chore(release): v0.4.4

Author: github-actions[bot]

CHANGELOG.md

@@ -1,3 +1,31 @@
+## v0.4.4 — 2026-08-03
+
+### Core updates
+
+- sing-box: `v1.13.14` → `v1.13.15`
+
+### Changes
+
+- [`49dc58f`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/49dc58f) fix(desktop): propagate boot_init dir-creation errors
+- [`0beef3c`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/0beef3c) fix(desktop): stop mutating the process-global umask in privhelper serve
+- [`8b73874`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/8b73874) fix(desktop): let settings stay editable while the proxy is running
+- [`4789239`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/4789239) feat(core): DataPathState document + read/write helpers
+- [`a12e8ea`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/a12e8ea) test(desktop): drop env mutation from path-dependent tests
+- [`9fdcba8`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/9fdcba8) feat(frontend): pending-restart banner on the overview
+- [`f2b20a0`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/f2b20a0) feat(backend): flag a running data path stale after settings mutations
+- [`37f0aa3`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/37f0aa3) feat(core): pendingRestart status flag + mutation-effect decision
+- [`a878c4c`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/a878c4c) feat(desktop): skip the privileged helper in non-tun proxy modes
+- [`04643a7`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/04643a7) fix(desktop): hand helper-created runtime files to the GUI owner
+- [`5617db8`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/5617db8) feat(desktop): make the PAC port a local-ports setting
+- [`2463bb2`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/2463bb2) feat(desktop): snapshot and restore the OS proxy around system/pac
+- [`157ee72`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/157ee72) feat(desktop): serve a PAC in pac mode
+- [`af5f1e2`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/af5f1e2) feat(desktop): set the OS proxy in system mode
+- [`49196c3`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/49196c3) feat(desktop): run a proxy-only data path + mode selector
+- [`7839739`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/7839739) feat(core): add proxyMode setting (tun/proxy-only/system/pac)
+- [`64286d3`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/64286d3) fix(desktop): tunnel root traffic on Linux; escape the core by fwmark
+- [`91ea0b2`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/91ea0b2) fix(core): make tun uid-0 exclusion a platform decision, not builder policy
+- [`0063db2`](https://github.com/loss-and-quick/Kasumi-Proxy/commit/0063db2) fix(tun): drive tun2socks through its YAML config
+
 ## v0.4.3 — 2026-07-13
 
 ### Core updates

module/module.prop

@@ -1,7 +1,7 @@
 id=kasumi-proxy
 name=Kasumi Proxy
-version=v0.4.3
-versionCode=011
+version=v0.4.4
+versionCode=012
 updateJson=https://raw.githubusercontent.com/loss-and-quick/Kasumi-Proxy/main/update.json
 author=minicx
 description=A system-level transparent proxy routing engine using Xray-core / Sing-Box

scripts/binary-hashes.json

@@ -1,7 +1,7 @@
 {
   "_comment": "SRI hashes of the desktop (linux-amd64) core archives, for the nix flake's fixed-output fetch. xray/tun2socks/sing-box/hev-socks5-tunnel are GENERATED by scripts/update-binary-hashes.sh from scripts/binaries.json + scripts/binary-versions.sh — do not hand-edit; the release CI regenerates them on a core bump. geodat2srs is built from source (nix/binaries.nix): geodat2srs-src (fetchFromGitHub NAR) and geodat2srs-vendor (go-module vendor) are nix-derived and preserved as-is here — refresh them with `nix build .#kasumi-desktop` (paste the expected hash) when bumping GEODAT2SRS_REV.",
   "hev-socks5-tunnel": "sha256-cARka6dNaMja0VYSQ/lPxrU2acRruPi9UXLK4g0C9NM=",
-  "sing-box": "sha256-9IcDRhoVR2lRrElnza0znZhvS4CWtOs/8IKaUAUC1pc=",
+  "sing-box": "sha256-o6P/Ijsjw/RzHQoXyw75TJfOJXxwchpbB9x8oHkgPJ8=",
   "tun2socks": "sha256-phK6ooejtt5iIfdP0CtEKlCIhQgifs9R4SiKXMu3c4E=",
   "xray": "sha256-I82a+Td0TZd3buNeytSXLPSyEJ0eD+a+mTBGdgj3yK4=",
   "geodat2srs-src": "sha256-iPdqPmNULHmX0a1sb++TMbjpRJvNE41WIxTtK27dGIQ=",

scripts/binary-versions.sh

@@ -11,7 +11,7 @@ TUN2SOCKS_VERSION="${TUN2SOCKS_VERSION:-v2.7.0}"
 HEV_VERSION="${HEV_VERSION:-2.15.0}"
 # sing-box runs Hysteria2/TUIC profiles (second core). Pin a 1.13.x line whose
 # config schema matches singbox_config.rs (mixed inbound, tls/utls, hysteria2/tuic).
-SINGBOX_VERSION="${SINGBOX_VERSION:-v1.13.14}"
+SINGBOX_VERSION="${SINGBOX_VERSION:-v1.13.15}"
 # geodat2srs converts geoip/geosite .dat → sing-box .srs rule-sets. Unlike the
 # cores above it ships NO release artifacts — it is built from source at this rev
 # (CGO off, static): scripts/fetch-binaries.sh builds it for both the Android module

update.json

@@ -1,6 +1,6 @@
 {
-  "version": "v0.4.3",
-  "versionCode": 11,
-  "zipUrl": "https://github.com/loss-and-quick/Kasumi-Proxy/releases/download/v0.4.3/kasumi-proxy-module-v0.4.3.zip",
+  "version": "v0.4.4",
+  "versionCode": 12,
+  "zipUrl": "https://github.com/loss-and-quick/Kasumi-Proxy/releases/download/v0.4.4/kasumi-proxy-module-v0.4.4.zip",
   "changelog": "https://raw.githubusercontent.com/loss-and-quick/Kasumi-Proxy/main/CHANGELOG.md"
 }