Changelog

All notable changes to SwizGuard will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.0.0] — 2026-04-08

First public release.

Full WireGuard + VLESS + REALITY + Vision chain, automated end to end
Single-command server setup: sudo ./swizguard setup
Client management commands: add, regen, share, list, remove
Operational commands: status, upgrade-vision, rekey, nuke
Desktop client generation (Xray JSON with sockopt.dialerProxy chain)
Mobile client generation (sing-box JSON with detour chain) for iOS SFI and Android SFA
VLESS share link + QR code output for fallback clients
Vision flow (xtls-rprx-vision) enabled by default — closes TLS-in-TLS fingerprinting
Auto-detect UFW and open only port 443/tcp when present
Debian 13 (Trixie) compatibility including the new ssh service name and the LXC reload bug
Default camouflage target: www.microsoft.com (Xray warns against Apple/iCloud targets)
Access logging disabled on the server by default — no record of client destinations
Userspace WireGuard on clients via gVisor (no sudo, no kernel module, no wg-quick)
Systemwide proxy enable/disable helpers on macOS (enable-system-proxy / disable-system-proxy)
Comprehensive documentation: README, how-it-works, setup-guide, troubleshooting
MIT license, security policy, and disclaimer

Server: Xray-core VLESS+REALITY+Vision inbound → freedom outbound → local WireGuard (wg1 on 127.0.0.1:51821)
Desktop client: single Xray process, WireGuard outbound with sockopt.dialerProxy chaining through VLESS+REALITY+Vision
Mobile client (iOS/Android): single sing-box process, wireguard endpoint with detour chaining through VLESS+REALITY+Vision
Vision flow enabled on both sides with "flow": "xtls-rprx-vision" on VLESS client entries
uTLS Chrome fingerprint on REALITY clients
Sniffing enabled at server inbound with routeOnly: true

Shadowrocket (iOS) cannot do the chained outbound pattern — use SFI for full chain on iPhone
Hiddify (iOS) only supports simple share links, not chained configs
sing-box 1.12.2 has a DNS-through-proxy bug; use 1.12.3+ or 1.13.x
SFI for iOS requires iOS 15+
Full chain requires a client that supports raw sing-box or Xray JSON import