Hello everyone.
ChuteMac has received its biggest update since launch. We have rewritten the user interface from scratch, migrated the VPN stack to Apple’s modern NetworkExtension framework, and added features that were previously only available on iOS. This post covers what changed and why.
Why Rewrite?
The original ChuteMac was built in 2019, targeting macOS 10.13. It used a kernel extension for packet interception — the standard approach at the time. But Apple has been deprecating kernel extensions for years, pushing developers toward the NetworkExtension framework instead. The old UI was written in a pre-SwiftUI era, using AppKit with manual layout code that had grown brittle over five years of incremental changes.
By late 2025 it was clear that incremental fixes were not enough. The foundation needed a refresh.
NetworkExtension Packet Tunnel Provider
The biggest architectural change is the move from kernel extension to NEPacketTunnelProvider. This is the same framework ChuteiOS has been using since its launch, and it brings several benefits:
- System integration: the VPN appears in macOS System Settings like any other VPN, with proper status indicators and connectivity management
- Sandbox safety: the packet tunnel runs in a sandboxed process, limiting the blast radius of any potential bug
- Apple silicon optimization: NetworkExtension is fully optimized for Apple silicon, which the old kernel extension path was not
- Future-proofing: Apple’s roadmap is clear — NetworkExtension is the present and future of VPN development on Apple platforms
The migration was not without challenges. The most interesting was the loopback TCP shuttle: a creative workaround for sandbox restrictions that prevent the packet tunnel process from communicating directly with the main app. We bridge the gap through a local TCP connection, carefully scoped to the loopback interface. It is not the most beautiful solution, but it is robust and respects the sandbox contract.
SMAppService and Modern Privilege Management
We also replaced the deprecated SMJobBless mechanism with SMAppService, Apple’s modern API for registering privileged helpers. The new approach requires fewer entitlements, integrates cleanly with System Settings, and handles updates more gracefully. Users will notice that installing and updating the helper no longer requires manual approval in Security & Privacy preferences — it just works.
The New UI
The old ChuteMac interface was functional but utilitarian. For the rewrite we focused on three principles:
Information density without clutter. The main window shows your active configuration, traffic statistics with a live sparkline chart, active connections, and DNS status — all on one screen. The traffic sparkline updates in real time, giving you an at-a-glance sense of bandwidth usage.
Profiles as first-class objects. You can import configurations from files, from URLs, or by scanning a QR code with your iPhone camera. Profiles are validated on import, and the editor highlights errors inline. A reload button lets you apply configuration changes without disconnecting.
macOS-native design. We adopted SF Symbols throughout for consistent iconography, added glass-effect panels on macOS 26, and maintained full compatibility back to macOS 10.13 — older Macs are not left behind. The interface adapts to both light and dark modes, and we fixed long-standing issues with bezel clipping, popover positioning, and window activation behavior.
Localization
ChuteMac now speaks your language. We added localization support covering the entire interface — menus, settings, alerts, and status messages. The initial release includes English and Chinese, with more languages planned.
System Proxy Integration
A frequent pain point in the old version was system proxy configuration. Users had to manually toggle proxy settings in System Preferences, and the process was error-prone. The new version integrates directly with macOS network configuration: enabling ChuteMac automatically configures the system proxy, and disabling it restores the previous settings. Behind the scenes, we use SCPreferences via the privileged helper, with a fallback path for environments where the helper is not available.
Enhanced Mode Redesign
Enhanced Mode — Chute’s TUN-based VPN mode — has been redesigned for clarity. The previous version had confusing multi-state toggles; the new version offers a simple on/off with a notice window explaining what Enhanced Mode does and when you should use it. When Enhanced Mode is turned off, the TUN tunnel is automatically torn down, preventing orphaned interfaces.
We also added an “Interrupt Existing Connections” toggle in advanced settings, giving you control over whether configuration reloads should drop active connections or let them drain naturally.
What Has Not Changed
The proxy engine under the hood is the same battle-tested codebase. All your existing configurations continue to work. Your rule sets, your policy groups, your DNS settings — everything carries forward. This update is about the packaging, not the engine.
ChuteMac has come a long way since 2019, and this update is the foundation for the next five years. Update now from the built-in Sparkle updater or download the latest version from chute.life.
Thanks.
Chute Devs