Surge 5

New Features - Added the `[IP Rewrite]` section to process packets entering Surge VIF by destination address before rule matching. Supported actions include `reflect`, `reject`, and `drop`. This can provide on-device loopback functionality for certain iOS developer toolchains. - Added a `category` parameter to policy groups for grouped display. - All `test-url` parameters now support HTTPS URLs. Results still measure a single HTTP round-trip latency, although TLS handshakes may increase overall testing time. - Added a device communication takeover option for Include All mode. - Added external resource management and other helper endpoints to the HTTP API. - URL-based linked profiles can now be updated manually. UI and Rules - Updated UI layouts and details for iPhone Duo support. - Improved the Add Rule page: domain rules can now be created from SNI-sniffed requests, and rule-specific options can be selected directly. - Inline rulesets with the same name now merge across the main profile and modules, preserving rules from each source. - Fixed logical rules incorrectly parsing policy names containing parentheses. Networking and Reliability - Improved Tailscale and WireGuard behavior when switching networks. - Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout. - Removed an erroneous Ponte notification when using a Ponte policy in a policy group. - Reverted per-domain MITM key-pair generation to address noticeable delays when intercepting many different domains concurrently. - Fixed a scripting-engine compatibility issue. - Improved performance and memory usage, fixed rare crashes, and resolved other minor issues.