Tunnel protocols (Xray / LibXray)

Supported outbounds

The tunnel is produced by XrayConfigBuilder.buildJSON → LibXray RunXrayFromJSON. The selected node becomes the outbound tagged proxy:

Node source	Protocols
Share links	`vless://`, `vmess://`, `trojan://`, `ss://` (Shadowsocks), `hy2://` / `hysteria2://` (Hysteria2)
JSON subscription (sing-box / xray, incl. Remnawave)	`vless`, `vmess`, `trojan`, `shadowsocks`, `hysteria` (v2) — the outbound object is stored verbatim as `sharx-xray-outbound:…`

unknown or unsupported outbounds still fail config generation.

Hysteria2 and TLS fragmentation: QUIC/Hysteria2 does not use the TLS fragment dialer (no extra freedom outbound, no dialerProxy on the proxy outbound).

Core version: hysteria outbounds and transports such as xhttp need a recent Xray-core inside LibXray; rebuild Vendor/LibXrayLocal with Scripts/build-libxray-ios.sh if needed.

Inbound and core

The template adds a tun inbound with stack: system, prefix 198.18.0.1/30, MTU 9000. The packet tunnel starts LibXray RunXrayFromJSON with JSON stored in the App Group.

The Xray-core revision referenced in Settings is listed in-app on “Core & open source” and in the Xray-core release linked there.

VLESS URL mapping

From vless://uuid@host:port?...#displayName:

Query key (case-insensitive)	Usage
`security`	`tls`, `reality`, otherwise `none`
`sni`	`serverName` for TLS/Reality
`fp`	`fingerprint` (default `chrome`)
`type`	Transport: `tcp` (default), `ws`, `grpc`, `xhttp`
`path`	WS path (default `/`)
`host`	WS `Host` header (fallback: `sni`/host)
`serviceName`	gRPC service name
`pbk`, `sid`, `spx`	Reality `publicKey`, `shortId`, `spiderX` (`spx` default `/`)
`flow`	VLESS user `flow` when non-empty

UUID comes from the URL user component; the VLESS user field that would hold a cipher id is always none in this client.

For type=xhttp, path, host, optional mode, and extra (URL-encoded JSON) follow common XHTTP link conventions.

Other schemes (short)

VMess — classic vmess:// Base64 JSON (add, port, id, net, tls, path, host, …).
Trojan — trojan://password@host:port?... (same query style as VLESS for TLS/Reality/WS/gRPC/xhttp).
Shadowsocks — ss:// (including base64 userinfo @host:port).
Hysteria2 — hy2:// / hysteria2:// with query sni, insecure, alpn, password in userinfo.

DNS and routing block

When no routing profile is active/selected, DNS defaults to 1.1.1.1 and 8.8.8.8, and traffic uses the proxy outbound without split rules.

See routing-profile-schema.md for profile fields.