Release 1.5.0 — the exit chain

[DarkPoesidon]

Why

Cloudflare WARP is explicit that it does not change your country. It egresses near you and geolocates the exit address to your region, so a user in Iran connects successfully and still looks like they are in Iran. No setting in Aether can alter that, because the decision is Cloudflare's.

This adds the hop that can.

Verified before a line was written

Everything below was proven by running mihomo against a real subscription, not read from documentation:

without the chain:  loc=TH  colo=BKK
with the chain:     loc=JP  colo=KIX

the tunnel saw:     <node server>:8443   ← the node dialled through it
node delays:        548ms · 485ms · 601ms · one unreachable

Four things that documentation would not have told us, each of which cost a wrong turn:

• provider nodes are not listed in /proxies; they answer only under their own provider
• /proxies/{name}/delay returns 404 for them — the path is /providers/proxies/{p}/{n}/healthcheck
• mihomo converts a base64 URI subscription itself, so there is no parser here
• a wireguard:// entry in the subscription is skipped rather than failing the whole provider

The order is the design

apps → mihomo → [node] dialled through → Aether → MASQUE → Cloudflare → node → internet

Reversed, traffic leaves via Cloudflare again and nothing changes. Getting it right has two consequences worth having: the node is dialled from inside the tunnel, so local filtering sees an ordinary Cloudflare connection and never the node's address or SNI; and a node blocked from this network is still reachable, because it is reached from Cloudflare's network instead.

dialer-proxy is set per provider, so a subscription of any size arrives without rewriting a single entry.

What the dashboard shows

Every measurement travels the tunnel, so one number answers both questions the feature exists for: does this config work from behind the tunnel, and how fast is it. A failure against a row is the answer, not an error.

Subscription links are shown host-only — a link is a credential, and this screen appears in screenshots and support threads.

Three things the config must not get wrong

Each has a test, because each is silent when broken:

every source dials through the tunnel	a provider without dialer-proxy reaches nodes directly and changes nothing
nothing takes a direct route	a DIRECT rule puts that traffic on the local network
DNS resolves inside the chain	a query that escapes names the destination even when the traffic does not

The control API is loopback-only behind a secret regenerated every run. Without both, any web page the user opened could reroute their traffic.

Ordering that matters

The chain starts before the system proxy is pointed anywhere, because which listener to point at is the question the chain answers. The other order aims the machine at the tunnel while mihomo loads a subscription — traffic leaving with the wrong exit address at the moment the user believes the opposite.

It stops whenever the proxy is restored: it exists only to carry a live tunnel's traffic.

Cost

The installer grows 6.2 → 18.8 MB (measured, not estimated). mihomo is pinned to v1.19.30 and staged as a sidecar for all five architectures.

GPL-3.0, shipped as a separate process — the licence text and a source pointer need to reach the Licences page before this is released publicly.

Verification

50 backend tests, 33 frontend, tsc --noEmit clean, Windows bundle built and the sidecar confirmed beside the binary. The dashboard was driven end to end in the browser: search reaches it, the toggle explains itself, and a pasted subscription is stored with its token hidden.

Not in this one

The chain is off unless configured, so nothing changes for existing users. Selecting a node from the Simple screen, and showing the node's country on the exit card, are follow-ups.