sign in opens a dialog: the code is sent to the e-mail address, you type it (three tries), Send a new code becomes available after 30 seconds, and every problem (wrong team, wrong address, expired or wrong code, no network) is explained in plain words.
• Sealed and visible. The sign-in is sealed with Windows DPAPI, bound to the team and the e-mail address, and the panel shows whether it is still valid and until when. Forget this sign-in removes it. The token never reaches the web UI.
• Code during connection. If the engine asks for an e-mail code while connecting, a dialog opens over any page. Not now stops that connection attempt instead of leaving it waiting.
• Membership. An enrolled device shows its membership with Remove this device’s membership (with confirmation, only while disconnected); the next connection enrols again.
• Service token and enrolment token. Service token → Test the service token runs the same exchange the engine uses, without saving anything. A pasted Access token (enrolment token) is checked on the spot (empty, malformed, expired, or valid with time left).

Share VPN on the local network

• Redesigned Share page. Live status (off, waiting for a network, ready, port busy), one Share on this network switch, a zero-leak badge, copyable SOCKS5 10810 / HTTP 10811 / address rows, the computer's other addresses, Copy all details, setup steps and the check address.
• Every real adapter. The share listens on every Wi‑Fi and Ethernet address of the computer (virtual adapters and Wi‑Fi Direct / hosted-network adapters are skipped) and follows network changes while connected.
• Optional username and password. Off by default, as on Android. When on, SOCKS5 (RFC 1929) and the HTTP proxy (Basic) require it. A strong password is generated; you can set your own username and password (at least 8 characters) or Generate a new password. Both are sealed with DPAPI and never shown on the share pages.
• http://aether.check/ from every path. Through the HTTP proxy, SOCKS5 or the PAC file, a shared device can open this address to see whether it is protected, which path it uses and the tunnel's exit IP.
• Setup page. http://<computer address>:10811/ gives bilingual (Persian/English) instructions, the PAC file (/proxy.pac, /wpad.dat), a live WebRTC leak test and one-click WebRTC locks for Windows, Firefox, macOS and Linux. The pages load nothing from the internet.
• Zero-leak guard. Shared devices cannot reach private or local addresses of the host's network, never receive Direct (bypass) rules, identifying proxy headers are removed, and UDP through SOCKS5 is offered only when the engine can carry it.

Core, routing and settings (carried over in 1.3.0)

• Aether Core 2.3.0, unmodified. All Tor modes use the bundled tor.exe; the protocol tile shows Tor → Psiphon instead of SMART. The Psiphon child is built from the compatible CluvexStudio commit 83aa73b9b982e7421e00117f5b0c5aceb5dda452 and receives the bundled server entries through AETHER_PSIPHON_SERVER_ENTRIES.
• DNS and routing. Bypass Iranian sites and Block ads and trackers are independent opt-in switches with bundled lists and a weekly refresh through the tunnel. Iranian hosts outside .ir are checked with DNS-over-HTTPS through the tunnel before going direct. In Aether → Psiphon and Tor → Psiphon, rules are applied at the local bridge.
• A working server is no longer thrown away. The app used to tell the engine to reuse the remembered server only if it answered faster than about 300 ms — and on the networks reports actually came from, nothing answers that fast, so the remembered server was discarded every time and each reconnect paid for a full scan. That check is now off by default, so a remembered server that answers is used, as the engine always did on its own. If you are on a fast connection and want the app to look for the best server, the switch Only reuse a fast endpoint is still under Transport & anti-DPI — with limits that now match real networks (2000 ms / 5000 ms direct, 1200 ms / 3500 ms chained).
• Your own ECH setting. If you have an ECHConfigList, you can paste it under Transport & anti-DPI instead of letting the app fetch one — useful where your network blocks exactly that default fetch. Pointing ECH at a different domain, as v2rayNG does, is not possible: the engine does not accept a domain there.
• Custom MTU in the range 1280–9000.
• AI and interface. The default model prefers Gemini 3.1 Flash-Lite when available; token limits are shown only when Google reports them. The connection card groups status, IP, time and traffic; settings use grouped cards and horizontal option tiles.
• Saved backend is kept. Aether is only the default for a new profile; restarting never replaces the user's choice.

Packaging

Outputs are x64/x86 .exe installers and x64/x86 portable .zip archives plus SHA256SUMS.txt; no .msi. The version is 1.3.0 in every manifest, and the CI preflight checks this. Real tunnel and network behaviour still needs testing on Windows.