English

The reverse proxy for external HTTPS access actually works in this build. Requests from another machine on your network now terminate TLS at the desktop app and are forwarded to the local CPA kernel, including streaming responses. Certificate paths survive app restarts, saving a bad configuration no longer stops a proxy that was working, and the status page tells you the real address other devices should use instead of a generic wildcard.

If you hit problems, tell us on Discord or open an issue on GitHub.

Fixed

• External HTTPS access never actually answered clients: enabling the reverse proxy did not bind a listener, so connections to the advertised port refused even though the page said it was running. The proxy now binds the configured host and port, accepts TLS connections, forwards requests to the kernel over HTTP or HTTPS depending on the kernel's own TLS setting, and reports bind or certificate failures back to the page instead of leaving the toggle in a half-started state.
• Saving a bad configuration killed a working proxy: an invalid certificate path, a missing private key, an occupied port, or a failed write could stop the healthy listener and overwrite the saved good settings. Invalid or unsuccessful saves now leave the previous running configuration and saved file untouched, and Discard restores them.
• Restarting the app forgot the certificate paths: the PEM certificate and private key fields only lived in memory. They are now persisted and restored on startup so an enabled proxy comes back up with the same settings.
• Proxy status claimed the wrong lifecycle: the running flag reflected whether a start request was submitted, not whether the listener was actually bound. The page now reads the real state, shows the actual listening address and target, and a failed start leaves a readable error instead of a false Running state.
• Stopping could fail for irrelevant reasons: turning the proxy off was blocked by invalid draft values in unrelated port fields, and a failed config write could prevent the listener from actually shutting down. Disable now always releases the listener; saving a disabled draft keeps valid edits so you can stage settings before enabling, while an invalid draft still reports an error when the proxy is already stopped.
• Startup probe used the wrong address after hardening: when the proxy was enabled, the kernel was correctly restricted to loopback but the startup readiness check still probed the original LAN or IPv6 host, killing a healthy kernel after a timeout. The check now uses the effective generated configuration.
• Delayed restarts could revive a stopped proxy: a kernel start that waited on a shared lock could return a stale running=true status and bring the listener back after the kernel had been stopped. The restore path now checks the real process state before and after applying the saved config.
• Temporary accept errors shut the listener down permanently: a transient error such as file-descriptor exhaustion or an aborted connection exited the accept loop. These errors now retry with a bounded 50–200 ms backoff and only give up after ten consecutive failures.
• Custom target port was silently ignored: an explicit target port was overwritten by the kernel port at save and again at startup. A nonzero target is now preserved; target port 0 follows the kernel port, which remains the default.

Improved

• The access route is clearer about what to give clients: the wildcard bind address is labelled a draft preview, the running page shows the actual server LAN address and port to hand to clients, and the enable hint says the switch only takes effect after saving.
• PEM path inputs no longer trigger browser autofill: certificate and key fields opt out of the WebView autofill popup that was causing crashes on Windows, and invalid file selections surface as inline field errors instead of unhandled exceptions.
• The reverse proxy is exercised end-to-end in tests: the suite now covers plain and TLS kernel targets, native kernel TLS forwarding, kernel port changes, app restarts, manual kernel starts, streaming and non-streaming requests through a real kernel, and shutdown across normal and corrupt-config paths.

简体中文

这个版本修复了对外访问功能：HTTPS 反向代理现在真正能工作，局域网里其他设备请求会先到达桌面的 HTTPS 端口，再转发给只监听本机的内核，流式输出也是逐段返回的。证书路径在重启应用后不会丢，保存无效配置也不会把原本正在运行的反代弄停，页面会显示外部设备真正能用的地址，不再只给 0.0.0.0 这个占位符。

如果你在使用中遇到问题，请通过 QQ群 反馈，我们会尽快处理。

修复

• 对外访问根本没起来：之前开了反向代理但端口上并没有监听，客户端一连就被拒绝，页面却还显示"运行中"。现在监听会按配置的主机和端口真正建立，按内核是否开了 TLS 自动选 HTTP 或 HTTPS 转发，绑定或证书失败会写回页面，不会留下一个看起来已经启动但实际没工作的开关。
• 保存坏配置会把正常代理弄停：证书路径不对、私钥缺失、端口被占用、写配置失败，都可能把健康的监听停掉，还把已保存的好配置覆盖掉。现在校验或落盘失败都不会动正在运行的代理和磁盘上的配置，点"放弃修改"也能恢复原值。
• 重启后证书路径丢失：PEM 证书和私钥路径以前只在内存里，重启应用就清空。现在会写盘并在启动时回填，启用了的反代重启后仍按同样设置恢复。
• 运行状态是假的：原来的 Running 标志只代表发过一次启动请求，不代表监听真的建立。现在页面读的是真实状态，显示实际监听地址和目标端口，启动失败会留下可读错误而不是假 Running。
• 停用被无关的校验挡住：清空端口后想关代理反而被端口格式校验拦下；写配置失败还可能让监听明明关了却停不下来。现在停用一定能释放监听端口；代理已经停时，保存有效的新配置是允许的，但输入无效端口仍会报错。
• 加固后启动探测用错地址：反代启用后内核被限制到 127.0.0.1，但启动探测还在按原来的局域网或 IPv6 地址探测，健康内核会被误杀。现在探测用生成后的有效配置。
• 并发启停可能把代理复活：内核启动在等待锁时可能被另一个停止操作抢先，之后仍返回 running=true 并把监听拉回来。现在恢复前后都会核对真实进程状态，已停止的内核不会再把代理带回来。
• 临时 accept 错误会永久关掉监听：文件描述符耗尽或连接中止这类临时错误之前直接退出循环，要重启应用才能恢复。现在这类错误按 50–200ms 退避重试，连续十次失败才真正退出。
• 自定义目标端口被忽略：手动指定的目标端口在保存和启动时都会被内核端口覆盖。现在非零目标会保留，0 表示跟随内核端口，默认值不变。

优化

• 访问路径更清楚了：0.0.0.0 被标成监听绑定预览，运行中页面额外显示本机局域网地址和实际端口，提示你切换后要保存才生效。
• PEM 输入框不再触发浏览器自动填充：证书、私钥字段关闭了 WebView 的自动填充弹窗，这个弹窗在 Windows 上直接让应用崩溃；选错文件现在变成字段下方的行内错误。
• 补了真实链路测试：普通/启用 TLS 的内核、内核 TLS 转发、内核端口变化、应用重启、手动启动内核、经真实内核的流式和非流式请求、正常及损坏配置下的停用路径都覆盖到了。