Guide

From switching cores to writing overrides, find the next step for your setup.

Quick start: install → import → pick a node → take over → verify

First time? Follow these five steps. Advanced topics (dual cores, JS overrides) come later in the guide and can wait.

1

Install

On macOS download the DMG and drag it into Applications; on Windows run the installer; on Linux unpack the archive and run run.sh. Installers come from GitHub Releases.For support boundaries see Platform support matrix.
2

Import a subscription

Paste a subscription URL on the Config page, or drag a .yaml file into the window. Imports are validated on the spot; set an update interval once and forget it.
3

Pick a node

Pick a node by region or latency on the Nodes page, or keep Auto select and let the core decide.
4

Take over the network

Turn on the system proxy on the overview for everyday browsing; enable TUN only when you need to take over more apps (macOS asks for admin once, Windows installs a service first).
5

Verify

Confirm the exit and rates on the overview, run a delay test on the Nodes page, then verify with a real browser visit. When something doesn't connect, open Diagnostics.

Two cores: mihomo ↔ sing-box

Crossbow supports mihomo and sing-box. Before switching, check that the target core supports your subscription’s protocols and rules. Configuration formats are converted automatically, followed by a core restart.

01

Download a core

Settings → Core engine → sing-box → Download core (about 20 MB, with mirror support). Already installed cores are not downloaded again.
02

Switch cores

Choose the target engine in Settings → Network & core and download it if missing. After installation, apply the engine. A running core reloads or restarts, with configuration converted for that engine.
03

Before switching

Check that the target core supports your node types. Both cover most common protocols; for less common ones, consider staying on mihomo. sing-box rule sets (geoip/geosite) are downloaded and updated daily.

JS overrides: make the configuration yours

Configuration → Overrides → New override → JS script. Write function main(config) and return the transformed configuration. Scripts run in a sandbox without network or file access and are tested on save.

  • Prerequisite: your subscription contains nodes whose names include 香港 (HK) or JP — otherwise the filtered list is empty.
  • The sample rules reference an AUTO group that must exist in your subscription; if the name differs, adjust the rules or remove the reference — the dry run on save exposes dangling references.
function main(config) {
  // Keep nodes whose names include 香港 (Hong Kong) or JP.
  config.proxies = config.proxies.filter(p =>
    /香港|JP/.test(p.name)
  );

  // Route streaming through 自动选择 (Auto select), then use MATCH.
  config.rules = [
    "DOMAIN-SUFFIX,netflix.com,自动选择",
    "GEOIP,CN,DIRECT",
    "MATCH,自动选择",
  ];
  return config;
}
01

Write & bind

Create a script → paste the code → Save (syntax and runtime checks run automatically) → bind it to the current subscription and enable it.
02

Apply overrides in order

Enable multiple overrides and Merge patches together. They are applied to the subscription in list order.
03

Recover from an error

If an override prevents startup, safe mode temporarily disables all overrides and restarts the core. Fix and save the script to return to normal.

Live menu bar traffic

When the core is running, the macOS menu bar shows upload and download rates, refreshed every second in a compact, fixed-width layout. It also works in lightweight mode and disappears when the core stops. This feature is currently macOS-only.

Mixed port & bypass rules

The shared HTTP and SOCKS5 port defaults to 7897. In Settings → Network & core, choose Edit beside the port, then Apply or press Enter. Escape cancels; moving focus does not save. A running core may briefly restart. The system proxy bypasses local and private network addresses.

If another proxy app holds port 7897, startup reports the conflict. Choose an unused port in Settings.

To share the proxy with devices on the same network, enable Allow LAN and use this computer’s LAN IP and mixed port. This listens on 0.0.0.0; enable it only on trusted networks and review the system firewall rules.

Linux preview: check the support scope first

The community x86_64 archive is mainly tested on CachyOS + niri / Wayland. Thanks to YangYuS8 for the adaptation and field feedback. Other distros and desktop environments are not fully verified yet.

01

Extract & run as a regular user

From the Download page, get the TAR.GZ, verify SHA256SUMS, extract it, and run ./run.sh. Do not launch the GUI as root. AppImage / DEB packages and in-app updates are not available yet.
02

Set the app proxy manually

Import a subscription and choose a working node. Set the browser or terminal HTTP / SOCKS proxy to 127.0.0.1 and the port shown in Crossbow Settings. The Linux preview does not change desktop proxy settings automatically. Check the core path with the site connectivity tests first.
03

Install the service if you need TUN

With systemd / polkit and mihomo, follow the repository’s Linux networking guide to install the optional service. Full host TUN, suspend/resume, and other desktop scenarios are still being validated. Prepare a recovery plan first, and avoid running another VPN’s TUN at the same time.

Release and development status differ. Linux background work after closing the window, cold-start deep links, and native notification improvements are on main. Check whether your downloaded version includes them in the release notes. Detailed validation records are in the Linux testing document.

Choosing between the system proxy and TUN

On macOS / Windows, start with the system proxy in Overview for everyday browsing. Enable TUN in Settings for apps that ignore system proxy settings. Both can run together with independent controls. After disabling TUN, check the system proxy state and connectivity.

01

Before enabling

Disable TUN in Clash Verge or any other VPN first, and check that your configuration and node work. Before testing recovery, prepare a backup proxy using the offline recovery guide.
02

Enable & verify

Settings → TUN mode → On. macOS requires administrator authorization on first use; Windows needs the background service installed. Open a website and inspect logs and menu bar rates to verify that traffic passes through the core.
03

Disable or recover

After disabling TUN, check that the original system proxy settings and connection are restored. If connectivity is lost during testing, run the repository’s offline recovery commands. These commands depend on a backup proxy that is still running.

Lightweight mode & tray

Enable Lightweight mode in Settings. Closing the window keeps the proxy and tray running while releasing interface memory. Click the tray icon to reopen. Use Quit in the tray menu to exit completely. A running core is handed off and adopted again on the next launch.

Track actionable problems in the notification center

Click the bell to see recent notifications. Unread and unresolved are different states: marking everything as read does not fix a failure. Once it is fixed through Diagnostics or Settings, the original record shows recovery.

Theme, language, and routine setting changes do not repeat success messages. Tasks continue after you dismiss progress notifications; failures offer redacted details. Records last only for the current session. Use logs for longer-term investigation.

Subscription updates: see what changed

Select a subscription in Configuration → Sources. Review its update status before requesting a manual update.

01

Review update times

Details show the last success and next update or retry time. Turn automatic updates off or choose a 6, 12, or 24 hour interval.
02

Failures and node changes

Failed updates keep the previous configuration and show the latest failure reason. Successful updates report added, removed, and changed node counts.

Restore a configuration snapshot

The five most recent snapshots are kept before saving. Choose Configuration recovery on the Configuration page and select a restore point by time and contents.

01

Confirm the scope

Recovery replaces subscriptions, local profiles, overrides, and the active profile. Appearance, ports, engine, and takeover settings are preserved. Snapshot entries show profile and override counts.
02

Check the connection afterward

The current version is snapshotted first; a running core may reload or briefly restart. After recovery, check the active profile, node, and diagnostic results. Keep a separate data-directory backup before upgrading.

Troubleshoot using connection evidence

Core operation, traffic takeover settings, and network connectivity are different states. A running core does not prove that a browser can reach a website.

01

Start with the first diagnostic blocker

Open Monitoring → Diagnostics or the top Diagnostics button. Review checking, passed, failed, and skipped steps. Address the first blocker with its available repair action or configuration link, then run the checks again.
02

Inspect connections and logs

In Monitoring → Connections, search targets, rules, chains, or processes. Open a row to copy its full details. In Logs, select levels and keywords, pause following to read, copy an entry, or export the filtered results as redacted logs.
03

Read site tests in context

Site connectivity tests in Nodes retain the time and outbound. Retest after changing paths. An HTTP restriction means the target responded but limited access; it differs from a connection failure and does not prove the browser uses the proxy.

In-app updates: check, download, install

On macOS and Windows, check the version in Settings → App & updates. The Linux preview requires a new archive downloaded manually.

01

Confirm a download after a manual check

Check for updates only checks the version. Choose Download when a new version is found, then follow the restart prompt to install. Manual checks wait for confirmation even when automatic downloads are enabled.
02

Set background update preferences

Configure automatic checks and downloads separately. Scheduled checks run about 30 seconds after startup and every 6 hours afterward. Automatic downloads apply only to these scheduled checks.

Windows installation and the TUN service

The Windows x64 installer includes CrossbowService, which is required for TUN. If installation or an update reports locked files, close other Crossbow instances and retry as instructed. Use the full installer to repair a missing service. Check the release notes for signing and support details.

Windows installation, service, and upgrade guide ↗

Where configuration & data live

On macOS, data is stored in ~/Library/Application Support/com.richard.crossbow/: store.json (subscriptions, settings, and overrides, with five snapshots kept before saving), runtime/ (runtime state and logs), and binaries/ (core binaries). Data from com.crossbow.app data migrates automatically; backing up the new directory before an upgrade is a good idea.

Not installed yet?

Free and open source, with macOS Apple Silicon, Windows x64, and experimental Linux x86_64 packages.

Download Crossbow Design documents (DESIGN / MVP)