SurgeBeta

Updates on the latest beta version of Surge App

[SurgeBeta @SurgeBeta]

iOS TestFlight Updates
New Feature: Terminal
You can now operate Surge directly through the CLI on Surge iOS.
- CLI mode includes a comprehensive set of debugging and diagnostic tools for troubleshooting. For example, the rule explain command can be used to inspect how rules are evaluated and how policy groups make their decisions.
- The new virtual Terminal provides a full interactive experience, including command auto-completion and history. For details on available commands, refer to the Surge Manual or simply run help in the Terminal.

Other reasons why you might want to use Surge from the CLI:
- It’s cool. Maybe even cooler when you’re using it on an iPhone Fold later this year.
- Bringing full CLI capabilities to iOS also lays the groundwork for future AI Agent features on Surge iOS.

New Icons: Arctic & Pulse
- The former Surge Enterprise icon now has a new name: Arctic, and is available for everyone to use.
- Added a new icon: Pulse.

[SurgeBeta @SurgeBeta]

Prometheus Metrics Endpoint
Surge now provides a Prometheus-compatible metrics endpoint at GET /v1/metrics, making it easy to integrate Surge with Prometheus and Grafana for long-term monitoring and visualization. This is particularly useful for gateway deployments that run continuously.

The endpoint exposes cumulative traffic counters for each network interface and policy (surge_interface_*_bytes_total and surge_policy_*_bytes_total), which can be combined with PromQL functions such as rate() for real-time throughput or increase() for traffic usage over any time window.

It also provides metrics for the Surge engine��s memory footprint (surge_memory_bytes), in-flight requests, DNS cache size, active unauthorized-access bans, uptime, and build information. The memory metric can be especially useful on iOS for monitoring Network Extension memory usage over time.

The metrics endpoint uses the same authentication mechanism as the rest of the Surge HTTP API. Since Prometheus does not send custom authentication headers by default, the API key can also be supplied through the x-key query parameter:

```
scrape_configs:
- job_name: surge
metrics_path: /v1/metrics
params:
x-key: ["<your-http-api-key>"]
static_configs:
- targets: ["192.168.1.1:6171"]
```

[SurgeBeta @SurgeBeta]

Group-Level Proxy Chaining
Surge now supports the group-level underlying-proxy parameter, allowing you to configure a proxy chain for an entire policy group in one place. Every member of the group will connect through the specified policy, including members imported via policy-path, include-all-proxies, and include-other-group.

Chained members are represented as derived policies such as Name (via Relay), each with its own independent latency test result. This means automatic policy groups can select the best node based on its actual performance through the complete proxy chain, rather than the performance of the node alone.

The new option is also fully integrated into the policy group editor UI.

Previously, similar behavior could be achieved with external-policy-modifier="underlying-proxy=...", but that approach only applied to members loaded through policy-path. The new group-level parameter works with members from all sources, provides explicit misconfiguration reporting, and is available as a first-class option in the UI. The existing external-policy-modifier syntax remains supported for backward compatibility.

Please refer to the manual for a detailed comparison and configuration examples:
https://t.co/wHzlq3TgeD

[SurgeBeta @SurgeBeta]

Protocol Updates
- Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP for UDP datagrams.
- Added UDP relay support to HTTP/2 CONNECT proxies with `udp-relay=true`.
- Added HTTP/3 transport support to TrustTunnel with `h3=true`.

[SurgeBeta @SurgeBeta]

Surge CLI Updates
As Surge CLI becomes a key foundation for integrating AI capabilities with Surge, we are continuing to expand and refine it.

The interactive CLI now supports command history and auto-completion, making it significantly more convenient for both everyday use and exploratory workflows.

We’ve also added a new set of useful commands, including rule match and rule explain, which let Surge answer a common debugging question without generating any real traffic: “Why would this request go through that policy?”

**rule match**

rule match performs a dry-run evaluation against the active rule set and reports the matched rule and final policy.

All relevant matching attributes — including hostname or URL, port, process path, source address, client MAC, protocol, and more — can be supplied as key=value options. This makes it possible to reproduce exactly how a specific request or client would be routed.

Combined with --raw, it can also be used in scripts to audit an entire list of domains against your current rules.

**rule explain**

rule explain goes a step further by showing why a particular policy was selected.

It traces the complete policy-group resolution path and reports every decision along the way, including manual selections, automatic test results, overrides, load-balancing decisions, Smart Group selections, the underlying proxy chain, DNS evaluation notes, and timing information.

Use rule match for quick checks and scripting, and rule explain when you need to inspect the complete decision path.

And there’s more coming: starting with the next iOS TestFlight build, Surge CLI will be able to operate Surge directly on iOS. Stay tuned.