Surge 5.21.1：新增 MTProto 服务器、Tailscale 自动路由
Surge 5 5.21.1
Surge 重度用户注意：本次更新带来 MTProto 服务器、Tailscale 自动路由和 ECN 默认开启等能力变化，且 iOS 最低版本升至 17，建议升级前确认系统兼容。
What's New
新功能
Surge as MTProto Server - Surge now can operate as an incoming MTProto proxy server for Telegram. Please read manual for more information: https://manual.nssurge.com/
Surge 作为 MTProto 服务器 - Surge 现在可以作为 Telegram 的传入 MTProto 代理服务器运行。请阅读手册了解更多信息：https://manual.nssurge.com/
Tailscale - Added interactive Tailscale sign-in on iOS and macOS. Resolve the issue where some enterprise users are unable to obtain the auth key. - Added automatic Tailscale routing. Surge can discover the tailnet’s MagicDNS suffix and peer IPv4/IPv6 addresses, then automatically route matching domains and peer IP traffic through the corresponding Tailscale policy. - Automatic Tailscale routing is enabled by default and can be disabled with `auto-add-magic-dns-rule = false`. - Improved Tailscale session warm-up and recovery. Sessions now retry MagicDNS discovery after startup failures and network changes without requiring matching traffic to arrive first. - Tailscale sessions now stay active by default. An omitted `idle-keepalive`, `0`, or `-1` keeps the session always active; set a positive value to enable idle teardown. - Tailscale can now begin handling traffic as soon as a valid network map is received, without waiting for the home DERP connection to be established. - Improved recovery after network changes and control-server reconnections by preserving the last known home DERP region and retrying peer handshakes at the appropriate time. - Aligned DERP measurement and selection behavior with official Tailscale client, improving compatibility with custom DERP maps, STUN-only nodes, fallback probes, and temporarily unavailable control connections. - Sensitive values such as authentication keys and authorization URLs are now redacted from verbose Tailscale control logs.
Tailscale - 在 iOS 和 macOS 上增加了交互式 Tailscale 登录。解决了部分企业用户无法获取认证密钥的问题。 - 增加了自动 Tailscale 路由。Surge 可以发现 tailnet 的 MagicDNS 后缀和对等 IPv4/IPv6 地址，然后自动将匹配的域名和对等 IP 流量通过相应的 Tailscale 策略进行路由。 - 自动 Tailscale 路由默认启用，可通过 `auto-add-magic-dns-rule = false` 禁用。 - 改进了 Tailscale 会话的预热和恢复。会话现在在启动失败和网络变化后重试 MagicDNS 发现，无需等待匹配流量先到达。 - Tailscale 会话现在默认保持活动状态。省略 `idle-keepalive`、`0` 或 `-1` 会使会话始终保持活动；设置正值以启用空闲拆除。 - Tailscale 现在可以在收到有效网络地图后立即开始处理流量，无需等待主 DERP 连接建立。 - 通过保留最后已知的主 DERP 区域并在适当时间重试对等握手，改进了网络变化和控制服务器重新连接后的恢复。 - 使 DERP 测量和选择行为与官方 Tailscale 客户端对齐，提高了与自定义 DERP 地图、仅 STUN 节点、回退探测和暂时不可用的控制连接的兼容性。 - 敏感值（如认证密钥和授权 URL）现在会从详细的 Tailscale 控制日志中编辑掉。
TLS - Added `server-cert-verify-name` to independently specify the hostname used for proxy server certificate verification without changing SNI. This parameter applies to all TLS- and QUIC-based proxy protocols.
TLS - 添加了 `server-cert-verify-name`，用于独立指定用于代理服务器证书验证的主机名，而不更改 SNI。此参数适用于所有基于 TLS 和 QUIC 的代理协议。
ECN - Reworked ECN configuration and packet handling across QUIC, WireGuard, Tailscale, Ponte, and nested UDP tunnels. - Correctly preserves ECN and DSCP/TOS metadata across IPv4 and IPv6 encapsulation and decapsulation. - For QUIC-based proxy protocols, when ECN is enabled, anomalies will be automatically detected and fallback to non-ECN handling. - ECN is now enabled by default for QUIC-based proxy protocols on supported systems. WireGuard and Tailscale remain disabled by default. Use `ecn=false` or `ecn=true` to override the default explicitly. - Surge Ponte now also has ECN enabled by default, and the `client-use-ecn` parameter has been removed.
ECN - 重新设计了 QUIC、WireGuard、Tailscale、Ponte 以及嵌套 UDP 隧道中的 ECN 配置和数据包处理。 - 在 IPv4 和 IPv6 封装和解封装过程中正确保留 ECN 和 DSCP/TOS 元数据。 - 对于基于 QUIC 的代理协议，当启用 ECN 时，将自动检测异常并回退到非 ECN 处理。 - 在支持的系统上，基于 QUIC 的代理协议现在默认启用 ECN。WireGuard 和 Tailscale 默认保持禁用。使用 `ecn=false` 或 `ecn=true` 显式覆盖默认设置。 - Surge Ponte 现在也默认启用 ECN，并且已移除 `client-use-ecn` 参数。
DNS - Optimized TCP connection establishment for `prefer-v4` and `prefer-v6`. In earlier versions, these two parameters indicated which record to use when a domain name had both A and AAAA records. Now, during the TCP handshake, A or AAAA records are used preferentially; if the handshake cannot be completed within 3 seconds, other records will start to be tried. - Added DNS-over-TCP support. DNS server settings now accept `tcp://hostname[:port]`.
DNS - 优化了 `prefer-v4` 和 `prefer-v6` 的 TCP 连接建立。在早期版本中，这两个参数表示当域名同时具有 A 和 AAAA 记录时使用哪条记录。现在，在 TCP 握手期间，优先使用 A 或 AAAA 记录；如果握手在 3 秒内无法完成，将开始尝试其他记录。 - 增加了 DNS-over-TCP 支持。DNS 服务器设置现在接受 `tcp://主机名[:端口]`。
iOS - Raised the minimum system requirement to iOS 17. - Reworked Shortcuts and App Intent support and improved the reliability of App Intent operations. - Added manual Suspend and Bypass Suspension controls. The Ponte management page, scripts, and local proxy services remain available while Surge is suspended. - Snell Server can now be configured and used on iOS and tvOS.
iOS - 将最低系统要求提升至 iOS 17。 - 重新设计了快捷指令和 App Intent 支持，并提高了 App Intent 操作的可靠性。 - 增加了手动挂起和绕过挂起控制。当 Surge 挂起时，Ponte 管理页面、脚本和本地代理服务仍然可用。 - Snell Server 现在可以在 iOS 和 tvOS 上配置和使用。
Codebase Refactoring
代码库重构
After more than a decade of development, the Surge codebase has grown into a large and complex project. To further improve reliability, we have introduced AI-assisted code review across the entire codebase.
经过十多年的发展，Surge 代码库已经成长为一个庞大而复杂的项目。为了进一步提高可靠性，我们在整个代码库中引入了 AI 辅助代码审查。
Every code change is independently reviewed by Fable 5, GPT-5.6 Sol, and a human developer before being merged, helping us identify potential security issues, rare crash scenarios, and subtle correctness problems.
每次代码更改在合并前都会由 Fable 5、GPT-5.6 Sol 和一名人类开发人员独立审查，帮助我们识别潜在的安全问题、罕见的崩溃场景和微妙的正确性问题。
Due to the large number of updates, please refer to the Mac version release notes for details: https://nssurge.com/support/mac/release-notes
由于更新数量众多，详情请参阅 Mac 版本发布说明：https://nssurge.com/support/mac/release-notes
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力