Tenebra: vanhemmat versiot ja versiohistoria

<!-- tenebra-promotion-sha256:0e37bee00a3e5e0948d1c41d5720096d7674f01cce2dac9fb329de15a6dcc058 -->
# Tenebra 0.6.1

This desktop hotfix prevents failures in Tenebra's on-connect,
multi-destination node validation from being reported as an
all-servers-unreachable result. It also makes failures in the server list's
separate direct TCP status checks visible and prevents one incompatible
subscription node from invalidating the shared sing-box configuration.

• The on-connect validation reserves a free contiguous block of loopback ports
instead of relying on a fixed range that another local process may already
own.
• Its temporary SOCKS listeners use fresh credentials, and readiness is
confirmed with an authenticated SOCKS negotiation. A foreign listener can
no longer be accepted as Tenebra's probe merely because it answers on the
expected port.
• The core watches this validation's probe process throughout startup and
measurement. Detected startup failures, bind races and early process exits
now stop validation with a local error rather than returning an
all-servers-unreachable verdict.
• Probe stdout and stderr are retained in a bounded tail for diagnosis and are
scrubbed before being logged or returned through the control interface.
• Imported VLESS URLs with unsupported stream transports, including `xhttp`,
are excluded before the shared probe or tunnel configuration is built.
VLESS nodes using QUIC without its required TLS are excluded for the same
reason, while compatible VLESS QUIC nodes remain supported. Other usable
nodes in the profile stay available.
• Separately, the server list shows whether its direct TCP status checks are in
progress, ready or failed and provides a retry action. An earlier successful
RTT may remain visible while a refresh runs or fails, but it is marked stale
and is not counted or rendered as a current signal-strength result.

## Verification scope

Automated tests cover the on-connect validation's probe ownership, lifecycle
and port races, authenticated readiness, bounded log capture and the bundled
sing-box configuration, builder-level unsupported-transport isolation and
compatible VLESS QUIC, plus the server list's direct TCP states. The affected
profile reproduced the original failure in a retained Windows VM：one `xhttp`
entry made the bundled sing-box reject the shared configuration with `unknown
transport type：xhttp`, blocking otherwise usable nodes. Native installation,
service, ordinary-user UI and tunnel checks of the exact rebuilt signed
candidate remain required before publication.

<!-- tenebra-promotion-sha256:a72ce0d98b8826c165c99ce3a7e5d6f2f075964ed6de178b00eee5fad0714c03 -->
# Tenebra 0.6.0

## Verification scope for this release

Tenebra 0.6.0 is published with the project owner's approval of a reduced release acceptance scope. **The complete Windows protection matrix has not passed.** The implementation's intended coverage described below is not evidence that every failure condition has been tested.

The exact Windows installer was exercised through installation, upgrade from 0.5.11, repair, uninstall with profile preservation and reinstall. Both interface modes and ordinary-user flows were checked at 100% and 150% scaling. Controlled IPv4 tunnel and system-proxy traffic, proxy restoration, repeated engine crashes and a bounded service-stop scenario were exercised.

End-to-end IPv6/QUIC leakage checks, BFE restart, reboot before core recovery, all existing-flow and DIRECT-exception cases, routing/interface changes, suspend/resume and the full update/uninstall failure matrix remain follow-up work. The tested service-stop capture is a limited observation, not a universal no-leak guarantee. The original report of unavailable servers on another Windows PC and real-world DPI bypass effectiveness remain unverified. macOS/Linux package build checks do not establish equivalent native runtime coverage.

The attached `acceptance.json` records this limited release decision and explicitly sets `fullNativeMatrixPassed` to `false`. The candidate files, updater signatures and source provenance are unchanged.

### Область проверки

Версия выпущена по решению владельца проекта с перечисленными ограничениями. Проверены установка и обновление Windows, оба режима интерфейса, реальные IPv4-подключения, восстановление прокси и отдельные аварии движка и службы. Полная матрица защиты, IPv6/QUIC, перезагрузка и остальные перечисленные выше случаи ещё не приняты. Работа обхода DPI в каждой сети и исходный случай «все серверы недоступны» не подтверждены.

---

This desktop release revises both interface modes and Windows service,
installation and connection handling.

• Simple mode brings subscription setup, server selection and connection
feedback into one flow. Full mode has a revised connection panel, searchable
servers and consistent settings, profiles, import and diagnostic screens.
• Connection errors distinguish local service, engine and proxy failures from
server failures. A failed TCP probe no longer prevents selecting a server or
claims that its VPN protocol cannot connect.
• Windows service communication verifies the installed service identity,
supports the ordinary signed-in user and elevated administrators, and bounds
requests when the service stops responding.
• System proxy handling tracks the owning Windows user and keeps the settings
required for restoration. Disconnect and cleanup errors remain visible.
• The Windows installer loads the service-management assembly before waiting
for the service to stop, fixing the false stop-state failure in a fresh
PowerShell process.
• Routing and reconnect changes preserve split settings, reject unusable
multihop chains and limit repeated engine failures.
• Keyboard focus, compact layouts, themes and Russian/English text have been
revised across both modes.

## Windows protection

When enabled and applied by a connection, persistent Windows protection keeps
blocking if the VPN engine or Tenebra service exits. Explicit Disconnect,
disabling protection with confirmed cleanup, or a successful uninstall releases
Tenebra's policy. Configured DIRECT exceptions use the running engine.

Protection covers ordinary Windows application IPv4/IPv6 traffic after Windows
Filtering Platform loads its policy. It does not cover the interval before BFE
starts, deliberately disabled BFE, or forwarded VM/container traffic. The saved
preference, last confirmed protection state and errors are shown separately.

## Packages and verification

Desktop packages cover Windows, macOS, Linux and Arch

Desktop builds of Tenebra for Windows, macOS and Linux.

**Windows** is user-ready：run the installer (SmartScreen warns on an
unsigned build -> More info -> Run anyway); it sets up the background
service, and the in-app updater keeps both app and service current.

**macOS is for advanced users, not click-to-run yet.** The DMG alone
will NOT give you a working tunnel：macOS needs a root helper daemon
that is currently installed by hand with a sudo script
(scripts/macos/install-daemon.sh), and the build is unsigned (first
launch：System Settings -> Privacy & Security -> Open Anyway). Read
the "macOS note" in the README before downloading. A signed,
click-to-run macOS build is planned.

**Linux**：the Arch package (.pkg.tar.zst) is the click-to-run one
— `pacman -U` installs the app, the core and the systemd unit, and
`systemctl enable --now tenebra` starts the tunnel service. The .deb
and the AppImage install only the app and the core：the privileged
service still has to be set up once by hand with
scripts/linux/install-daemon.sh, because the Debian bundle cannot run
a post-install script. Updates for a packaged install come from your
package manager, not the in-app updater, which only works for the
AppImage.

Updates are delivered in-app and verified against the project's
minisign key before they install (on macOS the updater refreshes the
app, not the hand-installed daemon).

Desktop builds of Tenebra for Windows, macOS and Linux.

**Windows** is user-ready：run the installer (SmartScreen warns on an
unsigned build -> More info -> Run anyway); it sets up the background
service, and the in-app updater keeps both app and service current.

**macOS is for advanced users, not click-to-run yet.** The DMG alone
will NOT give you a working tunnel：macOS needs a root helper daemon
that is currently installed by hand with a sudo script
(scripts/macos/install-daemon.sh), and the build is unsigned (first
launch：System Settings -> Privacy & Security -> Open Anyway). Read
the "macOS note" in the README before downloading. A signed,
click-to-run macOS build is planned.

**Linux**：the Arch package (.pkg.tar.zst) is the click-to-run one
— `pacman -U` installs the app, the core and the systemd unit, and
`systemctl enable --now tenebra` starts the tunnel service. The .deb
and the AppImage install only the app and the core：the privileged
service still has to be set up once by hand with
scripts/linux/install-daemon.sh, because the Debian bundle cannot run
a post-install script. Updates for a packaged install come from your
package manager, not the in-app updater, which only works for the
AppImage.

Updates are delivered in-app and verified against the project's
minisign key before they install (on macOS the updater refreshes the
app, not the hand-installed daemon).

Desktop builds of Tenebra for Windows, macOS and Linux.

**Windows** is user-ready：run the installer (SmartScreen warns on an
unsigned build -> More info -> Run anyway); it sets up the background
service, and the in-app updater keeps both app and service current.

**macOS is for advanced users, not click-to-run yet.** The DMG alone
will NOT give you a working tunnel：macOS needs a root helper daemon
that is currently installed by hand with a sudo script
(scripts/macos/install-daemon.sh), and the build is unsigned (first
launch：System Settings -> Privacy & Security -> Open Anyway). Read
the "macOS note" in the README before downloading. A signed,
click-to-run macOS build is planned.

**Linux**：the Arch package (.pkg.tar.zst) is the click-to-run one
— `pacman -U` installs the app, the core and the systemd unit, and
`systemctl enable --now tenebra` starts the tunnel service. The .deb
and the AppImage install only the app and the core：the privileged
service still has to be set up once by hand with
scripts/linux/install-daemon.sh, because the Debian bundle cannot run
a post-install script. Updates for a packaged install come from your
package manager, not the in-app updater, which only works for the
AppImage.

Updates are delivered in-app and verified against the project's
minisign key before they install (on macOS the updater refreshes the
app, not the hand-installed daemon).

Desktop builds of Tenebra for Windows, macOS and Linux.

**Windows** is user-ready：run the installer (SmartScreen warns on an
unsigned build -> More info -> Run anyway); it sets up the background
service, and the in-app updater keeps both app and service current.

**macOS is for advanced users, not click-to-run yet.** The DMG alone
will NOT give you a working tunnel：macOS needs a root helper daemon
that is currently installed by hand with a sudo script
(scripts/macos/install-daemon.sh), and the build is unsigned (first
launch：System Settings -> Privacy & Security -> Open Anyway). Read
the "macOS note" in the README before downloading. A signed,
click-to-run macOS build is planned.

**Linux**：the Arch package (.pkg.tar.zst) is the click-to-run one
— `pacman -U` installs the app, the core and the systemd unit, and
`systemctl enable --now tenebra` starts the tunnel service. The .deb
and the AppImage install only the app and the core：the privileged
service still has to be set up once by hand with
scripts/linux/install-daemon.sh, because the Debian bundle cannot run
a post-install script. Updates for a packaged install come from your
package manager, not the in-app updater, which only works for the
AppImage.

Updates are delivered in-app and verified against the project's
minisign key before they install (on macOS the updater refreshes the
app, not the hand-installed daemon).

Desktop builds of Tenebra for Windows, macOS and Linux.

**Windows** is user-ready：run the installer (SmartScreen warns on an
unsigned build -> More info -> Run anyway); it sets up the background
service, and the in-app updater keeps both app and service current.

**macOS is for advanced users, not click-to-run yet.** The DMG alone
will NOT give you a working tunnel：macOS needs a root helper daemon
that is currently installed by hand with a sudo script
(scripts/macos/install-daemon.sh), and the build is unsigned (first
launch：System Settings -> Privacy & Security -> Open Anyway). Read
the "macOS note" in the README before downloading. A signed,
click-to-run macOS build is planned.

**Linux**：the Arch package (.pkg.tar.zst) is the click-to-run one
— `pacman -U` installs the app, the core and the systemd unit, and
`systemctl enable --now tenebra` starts the tunnel service. The .deb
and the AppImage install only the app and the core：the privileged
service still has to be set up once by hand with
scripts/linux/install-daemon.sh, because the Debian bundle cannot run
a post-install script. Updates for a packaged install come from your
package manager, not the in-app updater, which only works for the
AppImage.

Updates are delivered in-app and verified against the project's
minisign key before they install (on macOS the updater refreshes the
app, not the hand-installed daemon).

Desktop builds of Tenebra for Windows, macOS and Linux.

**Windows** is user-ready：run the installer (SmartScreen warns on an
unsigned build -> More info -> Run anyway); it sets up the background
service, and the in-app updater keeps both app and service current.

**macOS is for advanced users, not click-to-run yet.** The DMG alone
will NOT give you a working tunnel：macOS needs a root helper daemon
that is currently installed by hand with a sudo script
(scripts/macos/install-daemon.sh), and the build is unsigned (first
launch：System Settings -> Privacy & Security -> Open Anyway). Read
the "macOS note" in the README before downloading. A signed,
click-to-run macOS build is planned.

**Linux**：the Arch package (.pkg.tar.zst) is the click-to-run one
— `pacman -U` installs the app, the core and the systemd unit, and
`systemctl enable --now tenebra` starts the tunnel service. The .deb
and the AppImage install only the app and the core：the privileged
service still has to be set up once by hand with
scripts/linux/install-daemon.sh, because the Debian bundle cannot run
a post-install script. Updates for a packaged install come from your
package manager, not the in-app updater, which only works for the
AppImage.

Updates are delivered in-app and verified against the project's
minisign key before they install (on macOS the updater refreshes the
app, not the hand-installed daemon).

Desktop builds of Tenebra for Windows, macOS and Linux.

**Windows** is user-ready：run the installer (SmartScreen warns on an
unsigned build -> More info -> Run anyway); it sets up the background
service, and the in-app updater keeps both app and service current.

**macOS is for advanced users, not click-to-run yet.** The DMG alone
will NOT give you a working tunnel：macOS needs a root helper daemon
that is currently installed by hand with a sudo script
(scripts/macos/install-daemon.sh), and the build is unsigned (first
launch：System Settings -> Privacy & Security -> Open Anyway). Read
the "macOS note" in the README before downloading. A signed,
click-to-run macOS build is planned.

**Linux**：the Arch package (.pkg.tar.zst) is the click-to-run one
— `pacman -U` installs the app, the core and the systemd unit, and
`systemctl enable --now tenebra` starts the tunnel service. The .deb
and the AppImage install only the app and the core：the privileged
service still has to be set up once by hand with
scripts/linux/install-daemon.sh, because the Debian bundle cannot run
a post-install script. Updates for a packaged install come from your
package manager, not the in-app updater, which only works for the
AppImage.

Updates are delivered in-app and verified against the project's
minisign key before they install (on macOS the updater refreshes the
app, not the hand-installed daemon).