audit #13: notification fix, sync guard, bypass gate, responsive layout, dynamic version, dart format, clock_display to backups, stats race fix, new locks, nginx swarm block

lib/logic/app_config.example.dart

@@ -46,4 +46,11 @@ abstract final class AppConfig {
 
   // ── AdMob ──────────────────────────────────────────────────────────────
   static const String adUnitId = 'ca-app-pub-0000000000000000/0000000000'; // REPLACE
+
+  // ── Debug ──────────────────────────────────────────────────────────────
+  /// When true, the client skips the real AdMob flow and sends a fake SSV
+  /// callback directly to the server (requires ADMOB_BYPASS=True server-side).
+  /// Set to false in production — the Dart compiler tree-shakes the bypass
+  /// code entirely when this is a compile-time constant false.
+  static const bool enableAdBypass = false;
 }

lib/logic/hivemind_service.dart

@@ -37,7 +37,7 @@ class HivemindService {
     final url = _url('/session/status?device_id=$deviceId');
 
     // ── AD BYPASS (debug only) ────────────────────────────────────────
-    if (kDebugMode && !skipAdBypass) {
+    if (AppConfig.enableAdBypass && !skipAdBypass) {
       try {
         final customData = jsonEncode({'device_id': deviceId, 'nonce': nonce});
         final fakeUrl = _url(

lib/logic/session_timer.dart

@@ -20,6 +20,7 @@ class SessionTimer extends ChangeNotifier {
   int  _consecutiveFailures = 0;
   bool _isDisconnecting     = false;
   bool _userInitiatedStop   = false;
+  bool _syncInProgress      = false;
 
 
   int? _currentPort;
@@ -183,9 +184,10 @@ class SessionTimer extends ChangeNotifier {
 
 
   Future<void> _syncWithHivemind() async {
-    // Never sync while the user is explicitly disconnecting.
-    if (_isDisconnecting) return;
-
+    // Never sync while the user is explicitly disconnecting,
+    // or while another sync is already in flight.
+    if (_isDisconnecting || _syncInProgress) return;
+    _syncInProgress = true;
     try {
       final deviceId = await CryptoService.getDeviceId();
       final url = Uri.parse(
@@ -248,6 +250,8 @@ class SessionTimer extends ChangeNotifier {
     } catch (e) {
       debugPrint('Hivemind sync error: $e');
       _markSyncFailure();
+    } finally {
+      _syncInProgress = false;
     }
   }
 
@@ -268,6 +272,7 @@ class SessionTimer extends ChangeNotifier {
     _currentSpeedKBps = 0.0;
     _hasSyncedOnce = false;
     _remainingSeconds = 0;
+    VpnNotificationManager.cancel();
     notifyListeners();
   }
 

lib/logic/vpn_connection.dart

@@ -60,7 +60,8 @@ class VpnConnection extends ChangeNotifier {
 
     // Periodic server health check
     _checkHealth();
-    _healthTimer = Timer.periodic(const Duration(seconds: 30), (_) => _checkHealth());
+    _healthTimer =
+        Timer.periodic(const Duration(seconds: 30), (_) => _checkHealth());
 
     // Check if VPN was already running (app killed and reopened)
     try {
@@ -102,7 +103,8 @@ class VpnConnection extends ChangeNotifier {
     }
   }
 
-    Future<bool> connect({bool skipAdBypass = false, bool quickReconnect = false}) async {
+  Future<bool> connect(
+      {bool skipAdBypass = false, bool quickReconnect = false}) async {
     if (_status == VpnStatus.connected || _status == VpnStatus.connecting) {
       return false;
     }
@@ -130,7 +132,8 @@ class VpnConnection extends ChangeNotifier {
         quickReconnect: quickReconnect,
         onAttempt: (attempt, total) {
           if (!quickReconnect) {
-            _setStatus(VpnStatus.connecting, 'Contacting server ($attempt/$total)…');
+            _setStatus(
+                VpnStatus.connecting, 'Contacting server ($attempt/$total)…');
           }
         },
       );
@@ -140,11 +143,15 @@ class VpnConnection extends ChangeNotifier {
       if (raw.contains('Cancelled')) {
         // User tapped disconnect — silently abort
         return false;
-      } else if (raw.contains('timed out') || raw.contains('Session not activated')) {
-        _errorMessage = 'The server did not respond in time.\nCheck your connection and try again.';
+      } else if (raw.contains('timed out') ||
+          raw.contains('Session not activated')) {
+        _errorMessage =
+            'The server did not respond in time.\nCheck your connection and try again.';
         _setStatus(VpnStatus.error, 'Server unreachable');
-      } else if (raw.contains('SocketException') || raw.contains('Failed host lookup')) {
-        _errorMessage = 'Cannot reach the server.\nMake sure you have internet access.';
+      } else if (raw.contains('SocketException') ||
+          raw.contains('Failed host lookup')) {
+        _errorMessage =
+            'Cannot reach the server.\nMake sure you have internet access.';
         _setStatus(VpnStatus.error, 'No internet');
       } else {
         _errorMessage = raw;
@@ -186,7 +193,8 @@ class VpnConnection extends ChangeNotifier {
         }
 
         if (!sessionOk) {
-          debugPrint('[VPN] Tunnel started but no server session — tearing down.');
+          debugPrint(
+              '[VPN] Tunnel started but no server session — tearing down.');
           try {
             await _vless.stopVless();
           } catch (_) {}
@@ -209,7 +217,8 @@ class VpnConnection extends ChangeNotifier {
   Future<void> disconnect({bool skipCleanup = false}) async {
     _cancelled = true;
     HivemindService.cancel(); // abort any in-progress polling
-    if (_status == VpnStatus.disconnected || _status == VpnStatus.disconnecting) {
+    if (_status == VpnStatus.disconnected ||
+        _status == VpnStatus.disconnecting) {
       return;
     }
 
@@ -223,9 +232,9 @@ class VpnConnection extends ChangeNotifier {
 
     try {
       await _vless.stopVless().timeout(
-        const Duration(seconds: 5),
-        onTimeout: () => debugPrint('[VPN] stopVless() timed out.'),
-      );
+            const Duration(seconds: 5),
+            onTimeout: () => debugPrint('[VPN] stopVless() timed out.'),
+          );
     } catch (e) {
       debugPrint('[VPN] VLESS stop error: $e');
     }