Introduce gh_fetch() in both core_mgmt.uc and luci.homeproxy: tries
GitHub first, falls back to the mirror configured in
homeproxy.config.github_mirror only if GitHub fails — so a healthy
GitHub is never bypassed.
For APK signing key fetches (hiddify and zapret2), skip the download
entirely if the key is already present (pre-placed by a provisioning
tool or a prior install), use a short 20s timeout so a throttled
GitHub cannot hang the ubus call until timeout (exit 249), and fall
back to --allow-untrusted if the key fetch still fails rather than
blocking installation.
Update Yandex URLs in root/usr/share/rpcd/ucode/luci.homeproxy: replace https://www.yandex.ru with https://ya.ru in the switch-case mapping and in the conn_sites array to keep Yandex links consistent.
Expose UDP TPROXY nft chain counters to diagnostics and show them in the UI; rpcd ucode now collects lines from homeproxy UDP-related nft chains and returns them as udp_tproxy, and diagnostics.js renders that output. Update Zapret help text to note QUIC support (shorten previous comparison to ByeDPI) and update the Russian translation accordingly. Fix zapret preset picker in node.js by keeping a reference to the select element so applyPreset updates the UI selection when a preset is applied.
Introduce support for Zapret (nfqws2) across UI, RPC and core generation: add Zapret entries to client selector UI and AntiDPI status card, implement install/remove/status RPC hooks in the status view, and show kmod warnings. Diagnostics now resolve aggregate tags to configured nodes and can query a focused tag (used to show the active UDP node). generate_client.uc now treats Zapret like ByeDPI for secure-DNS detours and handles Zapret as a synthetic direct outbound with routing marks for main and UDP nodes. core_mgmt.uc avoids auto-selecting UPX-compressed builds on certain MIPS targets (UPX causes crashes) and produces clearer errors when space is constrained. Updated Russian translations for new strings.
Integrate Zapret (nfqws2) packet-level DPI-bypass: add UI options and warnings, diagnostics, backend detection, and documentation. Changes include frontend guards when NFQUEUE kernel module (kmod-nft-queue) is missing, diagnostics card entries and NFQUEUE counter listing, translated strings, and strategy attribution. The rpcd backend now detects zapret installation/running state, exposes zapret queue contents and a kmod_ok check, and includes Zapret info in the text report. README and wiki pages updated (docs, getting-started, DNS & Diagnostics) and Russian translations adjusted.
Introduce Zapret (nfqws2) integration across UI, init, firewall and RPC. Adds UI controls to enable/install Zapret, a strategy preset picker, strategy tester, and a Discord-voice opt-in; plumbing in client.js and node.js to install/manage and test strategies. Add zapret_test.sh to run isolated strategy tests against several sites. Enable runtime nfqws2 instance via init script (procd) and ensure HomeProxy runs its own nfqws2 with admin-specified strategy. Update nft rules and firewall_post.ut to mark and queue zapret flows (including both TCP and UDP/QUIC handling) and to respect zapret marks; generate_client.uc emits zapret outbound, optional voice-port routing, adds sniff action for QUIC routing, and tweaks default uTLS fingerprint to 'edge'. Add RPC handlers (zapret_status, zapret_prepare_install, zapret_install_pkg, zapret_remove, zapret_strategy_test) to support detection, installation and testing from the web UI. Minor: register 'zapret-out' as a routing option and wire it into rule generation.
core_mgmt.uc: drop --no-cache from apk add invocations (regular installs and --allow-untrusted) to avoid forcing an index refetch over the network. Add a comment explaining that --no-cache can be slow on poor uplinks and that kmod packages are resolved from the local index. Also remove --no-cache from the kmods install and increase the apk kmods timeout from 60s to 120s.
Update Russian translations for UI strings and improve diagnostics/reporting logic.
- po/ru/homeproxy.po: adjust Russian translations ("Direct IP", TLS phrasing, "passed").
- root/usr/share/rpcd/ucode/luci.homeproxy: harden UCI sanitization to handle multi-line option values (e.g. PEM keys) by redacting the option value and skipping subsequent continuation lines to avoid leaking secret bodies. Add a Connectivity section to generated diagnostics that probes several sites (Baidu, Google, YouTube, Yandex, Speedtest) using wget and records OK/FAIL for each site. Exit-IP rows are intentionally omitted.
Introduce a Connectivity diagnostics section (connection checks, exit IP / active node info) with new RPCs and live polling; move connection-check UI out of status into diagnostics and add translations. Add active URLTest node display and several routing/DNS UI tweaks for 'proxy_banned_ru' mode (russia-dns, secure-dns, main-out, byedpi-out). Rework ByeDPI presets: group presets by letter, add community presets, improve "Test all" flow with ordered execution, a Stop button, clearer progress/messages and updated translations. Fix template/comment text (replace crude QUIC comment), and harden client config generation by recognizing built-in DNS tags and skipping empty/dangling routing node outbounds to avoid crashes. Minor README_ru wording update and assorted i18n strings added.
Add root/usr/share/homeproxy/scripts/import_conf.uc: a ucode script to import a WireGuard/AmneziaWG .conf into the homeproxy UCI 'node' section from the CLI/SSH. Parses Interface/Peer blocks (including AWG-specific fields), maps keys (private/public/preshared, endpoint host:port with IPv6-safe parsing, addresses, MTU, etc.) to a node object, and writes it idempotently to the 'homeproxy' config using a stable FNV-1a hash-derived section name. Emits a single JSON line with result or error and is intentionally dependency-free (avoids digest/md5 for OpenWrt compatibility). Usage: ucode import_conf.uc <path-to-.conf> [label].
Several related fixes and improvements:
- htdocs/luci-static/.../client.js: Reworded the Russia Inside/Re-filter description to clarify contents and routing behavior shown in the UI.
- root/etc/homeproxy/scripts/generate_client.uc: Tightened UDP-over-TCP generation so it is only emitted for hiddify when node.udp_over_tcp is enabled; treat an empty cfg.node as equivalent to 'main-out' when selecting effective_outbound and avoid creating redundant outbounds. These changes make outbound selection more robust and prevent unnecessary outbound creation.
- root/usr/share/homeproxy/scripts/core_mgmt.uc: Made download_pkg tolerant of an optional leading core argument (accepts both (url, tmp_path) and (core, url, tmp_path)); improved install_kmods by defaulting to a detected package manager and returning a proper success/failure result with an error message when kmod installation fails. This improves compatibility with different callers and surfaces installation errors.
Rename project and packages to Re:HomeProxy (luci-app-re-homeproxy), update package metadata and build scripts, and adjust UI labels and menus accordingly. Improve core install flow: add RAM detection, overlay-compression heuristics, automatic selection between full and compact (UPX) builds, stricter storage/RAM checks, and a variant argument for prepare_install; fetch sing-box-extended releases more robustly. Fix runtime behavior: init.d restores a default config when missing, add packaged homeproxy.default, prefer user-preferred core in ucode, and suppress top-level TLS for Shadowsocks in generated client configs. UI tweaks include better install/remove UX, gating "Same as main node" for custom routing, and updated diagnostics/status strings. Update translations (po files) and rpcd/menu/acl renames to match the rebrand.
Improve the ByeDPI strategy tester UI and backend and adjust routing logic for special nodes.
- UI (htdocs/luci-static/.../node.js): probe 4 sites (YouTube, Telegram, Discord, Speedtest) to reveal destination-sensitive strategies, display per-site pass/fail dots and aggregate full/partial results, update 'Test all' flow and messages, and require curl for full testing.
- RPC (root/usr/share/rpcd/ucode/luci.homeproxy): byedpi_strategy_test now starts one ciadpi instance and runs parallel curl probes, returns detailed per-host results and reasons (dns/tls/timeout/etc.), preserves/restores nft redirect rules and ByeDPI skgid, and handles cases without curl by returning a startup-only result.
- Generator (root/etc/homeproxy/scripts/generate_client.uc): route secure-dns via direct-out when main node is byedpi-out, and force ruleset downloads via direct-out when main path uses WireGuard/AmneziaWG or is byedpi-out; add clarifying comments about why these exceptions are required.
Move ByeDPI configuration and testing UI from the Client tab to the Node Settings page and add an integrated installer/prepare flow. client.js: add fs/ui requires, new RPC declarations and core_mgmt download helper, change ByeDPI flag to auto-install on first enable with a modal-driven install flow and requirement checks; remove the large in-page ByeDPI settings block (now on Node page). node.js: add a full ByeDPI tab (presets, command options, strategy tester, test-all runner, UDP-over-TCP and QUIC-block flags) with RPC-based testing and curl detection. status.js: disable package removal when ByeDPI is selected as the main node and pass a flag to the card builder. Update po and pot translation strings and adjust several UI texts and warnings. Also update init/scripts/ucode files related to ByeDPI packaging and management.
Expose ByeDPI controls in the Client UI: add an enable flag, port / options fields, grouped preset selector, and a command-options field. Implement an interactive "Test current strategy" button and a "Test all strategies" runner (requires curl) that exercises ciadpi and shows which presets work. Add Status page UI to show/install/remove curl and wire new RPC methods (byedpi_strategy_test enhanced to actually start ciadpi and optionally perform an HTTP test via curl, plus curl_status/curl_install/curl_remove). Adjust package install helpers (apk handling and signing key copy) in core_mgmt and rpcd ucode. Update POT/PO translation templates for the new strings.
Introduce local ByeDPI (ciadpi) integration: add a ByeDPI tab in Client settings (presets, cmd options, tester, UDP-over-TCP and QUIC-blocking), a ByeDPI card on the Status page with install/remove/update actions and live status, and route support (byedpi-out) in generated client configs. Add RPC handlers for byedpi status, prepare/install/remove, strategy test and custom core detection; update ucode to detect custom core paths and expose core info. Init script now launches ciadpi when enabled and can add an nft rule to block QUIC; generate_client handles byedpi outbound fallback. Also update menu ordering and add translation strings for new core descriptions.
Add a new HomeProxy diagnostics page (htdocs/.../diagnostics.js) for core/config/DNS/nftables checks and report generation. Introduce ShadowTLS options (flag + password) in node settings and wire dependencies for Shadowsocks. Refactor core installation flow in status.js into prepare/download/install_pkg/install_kmods steps with new RPC calls, improving download/install error handling and progress messages. Update UI copy in client.js, and refresh localization strings and backend ucode/scripts to match the new features.
Add postinst hook in Makefile to reload rpcd after package install. Add new UI translation entries (status.js) to templates and fa_IR, ru, zh_Hans PO files for core/package management and status messages. Fix core_mgmt.uc output by printing the result directly (remove json() wrapper). Grant rpcd ACL exec permission for /usr/bin/ucode to allow invoking ucode from the service.
Add a new /usr/share/homeproxy/scripts/core_mgmt.uc to handle core info, remote checks, install and remove operations (apk/opkg, GitHub API, package downloads). Update LuCI frontend to call the new script (fs.exec_direct) instead of in-process rpc methods, adjust core descriptions and translations, and conditionally hide China/GFW list version fields when routing_mode is proxy_banned_ru. In generate_client.uc prefer direct-out for ruleset downloads if the main node (or urltest nodes) use WireGuard/AmneziaWG. Also ensure RUN_DIR exists earlier in the init script and remove the old core_* rpc handlers from luci.homeproxy.
Introduce core management features for hiddify and sing-box: add client-side UI in htdocs/luci-static/resources/view/homeproxy/status.js (new RPC declarations, buildCoreCard, core info display, install/check/remove buttons, and load/render changes) and server-side RPC handlers in root/usr/share/rpcd/ucode/luci.homeproxy (core_info, core_check_remote, core_install, core_remove).
The server side detects package manager (apk/opkg), architecture, free /tmp and overlay space, inspects installed versions, queries GitHub releases for latest versions, and performs installs/removals via wget + apk/opkg with basic validation and error reporting. The UI shows package manager, arch, free space, install status/version, remote update check, and interactive install/update/remove flows.
Expose and persist a preferred core option across UI and runtime. UI: show a 'Preferred core' dropdown in routing when multiple cores are available and populate it with auto/hiddify/singbox (htdocs/luci-static/.../client.js). Translations: add msgid for 'Preferred core' to POT and update fa_IR, ru, zh_Hans PO files. Init script: read config preferred_core, try the preferred core first and fall back to any installed core, keeping previous error behavior if none found (root/etc/init.d/homeproxy). Backend: rpcd ucode now reports available_cores by checking /usr/bin/hiddify-core and /usr/bin/sing-box (root/usr/share/rpcd/ucode/luci.homeproxy).
Refactor UI and backend to show clearer node labels and richer IP metadata. Add a shared resolveTag() in the status view to map sing-box outbound tags to human-readable UCI labels and remove duplicated logic; show IP country/org and delay alongside the IP. Update generate_client.uc to make default_domain_resolver compatible with both sing-box variants (object action for extended sing-box, plain tag/string for standard). Update luci.homeproxy RPC logic to follow GLOBAL.now to the active leaf node (including Selector), pick the first suitable fallback group if needed, and return richer direct/proxy entries (ip, country, org, delay, node) via a toEntry helper.
Add full Farsi (fa_IR) translation and CI/build support: - Add po/fa_IR/homeproxy.po (Persian translations). - Extend .github/build-ipk.sh to build a luci-i18n-homeproxy-fa package for both apk and ipk formats. - Update .github/workflows/build-ipk.yml to watch po/**, expose FA artifact names to the environment, and upload fa APK/IPK artifacts.
UI/runtime changes: - Update htdocs/luci-static/resources/view/homeproxy/node.js to rename TLS fingerprint field tls_fingerprint -> tls_utls in parsed link objects. - Add active node polling and display (getActiveNode) in htdocs/luci-static/resources/view/homeproxy/status.js and show the Active Node dummy field when core_type === 'singbox'.
Other: - Update RPC/uCode (root/usr/share/rpcd/ucode/luci.homeproxy) and translation templates/other locale files to support the new UI/RPC changes and translation strings.
Detect and expose core type/version reliably and add MTProxy inbound
- LuCI: fall back to /var/run/homeproxy/core.info when RPC lacks core info; load features before rendering status view.
- init: write core_type and version to /var/run/homeproxy/core.info on start.
- rpcd ucode: improve kernel module detection (use /sys/module), normalize access checks and parse core version/tags more robustly.
- UI: remove ip-full from Tun prerequisite message; only show direct/proxy IP checks for hiddify cores.
- Server view: add MTProxy server options (secrets, domain fronting, timeouts, concurrency) and expose MTProxy type when using singbox core.
- Client generator: emit MTProxy fields (secrets -> users, domain fronting, timeouts, concurrency) and propagate xhttp x_padding_bytes when using singbox.
- Node parsing: handle amnezia last_config JSON, fix labels and host/port resolution, and extract xhttp fields (path/host/mode/padding).
Support for AmneziaWG (vpn://) links and sing-box core was added across UI, backend and init scripts. UI: parseVpnLink() handles AmneziaVPN vpn:// payloads; node editor adds amneziawg type and numerous Amnezia-specific fields; share import now accepts vpn:// links, deduplicates inputs and imports vpn + URI configs. View changes: renderStatus shows detected core name (hiddify-core or sing-box). Backend: generate_client treats amneziawg as a wireguard endpoint with extra amnezia parameters and includes amneziawg nodes in endpoint/outbound selection. Init script: start logic now prefers hiddify-core or sing-box and logs the actual binary started. RPCD: feature detection updated to probe for sing-box and parse its version/tags.
New Features
Outbound Interface Binding
Added Binded interface field to every outbound node — allows pinning a proxy node to a specific network interface. using SO_BINDTODEVICE
The bind_interface value is preserved across subscription updates and not overwritten when nodes are refreshed
Status Page — IP Check
Added Direct IP button: shows the current exit IP and latency of the direct outbound
Added Proxy IP button: shows the exit IP, latency, and active node name of the currently selected proxy in the URLTest/Fallback group
Status Page — YouTube Check
Added YouTube connectivity check alongside the existing Google, Yandex, Baidu, Speedtest checks
Clash API
sing-box Clash API now enabled on 127.0.0.1:9090 for all routing modes
Build
Added luci-i18n-homeproxy-zh-cn package to the build pipeline — Chinese Simplified translation is now distributed as a standalone installable package, for both main and legacy (OpenWRT 23.05) releases
Translations
Added Russian and Chinese Simplified translations for all new UI strings
Fixed missing Russian translation for unchecked
Replace the RPC-based subscription update and polling flow with a direct fs.exec_direct call to /etc/homeproxy/scripts/update_subscriptions.uc from the UI. Remove client-side rpc usage and the async polling logic, and update error handling to reload on success and reset the map on failure (use this.map.reset()). Remove the corresponding server-side rpcd ucode methods (subscription_update and subscription_update_status) and the now-unused translation string.
Introduce a legacy build mode for OpenWRT 23.05 and make subscription updates asynchronous with status polling. Changes: add LEGACY arg to .github/build-ipk.sh (produce -legacy IPKs and patch update_subscriptions.uc to avoid ucode-mod-digest by injecting an md5 shim), adjust control Depends and artifact names; update .github/workflows/build-ipk.yml to build/publish legacy IPKs and tweak asset matching; implement non-blocking subscription_update + new subscription_update_status RPC in root/usr/share/rpcd/ucode/luci.homeproxy; update frontend (htdocs/...) to poll update status with timeout and use translated timeout message (po/ru/...). This enables compatibility with systems missing ucode-mod-digest and avoids blocking UI during long subscription updates.
Replace references to the deprecated 'sing-box-s' instance with 'hiddify-c', remove the separate generate_server.uc script, and consolidate server inbound generation into generate_client.uc. UI code (server.js, status.js) now checks/logs only for 'hiddify-c'. ACL (luci-app-homeproxy-hiddify.json) no longer exposes sing-box-s.log. RPC ucode (luci.homeproxy) restricts log_clean types to 'homeproxy' and 'hiddify-c'. Overall cleanup unifies server generation and removes obsolete sing-box-s artifacts.
Client and server views now build a version string (v<version> or 'unknown') and use it in the status render template to avoid duplicating the 'v' prefix and to show a fallback when version is missing. The rpcd ucode for luci.homeproxy now reads the full hiddify-core output, extracts the version and Tags using regexes, closes the process earlier, and trims/splits tags into feature flags for more robust parsing.
Adds a new 'custom_json' routing mode that can use a user-provided client config; UI changes in client.js to expose custom_json options and trigger subscription updates via RPC. node.js: require rpc, add NaïveProxy node type and XHTTP transport with UI fields (xhttp_mode, xhttp_headers), and adjust field dependencies. generate_client.uc: add TLS fragment support, normalize TLS ALPN to an array, handle xhttp mode/headers, rename log/output filenames, add default_mark and use it in routing, and write out hiddify-c.json. update_subscriptions.uc: import urldecode_params and extend URI parsing (naive, ssh, enhanced trojan parsing including xhttp and hiddify extras), add WireGuard parsing, and make base64 node decoding more robust. init.d: support custom_json by copying user-supplied config or generating config as appropriate and include custom_json in DNSMasq routing cases. Add an RPC method (subscription_update) in luci.homeproxy to run the subscription updater.
Extend the HomeProxy status page and RPC handler to include connectivity checks for Yandex and Speedtest. Adds two new DummyValue entries ('_check_yandex', '_check_speedtest') in the status view and adds corresponding cases in luci.homeproxy to map 'yandex' and 'speedtest' to their URLs. This enables the existing getConnStat routine to report on those additional services.
Update package name and references to the hiddify variant: change README download URL to luci-app-homeproxy-hiddify_latest_all.ipk; rename luci menu and rpcd ACL JSON files to luci-app-homeproxy-hiddify and update their acl/depends keys; update i18n POT/PO source references accordingly (po/templates/homeproxy.pot, po/zh_Hans/homeproxy.po). This aligns menu/ACL entries and translations with the released package name.
Migrate the project from sing-box to hiddify-core across packaging, init scripts, UI and runtime helpers. Removed sing-box package dependency from build/IPK/Makefile and updated GitHub Actions usages (checkout/upload-artifact pinned to v4). UI and status/log viewers now reference hiddify-c/hiddify-core and log filenames were renamed. init.d was rewritten to use /usr/bin/hiddify-core, load client config from /etc/homeproxy/hiddify-c.json, simplify routing/tproxy setup, adjust dnsmasq handling, and run hiddify-c via procd; log cleaner and ACL/ucode RPC checks were updated accordingly. Overall this change migrates runtime/service names, config paths and version parsing to hiddify-core.
