Features
From subscriptions and nodes to routing and monitoring. Understand what makes up each connection.
Platform support matrix
Each device maps to its own capability set: OS, CPU, TUN, dual cores and auto update. Check the matrix before picking the machine.
| Capability | macOSApple Silicon | Windowsx64 | Linuxx86_64（Community experiment） | iOSIn development |
|---|---|---|---|---|
| Installer | DMG（signed & notarized） | EXE（unsigned） | TAR.GZ（community archive） | not publicly distributed yet |
| System proxy | ✓ automatic snapshot & restore | ✓ automatic snapshot & restore | ✗ manual setup | — |
| TUN mode | ✓ admin authorization | ✓ system-service backed | experimental systemd / polkit service | — |
| Dual cores | ✓ | ✓ | ✓ | — |
| In-app auto update | ✓ | ✓ | ✗ manual download | — |
| Current status | Fully supported | Fully supported | Community experiment | In development |
Update contents follow each platform's release notes. For Linux acceptance boundaries and setup steps seeLinux support scope.
Node selection & latency tests
Find a suitable node by region, name, or latency. Keep automatic selection or pick a node manually.
- Group nodes by region, then narrow the list with name search, available-only filtering, and latency sorting.
- Test one node or an entire group, with distinct testing, success, and timeout states.
- Manually pin a node in an automatic group, then use Restore automatic to let the core choose again.
- On macOS, switch nodes and view latency from the tray without reopening the main window.
Subscriptions
Import by URL, paste, file, drag and drop, or deep link. Track usage and expiry. Failed automatic updates keep the previous configuration and retry with exponential backoff.
- Validate on import. Invalid formats report an error without overwriting the working configuration.
- Subscription cards show remaining traffic and expiry, with a warning as expiry approaches.
- Set update intervals per subscription (six hours by default). Failed updates keep existing nodes and the previous configuration.
- Use crossbow://import?url=… deep links to import directly from a sharing page.
- Switch imported profiles directly from the top profile selector. Check the outbound and takeover state in Overview afterward.
- Profile details show the last successful update, the next update or retry, and the latest failure reason. Update summaries count added, removed, and changed nodes.
System proxy protection
On macOS / Windows, snapshot settings before enabling the proxy and restore them on exit or crash. Recover automatically when the core fails.
- Journal the original HTTP, HTTPS, and SOCKS settings for each network service before enabling the proxy.
- After an exit, crash, or forced termination, the next launch restores the original settings first.
- If the core crashes, restore the system proxy and report the problem. Configuration errors caused by overrides trigger safe mode, restarting once without overrides.
- If another program holds the mixed port, report the conflict before startup instead of leaving the interface stuck on Starting.
TUN mode
Capture more app traffic through a virtual interface. On macOS / Windows, TUN can run with Crossbow’s system proxy. The Linux preview needs a separate service.
- macOS needs administrator authorization on first use. Windows needs the background service. After setup, control TUN from the interface.
- TUN and Crossbow’s system proxy can run together. Disable TUN in other proxy apps or VPNs first to avoid route conflicts.
- The Linux preview runs mihomo TUN through systemd / polkit. Full validation across desktops and real network conditions is still in progress.
- If another VPN or proxy owns the tunnel routes, disable its TUN first. For a lost connection, follow the repository’s offline recovery guide.
Network diagnostics
Check the core, controller, configuration, port, system proxy, proxy connectivity, and DNS in dependency order. Find the first blocker before proceeding.
- Check the core, controller readiness, configuration, listening port, system proxy destination, proxy connectivity, and DNS in that order.
- Each step shows checking, passed, failed, or skipped. Results prioritize the first blocker with an available repair action or a link to configuration.
- Diagnostic results remain in the current app session. Run the checks again after a repair to verify dependent steps.
JS overrides
Transform subscriptions with function main(config): filter nodes, rewrite rules, or inject configuration. Validate on save and locate errors immediately.
- Run a sandboxed JS engine without network or file access. Overrides transform only the subscription configuration.
- Use scripts and Merge patches together, with multiple overrides bound to specific subscriptions.
- A trial run on save reports syntax and runtime errors with line information.
- An override failure triggers safe mode, restarting the core with overrides disabled. Fix and save the script to restore normal operation.
Lightweight mode
Close the window while the core and proxy keep running. Release interface memory and restore the current state when you reopen, with tray controls always available.
- The GUI retains tray controls and core management while releasing WebView memory.
- The detached core stays alive. Reopening Crossbow adopts it and restores the current state.
- Live menu bar traffic on macOS continues in lightweight mode.
Live monitoring
Menu bar rates, traffic charts, per-process usage, individual connection controls, and filtered logs show what is happening.
- On macOS, upload and download rates appear on two lines, with a fixed width to avoid jitter.
- Overview shows live traffic charts, totals, the current exit node, and its latency.
- The Connections page groups traffic by process and lets you close individual connections.
- Open a connection row for its full target, matched rule, routing chain, and process path. Copy fields or all details, sort by traffic, search, and pause refresh.
- Select multiple log levels, filter by keyword, pause following, jump to the bottom, and copy individual entries. Export the filtered results as redacted logs.
- Test YouTube, X, Google, and GitHub from Nodes, with the test time and outbound recorded. Path changes prompt a retest; HTTP restrictions are distinguished from connection failures.
Two proxy cores
Use mihomo for broad ecosystem compatibility or sing-box for its protocol support. Download and switch from within the app.
- Download the desired core in Settings (about 20 MB, with mirror support). A core must be installed before switching to it.
- Switching restarts the core and converts the configuration automatically. sing-box uses JSON with a Clash-compatible API.
- sing-box rule sets (geoip/geosite) are downloaded automatically, cached locally, and updated daily.
- Tray rates and connection monitoring continue after a core switch.
Important results. Less noise.
Keep errors, actionable problems, and background progress together. Visible changes such as theme or language switches stay quiet.
- The bell indicates unread items. The notification center organizes open issues and recent events, merges repeated failures, and keeps recovery in the same record.
- Updates, core downloads, and latency tests share progress feedback. Dismissing a notification does not cancel the task; failures remain available for review.
- Technical details are redacted and can be copied, with shortcuts to Settings, Logs, or Diagnostics. History is limited to recent records in the current session, not a permanent log.
- Linux native background notification improvements are on main. They use desktop notifications rather than focus-stealing overlays. Check the release notes for availability in your installed version.
Configuration snapshots and recovery
Keep the five most recent configuration snapshots before saving. Review their time and profile and override counts, then choose a version to restore.
- Open Configuration → Configuration recovery to review snapshots and confirm the impact before restoring.
- Restore subscriptions, local profiles, overrides, and the active profile while preserving appearance, ports, engine, and takeover settings.
- The current version is snapshotted first. A running core may reload or briefly restart. Automatic snapshots do not replace a data-directory backup before upgrading.
App updates with your confirmation
Check, download, and install updates in the macOS and Windows app. Checking a version and downloading it are separate actions.
- A manual Check for updates only checks the version. Choose Download to proceed, even when automatic downloads are enabled.
- Configure automatic checks and downloads separately. Automatic downloads apply to scheduled checks; a completed download prompts a restart to install.
- The Linux preview requires a new archive from the release page. See the guide for Windows installation and service details.
Appearance and connection settings
Choose light, dark, or system appearance and Chinese or English. Adjust the port and local network access for your setup.
- Change the theme and language in app settings. System appearance follows device light and dark changes.
- HTTP and SOCKS5 share the mixed port. Apply a change with Apply or Enter; moving focus does not save.
- With Allow LAN enabled, devices on the same network can use this computer’s LAN IP and mixed port. The system firewall must allow access.
A community-built Linux preview
An x86_64 TAR.GZ is available, mainly tested on CachyOS with niri / Wayland as desktop support improves.
- The archive includes the GUI, mihomo, and optional service scripts. Run as a regular user and manually set HTTP / SOCKS proxies in your browser or terminal.
- TUN needs the systemd / polkit service and currently uses mihomo. Linux does not yet offer a system proxy switch, AppImage / DEB packages, or in-app updates.
- Full host TUN on niri, suspend/resume, and other desktop environments still need validation. This preview is intended for testers willing to share feedback.
Take your setup further
Explore JS overrides, core switching, and deep-link imports.