Kitsune v0.1.1 — subscription cookie-gating fix

Hotfix for a real user-reported bug.

What's fixed

Many subscription services (FastVPN, Hiddify-derived panels, and similar) use a classic cookie-based bot deterrent: the first request returns HTTP 302 with a Set-Cookie header and the same URL as Location. Without preserving the cookie across redirects, the previous version got stuck in an infinite redirect loop and the subscription failed to load with no clear error.

v0.1.1 wires a CookieJar into fetch_subscription so the gating cookie is preserved automatically. The redirect follow-up sends it back, the server returns real content.

Compatibility

No behavioural change for subscriptions that don't use cookies. Existing users don't need to do anything.

Verified against

A real subscription URL using the __hash_ cookie scheme:

• before: 0 bytes, infinite redirect error
• after: ~12 KB returned, 31 vless links parsed, all valid

Upgrade

Download the installer or portable zip below, install / unpack over the existing version. State (groups / settings) is preserved in %LocalAppData%\Kitsune\.

Thanks to the user who reported it.

Kitsune v0.1.0 — first public release

First public release of Kitsune — a Windows VPN client built on sing-box.

Download

• KitsuneSetup.exe (67 MB) — installer with RU/EN wizard, per-user install (no admin needed)
• Kitsune-portable.zip (91 MB) — unpack anywhere, run Kitsune.exe

Windows SmartScreen will warn on first run because the binary isn't code-signed yet.
Click More info → Run anyway.

What's inside

• Protocols: VLESS (Reality + Vision + PQC mlkem768), VMess, Trojan, Shadowsocks, WireGuard
• Transports: tcp / ws / grpc / httpupgrade / xhttp
• TUN mode with auto_route (UAC elevation on first connect)
• Proxy mode — SOCKS + HTTP on one mixed inbound
• Per-app routing — 3-state toggle (Auto / VPN / Direct) for any installed exe
• Routing profiles — named snapshots, switch in one click
• Subscriptions — base64 / plain, background validation, favorites preserved
• Rules import — paste sing-box JSON or Clash YAML
• Kill-switch — Windows Firewall blocks all outbound on tunnel drop
• Auto-reconnect — 5-attempt watchdog
• Auto-update for sing-box core
• Bundled rule-sets — geosite-ru, geoip-ru, ads block (offline-ready)
• Seamless server switch — selector outbound + Clash API, no reconnect
• System tray with animated icon
• Global hotkey — toggle VPN even when minimized
• Bilingual UI — RU / EN, switch on the fly
• Logs panel — hidden by default in Settings → Diagnostics

Requirements

• Windows 10 / 11 (x64)
• TUN mode requires admin rights (granted via UAC on first connect)
• Proxy mode works without admin

Notes

• State is stored at %LocalAppData%\Kitsune\ (groups.json + settings.json)
• The app makes no telemetry, no accounts, no remote calls except your own subscription URLs and the sing-box version check

Engine

Built on top of sing-box v1.13. The patched nekobox_core.exe is used when present (extra protocol support); falls back to the official sing-box.exe otherwise.