Surge 5.22.0：新增MASQUE/HTTP3代理、终端与Prometheus指标

New Features

• Added a full-featured Terminal to Surge iOS, providing CLI-based diagnostics, rule explanations, policy-group inspection, command completion, and history. - Added MASQUE proxy support using HTTP/3 CONNECT and CONNECT-UDP. - HTTP/2 CONNECT proxies can now relay UDP traffic with `udp-relay=true`. - TrustTunnel can now use HTTP/3 transport with `h3=true`. - Added group-level proxy chaining. Policy groups can connect concrete proxy members through an underlying proxy. - Added a Prometheus-compatible `/metrics` endpoint to the HTTP Controller. - Added a graphical Policy Priority editor for Smart Groups. - Added event-script support for `engine-started` and `profile-reloaded`. - Added notification controls for proxy clients, scripts, and rule matches. - Added Arctic and Pulse app icons.

Tailscale

• Added peer-relay support through eligible tailnet devices, with Direct → Peer Relay → DERP priority and runtime latency information. - Interactive sign-in now supports tailnets requiring administrator device approval. - Improved interrupted sign-in recovery by reconnecting and continuing the existing authorization flow. - Improved compatibility with the Tailscale administration console and version-gated operations. - Fixed connectivity after the control server assigns a new tailnet address. - Improved recovery after network changes, UDP binding failures, expired connections, and multi-peer configurations.

Profiles, Includes, and Rulesets

• `#include` directives can now be freely combined with regular section content. - Sections using multiple or mixed includes are presented as read-only when their write-back destination is ambiguous. - Added wildcard detached-section includes for `[Ruleset *]`, `[WireGuard *]`, and `[Tailscale *]`. - Added `DEVICE_NAME` to the profile environment for use in `#!REQUIREMENT`. - Added diagnostics for missing WireGuard and Tailscale configuration sections and clarified named-include behavior. - Local and inline rulesets can now be edited graphically on macOS and iOS. - Rulesets can reference other inline rulesets and external `RULE-SET` or `DOMAIN-SET` sources. - Circular ruleset references are rejected with a clear reference chain. - The ruleset editor now better preserves blank lines, comments, disabled rules, and source locations. - Fixed rules created inside rulesets or logical rules retaining an unintended hidden policy value. - Improved selection of the appropriate write-back target when mixed includes are used. - Fixed `[General]` values containing `#`, `//`, or `;` being altered after saving. - Profiles changed on disk or through iCloud now reload automatically, while invalid updates leave the working configuration active. - Module installation state is no longer governed directly by iCloud. - Cloud synchronization now excludes `.git` and `node_modules`.

UI and Editing

• The bottom tab bar remains visible during navigation to avoid UIKit transition glitches. - The Script Editor now uses a dedicated modal interface with an improved toolbar and keyboard layout. - Remote Controller and Ponte Diagnostics are available for all Ponte devices, including shared devices. - Improved policy-group icon handling across themes and profile reloads. - Virtual IP records and search results now use self-sizing rows. - Fixed policy groups using an underlying proxy being unavailable from the UI. - Improved module error reporting for download, parsing, writing, and installation failures.

Networking and Reliability

• `[Host]` domain aliases can specify a dedicated DNS server. - Fixed recursive HTTP/3 timer processing that could cause stack overflow. - Fixed QUIC connections stalling after receive-side backpressure. - Fixed long-running Ponte and Vector sessions eventually exhausting their ability to open relayed streams. - Improved MITM certificate generation and certificate-chain handling. - Fixed several additional crashes and minor issues.