The studio’s first notes left VPN Works at 0.6.0, BareProxy at nine plugins and the new HyperCrux engine at 44 of its 48 tasks. All three moved on later the same day, 14 October. VPN Works put out two releases, BareProxy four. The HyperCrux engine has one small task left before its docs and its release run.
VPN Works Adds Exit, Then Tunnel Plugins
Exit used to be a separate engine; VPN Works 0.7.0 makes it part of vpnw. Partner systems and internal services often admit callers by IP address, so an agent or a CI job that calls them needs a fixed one. vpnw exit runs on a server that has those addresses. Each client connects to it over TLS with a token and goes out from an address the exit gives it.
A plain proxy would trust anyone holding that token. The exit runs each request past the client’s policy a second time, with the same code vpnw uses on the client’s side, so a stolen token reaches nothing that policy refuses. In the tests, 11 forbidden requests went directly to the exit with a valid token. The exit refused every one. An independent review also attacked the exit before release, in three passes, and found four real problems; one let a few thousand idle connections that never showed a token fill every slot and shut everyone else out. All four are fixed, each with a test.
0.8.0 brings a new plugin type, the Tunnel plugin, which chooses the WireGuard config to use and for how long. vpnw keeps running the tunnels, and the traffic stays inside it. The built-in rotate steps through a folder of provider configs on a timer and jumps ahead early when a tunnel has gone 20 seconds without an answer. That suits scrapers and crawlers that need a fresh exit address every few minutes, without a restart. A switch waits until the next tunnel is up, and connections already running stay on their old tunnel until they close. If no new config works, vpnw keeps the current tunnel; traffic never goes around it. In a test that switched among three peers every 5 seconds while a program fetched a page every 200 ms, all 102 requests succeeded. Lab’s 18 fault cases from 0.6.0 now run twice, once through rotate, and all 36 pass.
That completes the 0.4.1 to 0.8.0 program. The next release gets picked after a pause to review where things stand. The roadmap suggests provider-specific Tunnel plugins as a follow-up to rotate; further out is a gateway mode that would put every device behind one machine under a single policy. Binaries for Linux and macOS are on the releases page.
Four BareProxy Plugins in One Day
BareProxy shipped 0.12.0 through 0.15.0 on 14 October, one new plugin in each. They’re the first of the bigger plugins on its list, and the first two are about bots.
- AI crawler control, in 0.12.0, decides per bot, or per group (training, search, assistant), whether it gets in, gets blocked or gets rate-limited. It recognizes 24 bots from 12 operators and verifies each against the IP ranges published by its operator. So a request claiming to be GPTBot from outside OpenAI’s ranges counts as a fake and is blocked by default.
- Bot challenges, in 0.13.0, deal with scrapers that claim to be browsers. Before such a client sees the site, its browser has to solve a short proof-of-work puzzle, well under a second on a desktop, and it then gets a signed cookie that lasts a week by default. The proxy keeps no record of visitors; puzzles and passes are both signed, so checking one needs nothing stored.
- Markdown serving, in 0.14.0, publishes a folder of Markdown files as web pages, with no build step. Each page is rendered a single time and cached until its file changes. Ask for
text/markdownand you get the raw source instead. - Cookie consent, in 0.15.0, shows a consent banner built without JavaScript. The proxy holds back each category’s cookies, in both directions, and disables its scripts until the visitor agrees to that category. Global Privacy Control from the browser is read as a refusal.
The core got a fix along the way. 0.14.0 stopped shared data from adding a key’s length to its total each time the key was rewritten. AI crawler control rewrites its keys every 5 seconds, so in a matter of weeks it would have filled its 64 MB allowance and been unable to write.
That’s 13 of the 21 planned plugins. Status pages, OpenTelemetry export and analytics are next, at two or three days of work each, followed by the five longest: an auth gate, a response cache, a payment gate for AI crawlers, an image optimizer and RenderCache. The roadmap keeps the order. 0.15.0 is on the releases page for Linux, macOS and Windows, with all 13 plugins beside it.
A Faster HyperCrux Engine Nears Release
HyperCrux’s current release is still 0.2.0, from 7 October. The work since has gone into the Beta, a new engine written in Go alone, and a week after the go-ahead the project posted where it stands. Of the 133 hours of work planned, 128 are done.
In one run on a two-core machine, the Beta searched 100,000 vectors of 384 values in 30.2 ms; the SQLite version took 346 ms. A filtered search took 14.8 ms against 98.2 ms, and a read by key 2.58 µs against 16.2 µs. Puts of records with vectors, 1,000 to a transaction, ran four and a half times faster. A single committed put cost about the same on each, because the disk sets the pace. Opening is the price: 358 ms for 100,000 records with vectors, since each process reads the whole database into its own memory when it opens the file.
A harness ran 800,000 operations through both engines on x86, then again on ARM, and compared every answer. The tests also catch all 251 bugs planted on purpose. An independent review on 14 October made several fixes, among them one for a crafted file that could push memory use to about 89 times the size of a batch, and one that cut a filtered vector search in SQL from about 150 ms to about 14.
One small task is left: holding text and bytes to the 1 GB per value the SQLite version already allows, so an export from either engine always loads into the other. After that, the docs get written and a release run finishes with one last overnight test. Until the Beta ships, 0.2.0 is on the releases page, and the task board keeps a record of every task.