Release 7.0.8-beta

src/Titanium.Cli/Titanium.Cli.csproj

@@ -7,7 +7,7 @@
     <LangVersion>latest</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <SignAssembly>false</SignAssembly>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>Titanium Web Proxy CLI (titanium / twp).</Description>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>

src/Titanium.Inspector/Titanium.Inspector.csproj

@@ -8,7 +8,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
     <SignAssembly>false</SignAssembly>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>Titanium Inspector desktop traffic debugger (PolyForm Noncommercial).</Description>
     <PackageLicenseFile>LICENSE</PackageLicenseFile>

src/Titanium.Inspector/ViewModels/MainWindowViewModel.cs

@@ -977,23 +977,16 @@
             return;
         }
 
-        var (saved, kind, _) = await AwaitCancellableAsync(ExcludeHostDialog.ShowAsync(owner, _settings, selected.Host));
+        var (saved, _) = await AwaitCancellableAsync(ExcludeHostDialog.ShowAsync(owner, _settings, selected.Host));
         if (!saved)
         {
             StatusText = "Exclude host cancelled";
             return;
         }
 
         ApplyExclusionSettingsFromSettings();
-        if (kind == ExcludeHostKind.BypassProxy && SystemProxy)
-        {
-            _interception.ReapplySystemProxyIfEnabled();
-        }
-
         UpdateExclusionSummary();
-        StatusText = kind == ExcludeHostKind.BypassProxy
-            ? $"Added {selected.Host} to OS bypass exclusions (new connections)"
-            : $"Added {selected.Host} to tunnel-only exclusions (new connections)";
+        StatusText = $"Excluded {selected.Host} — still listed, HTTPS not read";
     }
 
     private async Task ResetSettingsAsync()
@@ -1378,7 +1371,7 @@
     public bool SystemProxy
     {
         get => _systemProxy;
         set // NOSONAR S4275 -- fail paths leave _systemProxy unchanged and re-raise PropertyChanged to snap the checkbox back
         {
             if (_systemProxy == value)
             {
@@ -1461,17 +1454,17 @@
 
             if (SystemProxy && !_interception.ReapplySystemProxyIfEnabled())
             {
-                StatusText = "Proxy localhost saved; re-toggle System proxy to apply";
+                StatusText = "Capture local traffic saved; re-toggle System proxy to apply";
                 return;
             }
 
             StatusText = value
-                ? "Proxy localhost on — loopback uses the system proxy"
-                : "Proxy localhost off — loopback skips the system proxy";
+                ? "Capture local traffic on — localhost uses the system proxy"
+                : "Capture local traffic off — localhost skips the system proxy";
         }
     }
 
     public string ProxyLocalhostTip => OsTrustUxCopy.ProxyLocalhostTip();
 
     public bool AutoStartCapture
     {
@@ -1560,7 +1553,7 @@
     public bool DecryptHttps
     {
         get => _decryptHttps;
         set // NOSONAR S4275 -- true path updates _decryptHttps via SetDecryptHttpsCore after async trust flow
         {
             if (_decryptHttpsBusy || _decryptHttps == value)
             {

src/Titanium.Inspector/Views/ExcludeHostDialog.axaml

@@ -3,26 +3,19 @@
         x:Class="Titanium.Inspector.Views.ExcludeHostDialog"
         AutomationProperties.AutomationId="ExcludeHostDialog"
         Title="Exclude host"
-        Width="440" Height="280"
+        Width="440" Height="220"
         WindowStartupLocation="CenterOwner"
         CanResize="False">
   <DockPanel Margin="16">
     <StackPanel DockPanel.Dock="Bottom" Orientation="Horizontal" HorizontalAlignment="Right" Spacing="8" Margin="0,16,0,0">
-      <Button x:Name="SaveButton" Content="Add" MinWidth="88" AutomationProperties.AutomationId="ExcludeHostAdd" />
+      <Button x:Name="SaveButton" Content="Exclude" MinWidth="88" AutomationProperties.AutomationId="ExcludeHostAdd" />
       <Button x:Name="CancelButton" Content="Cancel" MinWidth="88" IsCancel="True" AutomationProperties.AutomationId="ExcludeHostCancel" />
     </StackPanel>
     <StackPanel Spacing="10">
       <TextBlock x:Name="HostLabel" FontWeight="SemiBold" />
-      <RadioButton x:Name="TunnelOnlyRadio" GroupName="ExcludeKind" IsChecked="True"
-                   Content="Tunnel only (recommended) — stays visible, no decrypt"
-                   AutomationProperties.AutomationId="ExcludeHostTunnelOnly" />
-      <RadioButton x:Name="BypassProxyRadio" GroupName="ExcludeKind"
-                   Content="Bypass proxy (System proxy) — hidden from session list"
-                   AutomationProperties.AutomationId="ExcludeHostBypassProxy" />
-      <TextBlock x:Name="BypassWarning" TextWrapping="Wrap" Foreground="OrangeRed" FontSize="12"
-                 IsVisible="False"
-                 Text="Traffic will not appear in Inspector. Requires System proxy to be on." />
-      <CheckBox x:Name="WildcardParentCheck" Content="Also add *.parent-domain.com"
+      <TextBlock TextWrapping="Wrap" Opacity="0.9"
+                 Text="This host will still appear in the session list. Inspector will not try to read its HTTPS." />
+      <CheckBox x:Name="WildcardParentCheck"
                 AutomationProperties.AutomationId="ExcludeHostWildcardParent" />
     </StackPanel>
   </DockPanel>

src/Titanium.Inspector/Views/ExcludeHostDialog.axaml.cs

@@ -4,15 +4,10 @@
 
 namespace Titanium.Inspector.Views;
 
-public enum ExcludeHostKind
-{
-    TunnelOnly,
-    BypassProxy,
-}
-
 public partial class ExcludeHostDialog : Window
 {
     private readonly SettingsService _settings;
+    private readonly string _hostname;
     private bool _saved;
 
     public ExcludeHostDialog() : this(SettingsService.Load(), "")
@@ -22,64 +17,57 @@ public ExcludeHostDialog() : this(SettingsService.Load(), "")
     public ExcludeHostDialog(SettingsService settings, string hostname)
     {
         _settings = settings;
+        _hostname = hostname.Trim();
         InitializeComponent();
-        HostLabel.Text = $"Exclude: {hostname}";
+        HostLabel.Text = _hostname;
+        var parent = ExtractParentDomain(_hostname);
+        if (string.IsNullOrEmpty(parent))
+        {
+            WildcardParentCheck.IsVisible = false;
+        }
+        else
+        {
+            WildcardParentCheck.Content = "Also exclude other hosts on " + parent;
+        }
+
         SaveButton.Click += OnSave;
         CancelButton.Click += (_, _) => Close();
-        BypassProxyRadio.IsCheckedChanged += (_, _) => UpdateWarning();
-        TunnelOnlyRadio.IsCheckedChanged += (_, _) => UpdateWarning();
     }
 
     public bool Saved => _saved;
-    public ExcludeHostKind SelectedKind =>
-        BypassProxyRadio.IsChecked == true ? ExcludeHostKind.BypassProxy : ExcludeHostKind.TunnelOnly;
 
-    public static async Task<(bool Saved, ExcludeHostKind Kind, bool WildcardParent)> ShowAsync(
+    public static async Task<(bool Saved, bool WildcardParent)> ShowAsync(
         Window owner,
         SettingsService settings,
         string hostname)
     {
         var w = new ExcludeHostDialog(settings, hostname);
         await w.ShowDialog(owner);
-        return (w.Saved, w.SelectedKind, w.WildcardParentCheck.IsChecked == true);
+        return (w.Saved, w.WildcardParentCheck.IsChecked == true);
     }
 
-    private void UpdateWarning() =>
-        BypassWarning.IsVisible = BypassProxyRadio.IsChecked == true;
-
-    private void OnSave(object? sender, RoutedEventArgs e) // NOSONAR S3776 -- Dialog save writes bypass and decrypt-skip lists together.
+    private void OnSave(object? sender, RoutedEventArgs e)
     {
-        var host = HostLabel.Text?["Exclude: ".Length..].Trim();
-        if (string.IsNullOrWhiteSpace(host))
+        if (string.IsNullOrWhiteSpace(_hostname))
         {
             Close();
             return;
         }
 
-        var patterns = new List<string> { host };
-        if (WildcardParentCheck.IsChecked == true)
+        var patterns = new List<string> { _hostname };
+        if (WildcardParentCheck.IsVisible && WildcardParentCheck.IsChecked == true)
         {
-            var parent = ExtractParentDomain(host);
+            var parent = ExtractParentDomain(_hostname);
             if (!string.IsNullOrEmpty(parent))
             {
                 patterns.Add("*." + parent);
             }
         }
 
         var s = _settings.Current;
-        if (SelectedKind == ExcludeHostKind.BypassProxy)
-        {
-            foreach (var p in patterns.Where(p => !s.SystemProxyBypassHosts.Contains(p, StringComparer.OrdinalIgnoreCase)))
-            {
-                s.SystemProxyBypassHosts.Add(p);
-            }
-        }
-        else
+        foreach (var p in patterns.Where(p => !s.DecryptSkipHosts.Contains(p, StringComparer.OrdinalIgnoreCase)))
         {
-            foreach (var p in patterns.Where(p => !s.DecryptSkipHosts.Contains(p, StringComparer.OrdinalIgnoreCase)))
-            {
-                s.DecryptSkipHosts.Add(p);
-            }
+            s.DecryptSkipHosts.Add(p);
         }
 
         _settings.Save();

src/Titanium.Inspector/Views/ExcludedHostsWindow.axaml

@@ -28,26 +28,26 @@
                  FontFamily="Consolas,Courier New,monospace"
                  AutomationProperties.AutomationId="ExcludedBypassHosts" />
 
-        <TextBlock FontWeight="SemiBold" Text="Tunnel only (no decrypt)" />
+        <TextBlock FontWeight="SemiBold" Text="Not decrypted hosts" />
         <TextBlock Opacity="0.75" TextWrapping="Wrap"
                    Text="CONNECT stays visible; TLS stays opaque when Decrypt HTTPS is on. Seeded with certificate-pinning hosts (Dropbox, Webex)." />
         <TextBox x:Name="SkipHostsBox" AcceptsReturn="True" TextWrapping="Wrap" MinHeight="72"
                  Watermark="dropbox.com&#x0a;webex.com"
                  FontFamily="Consolas,Courier New,monospace"
                  AutomationProperties.AutomationId="ExcludedSkipHosts" />
 
-        <TextBlock FontWeight="SemiBold" Text="Auto-tunnel on decrypt failure" />
-        <CheckBox x:Name="LearningEnabledCheck" Content="Learn hosts that fail origin TLS under decrypt (session only)"
+        <TextBlock FontWeight="SemiBold" Text="Automatically not decrypt on decrypt failure" />
+        <CheckBox x:Name="LearningEnabledCheck" Content="Learn hosts that fail origin TLS under decrypt"
                   AutomationProperties.AutomationId="ExcludedLearningEnabled" />
         <TextBlock Opacity="0.75" TextWrapping="Wrap"
-                   Text="When origin TLS fails repeatedly under decrypt, or MITM HTTPS returns 403/429 (document pages auto-retry onto a tunnel; APIs need repeated blocks), Inspector stops decrypting that host for later connections in this session. Prefetch is skipped once a host is learned. List is capped and forgotten on restart unless you promote. Certificate-pinning apps still belong on Tunnel only." />
+                   Text="When origin TLS fails repeatedly under decrypt, or the origin server returns 403/429, Inspector stops decrypting that host for later connections in this session. List is capped and forgotten on restart unless you promote." />
         <TextBlock x:Name="LearningPausedBanner" IsVisible="False" Opacity="0.85" TextWrapping="Wrap"
                    Text="Learning paused — existing entries kept until forgotten." />
         <ListBox x:Name="LearnedList" MinHeight="96" MaxHeight="180"
                  AutomationProperties.AutomationId="ExcludedLearnedList" />
         <TextBlock x:Name="LearnedEmptyText" Opacity="0.6" Text="No hosts learned yet." />
         <StackPanel Orientation="Horizontal" Spacing="8">
-          <Button x:Name="PromoteLearnedButton" Content="Promote to tunnel-only" MinWidth="140"
+          <Button x:Name="PromoteLearnedButton" Content="Add to not decrypted hosts" MinWidth="160"
                   AutomationProperties.AutomationId="ExcludedLearnedPromote" />
           <Button x:Name="ForgetLearnedButton" Content="Forget" MinWidth="88"
                   AutomationProperties.AutomationId="ExcludedLearnedForget" />

src/Titanium.Inspector/Views/MainWindow.axaml

@@ -47,7 +47,7 @@
                   IsChecked="{Binding SystemProxy, Mode=OneWay}"
                   Command="{Binding ToggleSystemProxyCommand}"
                   AutomationProperties.AutomationId="MenuToggleSystemProxy" />
-        <MenuItem Header="Proxy localhost" ToggleType="CheckBox"
+        <MenuItem Header="Capture local traffic" ToggleType="CheckBox"
                   IsChecked="{Binding ProxyLoopback, Mode=OneWay}"
                   Command="{Binding ToggleProxyLocalhostCommand}"
                   ToolTip.Tip="{Binding ProxyLocalhostTip}"

src/Titanium.Plus/Titanium.Plus.csproj

@@ -7,7 +7,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <SignAssembly>True</SignAssembly>
     <AssemblyOriginatorKeyFile>StrongNameKey.snk</AssemblyOriginatorKeyFile>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>Titanium Web Proxy Plus advanced features plugin (PolyForm Noncommercial).</Description>
     <PackageLicenseFile>LICENSE</PackageLicenseFile>

src/Titanium.Web.Proxy.Abstractions/Titanium.Web.Proxy.Abstractions.csproj

@@ -7,7 +7,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <SignAssembly>True</SignAssembly>
     <AssemblyOriginatorKeyFile>StrongNameKey.snk</AssemblyOriginatorKeyFile>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>Shared contracts for Titanium Web Proxy routing, clusters, middleware, and plugins.</Description>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>

src/Titanium.Web.Proxy.Configuration/Titanium.Web.Proxy.Configuration.csproj

@@ -7,7 +7,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <SignAssembly>True</SignAssembly>
     <AssemblyOriginatorKeyFile>StrongNameKey.snk</AssemblyOriginatorKeyFile>
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <Authors>Jehonathan Thomas</Authors>
     <Description>YAML/JSON configuration binding for Titanium Web Proxy CLI and reverse-proxy documents.</Description>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>

src/Titanium.Web.Proxy/Properties/AssemblyInfo.cs

@@ -77,5 +77,5 @@
 // file-properties version disagreed with the package it was published in. Keep both of the values
 // below equal to <VersionPrefix> (as Major.Minor.Build.0) whenever that property changes.
 
-[assembly: AssemblyVersion("7.0.7.0")]
-[assembly: AssemblyFileVersion("7.0.7.0")]
+[assembly: AssemblyVersion("7.0.8.0")]
+[assembly: AssemblyFileVersion("7.0.8.0")]

src/Titanium.Web.Proxy/Titanium.Web.Proxy.csproj

@@ -13,7 +13,7 @@
     <!-- Keep in sync with the AssemblyVersion/AssemblyFileVersion attributes in
          Properties/AssemblyInfo.cs on every bump - GenerateAssemblyInfo is false below, so the SDK
          does not derive those attributes from this property automatically. -->
-    <VersionPrefix>7.0.7</VersionPrefix>
+    <VersionPrefix>7.0.8</VersionPrefix>
     <!-- The library itself is the canonical implementation of the TWP001 experimental HTTP/3 APIs.
          Suppress the diagnostic internally; consumers will still see it. -->
     <!--

tests/Titanium.E2E.Tests/CliCommandE2ETests.cs

@@ -126,7 +126,7 @@ public async Task Version_Prints70()
         using var harness = new CliProcessHarness();
         var (code, stdout, _) = await harness.RunOnceAsync(["version"]);
         Assert.AreEqual(0, code);
-        StringAssert.Contains(stdout, "7.0.7");
+        StringAssert.Contains(stdout, "7.0.8");
     }
 
     [TestMethod]
@@ -492,7 +492,7 @@ public async Task Version_Check_SoftNetwork()
         var combined = stdout + stderr;
         // 0 = up to date, 2 = update available, 1 = feed unreachable (transient CI / network).
         Assert.IsTrue(code is 0 or 1 or 2, $"Unexpected exit {code}. Output: {combined}");
-        StringAssert.Contains(combined, "7.0.7");
+        StringAssert.Contains(combined, "7.0.8");
         if (code == 1)
         {
             StringAssert.Contains(combined, "Unable to query update feed");

tests/Titanium.E2E.Tests/UiHeadless/AutomationIdCoverageHeadlessTests.cs

@@ -476,6 +476,14 @@ await fx.DispatchAsync(() =>
                 string.Equals(AutomationProperties.GetAutomationId(c), "ExcludedOnlyHosts", StringComparison.Ordinal)
                 || string.Equals(AutomationProperties.GetAutomationId(c), "ExcludedBuiltInList", StringComparison.Ordinal)
                 || string.Equals(AutomationProperties.GetAutomationId(c), "ExcludedProxyLoopback", StringComparison.Ordinal)));
+
+            var excludeHost = new ExcludeHostDialog(settings, "api.example.com");
+            AssertHasAutomationId(excludeHost, "ExcludeHostDialog");
+            AssertHasAutomationId(excludeHost, "ExcludeHostAdd");
+            AssertHasAutomationId(excludeHost, "ExcludeHostWildcardParent");
+            Assert.IsFalse(excludeHost.GetLogicalDescendants().OfType<Control>().Any(c =>
+                string.Equals(AutomationProperties.GetAutomationId(c), "ExcludeHostTunnelOnly", StringComparison.Ordinal)
+                || string.Equals(AutomationProperties.GetAutomationId(c), "ExcludeHostBypassProxy", StringComparison.Ordinal)));
         });
     }
 

tools/InspectorDesktopProbe/Scenarios/ChromeScenario.cs

@@ -596,7 +596,6 @@ await harness.WaitUntilAsync(
                     {
                         if (!ProbeUiRobot.HasOtherWindows(harness.Window))
                             return true;
-                        ProbeUiRobot.TryClickInOtherWindows(harness.Window, "ExcludeHostTunnelOnly");
                         ProbeUiRobot.TryClickInOtherWindows(harness.Window, "ExcludeHostAdd");
                         return !ProbeUiRobot.HasOtherWindows(harness.Window);
                     },

tools/packaging/CHOCOLATEY_FOLLOWUP.md

@@ -57,4 +57,8 @@ choco push returned **403 Forbidden** for both packages after 7.0.6-beta / 7.0.6
 
 ## 2026-09-11: hold Chocolatey for 7.0.7-beta
 
-`v7.0.7-beta` GitHub/NuGet cut intentionally **did not** push Chocolatey. Repo secret `CHOCOLATEY_API_KEY` was removed so `release.yml` `publish-chocolatey` skips. Do not dispatch `chocolatey-publish.yml` until earlier packages clear chocolatey.org moderator review; then restore the secret and push withheld versions in order (7.0.6* before 7.0.7-beta).
+`v7.0.7-beta` GitHub/NuGet cut intentionally **did not** push Chocolatey. Repo secret `CHOCOLATEY_API_KEY` was removed so `release.yml` `publish-chocolatey` skips. Do not dispatch `chocolatey-publish.yml` until earlier packages clear chocolatey.org moderator review; then restore the secret and push withheld versions in order (7.0.6* before 7.0.7-beta).
+
+## 2026-09-11: hold Chocolatey for 7.0.8-beta
+
+Same hold as 7.0.7-beta: `CHOCOLATEY_API_KEY` remains unset; `v7.0.8-beta` GitHub/NuGet cut intentionally **does not** push Chocolatey. Do not dispatch `chocolatey-publish.yml` until earlier packages clear moderator review.

tools/packaging/chocolatey/titanium-cli/titanium-cli.nuspec

@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>titanium-cli</id>
-    <version>7.0.7</version>
+    <version>7.0.8</version>
     <title>Titanium CLI</title>
     <authors>justcoding121</authors>
     <owners>justcoding121</owners>
@@ -18,7 +18,7 @@
     <tags>titanium proxy cli http https mitm</tags>
     <summary>Titanium Web Proxy command-line daemon (titanium / twp).</summary>
     <description>Titanium Web Proxy CLI. Self-contained win-x64 zip from GitHub Releases (titanium / twp).</description>
-    <releaseNotes>https://github.com/justcoding121/titanium-web-proxy/releases/tag/v7.0.7</releaseNotes>
+    <releaseNotes>https://github.com/justcoding121/titanium-web-proxy/releases/tag/v7.0.8</releaseNotes>
   </metadata>
   <files>
     <file src="tools\**" target="tools" />

tools/packaging/chocolatey/titanium-cli/tools/chocolateyInstall.ps1

@@ -5,7 +5,7 @@ $toolsDir = "$(Split-Path -Parent $MyInvocation.MyCommand.Definition)"
 $packageArgs = @{
   packageName    = $env:ChocolateyPackageName
   unzipLocation  = $toolsDir
-  url64bit       = 'https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.7/Titanium.Cli-win-x64.zip'
+  url64bit       = 'https://github.com/justcoding121/titanium-web-proxy/releases/download/v7.0.8/Titanium.Cli-win-x64.zip'
   checksum64     = 'EF79522355392ABB805C27F98426DB22DDB73BFE759500FFF4B41320F9B48DAB'
   checksumType64 = 'sha256'
 }

tools/packaging/chocolatey/titanium-inspector/titanium-inspector.nuspec

@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>titanium-inspector</id>
-    <version>7.0.7</version>
+    <version>7.0.8</version>
     <title>Titanium Inspector</title>
     <authors>justcoding121</authors>
     <owners>justcoding121</owners>
@@ -18,7 +18,7 @@
     <tags>titanium proxy inspector mitm http https debugger</tags>
     <summary>Desktop HTTP(S) traffic debugger for Titanium Web Proxy.</summary>
     <description>Titanium Inspector MITM debugger. Installs the signed win-x64 MSI from GitHub Releases. PolyForm Noncommercial 1.0.0.</description>
-    <releaseNotes>https://github.com/justcoding121/titanium-web-proxy/releases/tag/v7.0.7</releaseNotes>
+    <releaseNotes>https://github.com/justcoding121/titanium-web-proxy/releases/tag/v7.0.8</releaseNotes>
   </metadata>
   <files>
     <file src="tools\**" target="tools" />