fix(app): do not throw from ConnectionSettings.initialize

The migration write is best-effort again. `_mode` is already the safe TUN
default in memory by the time it runs, so a failed write leaves nothing
insecure -- it only means the migration is retried on the next launch.

Throwing there was a startup brick rather than a fail-closed guard.
`initialize()` is awaited from `main()` at lib/main.dart:19, before
`runApp()`, with no try/catch and no `runZonedGuarded`; `FlutterError.onError`
and `PlatformDispatcher.onError` are installed later and would not catch it
either. The branch also runs on every fresh install, since `storedMode` is null
and `null != 'tun'`. A `setString` returning false would therefore have meant a
black screen with no error UI, repeating every launch, in exchange for no
security benefit.

Also restores two comments this PR removed from code it does not otherwise
touch -- the `_reconnect` note on why the repair path shows no rewarded ad, and
the explanation of how an orphaned proxy outlives the app process -- and drops
a stray 'ass' from the legacy-values comment.

The `setMode` half of the PR is unchanged: persisting before mutating memory
and surfacing failures to the UI is the right behaviour.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_019HT2x2JvJNg7XNsJubfHFf

.github/workflows/android-ci.yml

@@ -1,135 +0,0 @@
-name: Android CI
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-jobs:
-  android:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Set up Java 17
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
-        with:
-          distribution: temurin
-          java-version: '17'
-
-      - name: Verify Gradle supply chain
-        shell: bash
-        run: |
-          set -euo pipefail
-          test -x android/gradlew
-          test -f android/gradlew.bat
-          test -f android/gradle/wrapper/gradle-wrapper.jar
-          test -s android/gradle/verification-metadata.xml
-          test "$(sha256sum android/gradle/wrapper/gradle-wrapper.jar | awk '{print $1}')" = '7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172'
-          grep -qx 'distributionSha256Sum=efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1' android/gradle/wrapper/gradle-wrapper.properties
-          grep -q '<verify-metadata>true</verify-metadata>' android/gradle/verification-metadata.xml
-          ./android/gradlew --version
-
-      - name: Set up Flutter
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
-        with:
-          flutter-version: '3.47.2'
-          channel: stable
-          cache: false
-
-      - name: Create CI app config
-        run: cp lib/logic/app_config.example.dart lib/logic/app_config.dart
-
-      - name: Resolve dependencies
-        run: flutter pub get
-
-      - name: Verify dependency lock is committed
-        run: git diff --exit-code -- pubspec.lock
-
-      - name: Verify vendored runtime provenance
-        if: ${{ hashFiles('local_packages/flutter_vless_android-1.1.5/UPSTREAM') != '' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          PKG='local_packages/flutter_vless_android-1.1.5'
-          test -f "$PKG/UPSTREAM"
-          grep -q 'Tag: v1.1.5' "$PKG/UPSTREAM"
-          grep -q 'path: local_packages/flutter_vless_android-1.1.5' pubspec.yaml
-          ! grep -q 'patchFlutterVless' android/app/build.gradle.kts
-
-      - name: Analyze
-        run: flutter analyze
-
-      - name: Test
-        run: flutter test
-
-      - name: Android lint
-        working-directory: android
-        run: ./gradlew :app:lintDebug --no-daemon
-
-      - name: Verify production release config fails closed
-        shell: bash
-        working-directory: android
-        run: |
-          set -euo pipefail
-          set +e
-          output="$(./gradlew :app:verifyReleaseAppConfig --no-daemon 2>&1)"
-          status=$?
-          set -e
-          printf '%s\n' "$output"
-          test "$status" -ne 0
-          grep -Fq 'REVOLT_APP_CONFIG_SHA256 is required for production release builds' <<<"$output"
-
-      - name: Cold APK build
-        run: flutter build apk --debug
-
-      - name: Verify vendored native source stayed immutable
-        run: git diff --exit-code -- local_packages/flutter_vless_android-1.1.5
-
-      - name: Warm APK build
-        run: flutter build apk --debug
-
-      - name: Release R8 smoke build
-        env:
-          REVOLT_CI_RELEASE_SMOKE: 'true'
-        run: |
-          flutter build apk --release
-          test -f build/app/outputs/flutter-apk/app-release.apk
-          test -f build/app/outputs/mapping/release/mapping.txt
-
-      - name: Verify tracked build inputs stayed immutable
-        run: |
-          git diff --exit-code -- \
-            pubspec.yaml \
-            pubspec.lock \
-            local_packages/flutter_vless_android-1.1.5 \
-            android/app/build.gradle.kts \
-            android/app/proguard-rules.pro \
-            android/gradle/verification-metadata.xml \
-            android/gradle/wrapper/gradle-wrapper.properties \
-            android/gradle/wrapper/gradle-wrapper.jar \
-            android/gradlew \
-            android/gradlew.bat
-
-      - name: Upload APK
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: revoltvpn-debug-apk
-          if-no-files-found: error
-          path: build/app/outputs/flutter-apk/app-debug.apk
-
-      - name: Upload resolved lockfile
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: revoltvpn-resolved-lockfile
-          if-no-files-found: error
-          path: pubspec.lock

CHANGELOG.md

@@ -5,153 +5,6 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH
 
 ---
 
-## [Unreleased]
-
-### Removed
-- **The background server check while disconnected.** The app no longer contacts
-  the server every 30 seconds while you are not connected to it. Nothing about
-  the connected session changes.
-
-### Changed
-- **The status bar no longer guesses whether the server is up.** It reads
-  "Ready" while disconnected and shows "Online" once a session has synced, so a
-  green dot now means a session that is actually working rather than a
-  reachability check made beforehand.
-
-## [3.3.8] — 2026-10-17
-
-### Changed
-- **Reconnecting always starts a fresh session.** In SOCKS5 mode, the
-  **Reconnect** button used to re-attach to the session you already had. It now
-  ends that session and starts a new one, exactly as the connect button does —
-  one way to begin a session instead of two, and you get a full window back
-  rather than the remainder of a broken one.
-
-### Fixed
-- **SOCKS5 "Reconnect" works again.** In 3.3.7 it ended your session and then
-  asked for the session it had just ended, failing with "Session not activated".
-
----
-
-## [3.3.7] — 2026-10-17
-
-> **Known issue — fixed in 3.3.8.** In SOCKS5 mode, the **Reconnect**
-> button in Settings ends your session instead of re-attaching to it, and then
-> fails with "Session not activated". It only appears when a proxy session has
-> been orphaned, and you lose the rest of that session rather than anything
-> worse. Workaround: connect again from the main screen. The "SOCKS5 Reconnect"
-> entry below describes the intended behaviour, which this build does not have.
-
-### Added
-- **A warning before a session ends.** The VPN service schedules it off the same
-  deadline it already enforces, so it arrives even with the app closed, and a
-  support top-up moves it with the deadline. It does not promise an exact number
-  of minutes: on a deeply sleeping phone Android can hold it back past the end
-  of the session, in which case it is skipped rather than shown late.
-- **A "disconnected — not protected" notification** when a session ends without
-  you asking: the 2-hour expiry, the data limit, or the server ending the
-  session.
-- **SOCKS5 mode now asks for the notification permission.** It never did,
-  because it never raises the VPN consent dialog, so on Android 13+ these
-  alerts would have been dropped before they were shown.
-- **The app now shows what went wrong.** Connect errors, the reason a session
-  ended, and progress while connecting appear under the status bar instead of
-  the button silently going back to idle.
-
-### Changed
-- **A control-plane outage no longer tears down a working tunnel.** The app used
-  to disconnect itself after about two minutes of failed status polls, putting
-  you back on your real IP; it now keeps the tunnel up and shows
-  "Can't reach the server — still connected". Expiry is still enforced by the
-  VPN service's own deadline, which keeps running regardless.
-
-### Fixed
-- **The countdown no longer over-reports after the phone sleeps**, and a clock
-  moved backwards can no longer stretch a session.
-- **A session that expired while the phone was asleep is recognised on waking**,
-  by wall clock rather than by time the device spent awake.
-- **Disconnecting from Android's VPN settings no longer leaves a countdown in
-  the notification shade.** It used to sit there frozen, showing time remaining
-  on a tunnel that was already gone.
-- **The VPN recovers after the tunnel core stops.** Recovery never worked:
-  every attempt failed on the same internal error, and each one left another
-  copy of the core running in the background. It now usually comes back on the
-  first retry, without dropping the connection.
-- **Disconnecting with the app's own button now releases your session on the
-  server** instead of leaving it open until it expires.
-- **SOCKS5 "Reconnect" re-attaches to the current session** instead of
-  requesting a new one — see the known issue above; this does not work in 3.3.7.
-- **A core that fails to start now logs why.** Its output was being discarded,
-  so the only trace was an exit code.
-
-### Groundwork
-- **Rewarded-ad plumbing.** Ads are switched off in this build, so none of this
-  is reachable yet: the ad's verification nonce is now carried through to the
-  connect call rather than being minted twice, and the client waits longer
-  (~36 s) for Google's callback. Reviewed, not yet exercised end to end.
-
-## [3.3.6] — 2026-10-08
-
-### Fixed
-- **VPN service notification icon.** The ongoing notification now uses the
-  bundled `notification_icon` drawable instead of `notification_status_icon`,
-  and the vendored runtime resolves that drawable by name at runtime (falling
-  back to the platform icon only if it is missing), so the foreground-service
-  notification no longer shows the generic Android info icon.
-- **"Test Local SOCKS" no longer claims an outbound it never tested.** Xray
-  answers a SOCKS `CONNECT` before it dials upstream, so trusting the `0x00`
-  reply reported success for unroutable addresses and for hostnames that can
-  never resolve — meaning the test said OK while the server was down, which is
-  exactly when it gets run. It now forces a request/response round trip through
-  the tunnel and reports distinctly when the outbound never replies, drops the
-  connection, or returns unexpected data.
-
----
-
-## [3.3.5] — 2026-09-06
-
-### Added
-- **Reproducible release verification.** The release build pins the production
-  `app_config.dart` by SHA-256 and fails closed on any mismatch, so a release
-  APK cannot silently ship a template or wrong server config.
-
-### Changed
-- **Vendored Android runtime.** The pinned `flutter_vless` Android runtime is now
-  vendored in-tree instead of being patched in the pub cache at build time.
-- **Harden the control-plane trust boundary.** `/session/status` fields are
-  strictly validated (nonce, destination IP, port, SNI, XHTTP path), control
-  responses are capped and never follow redirects, and the tunnel destination
-  is pinned to the compiled server — a compromised API can no longer redirect
-  user traffic.
-- **Authenticated local SOCKS5 is now mandatory.** The ephemeral local proxy
-  replaces rather than filters inbounds, so only the authenticated SOCKS5
-  listener can exist.
-- **Fail closed on connection-mode changes.** The mode is persisted before it is
-  applied, and a failed save leaves the UI and runtime unchanged instead of
-  silently selecting a weaker route.
-
-### Fixed
-- Connect button no longer leaks a listener into a disposed `AnimationController`
-  during teardown.
-- Disclosure acknowledgement is only persisted once the user accepts it.
-- Session countdown now uses a monotonic clock (cannot be extended by rolling the
-  device clock back) and a VPN error tears the tunnel down instead of freezing
-  the timer on a live session.
-- The VPN-service notification's disconnect action and countdown re-post are
-  aligned with the vendored runtime.
-
-### Removed
-- Unsupported server-selector UI (single server today; design retained for
-  multi-server later).
-- Unused Flutter dependencies and orphaned assets.
-- Dead Dart wrappers whose native handlers no longer exist.
-
-### Security & privacy
-- IPv6 is captured by the VPN interface (`::/0` route), closing a leak where
-  IPv6 traffic could bypass the tunnel on IPv6-capable carriers.
-
----
-
 ## [3.3.4] — 2026-09-02
 
 ### Added

CONTRIBUTING.md

@@ -14,7 +14,7 @@ As a contributor, here are the guidelines we would like you to follow:
   │       │             │
   │       │             └─⫸ Summary in present tense. Not capitalized. No period at the end.
   │       │
-  │       └─⫸ Commit Scope: app|docs|config
+  │       └─⫸ Commit Scope: app|server|xray|nginx|docs|config
   │
   └─⫸ Commit Type: build|ci|docs|feat|fix|perf|refactor|test
 ```
@@ -40,12 +40,12 @@ Must be one of the following:
 The scope should be the part of the project affected:
 
 * `app` — Flutter client (screens, components, logic)
+* `server` — Python Hivemind backend
+* `xray` — Xray Reality config or tunnel behavior
+* `nginx` — nginx routing, SSL, auth
 * `docs` — documentation files
 * `config` — app_config, .gitignore, pubspec
 
-The `server`, `xray` and `nginx` components are not in this repository, so
-contributions targeting them cannot be reviewed or tested here.
-
 ##### Summary
 
 Use the summary field to provide a succinct description of the change:
@@ -65,9 +65,10 @@ You can include a comparison of the previous behavior with the new behavior in o
 #### Examples
 
 ```
-feat(app): add a server selector to the settings screen
+feat(server): add swarm monitoring endpoint
 
-Lists the available exit locations and persists the user's choice locally.
+GET /api/swarm returns sorted drone list for the TUI dashboard.
+Persistent total GB saved to swarm_total.json, survives restarts.
 ```
 
 ```

PRIVACY_POLICY.md

@@ -1,6 +1,6 @@
 # Privacy Policy
 
-**Last updated:** October 2026
+**Last updated:** September 2026
 
 ReVoltVPN is a free VPN service built and operated by ReVolt Team.
 
@@ -12,7 +12,7 @@ When you first open the app, we show a brief summary of this policy before you c
 
 We collect the minimum required to operate the service:
 
-- A randomly generated device ID created on your phone. It is stored on your device and reused between sessions, and it is not linked to your identity in any way.
+- A randomly generated device ID created on your phone. This is not linked to your identity in any way.
 - Your connection duration and data usage for the current session, linked to your device ID. This is used solely to enforce the per-session quota (see below).
 
 ## What our server sees
@@ -27,14 +27,14 @@ Support ads (the "Support us" button) extend an active session by 30 minutes and
 
 ## Operational logs
 
-Server logs are written to the system journal. These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs stay on the server and are accessible only to the server operator via local console; retention follows the server's journal settings. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device.
+Server logs are written to the systemd journal (`journalctl -u hivemind`). These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs stay on the server and are accessible only to the server operator via local console; retention follows the server's systemd journal settings. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device.
 
 ## What we do not collect
 
 - We do not collect your name, email, or any personal information.
 - We do not log your internet traffic, browsing history, DNS queries, or destination IPs.
 - We do not inspect or store the content of your traffic.
-- We do not sell your data. We do not share it with anyone, apart from what Google's ad SDK collects for ad delivery — see “Ads & Consent” below.
+- We do not sell or share any data with third parties.
 
 ## Ads & Consent
 

analysis_options.yaml

@@ -2,8 +2,6 @@ include: package:flutter_lints/flutter.yaml
 
 analyzer:
   exclude:
-    - build/**
-    - android/**
     - local_packages/**
     - whatsthis/**
 

android/app/build.gradle.kts

@@ -1,16 +1,132 @@
 import java.util.Properties
 import java.io.File
 import java.io.FileInputStream
-import java.security.MessageDigest
 
 plugins {
     id("com.android.application")
     id("dev.flutter.flutter-gradle-plugin")
 }
 
-fun sha256Hex(file: File): String {
-    val digest = MessageDigest.getInstance("SHA-256").digest(file.readBytes())
-    return digest.joinToString("") { "%02x".format(it.toInt() and 0xff) }
+val projectRootDir = rootProject.projectDir.parentFile
+val localPropertiesFile = rootProject.file("local.properties")
+val localProperties = Properties().apply {
+    if (localPropertiesFile.exists()) {
+        localPropertiesFile.inputStream().use { load(it) }
+    }
+}
+val flutterSdkPath = localProperties.getProperty("flutter.sdk")
+    ?: throw GradleException("flutter.sdk not set in android/local.properties")
+val dartExecutable = File(
+    flutterSdkPath,
+    if (System.getProperty("os.name").lowercase().contains("windows")) {
+        "bin/cache/dart-sdk/bin/dart.exe"
+    } else {
+        "bin/cache/dart-sdk/bin/dart"
+    },
+)
+val flutterVlessRecoveryPatchScript = File(
+    projectRootDir,
+    "tool/patch_flutter_vless_runtime_recovery.dart",
+)
+val flutterVlessSecureSocksPatchScript = File(
+    projectRootDir,
+    "tool/patch_flutter_vless_secure_socks_v2.dart",
+)
+val flutterVlessSecureSocksScopeFixScript = File(
+    projectRootDir,
+    "tool/patch_flutter_vless_secure_socks_scope_fix.dart",
+)
+
+val patchFlutterVlessRuntimeRecovery = tasks.register<Exec>("patchFlutterVlessRuntimeRecovery") {
+    group = "build setup"
+    description = "Recover stale Xray core and tun2socks socket before restart"
+    workingDir(projectRootDir)
+
+    doFirst {
+        if (!dartExecutable.isFile) {
+            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
+        }
+        if (!flutterVlessRecoveryPatchScript.isFile) {
+            throw GradleException("flutter_vless recovery patch script missing: ${flutterVlessRecoveryPatchScript.absolutePath}")
+        }
+        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
+            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
+        }
+    }
+
+    commandLine(
+        dartExecutable.absolutePath,
+        "run",
+        flutterVlessRecoveryPatchScript.absolutePath,
+    )
+}
+
+val patchFlutterVlessSecureSocks = tasks.register<Exec>("patchFlutterVlessSecureSocks") {
+    group = "build setup"
+    description = "Add authenticated ephemeral SOCKS5 and fail-closed process recovery to pinned flutter_vless_android 1.1.5"
+    workingDir(projectRootDir)
+    dependsOn(patchFlutterVlessRuntimeRecovery)
+
+    doFirst {
+        if (!dartExecutable.isFile) {
+            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
+        }
+        if (!flutterVlessSecureSocksPatchScript.isFile) {
+            throw GradleException("secure SOCKS patch script missing: ${flutterVlessSecureSocksPatchScript.absolutePath}")
+        }
+        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
+            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
+        }
+    }
+
+    commandLine(
+        dartExecutable.absolutePath,
+        "run",
+        flutterVlessSecureSocksPatchScript.absolutePath,
+    )
+}
+
+val patchFlutterVlessSecureSocksScopeFix = tasks.register<Exec>("patchFlutterVlessSecureSocksScopeFix") {
+    group = "build setup"
+    description = "Repair the secure Xray process monitor capture without changing stock 1.1.5 runtime sequencing"
+    workingDir(projectRootDir)
+    dependsOn(patchFlutterVlessSecureSocks)
+
+    doFirst {
+        if (!dartExecutable.isFile) {
+            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
+        }
+        if (!flutterVlessSecureSocksScopeFixScript.isFile) {
+            throw GradleException("secure SOCKS scope fix script missing: ${flutterVlessSecureSocksScopeFixScript.absolutePath}")
+        }
+        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
+            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
+        }
+    }
+
+    commandLine(
+        dartExecutable.absolutePath,
+        "run",
+        flutterVlessSecureSocksScopeFixScript.absolutePath,
+    )
+}
+
+// App compilation and the transitive Android plugin compilation must both wait
+// for the pinned runtime patches. Plain `flutter build apk` must behave like CI
+// instead of relying on a hidden manual pre-build step.
+tasks.configureEach {
+    if (name == "preBuild") {
+        dependsOn(patchFlutterVlessSecureSocksScopeFix)
+    }
+}
+
+gradle.projectsEvaluated {
+    rootProject.findProject(":flutter_vless_android")
+        ?.tasks
+        ?.matching { it.name == "preBuild" }
+        ?.configureEach {
+            dependsOn(patchFlutterVlessSecureSocksScopeFix)
+        }
 }
 
 android {
@@ -24,6 +140,10 @@ android {
         targetCompatibility = JavaVersion.VERSION_17
     }
 
+    packaging {
+        resources.excludes.add("META-INF/**")
+    }
+
     val keystorePropertiesFile = rootProject.file("key.properties")
     val keystoreProperties = Properties()
     if (keystorePropertiesFile.exists()) {
@@ -36,68 +156,6 @@ android {
         admobProperties.load(FileInputStream(admobPropertiesFile))
     }
 
-    // Explicit opt-in used only by GitHub Actions to exercise the real
-    // release/R8 graph. Production release signing and config pinning remain
-    // fail-closed outside that CI smoke path.
-    val ciReleaseSmoke =
-        System.getenv("GITHUB_ACTIONS") == "true" &&
-            System.getenv("REVOLT_CI_RELEASE_SMOKE") == "true"
-
-    val appConfigFile = rootProject.file("../lib/logic/app_config.dart")
-    val verifyReleaseAppConfig = tasks.register("verifyReleaseAppConfig") {
-        group = "verification"
-        description = "Verify the production Dart app config against REVOLT_APP_CONFIG_SHA256."
-        doLast {
-            if (ciReleaseSmoke) {
-                logger.lifecycle("Skipping production app-config pin for CI release smoke build")
-                return@doLast
-            }
-
-            val expected = System.getenv("REVOLT_APP_CONFIG_SHA256")?.trim()?.lowercase()
-            if (expected.isNullOrEmpty()) {
-                throw org.gradle.api.GradleException(
-                    "REVOLT_APP_CONFIG_SHA256 is required for production release builds"
-                )
-            }
-            if (!Regex("[0-9a-f]{64}").matches(expected)) {
-                throw org.gradle.api.GradleException(
-                    "REVOLT_APP_CONFIG_SHA256 must be exactly 64 lowercase hexadecimal characters"
-                )
-            }
-            if (!appConfigFile.isFile) {
-                throw org.gradle.api.GradleException(
-                    "Production app config is missing: ${appConfigFile.absolutePath}"
-                )
-            }
-
-            val configText = appConfigFile.readText()
-            val templateMarkers = listOf(
-                "'0.0.0.0'",
-                "YOUR_DOMAIN",
-                "YOUR_GITHUB_USERNAME",
-                "YOUR_REPO_NAME",
-                "ca-app-pub-0000000000000000/0000000000",
-            )
-            val remainingMarker = templateMarkers.firstOrNull(configText::contains)
-            if (remainingMarker != null) {
-                throw org.gradle.api.GradleException(
-                    "Production app config still contains template marker: $remainingMarker"
-                )
-            }
-
-            val actual = sha256Hex(appConfigFile)
-            if (actual != expected) {
-                throw org.gradle.api.GradleException(
-                    "Production app config SHA-256 mismatch: expected $expected, got $actual"
-                )
-            }
-        }
-    }
-
-    tasks.matching { it.name == "preReleaseBuild" }.configureEach {
-        dependsOn(verifyReleaseAppConfig)
-    }
-
     defaultConfig {
         applicationId = "com.paladinvpn.app"
         minSdk = flutter.minSdkVersion
@@ -118,11 +176,7 @@ android {
 
     buildTypes {
         release {
-            signingConfig = if (ciReleaseSmoke) {
-                signingConfigs.getByName("debug")
-            } else {
-                signingConfigs.getByName("release")
-            }
+            signingConfig = signingConfigs.getByName("release")
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(

android/app/proguard-rules.pro

@@ -1,4 +1,4 @@
-# ReVoltVPN ProGuard / R8 Rules
+# PaladinVPN ProGuard / R8 Rules
 # ==============================================================================
 # These rules prevent R8 from stripping classes and methods that are accessed
 # via JNI (Java Native Interface) or reflection, which would cause
@@ -11,8 +11,9 @@
 -keep class xray.** { *; }
 
 # ── Flutter / Platform Channels ───────────────────────────────────────────────
-# io.flutter.** already includes embedding and plugin subpackages.
 -keep class io.flutter.** { *; }
+-keep class io.flutter.embedding.** { *; }
+-keep class io.flutter.plugin.** { *; }
 
 # ── Google Mobile Ads (AdMob) ─────────────────────────────────────────────────
 -keep class com.google.android.gms.ads.** { *; }

android/app/src/main/AndroidManifest.xml

@@ -10,6 +10,9 @@
     <!-- Doze/App Standby stop background services of non-exempt apps. A VPN
          cannot stay up without this; Play allows it for VPN functionality. -->
     <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"/>
+    <!-- OS-level session-expiry alarm. Auto-granted on 31-32; on 33+ the daemon
+         falls back to setAndAllowWhileIdle if exact alarms aren't granted. -->
+    <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM"/>
 
     <!-- flutter_vless 1.1.5 declares this legacy permission. ReVolt never needs it. -->
     <uses-permission

android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt

@@ -3,6 +3,7 @@ package com.paladinvpn.app
 import android.app.Notification
 import android.app.NotificationChannel
 import android.app.NotificationManager
+import android.app.ActivityManager
 import android.app.PendingIntent
 import android.content.Context
 import android.content.Intent
@@ -20,7 +21,8 @@ import android.os.VibratorManager
 import android.provider.Settings
 import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
-import com.github.tfox.flutter_vless.xray.utils.RevoltAlerts
+import com.github.tfox.flutter_vless.xray.service.XrayVPNService
+import com.github.tfox.flutter_vless.xray.utils.AppConfigs
 import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
 import io.flutter.plugin.common.EventChannel
@@ -52,42 +54,38 @@ class MainActivity : FlutterActivity() {
         MethodChannel(flutterEngine.dartExecutor.binaryMessenger, powerChannel)
             .setMethodCallHandler { call, result ->
                 when (call.method) {
+                    // Doze and App Standby stop background services of apps that
+                    // are not exempt. A VPN has to be exempt to survive the screen
+                    // going off, so surface the real state rather than guessing.
                     "isIgnoringBatteryOptimizations" ->
                         result.success(isIgnoringBatteryOptimizations())
                     "requestIgnoreBatteryOptimizations" ->
                         result.success(requestIgnoreBatteryOptimizations())
+                    "setSessionExpiry" -> {
+                        val expiresAtMs = call.argument<Number>("expiresAtMs")?.toLong() ?: 0L
+                        if (expiresAtMs > 0) {
+                            sendSessionExpiryToDaemon(expiresAtMs)
+                        }
+                        result.success(null)
+                    }
+                    // Is our VPN runtime actually alive? The service lives in
+                    // :RunSoLibXrayDaemon, a separate process, so its statics are
+                    // NOT visible here -- this is the only honest check.
+                    "isVpnRuntimeAlive" -> result.success(isVpnRuntimeAlive())
                     else -> result.notImplemented()
                 }
             }
 
         MethodChannel(flutterEngine.dartExecutor.binaryMessenger, notificationChannel)
             .setMethodCallHandler { call, result ->
-                when (call.method) {
-                    "updateNotificationText" -> {
-                        val text = call.argument<String>("text") ?: ""
-                        val title = call.argument<String>("title") ?: "Revolt VPN"
-                        val action = call.argument<String>("disconnectLabel") ?: "Disconnect"
-                        updateVpnNotification(title, text, action)
-                        result.success(null)
-                    }
-                    // Session ends only Dart sees; the service posts the rest.
-                    "showDisconnectedAlert" -> {
-                        RevoltAlerts.postDisconnected(this)
-                        result.success(null)
-                    }
-                    // The countdown re-post is ongoing and non-dismissible, so
-                    // whoever posted it last has to take it down. A tick that
-                    // lands after the service cancelled its own foreground
-                    // notification otherwise strands a frozen countdown that
-                    // claims a protected session forever. Harmless while the
-                    // service is still in the foreground - the platform keeps
-                    // its notification regardless.
-                    "cancelNotification" -> {
-                        (getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager)
-                            .cancel(NOTIFICATION_ID)
-                        result.success(null)
-                    }
-                    else -> result.notImplemented()
+                if (call.method == "updateNotificationText") {
+                    val text = call.argument<String>("text") ?: ""
+                    val title = call.argument<String>("title") ?: "Revolt VPN"
+                    val action = call.argument<String>("disconnectLabel") ?: "Disconnect"
+                    updateVpnNotification(title, text, action)
+                    result.success(null)
+                } else {
+                    result.notImplemented()
                 }
             }
 
@@ -120,6 +118,7 @@ class MainActivity : FlutterActivity() {
         super.onDestroy()
     }
 
+    /** True when the OS has exempted us from Doze / App Standby. */
     private fun isIgnoringBatteryOptimizations(): Boolean {
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
         return try {
@@ -130,6 +129,11 @@ class MainActivity : FlutterActivity() {
         }
     }
 
+    /**
+     * Opens the system exemption prompt. Android shows this as a single dialog;
+     * it cannot be granted silently, so the caller must treat a false return as
+     * "ask again later" rather than a denial.
+     */
     private fun requestIgnoreBatteryOptimizations(): Boolean {
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
         if (isIgnoringBatteryOptimizations()) return true
@@ -142,6 +146,7 @@ class MainActivity : FlutterActivity() {
             )
             true
         } catch (_: Exception) {
+            // Some OEM builds hide the direct intent; fall back to the list.
             try {
                 startActivity(Intent(Settings.ACTION_IGNORE_BATTERY_OPTIMIZATION_SETTINGS))
                 true
@@ -151,6 +156,58 @@ class MainActivity : FlutterActivity() {
         }
     }
 
+    /** Pushes the session-expiry deadline to the VPN service process. */
+    private fun sendSessionExpiryToDaemon(expiresAtMs: Long) {
+        try {
+            val intent = Intent(this, XrayVPNService::class.java)
+            intent.putExtra("SESSION_EXPIRES_AT_MS", expiresAtMs)
+            startService(intent)
+        } catch (_: Exception) {
+            // Daemon not reachable; its persisted expiry still applies.
+        }
+    }
+
+    /**
+     * Whether the VPN runtime is genuinely alive.
+     *
+     * The Xray service runs in :RunSoLibXrayDaemon, a separate process, so its
+     * statics (AppConfigs.V2RAY_CONFIG, V2RAY_STATE) are NOT visible from here --
+     * reading them yields a fresh, empty copy. getRunningAppProcesses still
+     * returns our *own* processes, which makes it the one reliable signal.
+     */
+    private fun isVpnRuntimeAlive(): Map<String, Any> {
+        var processAlive = false
+        try {
+            val am = getSystemService(Context.ACTIVITY_SERVICE) as ActivityManager
+            processAlive = am.runningAppProcesses
+                ?.any { it.processName.endsWith(VPN_PROCESS_SUFFIX) } == true
+        } catch (_: Exception) {
+        }
+
+        var vpnTransport = false
+        try {
+            val cm = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
+            vpnTransport = cm.allNetworks.any { network ->
+                cm.getNetworkCapabilities(network)
+                    ?.hasTransport(NetworkCapabilities.TRANSPORT_VPN) == true
+            }
+        } catch (_: Exception) {
+        }
+
+        return mapOf(
+            "processAlive" to processAlive,
+            "vpnTransport" to vpnTransport,
+        )
+    }
+
+    /** Removes a notification left behind by a runtime that is no longer alive. */
+    private fun cancelVpnNotification() {
+        try {
+            NotificationManagerCompat.from(this).cancel(NOTIFICATION_ID)
+        } catch (_: Exception) {
+        }
+    }
+
     private fun updateVpnNotification(title: String, text: String, actionLabel: String) {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
             checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) !=
@@ -159,6 +216,15 @@ class MainActivity : FlutterActivity() {
             return
         }
 
+        // The foreground notification (id 1) is owned by XrayVPNService via
+        // startForeground. Posting to it from this process while the service is
+        // gone leaves a frozen countdown nothing will ever update again.
+        val alive = isVpnRuntimeAlive()["processAlive"] == true
+        if (!alive) {
+            cancelVpnNotification()
+            return
+        }
+
         ensureNotificationChannel()
 
         val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
@@ -168,38 +234,28 @@ class MainActivity : FlutterActivity() {
         }
 
         val launchIntent = packageManager.getLaunchIntentForPackage(packageName)
+        launchIntent?.action = "FROM_DISCONNECT_BTN"
         launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or
             Intent.FLAG_ACTIVITY_CLEAR_TOP or
             Intent.FLAG_ACTIVITY_NEW_TASK
 
-        // The VPN service owns the authoritative Disconnect PendingIntent and
-        // embeds the current runtime-generation token in it. Never recreate an
-        // unscoped STOP intent from the UI process: a stale notification could
-        // otherwise stop a newer tunnel. Reuse the live service action when the
-        // platform exposes it; on older Android versions omit the action rather
-        // than weaken generation scoping.
-        val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
-        val serviceStopAction = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-            manager.activeNotifications
-                .firstOrNull { it.id == NOTIFICATION_ID }
-                ?.notification
-                ?.actions
-                ?.firstOrNull()
-                ?.actionIntent
-        } else {
-            null
-        }
+        val stopIntent = Intent(this, XrayVPNService::class.java)
+        stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
+        val stopPendingIntent = PendingIntent.getService(this, 0, stopIntent, flags)
 
+        // Public lock-screen preview: keep the VPN status visible but hide the
+        // session countdown/speed so usage metadata never reaches the lock screen.
         val publicVersion = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
-            .setSmallIcon(R.drawable.notification_icon)
+            .setSmallIcon(R.drawable.notification_status_icon)
             .setContentTitle("Revolt VPN")
             .setContentText("VPN is active")
             .build()
 
         val builder = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
-            .setSmallIcon(R.drawable.notification_icon)
+            .setSmallIcon(R.drawable.notification_status_icon)
             .setContentTitle(title)
             .setContentText(text)
+            .addAction(0, actionLabel, stopPendingIntent)
             .setColorized(true)
             .setColor(0xFF0D1117.toInt())
             .setOngoing(true)
@@ -211,10 +267,6 @@ class MainActivity : FlutterActivity() {
             .setVisibility(NotificationCompat.VISIBILITY_PRIVATE)
             .setPublicVersion(publicVersion)
 
-        if (serviceStopAction != null) {
-            builder.addAction(0, actionLabel, serviceStopAction)
-        }
-
         if (launchIntent != null) {
             builder.setContentIntent(PendingIntent.getActivity(this, 0, launchIntent, flags))
         }
@@ -421,6 +473,7 @@ class MainActivity : FlutterActivity() {
 
     companion object {
         private const val NOTIFICATION_ID = 1
-        private const val NOTIFICATION_CHANNEL_ID = "REVOLT_VPN_SERVICE"
+        private const val VPN_PROCESS_SUFFIX = ":RunSoLibXrayDaemon"
+        private const val NOTIFICATION_CHANNEL_ID = "XRAY_SERVICE_CHANNEL"
     }
 }

android/gradlew

@@ -1,251 +0,0 @@
-#!/bin/sh
-
-#
-# Copyright © 2015-2021 the original authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-##############################################################################
-#
-#   Gradle start up script for POSIX generated by Gradle.
-#
-#   Important for running:
-#
-#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
-#       noncompliant, but you have some other compliant shell such as ksh or
-#       bash, then to run this script, type that shell name before the whole
-#       command line, like:
-#
-#           ksh Gradle
-#
-#       Busybox and similar reduced shells will NOT work, because this script
-#       requires all of these POSIX shell features:
-#         * functions;
-#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
-#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
-#         * compound commands having a testable exit status, especially «case»;
-#         * various built-in commands including «command», «set», and «ulimit».
-#
-#   Important for patching:
-#
-#   (2) This script targets any POSIX shell, so it avoids extensions provided
-#       by Bash, Ksh, etc; in particular arrays are avoided.
-#
-#       The "traditional" practice of packing multiple parameters into a
-#       space-separated string is a well documented source of bugs and security
-#       problems, so this is (mostly) avoided, by progressively accumulating
-#       options in "$@", and eventually passing that to Java.
-#
-#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
-#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
-#       see the in-line comments for details.
-#
-#       There are tweaks for specific operating systems such as AIX, CygWin,
-#       Darwin, MinGW, and NonStop.
-#
-#   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
-#       within the Gradle project.
-#
-#       You can find Gradle at https://github.com/gradle/gradle/.
-#
-##############################################################################
-
-# Attempt to set APP_HOME
-
-# Resolve links: $0 may be a link
-app_path=$0
-
-# Need this for daisy-chained symlinks.
-while
-    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
-    [ -h "$app_path" ]
-do
-    ls=$( ls -ld "$app_path" )
-    link=${ls#*' -> '}
-    case $link in             #(
-      /*)   app_path=$link ;; #(
-      *)    app_path=$APP_HOME$link ;;
-    esac
-done
-
-# This is normally unused
-# shellcheck disable=SC2034
-APP_BASE_NAME=${0##*/}
-# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
-
-# Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD=maximum
-
-warn () {
-    echo "$*"
-} >&2
-
-die () {
-    echo
-    echo "$*"
-    echo
-    exit 1
-} >&2
-
-# OS specific support (must be 'true' or 'false').
-cygwin=false
-msys=false
-darwin=false
-nonstop=false
-case "$( uname )" in                #(
-  CYGWIN* )         cygwin=true  ;; #(
-  Darwin* )         darwin=true  ;; #(
-  MSYS* | MINGW* )  msys=true    ;; #(
-  NONSTOP* )        nonstop=true ;;
-esac
-
-CLASSPATH="\\\"\\\""
-
-
-# Determine the Java command to use to start the JVM.
-if [ -n "$JAVA_HOME" ] ; then
-    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
-        # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD=$JAVA_HOME/jre/sh/java
-    else
-        JAVACMD=$JAVA_HOME/bin/java
-    fi
-    if [ ! -x "$JAVACMD" ] ; then
-        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-else
-    JAVACMD=java
-    if ! command -v java >/dev/null 2>&1
-    then
-        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-fi
-
-# Increase the maximum file descriptors if we can.
-if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
-    case $MAX_FD in #(
-      max*)
-        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC2039,SC3045
-        MAX_FD=$( ulimit -H -n ) ||
-            warn "Could not query maximum file descriptor limit"
-    esac
-    case $MAX_FD in  #(
-      '' | soft) :;; #(
-      *)
-        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC2039,SC3045
-        ulimit -n "$MAX_FD" ||
-            warn "Could not set maximum file descriptor limit to $MAX_FD"
-    esac
-fi
-
-# Collect all arguments for the java command, stacking in reverse order:
-#   * args from the command line
-#   * the main class name
-#   * -classpath
-#   * -D...appname settings
-#   * --module-path (only if needed)
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if "$cygwin" || "$msys" ; then
-    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
-    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
-
-    JAVACMD=$( cygpath --unix "$JAVACMD" )
-
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    for arg do
-        if
-            case $arg in                                #(
-              -*)   false ;;                            # don't mess with options #(
-              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
-                    [ -e "$t" ] ;;                      #(
-              *)    false ;;
-            esac
-        then
-            arg=$( cygpath --path --ignore --mixed "$arg" )
-        fi
-        # Roll the args list around exactly as many times as the number of
-        # args, so each arg winds up back in the position where it started, but
-        # possibly modified.
-        #
-        # NB: a `for` loop captures its iteration list before it begins, so
-        # changing the positional parameters here affects neither the number of
-        # iterations, nor the values presented in `arg`.
-        shift                   # remove old arg
-        set -- "$@" "$arg"      # push replacement arg
-    done
-fi
-
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"'
-
-# Collect all arguments for the java command:
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
-#     and any embedded shellness will be escaped.
-#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
-#     treated as '${Hostname}' itself on the command line.
-
-set -- \
-        "-Dorg.gradle.appname=$APP_BASE_NAME" \
-        -classpath "$CLASSPATH" \
-        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
-        "$@"
-
-# Stop when "xargs" is not available.
-if ! command -v xargs >/dev/null 2>&1
-then
-    die "xargs is not available"
-fi
-
-# Use "xargs" to parse quoted args.
-#
-# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
-#
-# In Bash we could simply go:
-#
-#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
-#   set -- "${ARGS[@]}" "$@"
-#
-# but POSIX shell has neither arrays nor command substitution, so instead we
-# post-process each arg (as a line of input to sed) to backslash-escape any
-# character that might be a shell metacharacter, then use eval to reverse
-# that process (while maintaining the separation between arguments), and wrap
-# the whole thing up as a single "set" statement.
-#
-# This will of course break if any of these variables contains a newline or
-# an unmatched quote.
-#
-
-eval "set -- $(
-        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
-        xargs -n1 |
-        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
-        tr '\n' ' '
-    )" '"$@"'
-
-exec "$JAVACMD" "$@"

android/gradlew.bat

@@ -1,94 +0,0 @@
-@rem
-@rem Copyright 2015 the original author or authors.
-@rem
-@rem Licensed under the Apache License, Version 2.0 (the "License");
-@rem you may not use this file except in compliance with the License.
-@rem You may obtain a copy of the License at
-@rem
-@rem      https://www.apache.org/licenses/LICENSE-2.0
-@rem
-@rem Unless required by applicable law or agreed to in writing, software
-@rem distributed under the License is distributed on an "AS IS" BASIS,
-@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-@rem See the License for the specific language governing permissions and
-@rem limitations under the License.
-@rem
-@rem SPDX-License-Identifier: Apache-2.0
-@rem
-
-@if "%DEBUG%"=="" @echo off
-@rem ##########################################################################
-@rem
-@rem  Gradle startup script for Windows
-@rem
-@rem ##########################################################################
-
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
-
-set DIRNAME=%~dp0
-if "%DIRNAME%"=="" set DIRNAME=.
-@rem This is normally unused
-set APP_BASE_NAME=%~n0
-set APP_HOME=%DIRNAME%
-
-@rem Resolve any "." and ".." in APP_HOME to make it shorter.
-for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS=-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"
-
-@rem Find java.exe
-if defined JAVA_HOME goto findJavaFromJavaHome
-
-set JAVA_EXE=java.exe
-%JAVA_EXE% -version >NUL 2>&1
-if %ERRORLEVEL% equ 0 goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:findJavaFromJavaHome
-set JAVA_HOME=%JAVA_HOME:"=%
-set JAVA_EXE=%JAVA_HOME%/bin/java.exe
-
-if exist "%JAVA_EXE%" goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:execute
-@rem Setup the command line
-
-set CLASSPATH=
-
-
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
-
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega

lib/components/connect_button.dart

@@ -19,7 +19,6 @@ class _ConnectButtonState extends State<ConnectButton>
   DateTime _lastTap = DateTime.fromMillisecondsSinceEpoch(0);
   AnimationController? _pulse;
   Animation<double>? _pulseAnim;
-  VpnConnection? _vpn;
 
   double get _pulseValue => _pulseAnim?.value ?? 0.0;
 
@@ -36,25 +35,20 @@ class _ConnectButtonState extends State<ConnectButton>
     );
     WidgetsBinding.instance.addObserver(this);
     WidgetsBinding.instance.addPostFrameCallback((_) {
-      if (!mounted || _vpn != null) return;
-      final vpn = context.read<VpnConnection>();
-      _vpn = vpn;
-      vpn.addListener(_onVpnChanged);
-      _onVpnChanged();
+      if (mounted) context.read<VpnConnection>().addListener(_onVpnChanged);
     });
   }
 
   @override
   void dispose() {
     WidgetsBinding.instance.removeObserver(this);
-    _vpn?.removeListener(_onVpnChanged);
+    context.read<VpnConnection>().removeListener(_onVpnChanged);
     _pulse?.dispose();
     super.dispose();
   }
 
   void _onVpnChanged() {
-    final vpn = _vpn;
-    if (vpn == null) return;
+    final vpn = context.read<VpnConnection>();
     if (vpn.status == VpnStatus.connected) {
       _pulse?.repeat(reverse: true);
     } else {
@@ -66,12 +60,14 @@ class _ConnectButtonState extends State<ConnectButton>
   @override
   void didChangeAppLifecycleState(AppLifecycleState state) {
     if (!mounted) return;
-    if (state != AppLifecycleState.resumed) {
+    if (state == AppLifecycleState.paused ||
+        state == AppLifecycleState.detached) {
       _pulse?.stop();
-      return;
-    }
-    if (_vpn?.status == VpnStatus.connected) {
-      _pulse?.repeat(reverse: true);
+    } else if (state == AppLifecycleState.resumed) {
+      final vpn = context.read<VpnConnection>();
+      if (vpn.status == VpnStatus.connected) {
+        _pulse?.repeat(reverse: true);
+      }
     }
   }
 
@@ -95,10 +91,10 @@ class _ConnectButtonState extends State<ConnectButton>
 
     setState(() => _busy = true);
     try {
-      final adNonce = await ad.showAd('main');
-      if (adNonce == null && AdManager.adsEnabled) return;
+      final adWatched = await ad.showAd('main');
+      if (!adWatched && AdManager.adsEnabled) return;
 
-      final ok = await vpn.connect(adNonce: adNonce);
+      final ok = await vpn.connect();
       if (ok) {
         await timer.start();
         HapticSettings.success();

lib/components/data_disclosure_dialog.dart

@@ -19,28 +19,23 @@ class DataDisclosureDialog {
 
     if (!context.mounted) return;
 
-    final accepted = await showDialog<bool>(
+    await showDialog(
       context: context,
       barrierDismissible: false, // Must tap Continue — no tap-outside dismiss.
-      builder: (_) => const _DisclosureDialog(),
+      builder: (_) => _DisclosureDialog(
+        onContinue: () {
+          prefs.setBool(_key, true);
+          Navigator.of(context).pop(); // Dismiss the dialog.
+        },
+      ),
     );
-    if (accepted != true) return;
-
-    // Persist only after the user action is complete. If storage fails, do not
-    // invent an accepted state; the disclosure will simply reappear later.
-    try {
-      final saved = await prefs.setBool(_key, true);
-      if (!saved) {
-        debugPrint('[Disclosure] Preference write was rejected');
-      }
-    } catch (e) {
-      debugPrint('[Disclosure] Failed to persist acknowledgement: $e');
-    }
   }
 }
 
 class _DisclosureDialog extends StatelessWidget {
-  const _DisclosureDialog();
+  final VoidCallback onContinue;
+
+  const _DisclosureDialog({required this.onContinue});
 
   @override
   Widget build(BuildContext context) {
@@ -54,6 +49,7 @@ class _DisclosureDialog extends StatelessWidget {
           mainAxisSize: MainAxisSize.min,
           crossAxisAlignment: CrossAxisAlignment.start,
           children: [
+            // Title
             const Text(
               'Before you connect',
               style: TextStyle(
@@ -63,6 +59,8 @@ class _DisclosureDialog extends StatelessWidget {
               ),
             ),
             const SizedBox(height: 16),
+
+            // Body
             const Text(
               'Revolt VPN creates a secure VPN tunnel to protect your '
               'traffic. To enforce your data/time quota, we log your '
@@ -78,10 +76,12 @@ class _DisclosureDialog extends StatelessWidget {
               ),
             ),
             const SizedBox(height: 24),
+
+            // Continue button — full-width, accent
             SizedBox(
               width: double.infinity,
               child: ElevatedButton(
-                onPressed: () => Navigator.of(context).pop(true),
+                onPressed: onContinue,
                 style: ElevatedButton.styleFrom(
                   backgroundColor: AppColors.accent,
                   foregroundColor: AppColors.bgDeep,

lib/components/lightning.dart

@@ -182,7 +182,7 @@ class _LightningPainter extends CustomPainter {
 
   @override
   void paint(Canvas canvas, Size size) {
-    Offset toScreen(Offset p) => Offset(p.dx * size.width, p.dy * size.height);
+    final toScreen = (Offset p) => Offset(p.dx * size.width, p.dy * size.height);
     final scaledMain = bolt.mainPath.map(toScreen).toList();
     final scaledBranches = bolt.branches
         .map((b) => b.map(toScreen).toList())

lib/components/sidebar_contents/discord_link_button.dart

@@ -14,8 +14,8 @@ class DiscordLinkButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return const IconButton(
-      icon: Icon(Icons.discord, color: AppColors.textWhite, size: 28),
+    return IconButton(
+      icon: const Icon(Icons.discord, color: AppColors.textWhite, size: 28),
       onPressed: launchDiscord,
       tooltip: 'Join Discord',
       splashRadius: 24,

lib/components/sidebar_contents/gdpr_button.dart

@@ -76,8 +76,8 @@ class GdprButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return const IconButton(
-      icon: Icon(Icons.admin_panel_settings_outlined,
+    return IconButton(
+      icon: const Icon(Icons.admin_panel_settings_outlined,
           color: AppColors.textWhite, size: 28),
       onPressed: showConsentForm,
       tooltip: 'Ad consent & privacy choices',

lib/components/sidebar_contents/info_button.dart

@@ -14,8 +14,8 @@ class InfoButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return const IconButton(
-      icon: Icon(Icons.help_outline, color: AppColors.textWhite, size: 28),
+    return IconButton(
+      icon: const Icon(Icons.help_outline, color: AppColors.textWhite, size: 28),
       onPressed: launchGitHub,
       tooltip: 'About ReVoltVPN',
       splashRadius: 24,

lib/components/sidebar_contents/privacy_policy_button.dart

@@ -14,8 +14,8 @@ class PrivacyPolicyButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return const IconButton(
-      icon: Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28),
+    return IconButton(
+      icon: const Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28),
       onPressed: launchPrivacyPolicy,
       tooltip: 'Privacy Policy',
       splashRadius: 24,

lib/components/sidebar_contents/website_button.dart

@@ -14,8 +14,8 @@ class WebsiteButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return const IconButton(
-      icon: Icon(Icons.language, color: AppColors.textWhite, size: 28),
+    return IconButton(
+      icon: const Icon(Icons.language, color: AppColors.textWhite, size: 28),
       onPressed: launchWebsite,
       tooltip: 'Website',
       splashRadius: 24,

lib/components/status_bar.dart

@@ -1,44 +1,11 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
-import 'package:revoltvpn/components/online_dot.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
-import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
-
-// The one line worth showing right now, and whether it is a problem.
-class _StatusDetail {
-  const _StatusDetail(this.text, {this.isProblem = false});
-
-  final String text;
-  final bool isProblem;
-}
-
-_StatusDetail? _detail(VpnConnection vpn, SessionTimer timer) {
-  final error = vpn.errorMessage;
-  if (error != null && error.isNotEmpty) {
-    return _StatusDetail(error.replaceAll('\n', ' '), isProblem: true);
-  }
-
-  if (vpn.status == VpnStatus.connecting ||
-      vpn.status == VpnStatus.disconnecting) {
-    return _StatusDetail(vpn.statusMessage);
-  }
-
-  // Control plane only - the tunnel still carries traffic.
-  if (vpn.status == VpnStatus.connected && timer.serverUnreachable) {
-    return const _StatusDetail(
-      'Can\'t reach the server — still connected',
-      isProblem: true,
-    );
-  }
-
-  if (vpn.status != VpnStatus.connected) {
-    final ended = timer.lastEndMessage;
-    if (ended != null) return _StatusDetail(ended, isProblem: true);
-  }
-
-  return null;
-}
+import 'package:revoltvpn/logic/session_timer.dart';
+import 'package:revoltvpn/logic/server_list.dart';
+import 'package:revoltvpn/components/online_dot.dart';
+import 'package:revoltvpn/screens/server_selector/selection_screen.dart';
 
 class StatusBar extends StatelessWidget {
   const StatusBar({super.key});
@@ -49,50 +16,76 @@ class StatusBar extends StatelessWidget {
       builder: (context, vpn, timer, _) {
         final isConnected = vpn.status == VpnStatus.connected;
         final isConnecting = vpn.status == VpnStatus.connecting;
-        // Rule 60: reachability is known only from a session sync that
-        // succeeded, never from a probe. While disconnected the app knows
-        // nothing about the server, so it claims nothing either way.
-        final serverHealthy = isConnected && timer.hasSyncedOnce;
+        final serverHealthy =
+            vpn.serverReachable || (isConnected && timer.hasSyncedOnce);
+        final sessionOrTunnelHealthy = timer.hasSyncedOnce || vpn.serverReachable;
 
         final statusLabel = isConnected
-            ? (timer.hasSyncedOnce ? 'Online' : 'Syncing…')
-            : (isConnecting ? 'Connecting…' : 'Ready');
+            ? (sessionOrTunnelHealthy ? 'Online' : 'Syncing…')
+            : (isConnecting
+                ? 'Connecting…'
+                : (vpn.serverReachable ? 'Ready' : 'Offline'));
 
-        final detail = _detail(vpn, timer);
+        final server = context.watch<ServerList>().selected;
 
         return Padding(
           padding: const EdgeInsets.symmetric(horizontal: 24),
           child: Column(
             mainAxisSize: MainAxisSize.min,
             children: [
-              Container(
-                padding:
-                    const EdgeInsets.symmetric(horizontal: 20, vertical: 12),
-                decoration: BoxDecoration(
-                  color: AppColors.bgCard,
-                  borderRadius: BorderRadius.circular(16),
-                  border: Border.all(color: AppColors.slate15),
-                ),
-                child: Row(
-                  children: [
-                    Image.asset(
-                      'assets/finland_flag_256.png',
-                      width: 20,
-                      height: 20,
+              GestureDetector(
+                onTap: () {
+                  Navigator.of(context).push(
+                    PageRouteBuilder(
+                      transitionDuration: const Duration(milliseconds: 300),
+                      pageBuilder: (_, __, ___) => const SelectionScreen(),
+                      transitionsBuilder: (_, animation, __, child) {
+                        return SlideTransition(
+                          position: Tween<Offset>(
+                            begin: const Offset(1.0, 0.0),
+                            end: Offset.zero,
+                          ).animate(
+                            CurvedAnimation(
+                              parent: animation,
+                              curve: Curves.easeOut,
+                            ),
+                          ),
+                          child: child,
+                        );
+                      },
                     ),
-                    const SizedBox(width: 8),
-                    const Expanded(
-                      child: Text(
-                        'Helsinki, Finland',
-                        style: TextStyle(
-                          color: AppColors.accent,
-                          fontWeight: FontWeight.w600,
-                          fontSize: 13,
-                          letterSpacing: 0.5,
+                  );
+                },
+                child: Container(
+                  padding:
+                      const EdgeInsets.symmetric(horizontal: 20, vertical: 12),
+                  decoration: BoxDecoration(
+                    color: AppColors.bgCard,
+                    borderRadius: BorderRadius.circular(16),
+                    border: Border.all(color: AppColors.slate15),
+                  ),
+                  child: Row(
+                    children: [
+                      Image.asset(server.flagAsset, width: 20, height: 20),
+                      const SizedBox(width: 8),
+                      Expanded(
+                        child: Text(
+                          server.name,
+                          style: const TextStyle(
+                            color: AppColors.accent,
+                            fontWeight: FontWeight.w600,
+                            fontSize: 13,
+                            letterSpacing: 0.5,
+                          ),
                         ),
                       ),
-                    ),
-                  ],
+                      const Icon(
+                        Icons.chevron_right,
+                        color: AppColors.textDim,
+                        size: 20,
+                      ),
+                    ],
+                  ),
                 ),
               ),
               const SizedBox(height: 8),
@@ -132,21 +125,6 @@ class StatusBar extends StatelessWidget {
                   ],
                 ),
               ),
-              // Errors and session-end reasons used to render nowhere.
-              if (detail != null)
-                Padding(
-                  padding: const EdgeInsets.only(top: 6),
-                  child: Text(
-                    detail.text,
-                    textAlign: TextAlign.center,
-                    style: TextStyle(
-                      color: detail.isProblem
-                          ? AppColors.red
-                          : AppColors.textDim,
-                      fontSize: 11,
-                    ),
-                  ),
-                ),
             ],
           ),
         );

lib/components/support_button.dart

@@ -31,7 +31,7 @@ class _SupportButtonState extends State<SupportButton> {
     setState(() => _busy = true);
 
     try {
-      final rewarded = await ad.showAd('support') != null;
+      final rewarded = await ad.showAd('support');
       if (rewarded) {
         await timer.markSupportRewardClaimed();
         await timer.syncNow();

lib/logic/ad_manager.dart

@@ -1,5 +1,6 @@
 import 'dart:async';
 import 'dart:convert';
+import 'dart:math';
 import 'package:flutter/foundation.dart';
 import 'package:google_mobile_ads/google_mobile_ads.dart';
 import 'package:revoltvpn/logic/crypto_service.dart';
@@ -96,16 +97,13 @@ class AdManager extends ChangeNotifier {
 
   // ── Show ad (or debug bypass) ─────────────────────────────────────
 
-  // Returns the nonce put in the SSV custom_data, null if unrewarded. connect()
-  // must reuse it: minting a second nonce there rejects the ad's own session.
-  Future<String?> showAd(String adType) async {
-    if (!adsEnabled) {
-      // Main connect fires its own bypass in fetchConfigDirectly (rule 87).
-      if (adType != 'support' || !kDebugMode) return null;
-
-      // Needs ADMOB_BYPASS=True server-side.
+  Future<bool> showAd(String adType) async {
+    // Debug bypass: fire fake AdMob callback so support ads work in dev.
+    // The server's ADMOB_BYPASS must be True for this to succeed.
+    if (!adsEnabled && kDebugMode) {
       final deviceId = await CryptoService.getDeviceId();
-      final nonce = HivemindService.newNonce();
+      final nonce = '${Random().nextInt(0x7FFFFFFF)}-${DateTime.now().millisecondsSinceEpoch}';
+      HivemindService.setExpectedNonce(nonce);
       try {
         final customData = jsonEncode({
           'device_id': deviceId,
@@ -117,24 +115,29 @@ class AdManager extends ChangeNotifier {
             '?signature=test&key_id=test'
             '&custom_data=${Uri.encodeComponent(customData)}');
         await HivemindService.directGet(fakeUrl, timeout: const Duration(seconds: 8));
-        return nonce;
+        return true;
       } catch (_) {
-        return null;
+        return false;
       }
     }
 
+    if (!adsEnabled) return false;
+
     await ensureSdkInitialized();
 
     if (!_isAdLoaded || _rewardedAd == null) {
       final loaded = await preloadAd();
       if (!loaded || _rewardedAd == null) {
         debugPrint('[AdManager] Cannot show ad, failed to load.');
-        return null;
+        return false;
       }
     }
 
     final deviceId = await CryptoService.getDeviceId();
-    final nonce = HivemindService.newNonce();
+
+    final nonce = '${Random().nextInt(0x7FFFFFFF)}-${DateTime.now().millisecondsSinceEpoch}';
+    HivemindService.setExpectedNonce(nonce);
+    debugPrint('[AdManager] Ad nonce: $nonce');
 
     final ssvOptions = ServerSideVerificationOptions(
       customData: jsonEncode({
@@ -179,7 +182,7 @@ class AdManager extends ChangeNotifier {
       },
     );
 
-    return await rewardCompleter.future ? nonce : null;
+    return rewardCompleter.future;
   }
 
   @override

lib/logic/hivemind_service.dart

@@ -13,7 +13,6 @@ class HivemindService {
 
   static const _ua = 'Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 '
       '(KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36';
-  static const int _maxControlResponseBytes = 256 * 1024;
   static const _pollBackoff = <Duration>[
     Duration(seconds: 1),
     Duration(seconds: 2),
@@ -25,158 +24,35 @@ class HivemindService {
     Uri uri, {
     Duration timeout = const Duration(seconds: 5),
   }) {
-    return controlGet(uri, timeout: timeout);
+    return http.get(uri, headers: {'User-Agent': _ua}).timeout(timeout);
   }
 
-  static Future<http.Response> controlGet(
-    Uri uri, {
-    Duration timeout = const Duration(seconds: 5),
-  }) async {
-    final client = http.Client();
-    final request = http.Request('GET', uri)
-      ..headers['User-Agent'] = _ua
-      ..followRedirects = false;
+  static void cancel() => _currentCallId++;
 
-    Future<http.Response> read() async {
-      final streamed = await client.send(request);
-      final declaredLength = streamed.contentLength;
-      if (declaredLength != null && declaredLength > _maxControlResponseBytes) {
-        throw const FormatException('Control response is too large.');
-      }
-
-      final bytes = <int>[];
-      await for (final chunk in streamed.stream) {
-        if (bytes.length + chunk.length > _maxControlResponseBytes) {
-          throw const FormatException('Control response is too large.');
-        }
-        bytes.addAll(chunk);
-      }
-
-      return http.Response.bytes(
-        bytes,
-        streamed.statusCode,
-        headers: streamed.headers,
-        isRedirect: streamed.isRedirect,
-        persistentConnection: streamed.persistentConnection,
-        reasonPhrase: streamed.reasonPhrase,
-        request: request,
-      );
-    }
-
-    try {
-      return await read().timeout(
-        timeout,
-        onTimeout: () {
-          client.close();
-          throw TimeoutException('Control request timed out.', timeout);
-        },
-      );
-    } finally {
-      client.close();
-    }
+  static void setExpectedNonce(String nonce) {
+    _expectedNonce = nonce;
   }
 
-  static Future<http.Response> controlPost(
-    Uri uri,
-    Map<String, dynamic> body, {
-    Duration timeout = const Duration(seconds: 5),
-  }) async {
-    final client = http.Client();
-    final request = http.Request('POST', uri)
-      ..headers['User-Agent'] = _ua
-      ..headers['Content-Type'] = 'application/json'
-      ..body = jsonEncode(body)
-      ..followRedirects = false;
-
-    Future<http.Response> send() async {
-      final streamed = await client.send(request);
-      final declaredLength = streamed.contentLength;
-      if (declaredLength != null && declaredLength > _maxControlResponseBytes) {
-        throw const FormatException('Control response is too large.');
-      }
-
-      final bytes = <int>[];
-      await for (final chunk in streamed.stream) {
-        if (bytes.length + chunk.length > _maxControlResponseBytes) {
-          throw const FormatException('Control response is too large.');
-        }
-        bytes.addAll(chunk);
-      }
-
-      return http.Response.bytes(bytes, streamed.statusCode,
-          headers: streamed.headers, request: request);
-    }
-
-    try {
-      return await send().timeout(
-        timeout,
-        onTimeout: () {
-          client.close();
-          throw TimeoutException('Control request timed out.', timeout);
-        },
-      );
-    } finally {
-      client.close();
-    }
-  }
-
-  // Hands the session back so the server can drop the VLESS client instead of
-  // leaving it provisioned until the window runs out.
-  //
-  // Only the user-initiated disconnect calls this. An expiry, a hard cap or a
-  // server-ended session is already gone server-side, and /session/stop takes
-  // nothing but a device_id as proof (hivemind/api.py notes this), so a
-  // transient client error must never be allowed to destroy a live session.
-  // Best effort throughout: the session expires on its own regardless.
-  static Future<void> releaseSession() async {
-    try {
-      final deviceId = await CryptoService.getDeviceId();
-      await controlPost(
-        _publicUrl('/session/stop'),
-        {'device_id': deviceId},
-        timeout: const Duration(seconds: 3),
-      );
-    } catch (_) {
-      // Nothing to recover: the server expires the session anyway.
-    }
-  }
-
-  static void cancel() {
-    _currentCallId++;
-    _expectedNonce = null;
-  }
-
-  // Fetches this device's VLESS URL. Every session starts the same way, so
-  // there is always a nonce to bind it to: either the one the ad minted, or one
-  // we mint here before firing the bypass (rule 87). The re-attach path that
-  // used to accept any nonce is gone - see rule 4.
   static Future<String> fetchConfigDirectly({
     void Function(int attempt, int total)? onAttempt,
-    String? adNonce,
+    bool skipAdBypass = false,
   }) async {
-    // Capture the generation before the first await. Otherwise a disconnect
-    // that lands while secure storage is resolving the device ID can be lost
-    // and the cancelled call can resume network work with a fresh generation.
-    final callId = ++_currentCallId;
     final deviceId = await CryptoService.getDeviceId();
-    _throwIfCancelled(callId);
-
-    final nonce = adNonce ?? newNonce();
+    final callId = ++_currentCallId;
+    final nonce = _newNonce();
     _expectedNonce = nonce;
 
-    if (adNonce == null) {
+    if (!skipAdBypass) {
       await _runConfiguredBypass(deviceId, nonce);
-      _throwIfCancelled(callId);
     }
 
-    final maxAttempts = adNonce != null ? 10 : 5;
+    const maxAttempts = 5;
     for (var attempt = 1; attempt <= maxAttempts; attempt++) {
       _throwIfCancelled(callId);
       onAttempt?.call(attempt, maxAttempts);
 
       try {
         final session = await _fetchActiveSession(deviceId, nonce);
-        _throwIfCancelled(callId);
         if (session != null) {
           _expectedNonce = null;
           return session.toVlessUrl();
@@ -187,9 +63,7 @@ class HivemindService {
       }
 
       if (attempt < maxAttempts) {
-        await Future.delayed(
-          _pollBackoff[min(attempt - 1, _pollBackoff.length - 1)],
-        );
+        await Future.delayed(_pollBackoff[attempt - 1]);
         _throwIfCancelled(callId);
       }
     }
@@ -197,7 +71,19 @@ class HivemindService {
     throw Exception('Session not activated. Server callback may have timed out.');
   }
 
-  static String newNonce() {
+  static Future<bool> checkHealth() async {
+    try {
+      final response = await directGet(
+        _publicUrl('/health'),
+        timeout: const Duration(seconds: 3),
+      );
+      return response.statusCode == 200;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  static String _newNonce() {
     final random = Random.secure();
     final high = random.nextInt(0x7FFFFFFF);
     final low = random.nextInt(0x7FFFFFFF);
@@ -223,15 +109,18 @@ class HivemindService {
     final statusUri = _publicUrl('/session/status').replace(
       queryParameters: {'device_id': deviceId},
     );
-    final response = await controlGet(statusUri);
+    final response = await directGet(statusUri);
     if (response.statusCode != 200) return null;
 
     final decoded = jsonDecode(response.body);
     if (decoded is! Map<String, dynamic>) return null;
 
     final serverNonce = decoded['nonce'];
-    if (_expectedNonce != nonce) return null;
-    if (serverNonce is! String || serverNonce != nonce) return null;
+    if (_expectedNonce != null &&
+        serverNonce is String &&
+        serverNonce != nonce) {
+      return null;
+    }
 
     if (decoded['active'] != true || decoded['vless_uuid'] == null) {
       return null;
@@ -252,13 +141,6 @@ class HivemindService {
 }
 
 class _HivemindSessionConfig {
-  static final RegExp _uuidPattern = RegExp(
-    r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$',
-    caseSensitive: false,
-  );
-  static final RegExp _shortIdPattern =
-      RegExp(r'^[0-9a-f]{0,16}$', caseSensitive: false);
-
   final String uuid;
   final String host;
   final int port;
@@ -280,174 +162,50 @@ class _HivemindSessionConfig {
   });
 
   factory _HivemindSessionConfig.fromJson(Map<String, dynamic> json) {
-    final uuid = _requiredString(json, 'vless_uuid', maxLength: 64);
-    if (!_uuidPattern.hasMatch(uuid)) {
-      throw const FormatException('Invalid VLESS UUID');
-    }
-
-    // The API may rotate credentials and Reality parameters, but it must never
-    // choose the tunnel destination. Keep that trust anchor compiled into the
-    // app so an API/domain compromise can cause denial of service, not redirect
-    // VPN traffic to an attacker-controlled server.
-    final pinnedHost = _validatedPublicIp(AppConfig.serverIp, 'serverIp');
-    final advertisedHost = json['vless_ip'];
-    if (advertisedHost != null) {
-      if (advertisedHost is! String || advertisedHost.trim() != pinnedHost) {
-        throw const FormatException(
-          'Session VLESS host does not match compiled server pin',
-        );
-      }
-    }
-    final host = pinnedHost;
-
-    final advertisedPort = json['vless_port'];
-    if (advertisedPort != null &&
-        (advertisedPort is! num || advertisedPort.toInt() != 443)) {
-      throw const FormatException('Session VLESS port does not match compiled pin');
-    }
-    const port = 443;
-    final sni = _validatedHost(
-      _requiredString(json, 'reality_sni', maxLength: 253),
-      'reality_sni',
-    );
-    final publicKey = _requiredString(json, 'reality_pbk', maxLength: 128);
-    final shortId = _stringOr(json['reality_sid'], '').trim();
-    if (!_shortIdPattern.hasMatch(shortId)) {
-      throw const FormatException('Invalid Reality short ID');
-    }
-
-    final fingerprint =
-        _boundedString(json['reality_fp'], AppConfig.realityFp, 32, 'reality_fp');
-    final path =
-        _boundedString(json['xhttp_path'], AppConfig.vlessPath, 2048, 'xhttp_path');
-    if (!path.startsWith('/')) {
-      throw const FormatException('Invalid XHTTP path');
-    }
+    final uuid = _requiredString(json, 'vless_uuid');
+    final host = _stringOr(json['vless_ip'], AppConfig.serverIp);
+    final port = _portOr(json['vless_port'], 443);
+    final sni = _requiredString(json, 'reality_sni');
 
     return _HivemindSessionConfig(
       uuid: uuid,
       host: host,
       port: port,
-      publicKey: publicKey,
-      shortId: shortId,
+      publicKey: _stringOr(json['reality_pbk'], ''),
+      shortId: _stringOr(json['reality_sid'], ''),
       sni: sni,
-      fingerprint: fingerprint,
-      path: path,
+      fingerprint: _stringOr(json['reality_fp'], AppConfig.realityFp),
+      path: _stringOr(json['xhttp_path'], AppConfig.vlessPath),
     );
   }
 
   String toVlessUrl() {
-    return Uri(
-      scheme: 'vless',
-      userInfo: uuid,
-      host: host,
-      port: port,
-      queryParameters: <String, String>{
-        'security': AppConfig.vlessSecurity,
-        'type': AppConfig.vlessType,
-        'path': path,
-        'pbk': publicKey,
-        'sni': sni,
-        'sid': shortId,
-        'fp': fingerprint,
-      },
-      fragment: 'Revolt VPN',
-    ).toString();
+    return 'vless://$uuid@$host:$port'
+        '?security=${AppConfig.vlessSecurity}'
+        '&type=${AppConfig.vlessType}'
+        '&path=$path'
+        '&pbk=${Uri.encodeComponent(publicKey)}'
+        '&sni=${Uri.encodeComponent(sni)}'
+        '&sid=${Uri.encodeComponent(shortId)}'
+        '&fp=${Uri.encodeComponent(fingerprint)}'
+        '#Revolt VPN';
   }
 
-  static String _requiredString(
-    Map<String, dynamic> json,
-    String key, {
-    int maxLength = 4096,
-  }) {
+  static String _requiredString(Map<String, dynamic> json, String key) {
     final value = json[key];
-    if (value is! String) {
-      throw FormatException('Missing required session field: $key');
-    }
-    final trimmed = value.trim();
-    if (trimmed.isEmpty || trimmed.length > maxLength) {
-      throw FormatException('Invalid session field: $key');
-    }
-    return trimmed;
+    if (value is String && value.trim().isNotEmpty) return value.trim();
+    throw FormatException('Missing required session field: $key');
   }
 
   static String _stringOr(Object? value, String fallback) {
-    return value is String && value.trim().isNotEmpty ? value.trim() : fallback;
+    return value is String && value.isNotEmpty ? value : fallback;
   }
 
-  static String _boundedString(
-    Object? value,
-    String fallback,
-    int maxLength,
-    String field,
-  ) {
-    final result = _stringOr(value, fallback);
-    if (result.isEmpty || result.length > maxLength) {
-      throw FormatException('Invalid session field: $field');
+  static int _portOr(Object? value, int fallback) {
+    final parsed = value is num ? value.toInt() : fallback;
+    if (parsed <= 0 || parsed > 65535) {
+      throw const FormatException('Invalid VLESS port');
     }
-    return result;
-  }
-
-  static String _validatedHost(String input, String field) {
-    final value = input.trim();
-    if (value.isEmpty ||
-        value.length > 253 ||
-        value.contains(RegExp(r'[\s/@?#]'))) {
-      throw FormatException('Invalid session host: $field');
-    }
-    try {
-      final probe = Uri(scheme: 'https', host: value);
-      if (probe.host.isEmpty) {
-        throw FormatException('Invalid session host: $field');
-      }
-    } on FormatException {
-      throw FormatException('Invalid session host: $field');
-    }
-    return value;
-  }
-
-  static String _validatedPublicIp(String input, String field) {
-    final value = input.trim().toLowerCase();
-    if (_isPublicIpv4(value) || _isPublicIpv6(value)) return value;
-    throw FormatException('Invalid public IP pin: $field');
-  }
-
-  static bool _isPublicIpv4(String value) {
-    final parts = value.split('.');
-    if (parts.length != 4) return false;
-    final octets = <int>[];
-    for (final part in parts) {
-      if (part.isEmpty || (part.length > 1 && part.startsWith('0'))) return false;
-      final parsed = int.tryParse(part);
-      if (parsed == null || parsed < 0 || parsed > 255) return false;
-      octets.add(parsed);
-    }
-    final a = octets[0];
-    final b = octets[1];
-    if (a == 0 || a == 10 || a == 127 || a >= 224) return false;
-    if (a == 100 && b >= 64 && b <= 127) return false;
-    if (a == 169 && b == 254) return false;
-    if (a == 172 && b >= 16 && b <= 31) return false;
-    if (a == 192 && b == 168) return false;
-    if (a == 192 && b == 0 && octets[2] == 2) return false;
-    if (a == 198 && b == 51 && octets[2] == 100) return false;
-    if (a == 203 && b == 0 && octets[2] == 113) return false;
-    return true;
-  }
-
-  static bool _isPublicIpv6(String value) {
-    if (!value.contains(':') || value.contains('.')) return false;
-    try {
-      final parsed = Uri.parse('https://[$value]/');
-      if (parsed.host.isEmpty || !parsed.host.contains(':')) return false;
-    } on FormatException {
-      return false;
-    }
-    if (value == '::' || value == '::1') return false;
-    if (value.startsWith('fc') || value.startsWith('fd')) return false;
-    if (value.startsWith('fe8') || value.startsWith('fe9') || value.startsWith('fea') || value.startsWith('feb')) return false;
-    if (value.startsWith('ff')) return false;
-    if (value.startsWith('2001:db8:') || value == '2001:db8::') return false;
-    return true;
+    return parsed;
   }
 }

lib/logic/local_socks_tester.dart

@@ -20,13 +20,13 @@ abstract final class LocalSocksTester {
 
   /// Fast local readiness probe used while starting the VPN.
   ///
-  /// This stops after authenticated SOCKS5 negotiation. Startup must not depend
-  /// on an unrelated external host being reachable.
+  /// This stops after SOCKS5 authentication. Startup must not depend on an
+  /// unrelated external host being reachable.
   static Future<LocalSocksTestResult> testListener({
     String host = '127.0.0.1',
-    required int port,
-    required String username,
-    required String password,
+    int port = 10807,
+    String? username,
+    String? password,
   }) async {
     final stopwatch = Stopwatch()..start();
     Socket? socket;
@@ -86,47 +86,26 @@ abstract final class LocalSocksTester {
     }
   }
 
-  /// Full user-facing test: authenticated local SOCKS handshake, an outbound
-  /// CONNECT through the active ReVolt route, and — critically — a real
-  /// request/response exchange over that CONNECT.
-  ///
-  /// The exchange is not optional politeness. Xray answers a SOCKS CONNECT
-  /// before it dials upstream, so the reply code alone says nothing about the
-  /// outbound: it returns success for unroutable addresses and for hostnames
-  /// that can never resolve. Without a round trip this test reports OK while
-  /// the server is down, which is precisely when a user runs it.
+  /// Full user-facing test: authenticated local SOCKS handshake plus outbound
+  /// CONNECT. Credentials are optional so the helper remains usable for legacy
+  /// no-auth diagnostic builds.
   static Future<LocalSocksTestResult> test({
     String host = '127.0.0.1',
-    required int port,
-    required String username,
-    required String password,
-    String targetHost = 'example.com',
-    int targetPort = 80,
+    int port = 10807,
+    String? username,
+    String? password,
+    String targetHost = 'paladinvpn.duckdns.org',
+    int targetPort = 443,
   }) async {
-    const totalTimeout = Duration(seconds: 8);
     final stopwatch = Stopwatch()..start();
     Socket? socket;
     _SocketReader? reader;
 
-    Duration remaining() {
-      final micros = totalTimeout.inMicroseconds - stopwatch.elapsedMicroseconds;
-      if (micros <= 0) throw TimeoutException('SOCKS5 test timed out.', totalTimeout);
-      return Duration(microseconds: micros);
-    }
-
     try {
-      if (targetPort <= 0 || targetPort > 65535) {
-        return const LocalSocksTestResult(
-          ok: false,
-          latencyMs: null,
-          message: 'SOCKS5 test target is invalid.',
-        );
-      }
-
       socket = await Socket.connect(
         host,
         port,
-        timeout: remaining(),
+        timeout: const Duration(seconds: 3),
       );
       socket.setOption(SocketOption.tcpNoDelay, true);
       reader = _SocketReader(socket);
@@ -136,7 +115,6 @@ abstract final class LocalSocksTester {
         socket,
         username: username,
         password: password,
-        timeout: remaining(),
       );
       if (!authenticated) {
         return const LocalSocksTestResult(
@@ -167,7 +145,7 @@ abstract final class LocalSocksTester {
       ]);
       await socket.flush();
 
-      final replyHead = await reader.readExactly(4, timeout: remaining());
+      final replyHead = await reader.readExactly(4);
       if (replyHead[0] != 0x05 || replyHead[1] != 0x00) {
         return const LocalSocksTestResult(
           ok: false,
@@ -177,44 +155,7 @@ abstract final class LocalSocksTester {
         );
       }
 
-      await _consumeAddress(reader, replyHead[3], timeout: remaining());
-
-      // The CONNECT reply above is not evidence of an outbound. Force a round
-      // trip and require the peer's answer before claiming the route works.
-      socket.add(
-        utf8.encode(
-          'GET / HTTP/1.1\r\nHost: $targetHost\r\nConnection: close\r\n\r\n',
-        ),
-      );
-      await socket.flush();
-
-      List<int> banner;
-      try {
-        banner = await reader.readExactly(5, timeout: remaining());
-      } on TimeoutException {
-        return const LocalSocksTestResult(
-          ok: false,
-          latencyMs: null,
-          message: 'Local SOCKS5 is up, but the ReVolt outbound never replied.',
-        );
-      } on SocketException {
-        return const LocalSocksTestResult(
-          ok: false,
-          latencyMs: null,
-          message:
-              'Local SOCKS5 is up, but the ReVolt outbound dropped the connection.',
-        );
-      }
-
-      if (String.fromCharCodes(banner) != 'HTTP/') {
-        return const LocalSocksTestResult(
-          ok: false,
-          latencyMs: null,
-          message:
-              'Local SOCKS5 is up, but the ReVolt outbound returned unexpected data.',
-        );
-      }
-
+      await _consumeAddress(reader, replyHead[3]);
       stopwatch.stop();
       return LocalSocksTestResult(
         ok: true,
@@ -248,10 +189,23 @@ abstract final class LocalSocksTester {
   static Future<bool> _authenticate(
     _SocketReader reader,
     Socket socket, {
-    required String username,
-    required String password,
+    required String? username,
+    required String? password,
     Duration timeout = const Duration(seconds: 4),
   }) async {
+    final passwordAuth = username != null && password != null;
+    if ((username == null) != (password == null)) return false;
+
+    socket.add(passwordAuth
+        ? const <int>[0x05, 0x01, 0x02]
+        : const <int>[0x05, 0x01, 0x00]);
+    await socket.flush();
+
+    final greeting = await reader.readExactly(2, timeout: timeout);
+    if (greeting[0] != 0x05) return false;
+    if (!passwordAuth) return greeting[1] == 0x00;
+    if (greeting[1] != 0x02) return false;
+
     final userBytes = utf8.encode(username);
     final passBytes = utf8.encode(password);
     if (userBytes.isEmpty ||
@@ -261,15 +215,6 @@ abstract final class LocalSocksTester {
       return false;
     }
 
-    // ReVolt never accepts unauthenticated local SOCKS. Advertising only RFC
-    // 1929 username/password auth makes a future credential-plumbing regression
-    // fail closed instead of silently falling back to method 0x00.
-    socket.add(const <int>[0x05, 0x01, 0x02]);
-    await socket.flush();
-
-    final greeting = await reader.readExactly(2, timeout: timeout);
-    if (greeting[0] != 0x05 || greeting[1] != 0x02) return false;
-
     socket.add(<int>[
       0x01,
       userBytes.length,
@@ -284,24 +229,18 @@ abstract final class LocalSocksTester {
   }
 
   static Future<void> _consumeAddress(
-    _SocketReader reader,
-    int addressType, {
-    required Duration timeout,
-  }) async {
+      _SocketReader reader, int addressType) async {
     if (addressType == 0x01) {
-      await reader.readExactly(4 + 2, timeout: timeout);
+      await reader.readExactly(4 + 2);
       return;
     }
     if (addressType == 0x04) {
-      await reader.readExactly(16 + 2, timeout: timeout);
+      await reader.readExactly(16 + 2);
       return;
     }
     if (addressType == 0x03) {
-      final length = (await reader.readExactly(1, timeout: timeout)).first;
-      if (length == 0) {
-        throw const FormatException('Invalid SOCKS5 domain length');
-      }
-      await reader.readExactly(length + 2, timeout: timeout);
+      final length = (await reader.readExactly(1)).first;
+      await reader.readExactly(length + 2);
       return;
     }
     throw const FormatException('Unsupported SOCKS5 address type');
@@ -318,15 +257,8 @@ class _SocketReader {
     int count, {
     Duration timeout = const Duration(seconds: 4),
   }) async {
-    final elapsed = Stopwatch()..start();
     while (_buffer.length < count) {
-      final remainingMicros = timeout.inMicroseconds - elapsed.elapsedMicroseconds;
-      if (remainingMicros <= 0) {
-        throw TimeoutException('Socket read timed out', timeout);
-      }
-      final hasNext = await _iterator.moveNext().timeout(
-            Duration(microseconds: remainingMicros),
-          );
+      final hasNext = await _iterator.moveNext().timeout(timeout);
       if (!hasNext) {
         throw const SocketException('Socket closed early');
       }

lib/logic/notification_service.dart

@@ -16,41 +16,16 @@ class NotificationService {
   /// Sets the notification's content text to [text].
   ///
   /// The native side rebuilds the whole notification, so skip the round-trip
-  /// when the text has not changed. A failed native update is intentionally
-  /// not cached so the next tick can retry it.
+  /// when the text has not changed.
   static Future<void> updateTimer(String text) async {
     if (text == _lastText) return;
+    _lastText = text;
     try {
       await _channel.invokeMethod<void>('updateNotificationText', {
         'title': 'Revolt VPN',
         'text': text,
         'disconnectLabel': 'Disconnect',
       });
-      _lastText = text;
-    } catch (_) {
-      // Cosmetic.
-    }
-  }
-
-  // Same id as the service's own alert, so a double post replaces.
-  static Future<void> showDisconnectedAlert() async {
-    try {
-      await _channel.invokeMethod<void>('showDisconnectedAlert');
-    } catch (_) {
-      // Informational only.
-    }
-  }
-
-  /// Takes down the countdown notification.
-  ///
-  /// [updateTimer] re-posts an ongoing, non-dismissible notification, so a tick
-  /// that lands after the VPN service has cancelled its own foreground copy
-  /// leaves a frozen countdown on screen that nobody owns. Call this once the
-  /// tunnel is actually down.
-  static Future<void> cancelTimer() async {
-    _lastText = null;
-    try {
-      await _channel.invokeMethod<void>('cancelNotification');
     } catch (_) {
       // Cosmetic.
     }

lib/logic/power_settings.dart

@@ -41,4 +41,53 @@ abstract final class PowerSettings {
       return false;
     }
   }
+
+  /// Whether the VPN runtime is genuinely alive.
+  ///
+  /// The Xray service runs in a separate process, so nothing it stores in
+  /// statics is visible to us. This asks the OS instead: is our service process
+  /// running, and (for TUN) is there an active VPN transport?
+  static Future<VpnRuntimeState> runtimeState() async {
+    if (kIsWeb) return const VpnRuntimeState(processAlive: false, vpnTransport: false);
+    try {
+      final result = await _channel.invokeMapMethod<String, dynamic>(
+        'isVpnRuntimeAlive',
+      );
+      return VpnRuntimeState(
+        processAlive: result?['processAlive'] == true,
+        vpnTransport: result?['vpnTransport'] == true,
+      );
+    } catch (_) {
+      return const VpnRuntimeState(processAlive: false, vpnTransport: false);
+    }
+  }
+
+  /// Pushes the absolute session-expiry timestamp (epoch ms) to the VPN
+  /// service so it can tear the tunnel down even when the UI process is gone.
+  static Future<void> setSessionExpiry(int expiresAtMs) async {
+    if (kIsWeb) return;
+    try {
+      await _channel.invokeMethod<void>('setSessionExpiry', {
+        'expiresAtMs': expiresAtMs,
+      });
+    } catch (_) {
+      // Best-effort. The daemon also keeps its last persisted expiry.
+    }
+  }
+}
+
+@immutable
+class VpnRuntimeState {
+  final bool processAlive;
+  final bool vpnTransport;
+
+  const VpnRuntimeState({
+    required this.processAlive,
+    required this.vpnTransport,
+  });
+
+  /// TUN needs both a live service and a real VPN interface. Proxy mode has no
+  /// VPN interface at all, so the service process is the whole signal.
+  bool aliveFor({required bool tunMode}) =>
+      processAlive && (!tunMode || vpnTransport);
 }

lib/logic/secure_socks_session.dart

@@ -39,29 +39,40 @@ class SecureSocksSession {
     final username = _token(16);
     final password = _token(32);
 
-    // ReVolt owns local ingress. Never accept listeners supplied by a remote
-    // or imported Xray config; the client exposes exactly one authenticated
-    // loopback SOCKS5 listener for the current ephemeral session.
-    decoded['inbounds'] = <Map<String, dynamic>>[
-      <String, dynamic>{
-        'tag': inboundTag,
-        'port': port,
-        'listen': '127.0.0.1',
-        'protocol': 'socks',
-        'settings': <String, dynamic>{
-          'auth': 'password',
-          'udp': true,
-          'ip': '127.0.0.1',
-          'users': <Map<String, String>>[
-            <String, String>{'user': username, 'pass': password},
-          ],
-        },
-        'sniffing': <String, dynamic>{
-          'enabled': true,
-          'destOverride': <String>['http', 'tls'],
-        },
+    final sourceInbounds = decoded['inbounds'];
+    final inbounds = <dynamic>[];
+    if (sourceInbounds is List) {
+      for (final value in sourceInbounds) {
+        if (value is Map) {
+          final protocol = value['protocol']?.toString().toLowerCase();
+          // ReVolt owns local proxy ingress on Android. Drop imported SOCKS/HTTP
+          // listeners so a stale no-auth proxy cannot remain reachable beside
+          // the authenticated session listener.
+          if (protocol == 'socks' || protocol == 'http') continue;
+        }
+        inbounds.add(value);
+      }
+    }
+
+    inbounds.add(<String, dynamic>{
+      'tag': inboundTag,
+      'port': port,
+      'listen': '127.0.0.1',
+      'protocol': 'socks',
+      'settings': <String, dynamic>{
+        'auth': 'password',
+        'udp': true,
+        'ip': '127.0.0.1',
+        'users': <Map<String, String>>[
+          <String, String>{'user': username, 'pass': password},
+        ],
       },
-    ];
+      'sniffing': <String, dynamic>{
+        'enabled': true,
+        'destOverride': <String>['http', 'tls'],
+      },
+    });
+    decoded['inbounds'] = inbounds;
 
     return SecureSocksSession._(
       port: port,

lib/logic/server_list.dart

@@ -0,0 +1,69 @@
+import 'package:flutter/foundation.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+// ── lib/logic/server_list.dart ──────────────────────────────────────────────
+// Server data model and ChangeNotifier — shared by StatusBar (shows current
+// server name/flag) and SelectionScreen (lets user pick a server).
+//
+// Each server is defined by its tunnel IP/port. Reality credentials (public
+// key, shortId) come from /session/status per session; only the transport
+// parameters live in AppConfig.
+//
+// When multi-server ships:
+//   - _all becomes a fetched list (from /api/servers or bundled config)
+//   - SelectionScreen shows multiple rows
+//   - select() triggers a disconnect/reconnect cycle if the tunnel is active
+
+class ServerInfo {
+  final String id;
+  final String name;
+  final String flagAsset;
+  final String ip;
+  final int port;
+
+  const ServerInfo({
+    required this.id,
+    required this.name,
+    required this.flagAsset,
+    required this.ip,
+    required this.port,
+  });
+}
+
+class ServerList extends ChangeNotifier {
+  static const _all = [
+    ServerInfo(
+      id: 'finland',
+      name: 'Helsinki, Finland',
+      flagAsset: 'assets/finland_flag_256.png',
+      ip: '204.168.246.88',
+      port: 443,
+    ),
+  ];
+
+  int _selectedIndex = 0;
+
+  List<ServerInfo> get all => _all;
+  int get selectedIndex => _selectedIndex;
+  ServerInfo get selected => _all[_selectedIndex];
+
+  // Loads persisted selection from SharedPreferences.
+  // Fire-and-forget — UI starts with default, updates when prefs load.
+  Future<void> init() async {
+    final prefs = await SharedPreferences.getInstance();
+    final saved = prefs.getInt('selected_server_index') ?? 0;
+    if (saved >= 0 && saved < _all.length && saved != _selectedIndex) {
+      _selectedIndex = saved;
+      notifyListeners();
+    }
+  }
+
+  // Switches to a different server. Persists the choice.
+  Future<void> select(int index) async {
+    if (index == _selectedIndex || index < 0 || index >= _all.length) return;
+    _selectedIndex = index;
+    notifyListeners();
+    final prefs = await SharedPreferences.getInstance();
+    await prefs.setInt('selected_server_index', index);
+  }
+}

lib/logic/session_timer.dart

@@ -7,11 +7,13 @@ import 'package:revoltvpn/logic/app_config.dart';
 import 'package:revoltvpn/logic/crypto_service.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
 import 'package:revoltvpn/logic/notification_service.dart';
+import 'package:revoltvpn/logic/power_settings.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 
 class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   Timer? _timer;
   int _tickCount = 0;
+  int _lastPushedExpiryAtMs = 0;
   bool _appBackgrounded = false;
 
   final VpnConnection vpnConnection;
@@ -23,10 +25,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   bool _hasSyncedOnce = false;
   int _consecutiveFailures = 0;
   bool _isDisconnecting = false;
-  int? _syncEpochInProgress;
-  Completer<void>? _syncCompletion;
-  int _sessionEpoch = 0;
-
+  bool _syncInProgress = false;
   bool _supportRewardClaimed = false;
   bool _supportRewardStateLoaded = false;
   int _supportStateEpoch = 0;
@@ -36,25 +35,28 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   static const FlutterSecureStorage _supportStorage = FlutterSecureStorage();
 
   static const int _maxConsecutiveFailures = 3;
+  static const int _maxOfflineSeconds = 120;
+  int _offlineSeconds = 0;
 
+  // The countdown ticks locally every second; these only drive the slow
+  // server heartbeat that catches server-side changes (support-ad extension,
+  // 10 GB cap, session-ended). Keeping it slow avoids a chatty /session/status
+  // beacon (see internal/LAUNCH_READINESS.md "cut the beacon rate").
   static const int _pollIntervalSeconds = 60;
   static const int _backgroundPollIntervalSeconds = 60;
 
   int _lastUsedBytes = 0;
-  Stopwatch? _sinceLastSuccessfulSync;
-  // Wall clock, because the Stopwatch is CLOCK_MONOTONIC and stops across
-  // device suspend - exactly when the RTC_WAKEUP expiry alarm fires.
-  DateTime? _deadlineAt;
+  DateTime? _lastSuccessfulSyncAt;
   double _currentSpeedKBps = 0.0;
 
   SessionTimer({required this.vpnConnection}) {
     WidgetsBinding.instance.addObserver(this);
     vpnConnection.addListener(_onVpnConnectionChanged);
     unawaited(_loadSupportRewardState());
-
-    // VpnConnection is eager and can report an already-running native tunnel
-    // before this provider is created. ChangeNotifier listeners do not replay
-    // old events, so always evaluate the current state once after construction.
+    // This provider is built lazily, so the tunnel may already be up and
+    // VpnConnection may already have fired its change before we attached.
+    // A listener does not replay history -- evaluate the current state once.
+    // Deferred so we never notify during the build that created us.
     unawaited(Future.microtask(_onVpnConnectionChanged));
   }
 
@@ -68,13 +70,6 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   int get usedBytes => _usedBytes;
   double get currentSpeedKBps => _currentSpeedKBps;
 
-  // Display state only - an unreachable API never tears down a live tunnel.
-  bool get serverUnreachable => _consecutiveFailures >= _maxConsecutiveFailures;
-
-  // Why the last session ended, if the user did not end it. Cleared on connect.
-  String? _lastEndMessage;
-  String? get lastEndMessage => _lastEndMessage;
-
   String get formatted {
     final h = (_remainingSeconds ~/ 3600).toString().padLeft(2, '0');
     final m = ((_remainingSeconds % 3600) ~/ 60).toString().padLeft(2, '0');
@@ -118,8 +113,11 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   }
 
   void _onVpnConnectionChanged() {
-    // A live tunnel with a stopped clock is always wrong, whether this process
-    // adopted an existing runtime, attached late, or recovered from a blip.
+    // A live tunnel with a stopped clock is always wrong, however we got here:
+    // adopting a tunnel that outlived the UI process, recovering from a blip, or
+    // attaching late to one that was already up. Previously this required either
+    // adoptedRunningRuntime or _hasSyncedOnce, both false on a fresh process, so
+    // the clock stayed at 00:00:00 and the notification countdown froze with it.
     if (vpnConnection.status == VpnStatus.connected &&
         !isRunning &&
         !_isDisconnecting) {
@@ -132,51 +130,49 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
     if (!hadActiveSession || _isDisconnecting) return;
 
     if (vpnConnection.status == VpnStatus.error) {
-      unawaited(_doDisconnect(
-        'VPN entered error state',
-        endedMessage: 'The tunnel stopped. You are not protected.',
-      ));
+      _stopForVpnFailure('VPN entered error state');
       return;
     }
 
     if (vpnConnection.status == VpnStatus.disconnected) {
-      // The native deadline beats the 1 s tick, so expiry lands here, not in
-      // _tick. postAlert is false: the service already posted, and a
-      // notification-Disconnect tap is the user asking.
-      final deadline = _deadlineAt;
-      final expired = _hasSyncedOnce &&
-          deadline != null &&
-          DateTime.now().isAfter(
-            deadline.subtract(const Duration(seconds: 5)),
-          );
-      unawaited(_doDisconnect(
-        'VPN tunnel dropped',
-        endedMessage:
-            expired ? 'Your session ended. You are not protected.' : null,
-        postAlert: false,
-      ));
+      unawaited(_doDisconnect('VPN tunnel dropped'));
     }
   }
 
+  void _stopForVpnFailure(String reason) {
+    if (_isDisconnecting) return;
+    _isDisconnecting = true;
+    debugPrint('[Timer] Stopping after VPN failure: $reason');
+
+    _timer?.cancel();
+    _timer = null;
+    _currentSpeedKBps = 0.0;
+    _remainingSeconds = 0;
+    _remainingAtLastSync = 0;
+    _hasSyncedOnce = false;
+    _lastSuccessfulSyncAt = null;
+    _consecutiveFailures = 0;
+    _offlineSeconds = 0;
+    NotificationService.reset();
+    notifyListeners();
+  }
+
   Future<void> start() async {
-    _sessionEpoch++;
     _remainingSeconds = 0;
     _remainingAtLastSync = 0;
     _usedBytes = 0;
     _lastUsedBytes = 0;
-    _sinceLastSuccessfulSync?.stop();
-    _sinceLastSuccessfulSync = null;
-    _deadlineAt = null;
+    _lastSuccessfulSyncAt = null;
     _currentSpeedKBps = 0.0;
     _tickCount = 0;
+    _lastPushedExpiryAtMs = 0;
     _hasSyncedOnce = false;
     _consecutiveFailures = 0;
+    _offlineSeconds = 0;
     _isDisconnecting = false;
     _appBackgrounded = false;
-    _lastEndMessage = null;
     NotificationService.reset();
 
-    // Every session is new, so the once-per-session top-up resets with it.
     _supportStateEpoch++;
     _supportRewardClaimed = false;
     _supportRewardStateLoaded = true;
@@ -192,15 +188,20 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   void _tick(Timer t) {
     if (_isDisconnecting) return;
 
-    if (_hasSyncedOnce) {
+    if (_hasSyncedOnce && _consecutiveFailures < _maxConsecutiveFailures) {
       _reconcileElapsedTime();
     }
 
+    if (_consecutiveFailures >= _maxConsecutiveFailures) {
+      _offlineSeconds++;
+      if (_offlineSeconds >= _maxOfflineSeconds) {
+        unawaited(_doDisconnect('Server unreachable'));
+        return;
+      }
+    }
+
     if (_hasSyncedOnce && _remainingSeconds <= 0) {
-      unawaited(_doDisconnect(
-        'Session expired',
-        endedMessage: 'Your session ended. You are not protected.',
-      ));
+      unawaited(_doDisconnect('Session expired'));
       return;
     }
 
@@ -219,66 +220,32 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
     }
   }
 
-  /// Force a control-plane refresh after an event that changes the session
-  /// server-side. If a periodic sync is already in flight, wait for it and
-  /// issue a fresh request so the event cannot be hidden behind the busy guard.
-  Future<void> syncNow() async {
-    final requestedEpoch = _sessionEpoch;
-    while (requestedEpoch == _sessionEpoch && !_isDisconnecting) {
-      final active = _syncEpochInProgress == requestedEpoch
-          ? _syncCompletion
-          : null;
-      if (active != null) {
-        await active.future;
-        continue;
-      }
-      await _syncWithHivemind();
-      return;
-    }
-  }
+  /// Force an immediate server sync (e.g. after a support-ad extension so the
+  /// countdown reflects the new expiry without waiting for the next heartbeat).
+  Future<void> syncNow() => _syncWithHivemind();
 
   Future<void> disconnect({String reason = 'User requested'}) async {
-    // Only here, not in _doDisconnect: this is the one path the user actually
-    // asked for. Unawaited so a slow or unreachable API never holds up the
-    // teardown.
-    unawaited(HivemindService.releaseSession());
     await _doDisconnect(reason);
   }
 
-  // endedMessage is what the UI shows; postAlert raises the notification.
-  // A user-requested disconnect passes neither.
-  Future<void> _doDisconnect(
-    String reason, {
-    String? endedMessage,
-    bool postAlert = true,
-  }) async {
+  Future<void> _doDisconnect(String reason) async {
     if (_isDisconnecting) return;
     _isDisconnecting = true;
-    _sessionEpoch++;
     debugPrint('[Timer] Disconnecting: $reason');
 
-    _lastEndMessage = endedMessage;
-    _deadlineAt = null;
     _timer?.cancel();
     _timer = null;
     _currentSpeedKBps = 0.0;
     _remainingSeconds = 0;
     _remainingAtLastSync = 0;
     _hasSyncedOnce = false;
-    _sinceLastSuccessfulSync?.stop();
-    _sinceLastSuccessfulSync = null;
+    _lastSuccessfulSyncAt = null;
     NotificationService.reset();
     notifyListeners();
 
     await vpnConnection.disconnect();
-    // After the service is down, so the cancel is not swallowed by a still
-    // foreground notification. Without it a revoke leaves the countdown on
-    // screen, frozen, claiming a session that no longer protects anything.
-    await NotificationService.cancelTimer();
-    if (endedMessage != null && postAlert) {
-      unawaited(NotificationService.showDisconnectedAlert());
-    }
 
+    if (!_isDisconnecting) return;
     _isDisconnecting = false;
     notifyListeners();
   }
@@ -290,28 +257,20 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   }
 
   Future<void> _syncWithHivemind() async {
-    if (_isDisconnecting) return;
-    final epoch = _sessionEpoch;
-    if (_syncEpochInProgress == epoch) return;
-
-    final completion = Completer<void>();
-    _syncCompletion = completion;
-    _syncEpochInProgress = epoch;
-
+    if (_isDisconnecting || _syncInProgress) return;
+    _syncInProgress = true;
     try {
       final deviceId = await CryptoService.getDeviceId();
-      if (epoch != _sessionEpoch || _isDisconnecting) return;
-
       final base = Uri.parse('${AppConfig.hivemindApiPublic}/session/status');
       final url = base.replace(queryParameters: {'device_id': deviceId});
       final response = await HivemindService.directGet(url);
-      if (epoch != _sessionEpoch || _isDisconnecting) return;
+      if (_isDisconnecting) return;
 
       if (response.statusCode == 200) {
         final decoded = jsonDecode(response.body);
         if (decoded is! Map<String, dynamic>) {
           debugPrint('[Timer] Invalid session payload type.');
-          _markSyncFailure(epoch);
+          _markSyncFailure();
           return;
         }
         final data = decoded;
@@ -319,15 +278,11 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
         final activeValue = data['active'];
         if (activeValue is! bool) {
           debugPrint('[Timer] Session payload missing boolean active state.');
-          _markSyncFailure(epoch);
+          _markSyncFailure();
           return;
         }
         if (!activeValue) {
-          await _doDisconnect(
-            'Server ended session',
-            endedMessage:
-                'The server ended your session. You are not protected.',
-          );
+          await _doDisconnect('Server ended session');
           return;
         }
 
@@ -336,75 +291,61 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
             !expiresValue.isFinite ||
             expiresValue < 0) {
           debugPrint('[Timer] Session payload has invalid expiry.');
-          _markSyncFailure(epoch);
+          _markSyncFailure();
           return;
         }
 
-        final elapsedMs = _sinceLastSuccessfulSync?.elapsedMilliseconds;
         _remainingAtLastSync = expiresValue.toInt();
         _remainingSeconds = _remainingAtLastSync;
-        _deadlineAt = DateTime.now().add(
-          Duration(seconds: _remainingAtLastSync),
-        );
+        // Push the absolute deadline to the VPN service so it can tear the
+        // tunnel down on its own clock, even if this UI process is gone.
+        final expiresAtMs =
+            DateTime.now().millisecondsSinceEpoch + _remainingSeconds * 1000;
+        if ((expiresAtMs - _lastPushedExpiryAtMs).abs() > 5000) {
+          _lastPushedExpiryAtMs = expiresAtMs;
+          unawaited(PowerSettings.setSessionExpiry(expiresAtMs));
+        }
         _usedBytes = _readNonNegativeInt(data['used_bytes'], _usedBytes);
 
+        final now = DateTime.now();
+        final previousSyncAt = _lastSuccessfulSyncAt;
         final deltaBytes = _usedBytes - _lastUsedBytes;
-        if (_hasSyncedOnce && elapsedMs != null && elapsedMs > 0) {
-          _currentSpeedKBps = deltaBytes > 0
-              ? (deltaBytes / (elapsedMs / 1000.0)) / 1000.0
-              : 0.0;
+        if (_hasSyncedOnce && previousSyncAt != null) {
+          final elapsedMs = now.difference(previousSyncAt).inMilliseconds;
+          if (deltaBytes > 0 && elapsedMs > 0) {
+            _currentSpeedKBps = (deltaBytes / (elapsedMs / 1000.0)) / 1000.0;
+          } else {
+            _currentSpeedKBps = 0.0;
+          }
         } else {
           _currentSpeedKBps = 0.0;
         }
         _lastUsedBytes = _usedBytes;
-        _sinceLastSuccessfulSync?.stop();
-        _sinceLastSuccessfulSync = Stopwatch()..start();
+        _lastSuccessfulSyncAt = now;
 
         if (data['cap_exhausted'] == true) {
-          await _doDisconnect(
-            'Data cap reached',
-            endedMessage: 'Data limit reached. You are not protected.',
-          );
+          await _doDisconnect('Data cap reached');
           return;
         }
 
-        if (epoch != _sessionEpoch || _isDisconnecting) return;
-        try {
-          await vpnConnection.setNativeSessionDeadline(_remainingAtLastSync);
-        } catch (e) {
-          debugPrint('[Timer] Failed to arm native session deadline: $e');
-          await _doDisconnect(
-            'Native session deadline unavailable',
-            endedMessage:
-                'Could not arm the session timer. You are not protected.',
-          );
-          return;
-        }
-        if (epoch != _sessionEpoch || _isDisconnecting) return;
         _consecutiveFailures = 0;
+        _offlineSeconds = 0;
         _hasSyncedOnce = true;
         notifyListeners();
       } else {
-        _markSyncFailure(epoch);
+        _markSyncFailure();
       }
     } catch (e) {
-      if (epoch == _sessionEpoch && !_isDisconnecting) {
+      if (!_isDisconnecting) {
         debugPrint('Hivemind sync error: $e');
-        _markSyncFailure(epoch);
+        _markSyncFailure();
       }
     } finally {
-      if (_syncEpochInProgress == epoch) {
-        _syncEpochInProgress = null;
-      }
-      if (identical(_syncCompletion, completion)) {
-        _syncCompletion = null;
-      }
-      if (!completion.isCompleted) completion.complete();
+      _syncInProgress = false;
     }
   }
 
-  void _markSyncFailure(int epoch) {
-    if (epoch != _sessionEpoch || _isDisconnecting) return;
+  void _markSyncFailure() {
     _consecutiveFailures++;
     if (_consecutiveFailures >= _maxConsecutiveFailures) {
       notifyListeners();
@@ -412,22 +353,12 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   }
 
   void _reconcileElapsedTime() {
-    final clock = _sinceLastSuccessfulSync;
-    if (!_hasSyncedOnce || clock == null) return;
+    final syncedAt = _lastSuccessfulSyncAt;
+    if (!_hasSyncedOnce || syncedAt == null) return;
 
-    final elapsed = clock.elapsed.inSeconds;
+    final elapsed = DateTime.now().difference(syncedAt).inSeconds;
     _remainingSeconds =
         (_remainingAtLastSync - elapsed).clamp(0, 1 << 31).toInt();
-
-    // The Stopwatch over-reports after device suspend. Take the smaller of
-    // the two, never the wall clock alone - a backward clock must not extend.
-    final deadline = _deadlineAt;
-    if (deadline != null) {
-      final byWallClock = deadline.difference(DateTime.now()).inSeconds;
-      if (byWallClock < _remainingSeconds) {
-        _remainingSeconds = byWallClock.clamp(0, 1 << 31).toInt();
-      }
-    }
   }
 
   @override
@@ -465,15 +396,9 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
 
   @override
   void dispose() {
-    // Invalidate every asynchronous generation before removing listeners so
-    // late storage/network completions cannot notify a disposed notifier.
-    _sessionEpoch++;
-    _supportStateEpoch++;
-    _isDisconnecting = true;
     WidgetsBinding.instance.removeObserver(this);
     vpnConnection.removeListener(_onVpnConnectionChanged);
     _timer?.cancel();
-    _sinceLastSuccessfulSync?.stop();
     super.dispose();
   }
 }

lib/logic/updater.dart

@@ -189,7 +189,7 @@ class Updater {
     }
 
     try {
-      final result = await const MethodChannel('com.revoltvpn.app/installer')
+      final result = await MethodChannel('com.revoltvpn.app/installer')
           .invokeMethod<String>('getInstallerPackage');
       _cachedSource = (result == 'com.android.vending')
           ? InstallSource.playStore

lib/logic/vpn_connection.dart

@@ -1,12 +1,12 @@
 import 'dart:async';
 
 import 'package:flutter/foundation.dart';
-import 'package:flutter/services.dart';
 import 'package:flutter_vless/flutter_vless.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
 import 'package:revoltvpn/logic/local_socks_tester.dart';
 import 'package:revoltvpn/logic/network_monitor.dart';
+import 'package:revoltvpn/logic/power_settings.dart';
 import 'package:revoltvpn/logic/secure_socks_session.dart';
 
 enum VpnStatus {
@@ -18,12 +18,7 @@ enum VpnStatus {
 }
 
 class VpnConnection extends ChangeNotifier {
-  static const MethodChannel _nativeControl = MethodChannel('flutter_vless');
-
-  int _connectEpoch = 0;
-  bool _suppressNativeConnect = false;
-  bool _disposed = false;
-
+  bool _cancelled = false;
   VpnStatus _status = VpnStatus.disconnected;
   VpnStatus get status => _status;
 
@@ -38,6 +33,9 @@ class VpnConnection extends ChangeNotifier {
   bool _adoptedRunningRuntime = false;
   bool get adoptedRunningRuntime => _adoptedRunningRuntime;
 
+  bool _serverReachable = false;
+  bool get serverReachable => _serverReachable;
+
   ConnectionMode _activeMode = ConnectionMode.tun;
   ConnectionMode get activeMode => _activeMode;
 
@@ -47,7 +45,6 @@ class VpnConnection extends ChangeNotifier {
   SecureSocksSession? get activeSocksSession => _lastSecureSocks;
 
   bool get canTestActiveLocalSocks =>
-      !_disposed &&
       _status == VpnStatus.connected &&
       _activeMode == ConnectionMode.proxy &&
       _lastSecureSocks != null;
@@ -70,6 +67,7 @@ class VpnConnection extends ChangeNotifier {
     );
   }
 
+  Timer? _healthTimer;
   StreamSubscription<NetworkSnapshot>? _networkSubscription;
 
   SecureSocksSession? _lastSecureSocks;
@@ -96,10 +94,9 @@ class VpnConnection extends ChangeNotifier {
   }
 
   Future<void> _startEngine() async {
-    if (kIsWeb || _disposed) return;
+    if (kIsWeb) return;
 
     await ConnectionSettings.initialize();
-    if (_disposed) return;
     _activeMode = ConnectionSettings.mode;
 
     _vless = FlutterVless(
@@ -116,18 +113,15 @@ class VpnConnection extends ChangeNotifier {
       await _vless.initializeVless(
         providerBundleIdentifier: 'com.paladinvpn.app',
         notificationIconResourceType: 'drawable',
-        notificationIconResourceName: 'notification_icon',
+        notificationIconResourceName: 'notification_status_icon',
       );
-      if (_disposed) return;
       _initialized = true;
     } catch (e) {
       debugPrint('[VPN] VLESS init error (expected on emulator): $e');
     }
-    if (_disposed) return;
 
     _networkSubscription = NetworkMonitor.changes.listen(
       (snapshot) {
-        if (_disposed) return;
         // ConnectivityManager is informational only. Restarting from every
         // callback caused the old VPN-created-network reconnect loop.
         _networkTransport = snapshot.transport;
@@ -138,12 +132,39 @@ class VpnConnection extends ChangeNotifier {
       },
     );
 
+    unawaited(_checkHealth());
+    _healthTimer = Timer.periodic(const Duration(seconds: 30), (_) {
+      unawaited(_checkHealth());
+    });
+
     try {
       final coreVersion = await _vless.getCoreVersion();
-      if (!_disposed) {
-        debugPrint('[VPN] Xray core version: $coreVersion');
-      }
+      debugPrint('[VPN] Xray core version: $coreVersion');
     } catch (_) {}
+
+    await _adoptRunningRuntime();
+  }
+
+  /// Reflect a tunnel that is already up when the UI starts.
+  ///
+  /// This asks the OS whether our VPN service process is alive, rather than
+  /// probing a local SOCKS port. The old probe called getConnectedServerDelay(),
+  /// which reads AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807 — but
+  /// AppConfigs lives in the VPN's own process, so from here it is always null
+  /// and the port always fell back to 10807. That was correct only while the
+  /// SOCKS port was fixed; per-session ephemeral ports made it permanently
+  /// wrong, so the app reported "connected" against a dead tunnel.
+  Future<void> _adoptRunningRuntime() async {
+    if (kIsWeb) return;
+    try {
+      final state = await PowerSettings.runtimeState();
+      if (state.aliveFor(tunMode: _activeMode == ConnectionMode.tun)) {
+        _adoptedRunningRuntime = true;
+        _setStatus(VpnStatus.connected, _connectedLabel);
+      }
+    } catch (e) {
+      debugPrint('[VPN] Runtime liveness check failed: $e');
+    }
   }
 
   String get _connectedLabel {
@@ -155,15 +176,9 @@ class VpnConnection extends ChangeNotifier {
     }
   }
 
-  bool _isCurrentConnect(int epoch) =>
-      !_disposed && epoch == _connectEpoch && !_userDisconnecting;
-
   void _mapStatus(VlessStatus status) {
-    if (_disposed) return;
     switch (status.connectionState) {
       case VlessConnectionState.connected:
-        if (_suppressNativeConnect || _userDisconnecting) return;
-        if (_connectEpoch == 0) _adoptedRunningRuntime = true;
         _setStatus(VpnStatus.connected, _connectedLabel);
         break;
 
@@ -173,7 +188,6 @@ class VpnConnection extends ChangeNotifier {
         break;
 
       case VlessConnectionState.connecting:
-        if (_suppressNativeConnect || _userDisconnecting) return;
         _setStatus(VpnStatus.connecting, 'Establishing tunnel…');
         break;
 
@@ -182,7 +196,6 @@ class VpnConnection extends ChangeNotifier {
         break;
 
       case VlessConnectionState.unknown:
-        if (_suppressNativeConnect || _userDisconnecting) return;
         if (_status != VpnStatus.connected &&
             _status != VpnStatus.disconnected) {
           _setStatus(VpnStatus.error, 'Connection failed');
@@ -191,46 +204,28 @@ class VpnConnection extends ChangeNotifier {
     }
   }
 
-  Future<bool> connect({String? adNonce}) async {
-    if (_disposed ||
-        _userDisconnecting ||
-        _status == VpnStatus.connected ||
-        _status == VpnStatus.connecting ||
-        _status == VpnStatus.disconnecting) {
+  Future<bool> connect({bool skipAdBypass = false}) async {
+    if (_status == VpnStatus.connected || _status == VpnStatus.connecting) {
       return false;
     }
 
-    final connectEpoch = ++_connectEpoch;
-    _suppressNativeConnect = false;
+    _cancelled = false;
     _userDisconnecting = false;
 
     await ConnectionSettings.initialize();
-    if (!_isCurrentConnect(connectEpoch)) return false;
     _activeMode = ConnectionSettings.mode;
 
     if (!kIsWeb && !_initialized) {
-      _suppressNativeConnect = true;
       _errorMessage = 'VPN service unavailable.';
       _setStatus(VpnStatus.error, 'Service unavailable');
       return false;
     }
 
-    // Proxy mode skips requestPermission below (VPN consent it never needs),
-    // so it has to ask for POST_NOTIFICATIONS on its own.
-    if (!kIsWeb && _activeMode == ConnectionMode.proxy) {
-      try {
-        await _nativeControl.invokeMethod<void>('requestNotificationPermission');
-      } catch (e) {
-        debugPrint('[VPN] Notification permission request failed: $e');
-      }
-      if (!_isCurrentConnect(connectEpoch)) return false;
-    }
-
+    // TUN needs the Android VPN permission; SOCKS5 proxy mode runs a local
+    // authenticated proxy without a VpnService, so no VPN permission is needed.
     if (!kIsWeb && _activeMode == ConnectionMode.tun) {
       final ok = await _vless.requestPermission();
-      if (!_isCurrentConnect(connectEpoch)) return false;
       if (!ok) {
-        _suppressNativeConnect = true;
         _errorMessage = 'VPN permission denied.';
         _setStatus(VpnStatus.error, 'Permission required');
         return false;
@@ -246,7 +241,6 @@ class VpnConnection extends ChangeNotifier {
 
     if (kIsWeb) {
       await Future.delayed(const Duration(seconds: 1));
-      if (!_isCurrentConnect(connectEpoch)) return false;
       _setStatus(VpnStatus.connected, 'Secured (dev mode)');
       return true;
     }
@@ -256,9 +250,8 @@ class VpnConnection extends ChangeNotifier {
     String realUrl;
     try {
       realUrl = await HivemindService.fetchConfigDirectly(
-        adNonce: adNonce,
+        skipAdBypass: skipAdBypass,
         onAttempt: (attempt, total) {
-          if (!_isCurrentConnect(connectEpoch)) return;
           _setStatus(
             VpnStatus.connecting,
             'Contacting server ($attempt/$total)…',
@@ -266,11 +259,9 @@ class VpnConnection extends ChangeNotifier {
         },
       );
     } catch (e) {
-      if (!_isCurrentConnect(connectEpoch)) return false;
       debugPrint('[VPN] Config fetch error: $e');
       final raw = e.toString().replaceAll('Exception: ', '');
       if (raw.contains('Cancelled')) return false;
-      _suppressNativeConnect = true;
       if (raw.contains('timed out') || raw.contains('Session not activated')) {
         _errorMessage =
             'The server did not respond in time.\nCheck your connection and try again.';
@@ -282,7 +273,11 @@ class VpnConnection extends ChangeNotifier {
       return false;
     }
 
-    if (!_isCurrentConnect(connectEpoch)) return false;
+    if (_cancelled) {
+      _setStatus(VpnStatus.disconnected, 'Tap to connect');
+      return false;
+    }
+
     _setStatus(VpnStatus.connecting, 'Starting secure route…');
 
     try {
@@ -290,7 +285,6 @@ class VpnConnection extends ChangeNotifier {
       final baseConfig = parsed.getFullConfiguration();
       final remark = parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN';
       final secureSocks = await SecureSocksSession.create(baseConfig);
-      if (!_isCurrentConnect(connectEpoch)) return false;
       final verifyLocalSocks = _activeMode == ConnectionMode.proxy;
 
       await _startRuntime(
@@ -298,45 +292,26 @@ class VpnConnection extends ChangeNotifier {
         remark: remark,
         proxyOnly: verifyLocalSocks,
       );
-      if (!_isCurrentConnect(connectEpoch)) return false;
 
       _setStatus(
         VpnStatus.connecting,
-        verifyLocalSocks
-            ? 'Waiting for local SOCKS5…'
-            : 'Waiting for VPN interface…',
+        verifyLocalSocks ? 'Waiting for local SOCKS5…' : 'Waiting for VPN interface…',
       );
-      if (!await _waitForNativeConnected(connectEpoch)) {
+      if (!await _waitForNativeConnected()) {
         throw StateError('VPN runtime did not report CONNECTED');
       }
 
       if (verifyLocalSocks) {
-        if (!_isCurrentConnect(connectEpoch)) return false;
         _setStatus(VpnStatus.connecting, 'Checking Local SOCKS5…');
-        if (!await _waitForLocalSocksListener(
-          secureSocks,
-          connectEpoch,
-        )) {
+        if (!await _waitForLocalSocksListener(secureSocks)) {
           throw StateError('Local SOCKS5 listener did not become ready');
         }
       }
 
-      if (!_isCurrentConnect(connectEpoch)) return false;
       _lastSecureSocks = secureSocks;
     } catch (e) {
-      if (!_isCurrentConnect(connectEpoch)) return false;
       debugPrint('[VPN] Tunnel start error: $e');
-      _suppressNativeConnect = true;
-      try {
-        await _stopRuntime();
-      } catch (stopError) {
-        debugPrint('[VPN] Runtime cleanup failed after start error: $stopError');
-        if (!_isCurrentConnect(connectEpoch)) return false;
-        _errorMessage = 'VPN failed to shut down cleanly.\nPlease restart the app.';
-        _setStatus(VpnStatus.error, 'Shutdown failed');
-        return false;
-      }
-      if (!_isCurrentConnect(connectEpoch)) return false;
+      await _stopRuntime();
       _clearRuntimeSnapshot();
       _errorMessage = _activeMode == ConnectionMode.proxy
           ? 'SOCKS5 gateway failed to start.\nTry reconnecting.'
@@ -345,7 +320,6 @@ class VpnConnection extends ChangeNotifier {
       return false;
     }
 
-    if (!_isCurrentConnect(connectEpoch)) return false;
     _setStatus(VpnStatus.connected, _connectedLabel);
     return true;
   }
@@ -362,20 +336,22 @@ class VpnConnection extends ChangeNotifier {
     );
   }
 
-  Future<bool> _waitForLocalSocksListener(
-    SecureSocksSession session,
-    int connectEpoch,
-  ) async {
+  Future<bool> _waitForLocalSocksListener([
+    SecureSocksSession? session,
+  ]) async {
+    final active = session ?? _lastSecureSocks;
+    if (active == null) return false;
+
     for (var attempt = 0; attempt < 4; attempt++) {
-      if (!_isCurrentConnect(connectEpoch)) return false;
       final result = await LocalSocksTester.testListener(
         host: '127.0.0.1',
-        port: session.port,
-        username: session.username,
-        password: session.password,
+        port: active.port,
+        username: active.username,
+        password: active.password,
       );
-      if (!_isCurrentConnect(connectEpoch)) return false;
-      if (result.ok) return true;
+      if (result.ok) {
+        return true;
+      }
       if (attempt < 3) {
         await Future.delayed(const Duration(milliseconds: 250));
       }
@@ -383,59 +359,54 @@ class VpnConnection extends ChangeNotifier {
     return false;
   }
 
-  Future<bool> _waitForNativeConnected(int connectEpoch) async {
+  Future<bool> _waitForNativeConnected() async {
+    // startVless() queues the Android foreground service. Wait for the native
+    // service/core broadcast rather than treating MethodChannel completion as
+    // proof that a TUN interface was established.
     for (var attempt = 0; attempt < 24; attempt++) {
-      if (!_isCurrentConnect(connectEpoch)) return false;
       if (_status == VpnStatus.connected) return true;
-      if (_status == VpnStatus.error || _status == VpnStatus.disconnected) {
-        return false;
-      }
+      if (_status == VpnStatus.error) return false;
+      if (_cancelled || _userDisconnecting) return false;
       await Future.delayed(const Duration(milliseconds: 250));
     }
-    return _isCurrentConnect(connectEpoch) &&
-        _status == VpnStatus.connected;
+    return _status == VpnStatus.connected;
   }
 
   Future<void> _stopRuntime() async {
-    await _vless.stopVless().timeout(const Duration(seconds: 8));
-  }
-
-  Future<void> setNativeSessionDeadline(int remainingSeconds) async {
-    if (kIsWeb) return;
-    if (_disposed) throw StateError('VPN connection has been disposed');
-    if (!_initialized) throw StateError('VPN native service is not initialized');
-    if (remainingSeconds < 0) {
-      throw ArgumentError.value(remainingSeconds, 'remainingSeconds');
-    }
-    await _nativeControl.invokeMethod<void>(
-      'setSessionDeadline',
-      <String, Object>{'remainingSeconds': remainingSeconds},
-    );
+    try {
+      await _vless.stopVless().timeout(const Duration(seconds: 5));
+    } catch (_) {}
   }
 
   Future<void> disconnect() async {
-    if (_disposed || _status == VpnStatus.disconnecting) return;
-
-    _connectEpoch++;
-    _suppressNativeConnect = true;
+    _cancelled = true;
     _userDisconnecting = true;
     HivemindService.cancel();
 
+    if (_status == VpnStatus.disconnected ||
+        _status == VpnStatus.disconnecting) {
+      _clearRuntimeSnapshot();
+      _userDisconnecting = false;
+      return;
+    }
+
     _setStatus(VpnStatus.disconnecting, 'Tearing down…');
 
     if (kIsWeb) {
       await Future.delayed(const Duration(milliseconds: 500));
-      if (_disposed) return;
       _clearRuntimeSnapshot();
       _setStatus(VpnStatus.disconnected, 'Tap to connect');
       _userDisconnecting = false;
       return;
     }
 
+    bool timedOut = false;
     try {
-      await _vless.stopVless().timeout(const Duration(seconds: 8));
+      await _vless.stopVless().timeout(
+            const Duration(seconds: 5),
+            onTimeout: () => timedOut = true,
+          );
     } catch (e) {
-      if (_disposed) return;
       debugPrint('[VPN] VLESS stop error: $e');
       _errorMessage = 'VPN shutdown error.\nPlease restart the app.';
       _clearRuntimeSnapshot();
@@ -444,7 +415,15 @@ class VpnConnection extends ChangeNotifier {
       return;
     }
 
-    if (_disposed) return;
+    if (timedOut) {
+      debugPrint('[VPN] stopVless() timed out after 5 s.');
+      _errorMessage = 'VPN did not shut down cleanly.\nPlease restart the app.';
+      _clearRuntimeSnapshot();
+      _setStatus(VpnStatus.error, 'Shutdown failed');
+      _userDisconnecting = false;
+      return;
+    }
+
     _errorMessage = null;
     _clearRuntimeSnapshot();
     _setStatus(VpnStatus.disconnected, 'Tap to connect');
@@ -457,19 +436,22 @@ class VpnConnection extends ChangeNotifier {
   }
 
   void _setStatus(VpnStatus status, String message) {
-    if (_disposed) return;
     _status = status;
     _statusMessage = message;
     notifyListeners();
   }
 
+  Future<void> _checkHealth() async {
+    // A live tunnel already proves reachability; only probe while disconnected
+    // so we don't add direct /health traffic while the VPN is active.
+    if (_status == VpnStatus.connected) return;
+    _serverReachable = await HivemindService.checkHealth();
+    notifyListeners();
+  }
+
   @override
   void dispose() {
-    _disposed = true;
-    _connectEpoch++;
-    _suppressNativeConnect = true;
-    _userDisconnecting = true;
-    HivemindService.cancel();
+    _healthTimer?.cancel();
     _networkSubscription?.cancel();
     // Provider/UI disposal is not a user disconnect command. Keeping teardown
     // in disconnect() prevents lifecycle churn from silently dropping the VPN.

lib/main.dart

@@ -7,6 +7,7 @@ import 'package:revoltvpn/logic/ad_manager.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/haptic_settings.dart';
+import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/screens/intro.dart';
@@ -55,6 +56,10 @@ class ReVoltApp extends StatelessWidget {
               prev ?? SessionTimer(vpnConnection: vpn),
         ),
         ChangeNotifierProvider(create: (_) => AdManager()),
+        ChangeNotifierProvider(
+          create: (_) => ServerList()..init(),
+          lazy: false,
+        ),
       ],
       child: MaterialApp(
         title: 'ReVolt VPN',

lib/screens/server_selector/selection_screen.dart

@@ -0,0 +1,63 @@
+import 'package:flutter/material.dart';
+import 'package:provider/provider.dart';
+import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/logic/server_list.dart';
+
+// ── lib/screens/server_selector/selection_screen.dart ──────────────────────
+// Server picker — reads the server list from the ServerList provider.
+// Each row shows a flag + city name.  Tapping a row persists the choice
+// and pops back.  No latency measurement — the app runs inside a Reality
+// tunnel and must not emit separate probe traffic.
+
+class SelectionScreen extends StatelessWidget {
+  const SelectionScreen({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    final serverList = context.watch<ServerList>();
+
+    return Scaffold(
+      backgroundColor: AppColors.bgDeep,
+      appBar: AppBar(
+        backgroundColor: AppColors.bgSurface,
+        elevation: 0,
+        leading: IconButton(
+          icon: const Icon(Icons.arrow_back, color: AppColors.textWhite),
+          onPressed: () => Navigator.of(context).pop(),
+        ),
+        title: const Text(
+          'Select Server',
+          style: TextStyle(
+            color: AppColors.textWhite,
+            fontWeight: FontWeight.w600,
+          ),
+        ),
+      ),
+      body: ListView.builder(
+        itemCount: serverList.all.length,
+        itemBuilder: (context, index) {
+          final server = serverList.all[index];
+          final isSelected = index == serverList.selectedIndex;
+
+          return ListTile(
+            leading: Image.asset(server.flagAsset, width: 28, height: 28),
+            title: Text(server.name,
+                style: TextStyle(
+                  color: isSelected ? AppColors.accent : AppColors.textWhite,
+                  fontWeight: FontWeight.w600,
+                )),
+            trailing: isSelected
+                ? const Icon(Icons.check, color: AppColors.accent)
+                : null,
+            onTap: () {
+              serverList.select(index);
+              Navigator.of(context).pop();
+            },
+            contentPadding:
+                const EdgeInsets.symmetric(horizontal: 20, vertical: 8),
+          );
+        },
+      ),
+    );
+  }
+}

lib/screens/settings/in_settings/connection_mode.dart

@@ -1,6 +1,5 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
-import 'package:revoltvpn/logic/ad_manager.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/local_socks_tester.dart';
@@ -68,25 +67,20 @@ class _ConnectionModeTileState extends State<ConnectionModeTile> {
     widget.onChanged?.call(next);
   }
 
-  // Recovers an orphaned proxy by ending the session and starting a new one,
-  // exactly as the connect button does. Re-attaching to the session already
-  // held was the one place a session began without an ad and without a nonce
-  // to bind it to; a fresh one is the same path everywhere and hands back a
-  // full window rather than the remainder of a broken one.
+  /// Recovers from an orphaned proxy: tear the runtime down and start a fresh
+  /// session so a readable set of credentials exists again. No rewarded ad —
+  /// the user is repairing a connection they already paid for, not opening a
+  /// new one.
   Future<void> _reconnect() async {
     if (_reconnecting) return;
     final vpn = context.read<VpnConnection>();
     final timer = context.read<SessionTimer>();
-    final ad = context.read<AdManager>();
 
     setState(() => _reconnecting = true);
     try {
       await timer.disconnect();
       if (!mounted) return;
-      final adNonce = await ad.showAd('main');
-      if (adNonce == null && AdManager.adsEnabled) return;
-      if (!mounted) return;
-      if (await vpn.connect(adNonce: adNonce)) {
+      if (await vpn.connect()) {
         if (!mounted) return;
         await timer.start();
       }

local_packages/flutter_vless_android-1.1.5/.metadata

@@ -1,30 +0,0 @@
-# This file tracks properties of this Flutter project.
-# Used by Flutter tool to assess capabilities and perform upgrades etc.
-#
-# This file should be version controlled and should not be manually edited.
-
-version:
-  revision: "adc901062556672b4138e18a4dc62a4be8f4b3c2"
-  channel: "stable"
-
-project_type: plugin
-
-# Tracks metadata for the flutter migrate command
-migration:
-  platforms:
-    - platform: root
-      create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
-      base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
-    - platform: android
-      create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
-      base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
-
-  # User provided section
-
-  # List of Local paths (relative to this file) that should be
-  # ignored by the migrate tool.
-  #
-  # Files that are not part of the templates will be ignored by default.
-  unmanaged_files:
-    - 'lib/main.dart'
-    - 'ios/Runner.xcodeproj/project.pbxproj'

local_packages/flutter_vless_android-1.1.5/CHANGELOG.md

@@ -1,49 +0,0 @@
-## 1.1.5
-
-* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.7.11`.
-* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.7.11`.
-* Fixed Android VPN app routing: all configured blocked apps are now applied to `VpnService.Builder` as disallowed applications and bypass the Xray VPN tunnel.
-
-## 1.1.4
-
-* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.27.1`.
-* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.27`.
-
-## 1.1.3
-
-* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.22`.
-* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.22`.
-
-## 1.1.2
-
-* Clarified that Android device and emulator runtime binaries are delivered through the main Maven `xray-android` AAR.
-* Kept the Android runtime dependency on `dev.tfox.fluttervless:xray-android:26.6.1.1`.
-
-## 1.1.1
-
-* Updated the Android device runtime `libxray.so` binaries to Xray-core `v26.6.1`.
-* Kept Android 15+ 16KB page-size linker alignment for the rebuilt ARM binaries.
-* Moved Android runtime binaries and geodata into the Maven `dev.tfox.fluttervless:xray-android:26.6.1.1` AAR dependency.
-* Included device and emulator ABIs (`armeabi-v7a`, `arm64-v8a`, `x86`, `x86_64`) in the main Maven runtime AAR.
-* Removed raw device `jniLibs` and geodata files from the Pub.dev wrapper package; the wrapper now resolves the runtime from Maven Central.
-
-## 1.1.0
-
-* Replaced Android Dart boilerplate with the shared `VlessMethodChannelAdapter`.
-* Removed template `getPlatformVersion` scaffold files.
-* Moved `flutter_lints` to `dev_dependencies`.
-* Removed publish-time dependency overrides from `pubspec.yaml`.
-
-## 1.0.2
-
-* XRay version up
-
-## 1.0.1
-
-*   XRay version up
-
-## 1.0.0
-
-*   Initial release of the Android implementation for `flutter_vless`.
-*   Supports VLESS/VMESS protocols using Xray core.
-*   Implements `VlessPlatform` interface.

local_packages/flutter_vless_android-1.1.5/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2024-2026 13FOX Studio / tfox.dev
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

local_packages/flutter_vless_android-1.1.5/NOTICE

@@ -1,13 +0,0 @@
-flutter_vless_android
-
-Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
-
-This package is the Android implementation of the official flutter_vless
-project maintained by 13FOX Studio.
-
-Official project: https://github.com/XIIIFOX/flutter_vless
-Official publisher: https://pub.dev/publishers/tfox.dev
-Website: https://tfox.dev
-
-Redistributions, forks, and derived packages must preserve the copyright notice
-and MIT license notice where required by the license.

local_packages/flutter_vless_android-1.1.5/README.md

@@ -1,14 +0,0 @@
-# flutter_vless_android
-
-The Android implementation of the `flutter_vless` plugin.
-
-## Runtime
-
-Android runtime binaries and geodata are delivered through the Maven Central AAR dependency `dev.tfox.fluttervless:xray-android:26.7.11`. This keeps the Pub.dev package lightweight while preserving the same packaged Xray files in the final Android app.
-
-Do not add raw `android/src/main/jniLibs` or geodata files back to this package. Rebuild runtime files in `android_runtime/xray_android/src/main`, publish the Maven AAR, then publish this wrapper package.
-
-## Emulator Support
-
-The current Maven runtime AAR includes `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64`.
-This covers both physical Android devices and Android emulators.

local_packages/flutter_vless_android-1.1.5/UPSTREAM

@@ -1,4 +0,0 @@
-Upstream: https://github.com/XIIIFOX/flutter_vless
-Tag: v1.1.5
-Android package: flutter_vless_android 1.1.5
-ReVolt hardening is pre-applied to this vendored package.

local_packages/flutter_vless_android-1.1.5/analysis_options.yaml

@@ -1,4 +0,0 @@
-include: package:flutter_lints/flutter.yaml
-
-# Additional information about this file can be found at
-# https://dart.dev/guides/language/analysis-options

local_packages/flutter_vless_android-1.1.5/android/.gitignore

@@ -1,9 +0,0 @@
-*.iml
-.gradle
-/local.properties
-/.idea/workspace.xml
-/.idea/libraries
-.DS_Store
-/build
-/captures
-.cxx

local_packages/flutter_vless_android-1.1.5/android/XRAY_SETUP.md

@@ -1,92 +0,0 @@
-# Xray & Tun2socks Android Build Guide
-
-This guide explains how to build the native libraries (`libxray.so` and `libtun2socks.so`) for the Flutter Vless plugin.
-
-Android runtime files are stored in `android_runtime/xray_android/src/main` and published as the Maven Central AAR `dev.tfox.fluttervless:xray-android`. They are not stored in the `flutter_vless_android` Pub.dev package.
-
-**Key Features:**
-- ✅ **Android 15+ Support**: Builds with 16KB page size alignment.
-- ✅ **Socket FD Passing**: `tun2socks` is patched to receive the TUN file descriptor via a Unix socket (bypassing Android process restrictions).
-
-## Prerequisites
-
-1. **Go (Golang)**: Version 1.21+ installed.
-2. **Android NDK**: Version r27+ (recommended).
-3. **macOS/Linux**: Build scripts are designed for Unix-like environments.
-
-## 1. Environment Setup
-
-Export the path to your Android NDK.
-
-```bash
-# Example (Adjust path to your NDK installation)
-export ANDROID_NDK_HOME="$HOME/Library/Android/sdk/ndk/27.0.12077973"
-```
-
-## 2. Build Xray (`libxray.so`)
-
-This script builds the Xray core for Android device and emulator architectures (`arm64-v8a`, `armeabi-v7a`, `x86`, `x86_64`) by default and writes them to the Maven runtime module.
-
-```bash
-cd android
-chmod +x build_xray.sh
-./build_xray.sh
-```
-
-## 3. Build Tun2socks (`libtun2socks.so`)
-
-We use a custom Go-based build script (`build_tun2socks.sh`) instead of the old C-based one. This ensures 16KB page alignment and includes the socket-based FD passing logic.
-
-```bash
-cd android
-chmod +x build_tun2socks.sh
-./build_tun2socks.sh
-```
-
-## 4. Verification (16KB Page Size)
-
-To confirm that the libraries are compatible with Android 15+ (16KB page size), check the `LOAD` segment alignment using `llvm-readelf`.
-
-```bash
-# Check alignment (should be 0x4000)
-$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/darwin-x86_64/bin/llvm-readelf -l ../../../android_runtime/xray_android/src/main/jniLibs/arm64-v8a/libtun2socks.so | grep LOAD | head -1
-```
-
-**Expected Output:**
-```
-LOAD           ... 0x4000
-```
-If you see `0x1000`, it is **NOT** compatible with 16KB devices.
-
-## 5. Package The Maven Runtime AAR
-
-The `flutter_vless_android` Pub.dev package consumes the Android device runtime through the Maven artifact:
-
-```text
-dev.tfox.fluttervless:xray-android:26.7.11
-```
-
-After rebuilding `libxray.so`, `libtun2socks.so`, or the geodata files in `android_runtime/xray_android/src/main`, build the local Maven repository from the repository root:
-
-```bash
-tool/build_android_runtime_maven.sh
-```
-
-For local Android wrapper or example builds before Maven Central publication, pass the local repository path:
-
-```bash
-cd example/android
-./gradlew :app:assembleDebug \
-  -PflutterVlessAndroidRuntimeRepo="$PWD/../../android_runtime/xray_android/build/repo"
-```
-
-To upload the signed bundle to Maven Central, configure the Central Portal and signing environment variables documented in `android_runtime/xray_android/README.md`, then run:
-
-```bash
-tool/publish_android_runtime_maven.sh
-```
-
-## 6. Troubleshooting
-
-- **"bad file descriptor"**: This means the socket FD passing failed. Ensure `XrayVPNService.kt` is correctly sending the FD to the socket path specified in `-sock-path`.
-- **"permission denied"**: Ensure the app has permissions to write to the socket file in its private directory.

local_packages/flutter_vless_android-1.1.5/android/build.gradle

@@ -1,95 +0,0 @@
-group 'com.github.tfox.flutter_vless'
-version '1.0'
-
-buildscript {
-    ext.kotlin_version = '2.2.20'
-    repositories {
-        google()
-        mavenCentral()
-    }
-
-    dependencies {
-        classpath 'com.android.tools.build:gradle:8.1.0'
-        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
-    }
-}
-
-rootProject.allprojects {
-    repositories {
-        def localRuntimeRepo = findProperty('flutterVlessAndroidRuntimeRepo') ?: System.getenv('FLUTTER_VLESS_ANDROID_RUNTIME_REPO')
-        if (localRuntimeRepo) {
-            maven { url uri(localRuntimeRepo) }
-        }
-        google()
-        mavenCentral()
-    }
-}
-
-apply plugin: 'com.android.library'
-apply plugin: 'kotlin-android'
-
-android {
-    if (project.android.hasProperty("namespace")) {
-        namespace 'com.github.tfox.flutter_vless'
-    }
-
-    compileSdkVersion 34
-    compileOptions {
-        sourceCompatibility JavaVersion.VERSION_1_8
-        targetCompatibility JavaVersion.VERSION_1_8
-    }
-
-    kotlinOptions {
-        jvmTarget = '1.8'
-    }
-
-    defaultConfig {
-        minSdkVersion 23
-        targetSdkVersion 35
-        
-        // 16KB page size support for Android 15+
-        ndk {
-            abiFilters 'armeabi-v7a', 'arm64-v8a', 'x86', 'x86_64'
-        }
-    }
-    
-    // Configure 16KB page alignment
-    buildFeatures {
-        prefab true
-    }
-
-    dependencies {
-        testImplementation 'junit:junit:4.13.2'
-        testImplementation 'org.mockito:mockito-core:5.0.0'
-        testImplementation 'org.json:json:20240303'
-    }
-
-    testOptions {
-        unitTests.returnDefaultValues = true
-        unitTests.all {
-            testLogging {
-               events "passed", "skipped", "failed", "standardOut", "standardError"
-               outputs.upToDateWhen {false}
-               showStandardStreams = true
-            }
-        }
-    }
-
-    sourceSets {
-        main {
-            java.srcDirs += 'src/main/kotlin'
-        }
-    }
-    packaging {
-        jniLibs {
-            pickFirsts += ['lib/**/libc++_shared.so']
-        }
-    }
-}
-
-dependencies {
-    implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
-    implementation 'androidx.appcompat:appcompat:1.6.1'
-    implementation 'com.google.code.gson:gson:2.10.1'
-    implementation "dev.tfox.fluttervless:xray-android:${findProperty('flutterVlessXrayRuntimeVersion') ?: '26.7.11'}"
-}

local_packages/flutter_vless_android-1.1.5/android/build_tun2socks.sh

@@ -1,122 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Build script for tun2socks (Go version) with 16KB page size support
-# This is required for Android 15+ compatibility
-
-# Configuration
-TUN2SOCKS_REPO="https://github.com/xjasonlyu/tun2socks"
-TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}"
-NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}"
-
-# Check NDK
-if [ ! -d "$NDK_PATH" ]; then
-    echo "Error: NDK not found at $NDK_PATH"
-    echo "Please export ANDROID_NDK_HOME pointing to your NDK installation."
-    exit 1
-fi
-
-echo "Using NDK at: $NDK_PATH"
-
-case "$(uname -s)" in
-    Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;;
-    Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;;
-    *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;;
-esac
-if [ ! -d "$TOOLCHAIN" ]; then
-    echo "Error: NDK toolchain not found at $TOOLCHAIN"
-    echo "Please check ANDROID_NDK_HOME and host OS."
-    exit 1
-fi
-
-# Clone tun2socks if not exists
-if [ ! -d "tun2socks-go" ]; then
-    echo "Cloning tun2socks (Go version)..."
-    git clone "$TUN2SOCKS_REPO" tun2socks-go
-else
-    echo "tun2socks-go directory exists, pulling latest..."
-    cd tun2socks-go && git pull && cd ..
-fi
-
-# Build Function
-build_tun2socks() {
-    local ARCH_NAME=$1
-    local GO_ARCH=$2
-    local GO_ARM=$3
-    local ANDROID_TARGET=$4
-    local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}"
-
-    echo "Building tun2socks for ${ARCH_NAME}..."
-    
-    mkdir -p "$OUTPUT_DIR"
-
-    export CGO_ENABLED=1
-    export GOOS=android
-    export GOARCH=$GO_ARCH
-    export GOARM=$GO_ARM
-    
-    export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang"
-    export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++"
-    
-    # Verify compiler exists
-    if [ ! -f "$CC" ]; then
-        echo "Error: Compiler not found at $CC"
-        return 1
-    fi
-
-    cd tun2socks-go
-    
-    # Build with 16KB page alignment - same flags as xray
-    go build -v -trimpath -ldflags "-s -w -buildid= -linkmode=external -extldflags '-Wl,-z,max-page-size=16384'" -buildmode=pie -o "../${OUTPUT_DIR}/libtun2socks.so" .
-
-    echo "Success: ${OUTPUT_DIR}/libtun2socks.so created."
-
-    # Verify 16KB alignment
-    if [ -x "${TOOLCHAIN}/bin/llvm-readelf" ]; then
-        echo "Verifying 16KB alignment:"
-        ALIGN=$("${TOOLCHAIN}/bin/llvm-readelf" -l "../${OUTPUT_DIR}/libtun2socks.so" | grep "LOAD" | head -1 | awk '{print $NF}')
-        if [ "$ALIGN" = "0x4000" ]; then
-            echo "Alignment: $ALIGN (16KB) - correct"
-        else
-            echo "Warning: alignment is $ALIGN; expected 0x4000"
-        fi
-    fi
-
-    cd ..
-}
-
-# Build for Architectures
-echo "Building tun2socks (Go version) with 16KB page size support..."
-
-# ARM64
-if [ "${TUN2SOCKS_BUILD_ARM64:-1}" = "1" ]; then
-    build_tun2socks "arm64-v8a" "arm64" "" "aarch64-linux-android21"
-fi
-
-# ARMv7
-if [ "${TUN2SOCKS_BUILD_ARMV7:-1}" = "1" ]; then
-    build_tun2socks "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21"
-fi
-
-# x86 is included in the main runtime AAR.
-if [ "${TUN2SOCKS_BUILD_X86:-1}" = "1" ]; then
-    build_tun2socks "x86" "386" "" "i686-linux-android21"
-fi
-
-# x86_64 is included in the main runtime AAR.
-if [ "${TUN2SOCKS_BUILD_X86_64:-1}" = "1" ]; then
-    build_tun2socks "x86_64" "amd64" "" "x86_64-linux-android21"
-fi
-
-echo ""
-echo "========================================="
-echo "Build process finished!"
-echo "========================================="
-echo ""
-echo "Verification:"
-echo "Run this command to check all libraries:"
-echo ""
-echo "for arch in armeabi-v7a arm64-v8a x86 x86_64; do"
-echo "  echo \"=== \$arch ===\";"
-echo "  ${TOOLCHAIN}/bin/llvm-readelf -l ${TARGET_DIR}/\$arch/libtun2socks.so | grep LOAD | head -1;"
-echo "done"

local_packages/flutter_vless_android-1.1.5/android/build_xray.sh

@@ -1,116 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Configuration
-XRAY_REPO="https://github.com/XTLS/Xray-core"
-XRAY_VERSION="${XRAY_VERSION:-v26.7.11}"
-TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}"
-NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}"
-
-# Check NDK
-if [ ! -d "$NDK_PATH" ]; then
-    echo "Error: NDK not found at $NDK_PATH"
-    echo "Please export ANDROID_NDK_HOME pointing to your NDK installation."
-    exit 1
-fi
-
-echo "Using NDK at: $NDK_PATH"
-
-# MacOS NDK Toolchain path
-case "$(uname -s)" in
-    Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;;
-    Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;;
-    *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;;
-esac
-if [ ! -d "$TOOLCHAIN" ]; then
-    echo "Error: NDK toolchain not found at $TOOLCHAIN"
-    echo "Are you on macOS? If not, please edit the script to match your OS."
-    exit 1
-fi
-
-# Clone Xray if not exists
-if [ ! -d "Xray-core" ]; then
-    echo "Cloning Xray-core..."
-    git clone "$XRAY_REPO"
-else
-    echo "Xray-core directory exists, pulling latest..."
-    cd Xray-core && git fetch --tags && cd ..
-fi
-
-cd Xray-core
-git fetch --tags
-git checkout "$XRAY_VERSION"
-cd ..
-
-# Build Function
-build_xray() {
-    local ARCH_NAME=$1
-    local GO_ARCH=$2
-    local GO_ARM=$3
-    local ANDROID_TARGET=$4
-    local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}"
-
-    echo "Building for ${ARCH_NAME}..."
-    
-    mkdir -p "$OUTPUT_DIR"
-
-    export CGO_ENABLED=1
-    export GOOS=android
-    export GOARCH=$GO_ARCH
-    export GOARM=$GO_ARM
-    
-    export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang"
-    export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++"
-    
-    # 16KB page size support for Android 15+
-    export LDFLAGS="-Wl,-z,max-page-size=16384"
-    
-    # Verify compiler exists
-    if [ ! -f "$CC" ]; then
-        echo "Error: Compiler not found at $CC"
-        # Try older NDK naming convention if new one fails (API 21 is standard)
-        # Some NDKs use specific API levels in clang name
-        return 1
-    fi
-
-    cd Xray-core
-    
-    # Build with 16KB page alignment
-    if go build -v -trimpath -buildvcs=false \
-        -gcflags "all=-l=4" \
-        -ldflags "-X github.com/xtls/xray-core/core.build=${XRAY_VERSION} -s -w -buildid= -checklinkname=0 -linkmode=external -extldflags=${LDFLAGS}" \
-        -buildmode=pie \
-        -o "../${OUTPUT_DIR}/libxray.so" ./main; then
-        echo "Success: ${OUTPUT_DIR}/libxray.so created."
-    else
-        echo "Failed to build for ${ARCH_NAME}"
-        return 1
-    fi
-    
-    cd ..
-}
-
-# Build for Architectures
-# API Level 21 is generally safe for modern Flutter apps (Android 5.0+)
-
-# ARM64
-if [ "${XRAY_BUILD_ARM64:-1}" = "1" ]; then
-    build_xray "arm64-v8a" "arm64" "" "aarch64-linux-android21"
-fi
-
-# ARMv7
-if [ "${XRAY_BUILD_ARMV7:-1}" = "1" ]; then
-    build_xray "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21"
-fi
-
-# x86 is included in the main runtime AAR.
-if [ "${XRAY_BUILD_X86:-1}" = "1" ]; then
-    build_xray "x86" "386" "" "i686-linux-android21"
-fi
-
-# x86_64 is included in the main runtime AAR.
-if [ "${XRAY_BUILD_X86_64:-1}" = "1" ]; then
-    build_xray "x86_64" "amd64" "" "x86_64-linux-android21"
-fi
-
-echo "Build process finished."

local_packages/flutter_vless_android-1.1.5/android/settings.gradle

@@ -1 +0,0 @@
-rootProject.name = 'flutter_vless_android'

local_packages/flutter_vless_android-1.1.5/android/src/main/AndroidManifest.xml

@@ -1,31 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    package="com.github.tfox.flutter_vless">
-
-    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
-    <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
-    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <uses-permission
-        android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"
-        android:minSdkVersion="34" />
-
-    <application>
-        <service
-            android:name="com.github.tfox.flutter_vless.xray.service.XrayVPNService"
-            android:enabled="true"
-            android:exported="false"
-            android:foregroundServiceType="specialUse"
-            android:permission="android.permission.BIND_VPN_SERVICE"
-            android:process=":RunSoLibXrayDaemon">
-            <property
-                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
-                android:value="vpn" />
-            <intent-filter>
-                <action android:name="android.net.VpnService" />
-            </intent-filter>
-            <meta-data
-                android:name="android.net.VpnService.SUPPORTS_ALWAYS_ON"
-                android:value="false" />
-        </service>
-    </application>
-</manifest>

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/FlutterVlessPlugin.kt

@@ -1,424 +0,0 @@
-// Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
-// SPDX-License-Identifier: MIT
-
-package com.github.tfox.flutter_vless
-
-import android.Manifest
-import android.app.Activity
-import android.content.BroadcastReceiver
-import android.content.Context
-import android.content.Intent
-import android.content.IntentFilter
-import android.content.pm.PackageManager
-import android.net.VpnService
-import android.os.Build
-import android.os.Handler
-import android.os.Looper
-import android.util.Log
-import androidx.core.app.ActivityCompat
-import androidx.core.content.ContextCompat
-import com.github.tfox.flutter_vless.xray.dto.XrayConfig
-import com.github.tfox.flutter_vless.xray.service.XrayVPNService
-import com.github.tfox.flutter_vless.xray.utils.AppConfigs
-import io.flutter.embedding.engine.plugins.FlutterPlugin
-import io.flutter.embedding.engine.plugins.activity.ActivityAware
-import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
-import io.flutter.plugin.common.EventChannel
-import io.flutter.plugin.common.MethodCall
-import io.flutter.plugin.common.MethodChannel
-import io.flutter.plugin.common.PluginRegistry
-import java.io.BufferedReader
-import java.io.File
-import java.io.InputStreamReader
-import java.util.ArrayList
-import java.util.UUID
-import java.util.concurrent.Executors
-
-/**
- * Main entry point for the Flutter Vless plugin on Android.
- *
- * ReVolt keeps this bridge deliberately narrow: start/stop, session deadline,
- * permission handling, core version and private runtime status only.
- */
-class FlutterVlessPlugin : FlutterPlugin, ActivityAware, PluginRegistry.ActivityResultListener, MethodChannel.MethodCallHandler {
-
-    private val executor = Executors.newSingleThreadExecutor()
-    private lateinit var vpnControlMethod: MethodChannel
-    private lateinit var vpnStatusEvent: EventChannel
-    private var vpnStatusSink: EventChannel.EventSink? = null
-    private var activity: Activity? = null
-    private var xrayReceiver: BroadcastReceiver? = null
-    private var pendingResult: MethodChannel.Result? = null
-    private lateinit var context: Context
-    private var expectedRuntimeToken: String? = null
-    private var pendingStopResult: MethodChannel.Result? = null
-    private val mainHandler = Handler(Looper.getMainLooper())
-    private val stopTimeoutRunnable = Runnable {
-        val pending = pendingStopResult ?: return@Runnable
-        pendingStopResult = null
-        pending.error("STOP_TIMEOUT", "VPN service did not confirm shutdown", null)
-    }
-
-    companion object {
-        private const val TAG = "FlutterVlessPlugin"
-        private const val REQUEST_CODE_VPN_PERMISSION = 24
-        private const val REQUEST_CODE_POST_NOTIFICATIONS = 1
-    }
-
-    override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
-        context = binding.applicationContext
-        vpnControlMethod = MethodChannel(binding.binaryMessenger, "flutter_vless")
-        vpnStatusEvent = EventChannel(binding.binaryMessenger, "flutter_vless/status")
-
-        vpnControlMethod.setMethodCallHandler(this)
-        vpnStatusEvent.setStreamHandler(object : EventChannel.StreamHandler {
-            override fun onListen(arguments: Any?, events: EventChannel.EventSink?) {
-                vpnStatusSink = events
-                registerReceiver()
-            }
-
-            override fun onCancel(arguments: Any?) {
-                vpnStatusSink = null
-                unregisterReceiver()
-            }
-        })
-    }
-
-    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
-        when (call.method) {
-            "startVless" -> {
-                if (pendingStopResult != null) {
-                    result.error("STOP_IN_PROGRESS", "VPN shutdown is still in progress", null)
-                    return
-                }
-
-                val config = XrayConfig()
-                val runtimeToken = UUID.randomUUID().toString()
-                expectedRuntimeToken = runtimeToken
-                config.RUNTIME_TOKEN = runtimeToken
-                config.REMARK = call.argument("remark") ?: ""
-                config.V2RAY_FULL_JSON_CONFIG = call.argument("config") ?: ""
-                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
-                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
-                config.NOTIFICATION_DISCONNECT_BUTTON_NAME = call.argument("notificationDisconnectButtonName") ?: "Disconnect"
-
-                if (AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME.isNotEmpty() && AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE.isNotEmpty()) {
-                    config.NOTIFICATION_ICON_RESOURCE_NAME = AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME
-                    config.NOTIFICATION_ICON_RESOURCE_TYPE = AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE
-                    val resId = context.resources.getIdentifier(
-                        AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME,
-                        AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE,
-                        context.packageName
-                    )
-                    config.APPLICATION_ICON = resId
-                }
-
-                if (call.argument<Boolean>("proxy_only") == true) {
-                    AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.PROXY_ONLY
-                } else {
-                    AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.VPN_TUN
-                }
-
-                try {
-                    val jsonConfig = org.json.JSONObject(config.V2RAY_FULL_JSON_CONFIG)
-                    val outbounds = jsonConfig.optJSONArray("outbounds")
-                    if (outbounds != null && outbounds.length() > 0) {
-                        val firstOutbound = outbounds.getJSONObject(0)
-                        val settings = firstOutbound.optJSONObject("settings")
-                        val vnext = settings?.optJSONArray("vnext")
-                        if (vnext != null && vnext.length() > 0) {
-                            val server = vnext.getJSONObject(0)
-                            config.CONNECTED_V2RAY_SERVER_ADDRESS = server.optString("address", "")
-                            config.CONNECTED_V2RAY_SERVER_PORT = server.optInt("port", 0).toString()
-                        } else if (settings != null) {
-                            config.CONNECTED_V2RAY_SERVER_ADDRESS = settings.optString("address", "")
-                            config.CONNECTED_V2RAY_SERVER_PORT = settings.optInt("port", 0).toString()
-                        }
-                    }
-                } catch (_: Exception) {
-                    // Optional metadata only; runtime config validation happens downstream.
-                }
-
-                val intent = Intent(context, XrayVPNService::class.java)
-                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE)
-                intent.putExtra("V2RAY_CONFIG", config)
-                intent.putExtra("PROXY_ONLY", call.argument<Boolean>("proxy_only") ?: false)
-
-                try {
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-                        context.startForegroundService(intent)
-                    } else {
-                        context.startService(intent)
-                    }
-                    result.success(null)
-                } catch (e: Exception) {
-                    if (expectedRuntimeToken == runtimeToken) expectedRuntimeToken = null
-                    result.error("START_FAILED", e.message ?: "Could not start VPN service", null)
-                }
-            }
-
-            "stopVless" -> {
-                if (pendingStopResult != null) {
-                    result.error("STOP_IN_PROGRESS", "VPN shutdown is already in progress", null)
-                    return
-                }
-
-                // A STOP without a generation token can kill a newer runtime after
-                // UI/process churn. No token means this bridge owns nothing to stop.
-                val token = expectedRuntimeToken
-                if (token == null) {
-                    result.success(null)
-                    return
-                }
-
-                val intent = Intent(context, XrayVPNService::class.java)
-                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
-                intent.putExtra("RUNTIME_TOKEN", token)
-
-                try {
-                    context.startService(intent)
-                    pendingStopResult = result
-                    mainHandler.removeCallbacks(stopTimeoutRunnable)
-                    mainHandler.postDelayed(stopTimeoutRunnable, 6_000L)
-                } catch (e: Exception) {
-                    pendingStopResult = null
-                    mainHandler.removeCallbacks(stopTimeoutRunnable)
-                    result.error("STOP_FAILED", e.message ?: "Could not stop VPN service", null)
-                }
-            }
-
-            "setSessionDeadline" -> {
-                val token = expectedRuntimeToken
-                val remainingSeconds = call.argument<Number>("remainingSeconds")?.toLong()
-                if (token == null) {
-                    result.error("NO_RUNTIME", "No active runtime token", null)
-                    return
-                }
-                if (remainingSeconds == null || remainingSeconds < 0) {
-                    result.error("INVALID_DEADLINE", "remainingSeconds must be non-negative", null)
-                    return
-                }
-
-                val intent = Intent(context, XrayVPNService::class.java)
-                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE)
-                intent.putExtra("RUNTIME_TOKEN", token)
-                intent.putExtra("REMAINING_SECONDS", remainingSeconds)
-                try {
-                    context.startService(intent)
-                    result.success(null)
-                } catch (e: Exception) {
-                    result.error("DEADLINE_FAILED", e.message ?: "Could not update session deadline", null)
-                }
-            }
-
-            "initializeVless" -> {
-                val iconResourceName = call.argument<String>("notificationIconResourceName")
-                val iconResourceType = call.argument<String>("notificationIconResourceType")
-                if (iconResourceName != null && iconResourceType != null) {
-                    AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME = iconResourceName
-                    AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE = iconResourceType
-                }
-                result.success(null)
-            }
-
-            "getCoreVersion" -> {
-                executor.submit {
-                    try {
-                        val nativeLibraryDir = context.applicationInfo.nativeLibraryDir
-                        val xrayExecutable = File(nativeLibraryDir, "libxray.so")
-                        if (xrayExecutable.exists()) {
-                            val p = Runtime.getRuntime().exec(arrayOf(xrayExecutable.absolutePath, "-version"))
-                            val reader = BufferedReader(InputStreamReader(p.inputStream))
-                            val version = reader.readLine()
-                            result.success(version)
-                        } else {
-                            result.success("Xray not found")
-                        }
-                    } catch (e: Exception) {
-                        result.success("Error: ${e.message}")
-                    }
-                }
-            }
-
-            // POST_NOTIFICATIONS without VpnService.prepare, for proxy mode.
-            "requestNotificationPermission" -> {
-                val currentActivity = activity
-                if (currentActivity == null) {
-                    result.error("NO_ACTIVITY", "Activity is not attached", null)
-                    return
-                }
-                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
-                    ActivityCompat.checkSelfPermission(
-                        currentActivity,
-                        Manifest.permission.POST_NOTIFICATIONS,
-                    ) != PackageManager.PERMISSION_GRANTED
-                ) {
-                    ActivityCompat.requestPermissions(
-                        currentActivity,
-                        arrayOf(Manifest.permission.POST_NOTIFICATIONS),
-                        REQUEST_CODE_POST_NOTIFICATIONS,
-                    )
-                }
-                result.success(null)
-            }
-
-            "requestPermission" -> {
-                val currentActivity = activity
-                if (currentActivity == null) {
-                    result.error("NO_ACTIVITY", "Activity is not attached", null)
-                    return
-                }
-                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-                    if (ActivityCompat.checkSelfPermission(currentActivity, Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
-                        ActivityCompat.requestPermissions(currentActivity, arrayOf(Manifest.permission.POST_NOTIFICATIONS), REQUEST_CODE_POST_NOTIFICATIONS)
-                    }
-                }
-                val request = VpnService.prepare(currentActivity)
-                if (request != null) {
-                    pendingResult = result
-                    currentActivity.startActivityForResult(request, REQUEST_CODE_VPN_PERMISSION)
-                } else {
-                    result.success(true)
-                }
-            }
-
-            else -> result.notImplemented()
-        }
-    }
-
-    private fun registerReceiver() {
-        if (activity == null) return
-        if (xrayReceiver == null) {
-            xrayReceiver = object : BroadcastReceiver() {
-                override fun onReceive(context: Context?, intent: Intent?) {
-                    if (intent == null || vpnStatusSink == null) return
-                    val state = intent.getSerializableExtra("STATE") as? AppConfigs.V2RAY_STATES
-                    val runtimeToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
-                    val runtimeReady = intent.getBooleanExtra("RUNTIME_READY", false)
-                    val duration = intent.getStringExtra("DURATION")
-                    val uploadSpeed = intent.getLongExtra("UPLOAD_SPEED", 0)
-                    val downloadSpeed = intent.getLongExtra("DOWNLOAD_SPEED", 0)
-                    val uploadTraffic = intent.getLongExtra("UPLOAD_TRAFFIC", 0)
-                    val downloadTraffic = intent.getLongExtra("DOWNLOAD_TRAFFIC", 0)
-
-                    val currentToken = expectedRuntimeToken
-                    if (currentToken == null) {
-                        if (runtimeToken.isNotEmpty() &&
-                            (state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
-                             state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING)
-                        ) {
-                            expectedRuntimeToken = runtimeToken
-                        } else {
-                            return
-                        }
-                    } else if (runtimeToken != currentToken) {
-                        return
-                    }
-
-                    val stateName = when (state) {
-                        AppConfigs.V2RAY_STATES.V2RAY_CONNECTED -> if (runtimeReady) "CONNECTED" else "CONNECTING"
-                        AppConfigs.V2RAY_STATES.V2RAY_CONNECTING -> "CONNECTING"
-                        else -> "DISCONNECTED"
-                    }
-
-                    val data = ArrayList<String>()
-                    data.add(duration ?: "0")
-                    data.add(uploadSpeed.toString())
-                    data.add(downloadSpeed.toString())
-                    data.add(uploadTraffic.toString())
-                    data.add(downloadTraffic.toString())
-                    data.add(stateName)
-
-                    if (state == AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED &&
-                        runtimeToken.isNotEmpty() && runtimeToken == expectedRuntimeToken
-                    ) {
-                        expectedRuntimeToken = null
-                        mainHandler.removeCallbacks(stopTimeoutRunnable)
-                        pendingStopResult?.success(null)
-                        pendingStopResult = null
-                    }
-
-                    vpnStatusSink?.success(data)
-                }
-            }
-        }
-
-        val filter = IntentFilter(AppConfigs.V2RAY_CONNECTION_INFO)
-        val currentActivity = activity ?: return
-        ContextCompat.registerReceiver(
-            currentActivity,
-            xrayReceiver,
-            filter,
-            ContextCompat.RECEIVER_NOT_EXPORTED,
-        )
-    }
-
-    private fun unregisterReceiver() {
-        val currentActivity = activity
-        val receiver = xrayReceiver
-        if (currentActivity != null && receiver != null) {
-            try {
-                currentActivity.unregisterReceiver(receiver)
-            } catch (e: Exception) {
-                Log.w(TAG, "Receiver was already detached during lifecycle cleanup", e)
-            }
-        }
-        xrayReceiver = null
-    }
-
-    private fun failPendingPermission(code: String, message: String) {
-        pendingResult?.error(code, message, null)
-        pendingResult = null
-    }
-
-    override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
-        mainHandler.removeCallbacks(stopTimeoutRunnable)
-        pendingStopResult?.error("ENGINE_DETACHED", "Flutter engine detached during VPN shutdown", null)
-        pendingStopResult = null
-        failPendingPermission("ENGINE_DETACHED", "Flutter engine detached during VPN permission request")
-        unregisterReceiver()
-        vpnControlMethod.setMethodCallHandler(null)
-        vpnStatusEvent.setStreamHandler(null)
-        executor.shutdown()
-    }
-
-    override fun onAttachedToActivity(binding: ActivityPluginBinding) {
-        activity = binding.activity
-        binding.addActivityResultListener(this)
-        if (vpnStatusSink != null) {
-            registerReceiver()
-        }
-    }
-
-    override fun onDetachedFromActivityForConfigChanges() {
-        unregisterReceiver()
-        activity = null
-    }
-
-    override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
-        activity = binding.activity
-        binding.addActivityResultListener(this)
-        if (vpnStatusSink != null) {
-            registerReceiver()
-        }
-    }
-
-    override fun onDetachedFromActivity() {
-        failPendingPermission("NO_ACTIVITY", "Activity detached during VPN permission request")
-        unregisterReceiver()
-        activity = null
-    }
-
-    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
-        if (requestCode == REQUEST_CODE_VPN_PERMISSION) {
-            if (resultCode == Activity.RESULT_OK) {
-                pendingResult?.success(true)
-            } else {
-                pendingResult?.success(false)
-            }
-            pendingResult = null
-            return true
-        }
-        return false
-    }
-}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManager.kt

@@ -1,700 +0,0 @@
-package com.github.tfox.flutter_vless.xray.core
-
-import android.app.Notification
-import android.app.NotificationChannel
-import android.app.NotificationManager
-import android.app.PendingIntent
-import android.app.Service
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageManager
-import android.graphics.Color
-import android.os.Build
-import android.os.CountDownTimer
-import android.os.Handler
-import android.os.Looper
-import android.util.Log
-import androidx.core.app.ActivityCompat
-import androidx.core.app.NotificationCompat
-import com.github.tfox.flutter_vless.xray.dto.XrayConfig
-import com.github.tfox.flutter_vless.xray.service.XrayVPNService
-import com.github.tfox.flutter_vless.xray.utils.AppConfigs
-import com.github.tfox.flutter_vless.xray.utils.Utilities
-import org.json.JSONObject
-import org.json.JSONArray
-import java.io.File
-import java.io.FileOutputStream
-
-/**
- * Manages the Xray Core process (libxray.so).
- * 
- * This singleton object is responsible for:
- * 1. Generating the final Xray configuration file (config.json).
- * 2. Injecting necessary inbounds (SOCKS, HTTP, API) into the user-provided config.
- * 3. Starting and monitoring the Xray process.
- * 4. Collecting traffic statistics via the Xray API.
- * 5. Showing the persistent foreground notification.
- */
-object XrayCoreManager {
-
-    private const val NOTIFICATION_ID = 1
-    private const val TAG = "XrayCoreManager"
-
-    // The core's output is kept only for its first seconds, and only to explain
-    // a non-zero exit. A core that has been up longer than this may be carrying
-    // traffic, and its log can name destinations, which must never reach the
-    // device log (rule 95) - so past the window the buffer is dropped.
-    private const val STARTUP_LOG_WINDOW_MS = 10_000L
-    private const val STARTUP_LOG_MAX_LINES = 40
-    private var xrayProcess: Process? = null
-    private var countDownTimer: CountDownTimer? = null
-    private var seconds = 0
-
-    private fun deleteEphemeralConfigOnFailure(filesDir: File) {
-        try {
-            val config = File(filesDir, "config.json")
-            if (config.exists() && !config.delete()) {
-                Log.w(TAG, "Could not delete failed ephemeral Xray config")
-            }
-        } catch (e: Exception) {
-            Log.w(TAG, "Could not delete failed ephemeral Xray config", e)
-        }
-    }
-
-    private fun nextFreePort(preferredPort: Int, usedPorts: Set<Int>): Int {
-        var port = preferredPort
-        while (usedPorts.contains(port)) {
-            port++
-        }
-        return port
-    }
-
-    private fun uniqueInboundTag(inbounds: JSONArray, preferredTag: String): String {
-        val tags = mutableSetOf<String>()
-        for (i in 0 until inbounds.length()) {
-            val tag = inbounds.optJSONObject(i)?.optString("tag").orEmpty()
-            if (tag.isNotEmpty()) tags.add(tag)
-        }
-
-        if (!tags.contains(preferredTag)) return preferredTag
-
-        var index = 1
-        var candidate = "${preferredTag}_$index"
-        while (tags.contains(candidate)) {
-            index++
-            candidate = "${preferredTag}_$index"
-        }
-        return candidate
-    }
-
-    private fun normalizeRuntimeConfig(value: Any?): Any? {
-        return when (value) {
-            is JSONObject -> {
-                val normalized = JSONObject()
-                val aliases = mapOf(
-                    "xHTTPSettings" to "xhttpSettings",
-                    "httpUpgradeSettings" to "httpupgradeSettings",
-                    "splitHTTPSettings" to "splithttpSettings"
-                )
-                val keys = value.keys()
-                while (keys.hasNext()) {
-                    val key = keys.next()
-                    if (key == "allowInsecure") continue
-
-                    val targetKey = aliases[key] ?: key
-                    if (aliases.containsKey(key) && value.has(targetKey)) continue
-
-                    val normalizedValue = normalizeRuntimeConfig(value.opt(key))
-                    if (targetKey == "network" && normalizedValue is String) {
-                        normalized.put(targetKey, normalizedValue.lowercase())
-                    } else {
-                        normalized.put(targetKey, normalizedValue)
-                    }
-                }
-                normalized
-            }
-            is JSONArray -> {
-                val normalized = JSONArray()
-                for (i in 0 until value.length()) {
-                    normalized.put(normalizeRuntimeConfig(value.opt(i)))
-                }
-                normalized
-            }
-            else -> value
-        }
-    }
-
-    private fun normalizeVlessOutbounds(configJson: JSONObject) {
-        val outbounds = configJson.optJSONArray("outbounds") ?: return
-        for (i in 0 until outbounds.length()) {
-            val outbound = outbounds.optJSONObject(i) ?: continue
-            if (outbound.optString("protocol") != "vless") continue
-
-            val settings = outbound.optJSONObject("settings") ?: continue
-            if (settings.has("vnext")) continue
-
-            val address = settings.optString("address")
-            val id = settings.optString("id")
-            val port = settings.optInt("port", 0)
-            if (address.isEmpty() || id.isEmpty() || port <= 0) continue
-
-            val user = JSONObject()
-            user.put("id", id)
-            user.put("encryption", settings.optString("encryption", "none"))
-            user.put("flow", settings.optString("flow", ""))
-            user.put("level", settings.optInt("level", 8))
-
-            val server = JSONObject()
-            server.put("address", address)
-            server.put("port", port)
-            server.put("users", JSONArray().put(user))
-
-            val normalizedSettings = JSONObject()
-            normalizedSettings.put("vnext", JSONArray().put(server))
-            outbound.put("settings", normalizedSettings)
-            Log.d(TAG, "Normalized flat VLESS outbound settings for $address:$port")
-        }
-    }
-
-    private fun sanitizeLogPaths(configJson: JSONObject, filesDir: File) {
-        val log = configJson.optJSONObject("log") ?: return
-
-        // The VPN client never needs destination/access logs. A server-provided
-        // config must not silently enable browsing metadata collection locally.
-        log.remove("access")
-        try { File(filesDir, "access.log").delete() } catch (_: Exception) {}
-
-        val errorPath = log.optString("error")
-        if (errorPath.isNotEmpty()) {
-            log.put("error", File(filesDir, "error.log").absolutePath)
-        }
-    }
-
-    internal fun buildRuntimeConfigJson(config: XrayConfig, filesDir: File): JSONObject {
-        val configJson = normalizeRuntimeConfig(
-            JSONObject(config.V2RAY_FULL_JSON_CONFIG)
-        ) as JSONObject
-        normalizeVlessOutbounds(configJson)
-        sanitizeLogPaths(configJson, filesDir)
-
-        // ReVolt needs only its authenticated local SOCKS ingress.
-        val inbounds = configJson.optJSONArray("inbounds") ?: JSONArray()
-        var secureSocksEnabled = false
-        for (i in 0 until inbounds.length()) {
-            val inbound = inbounds.optJSONObject(i) ?: continue
-            if (inbound.optString("tag") != "revolt-secure-socks") continue
-
-            val settings = inbound.optJSONObject("settings")
-                ?: throw IllegalStateException("Secure SOCKS5 settings are missing")
-            val users = settings.optJSONArray("users")
-                ?: throw IllegalStateException("Secure SOCKS5 users are missing")
-            val account = users.optJSONObject(0)
-                ?: throw IllegalStateException("Secure SOCKS5 account is missing")
-            val port = inbound.optInt("port", -1)
-
-            if (inbound.optString("protocol") != "socks" ||
-                inbound.optString("listen") != "127.0.0.1" ||
-                port <= 1024 || port > 65535 ||
-                settings.optString("auth") != "password" ||
-                account.optString("user").isEmpty() ||
-                account.optString("pass").isEmpty()
-            ) {
-                throw IllegalStateException("Secure SOCKS5 session is invalid")
-            }
-
-            config.LOCAL_SOCKS5_PORT = port
-            config.LOCAL_HTTP_PORT = 0
-            secureSocksEnabled = true
-            break
-        }
-
-        val usedPorts = mutableSetOf<Int>()
-        var hasSocksOnLocalPort = false
-        var hasHttpOnLocalPort = false
-        for (i in 0 until inbounds.length()) {
-            val inbound = inbounds.getJSONObject(i)
-            val protocol = inbound.optString("protocol")
-            val port = inbound.optInt("port", -1)
-            if (port > 0) usedPorts.add(port)
-            if (protocol == "socks" && port == config.LOCAL_SOCKS5_PORT) hasSocksOnLocalPort = true
-            if (protocol == "http" && port == config.LOCAL_HTTP_PORT) hasHttpOnLocalPort = true
-        }
-
-        if (!hasSocksOnLocalPort) {
-            if (usedPorts.contains(config.LOCAL_SOCKS5_PORT)) {
-                config.LOCAL_SOCKS5_PORT = nextFreePort(config.LOCAL_SOCKS5_PORT, usedPorts)
-            }
-            val socksInbound = JSONObject()
-            socksInbound.put("tag", uniqueInboundTag(inbounds, "socks"))
-            socksInbound.put("port", config.LOCAL_SOCKS5_PORT)
-            socksInbound.put("listen", "127.0.0.1")
-            socksInbound.put("protocol", "socks")
-            socksInbound.put("settings", JSONObject().put("auth", "noauth").put("udp", true))
-            socksInbound.put(
-                "sniffing",
-                JSONObject().put("enabled", true).put("destOverride", JSONArray().put("http").put("tls"))
-            )
-            inbounds.put(socksInbound)
-            usedPorts.add(config.LOCAL_SOCKS5_PORT)
-            Log.d(TAG, "Injected SOCKS inbound on port ${config.LOCAL_SOCKS5_PORT}")
-        }
-
-        if (!secureSocksEnabled && !hasHttpOnLocalPort) {
-            if (usedPorts.contains(config.LOCAL_HTTP_PORT)) {
-                config.LOCAL_HTTP_PORT = nextFreePort(config.LOCAL_HTTP_PORT, usedPorts)
-            }
-            val httpInbound = JSONObject()
-            httpInbound.put("tag", uniqueInboundTag(inbounds, "http"))
-            httpInbound.put("port", config.LOCAL_HTTP_PORT)
-            httpInbound.put("listen", "127.0.0.1")
-            httpInbound.put("protocol", "http")
-            inbounds.put(httpInbound)
-            usedPorts.add(config.LOCAL_HTTP_PORT)
-            Log.d(TAG, "Injected HTTP inbound on port ${config.LOCAL_HTTP_PORT}")
-        }
-
-        return configJson
-    }
-
-    internal fun buildDelayConfigJson(configJson: String, proxyPort: Int, filesDir: File): Pair<JSONObject, Int> {
-        val delayConfig = XrayConfig(
-            V2RAY_FULL_JSON_CONFIG = configJson,
-            LOCAL_SOCKS5_PORT = proxyPort,
-            LOCAL_HTTP_PORT = proxyPort + 1,
-            LOCAL_API_PORT = proxyPort + 2
-        )
-        val runtimeJson = buildRuntimeConfigJson(delayConfig, filesDir)
-        return Pair(runtimeJson, delayConfig.LOCAL_SOCKS5_PORT)
-    }
-
-    /**
-     * Starts the Xray Core process.
-     * 
-     * @param context The service context (needed for file access and notifications).
-     * @param config The configuration object containing the user's settings.
-     * @return true if started successfully, false otherwise.
-     */
-    fun startCore(context: Service, config: XrayConfig): Boolean {
-        AppConfigs.RUNTIME_READY = false
-        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
-        AppConfigs.V2RAY_CONFIG = config
-
-        // 1. Prepare the configuration file
-        val configFilesDir = context.filesDir
-        
-        try {
-            val configJson = buildRuntimeConfigJson(config, configFilesDir)
-            val configFile = File(context.filesDir, "config.json")
-            configFile.writeText(configJson.toString())
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to write config file", e)
-            deleteEphemeralConfigOnFailure(configFilesDir)
-            return false
-        }
-
-        // 2. Find Xray executable (libxray.so)
-        val nativeLibraryDir = context.applicationInfo.nativeLibraryDir
-        val xrayExecutable = File(nativeLibraryDir, "libxray.so")
-        if (!xrayExecutable.exists()) {
-            Log.e(TAG, "Xray executable not found at ${xrayExecutable.absolutePath}")
-            deleteEphemeralConfigOnFailure(configFilesDir)
-            return false
-        }
-
-        // 3. Prepare assets (geoip, geosite)
-        try {
-            Utilities.copyAssets(context)
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to prepare Xray assets", e)
-            deleteEphemeralConfigOnFailure(configFilesDir)
-            return false
-        }
-
-        // 4. Run Xray
-        try {
-            val cmd = listOf(
-                xrayExecutable.absolutePath,
-                "-config", File(configFilesDir, "config.json").absolutePath
-            )
-            val pb = ProcessBuilder(cmd)
-            pb.directory(configFilesDir)
-            pb.redirectErrorStream(true)
-            
-            // Set environment variables (XRAY_LOCATION_ASSET is crucial for finding geoip/geosite)
-            val env = pb.environment()
-            env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context)
-
-            xrayProcess = pb.start()
-            Thread.sleep(300)
-            if (xrayProcess?.isAlive != true) {
-                val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()
-                Log.e(TAG, "Xray process exited during startup. Output: $output")
-                xrayProcess = null
-                AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED
-                deleteEphemeralConfigOnFailure(configFilesDir)
-                return false
-            }
-            
-            // config.json contains per-session SOCKS credentials. Xray has
-            // consumed it after the startup liveness check, so remove it now.
-            try {
-                val ephemeralConfig = File(configFilesDir, "config.json")
-                if (ephemeralConfig.exists() && !ephemeralConfig.delete()) {
-                    Log.w(TAG, "Could not delete ephemeral Xray config")
-                }
-            } catch (e: Exception) {
-                Log.w(TAG, "Could not delete ephemeral Xray config", e)
-            }
-
-            AppConfigs.RUNTIME_READY = false
-            AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
-            startTimer(context)
-            showNotification(context, config)
-            sendStatusBroadcast(context, config)
-            
-            val process = xrayProcess ?: return false
-            // Monitor process in a separate thread to detect crash
-            Thread {
-                try {
-                    val startedAt = System.currentTimeMillis()
-                    val startupLog = ArrayDeque<String>()
-                    process.inputStream.bufferedReader().use { reader ->
-                        reader.forEachLine { line ->
-                            if (System.currentTimeMillis() - startedAt <= STARTUP_LOG_WINDOW_MS) {
-                                if (startupLog.size >= STARTUP_LOG_MAX_LINES) startupLog.removeFirst()
-                                startupLog.addLast(line)
-                            } else if (startupLog.isNotEmpty()) {
-                                startupLog.clear()
-                            }
-                        }
-                    }
-
-                    val exitCode = process.waitFor()
-                    if (exitCode != 0 && startupLog.isNotEmpty()) {
-                        Log.e(
-                            TAG,
-                            "Xray process exited with code $exitCode; startup output:\n" +
-                                startupLog.joinToString("\n")
-                        )
-                    } else {
-                        Log.e(TAG, "Xray process exited with code $exitCode")
-                    }
-                    if (xrayProcess === process &&
-                        AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN == config.RUNTIME_TOKEN &&
-                        (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
-                         AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING)
-                    ) {
-                        // Hold the Android TUN while the core is recovered. Killing
-                        // the VPN service here would allow direct-network fallback.
-                        xrayProcess = null
-                        AppConfigs.RUNTIME_READY = false
-                        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
-                        sendStatusBroadcast(context, config)
-                        if (context is XrayVPNService) {
-                            context.handleXrayCoreExit(config)
-                        } else {
-                            stopCore(context)
-                        }
-                    }
-                } catch (e: java.io.InterruptedIOException) {
-                    // Expected when stopping
-                } catch (e: InterruptedException) {
-                    // Expected when stopping
-                } catch (e: Exception) {
-                    Log.e(TAG, "Error reading xray output", e)
-                }
-            }.start()
-
-            return true
-
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to start Xray process", e)
-            // The process may already be running: pb.start() succeeds before
-            // anything below it can throw. Leaving it alive leaked one live
-            // core per recovery attempt. Clear the field BEFORE destroying so
-            // the monitor thread's `xrayProcess === process` guard fails and
-            // recovery is not re-entered for a core we are killing here.
-            val orphan = xrayProcess
-            xrayProcess = null
-            try {
-                orphan?.destroy()
-            } catch (destroyError: Exception) {
-                Log.w(TAG, "Failed to destroy partially started Xray process", destroyError)
-            }
-            deleteEphemeralConfigOnFailure(configFilesDir)
-            return false
-        }
-    }
-
-    /**
-     * Stops the Xray Core process and cleans up notifications.
-     */
-    fun stopCore(context: Service, confirmationToken: String? = AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN) {
-        try {
-            xrayProcess?.destroy()
-            xrayProcess = null
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to destroy Xray process", e)
-        }
-
-        AppConfigs.RUNTIME_READY = false
-        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED
-        stopTimer()
-        val notificationManager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
-        notificationManager.cancel(NOTIFICATION_ID)
-        sendDisconnectedBroadcast(context, confirmationToken.orEmpty())
-        AppConfigs.V2RAY_CONFIG = null
-    }
-
-    fun markRuntimeConnecting(context: Context, config: XrayConfig) {
-        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return
-        AppConfigs.RUNTIME_READY = false
-        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
-        sendStatusBroadcast(context, config)
-    }
-
-    fun markRuntimeReady(context: Service, config: XrayConfig) {
-        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return
-        AppConfigs.RUNTIME_READY = true
-        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED
-        showNotification(context, config)
-        sendStatusBroadcast(context, config)
-    }
-
-    fun isXrayRunning(): Boolean {
-        // Check state instead of process because VPN runs in separate service process
-        return AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
-               AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
-    }
-
-    // CountDownTimer builds a Handler, so it only constructs on a looper thread.
-    // Core recovery runs on a bare Thread (XrayVPNService.handleXrayCoreExit),
-    // where this threw "Can't create handler inside thread ... that has not
-    // called Looper.prepare()" and took the whole restart down with it.
-    private val mainHandler = Handler(Looper.getMainLooper())
-
-    private fun runOnMain(block: () -> Unit) {
-        if (Looper.myLooper() == Looper.getMainLooper()) block() else mainHandler.post(block)
-    }
-
-    private fun startTimer(context: Context) {
-        // Captured now: a stop that lands while the post is queued must not
-        // leave a timer ticking for a generation that is already gone.
-        val token = AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN
-        runOnMain { startTimerOnMain(context, token) }
-    }
-
-    private fun startTimerOnMain(context: Context, token: String?) {
-        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != token) return
-        countDownTimer?.cancel()
-        seconds = 0
-        countDownTimer = object : CountDownTimer(Long.MAX_VALUE, 1000) {
-            override fun onTick(millisUntilFinished: Long) {
-                seconds++
-                val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
-                intent.putExtra("STATE", AppConfigs.V2RAY_STATE)
-                intent.putExtra("RUNTIME_TOKEN", AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN.orEmpty())
-                intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY)
-                intent.putExtra("DURATION", seconds.toString())
-                
-                intent.putExtra("UPLOAD_SPEED", 0L)
-                intent.putExtra("DOWNLOAD_SPEED", 0L)
-                intent.putExtra("UPLOAD_TRAFFIC", 0L)
-                intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
-                
-                context.sendBroadcast(intent)
-            }
-
-            override fun onFinish() {}
-        }.start()
-    }
-
-    private fun stopTimer() {
-        runOnMain {
-            countDownTimer?.cancel()
-            countDownTimer = null
-            seconds = 0
-        }
-    }
-
-    fun sendStatusBroadcast(context: Context, config: XrayConfig) {
-        val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
-        intent.putExtra("STATE", AppConfigs.V2RAY_STATE)
-        intent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN)
-        intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY)
-        intent.putExtra("DURATION", seconds.toString())
-        intent.putExtra("UPLOAD_SPEED", 0L)
-        intent.putExtra("DOWNLOAD_SPEED", 0L)
-        intent.putExtra("UPLOAD_TRAFFIC", 0L)
-        intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
-        context.sendBroadcast(intent)
-    }
-
-    private fun sendDisconnectedBroadcast(context: Context, runtimeToken: String) {
-        val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
-        intent.putExtra("STATE", AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED)
-        intent.putExtra("RUNTIME_TOKEN", runtimeToken)
-        intent.putExtra("RUNTIME_READY", false)
-        intent.putExtra("DURATION", "0")
-        intent.putExtra("UPLOAD_SPEED", 0L)
-        intent.putExtra("DOWNLOAD_SPEED", 0L)
-        intent.putExtra("UPLOAD_TRAFFIC", 0L)
-        intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
-        context.sendBroadcast(intent)
-    }
-
-    private fun showNotification(context: Service, config: XrayConfig) {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-            if (ActivityCompat.checkSelfPermission(context, android.Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
-                return
-            }
-        }
-
-        val channelId = createNotificationChannel(context, config.APPLICATION_NAME)
-        
-        val launchIntent = context.packageManager.getLaunchIntentForPackage(context.packageName)
-        launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_NEW_TASK
-        
-        val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT else PendingIntent.FLAG_UPDATE_CURRENT
-        val contentPendingIntent = PendingIntent.getActivity(context, 0, launchIntent, flags)
-
-        val stopIntent = Intent(context, XrayVPNService::class.java)
-        stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
-        stopIntent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN)
-        val stopPendingIntent = PendingIntent.getService(context, 0, stopIntent, flags)
-        val smallIcon = if (config.APPLICATION_ICON != 0) config.APPLICATION_ICON else android.R.drawable.ic_dialog_info
-
-        val builder = NotificationCompat.Builder(context, channelId)
-            .setSmallIcon(smallIcon)
-            .setContentTitle(config.REMARK)
-            .setContentText(if (AppConfigs.RUNTIME_READY) "Connected" else "Connecting")
-            .addAction(0, config.NOTIFICATION_DISCONNECT_BUTTON_NAME, stopPendingIntent)
-            .setContentIntent(contentPendingIntent)
-            .setPriority(NotificationCompat.PRIORITY_MIN)
-            .setOngoing(true)
-            .setShowWhen(true)
-
-        context.startForeground(NOTIFICATION_ID, builder.build())
-    }
-
-    fun getConnectedV2rayServerDelay(context: Context, url: String): Long {
-        // Use the configured SOCKS port (default 10807)
-        val port = AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807
-        Log.d(TAG, "getConnectedV2rayServerDelay: Testing delay to $url via SOCKS port $port")
-        
-        return try {
-            val start = System.currentTimeMillis()
-            val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", port))
-            val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection
-            connection.connectTimeout = 5000
-            connection.readTimeout = 5000
-            connection.requestMethod = "HEAD"
-            val responseCode = connection.responseCode
-            val end = System.currentTimeMillis()
-            val delay = end - start
-            connection.disconnect()
-            Log.d(TAG, "getConnectedV2rayServerDelay: Success! Response code: $responseCode, Delay: ${delay}ms")
-            delay
-        } catch (e: Exception) {
-            Log.e(TAG, "getConnectedV2rayServerDelay: Failed to measure delay (VPN may not be running)", e)
-            -1L
-        }
-    }
-
-    /**
-     * Measure delay for a server configuration (when not connected).
-     * Temporarily starts Xray with the provided config, measures delay, then stops it.
-     */
-    fun getServerDelay(context: Context, configJson: String, url: String): Long {
-        Log.d(TAG, "getServerDelay: Starting temporary Xray instance")
-        
-        var tempProcess: Process? = null
-        try {
-            // Find a random free port to avoid conflict with running VPN
-            val freePort = try {
-                val socket = java.net.ServerSocket(0)
-                val port = socket.localPort
-                socket.close()
-                port
-            } catch (e: Exception) {
-                10806 // Fallback
-            }
-            
-            val (json, socksPort) = buildDelayConfigJson(configJson, freePort, context.filesDir)
-            Log.d(TAG, "getServerDelay: Using SOCKS port $socksPort")
-            
-            // Write temp config file
-            val tempConfigFile = File(context.filesDir, "temp_delay_config.json")
-            tempConfigFile.writeText(json.toString())
-            
-            // Copy assets
-            Utilities.copyAssets(context)
-            
-            // Start Xray process
-            val xrayExecutable = File(context.applicationInfo.nativeLibraryDir, "libxray.so")
-            if (!xrayExecutable.exists()) {
-                Log.e(TAG, "getServerDelay: Xray executable not found")
-                return -1L
-            }
-            
-            val cmd = listOf(
-                xrayExecutable.absolutePath,
-                "-config", tempConfigFile.absolutePath
-            )
-            
-            val pb = ProcessBuilder(cmd)
-            pb.directory(context.filesDir)
-            val env = pb.environment()
-            env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context)
-            
-            tempProcess = pb.start()
-            
-            // Wait a bit for Xray to start
-            Thread.sleep(1000)
-            
-            // Measure delay
-            val delay = try {
-                val start = System.currentTimeMillis()
-                val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", socksPort))
-                val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection
-                connection.connectTimeout = 5000
-                connection.readTimeout = 5000
-                connection.requestMethod = "HEAD"
-                val responseCode = connection.responseCode
-                val end = System.currentTimeMillis()
-                connection.disconnect()
-                val result = end - start
-                Log.d(TAG, "getServerDelay: Success! Response code: $responseCode, Delay: ${result}ms")
-                result
-            } catch (e: Exception) {
-                Log.e(TAG, "getServerDelay: Failed to measure delay", e)
-                -1L
-            }
-            
-            // Stop temp process
-            tempProcess?.destroy()
-            tempConfigFile.delete()
-            
-            return delay
-            
-        } catch (e: Exception) {
-            Log.e(TAG, "getServerDelay: Error starting temp Xray", e)
-            tempProcess?.destroy()
-            return -1L
-        }
-    }
-
-    private fun createNotificationChannel(context: Context, appName: String): String {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            val channelId = "REVOLT_VPN_SERVICE"
-            val channelName = "$appName Background Service"
-            val channel = NotificationChannel(channelId, channelName, NotificationManager.IMPORTANCE_LOW)
-            channel.lightColor = Color.BLUE
-            channel.lockscreenVisibility = Notification.VISIBILITY_PRIVATE
-            val manager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
-            manager.createNotificationChannel(channel)
-            return channelId
-        }
-        return ""
-    }
-}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/dto/XrayConfig.kt

@@ -1,71 +0,0 @@
-package com.github.tfox.flutter_vless.xray.dto
-
-import java.io.Serializable
-import java.util.ArrayList
-
-/**
- * Data class representing the Xray configuration and app settings.
- * 
- * This class is passed from Flutter to Android and contains:
- * 1. The full Xray JSON configuration (V2RAY_FULL_JSON_CONFIG).
- * 2. App-specific settings like blocked apps, notification text, etc.
- * 3. Connection parameters (server address, ports).
- */
-data class XrayConfig(
-    /** The IP address of the connected server (used to exclude it from VPN routing). */
-    var CONNECTED_V2RAY_SERVER_ADDRESS: String = "",
-    
-    /** The port of the connected server. */
-    var CONNECTED_V2RAY_SERVER_PORT: String = "",
-    
-    /** Local port for SOCKS5 proxy (default: 10807). used by tun2socks. */
-    var LOCAL_SOCKS5_PORT: Int = 10807,
-    
-    /** Local port for HTTP proxy (default: 10808). */
-    var LOCAL_HTTP_PORT: Int = 10808,
-    
-    /** Local port for Xray API (stats, etc.) (default: 10809). */
-    var LOCAL_API_PORT: Int = 10809,
-    
-    /** Timeout for connections in milliseconds. */
-    var ALLOWED_TIMEOUT_MS: Int = 0,
-    
-    /** List of subnets to bypass (not routed through VPN). */
-    var BYPASS_SUBNETS: ArrayList<String> = ArrayList(),
-    
-    /** List of app package names to exclude from VPN. */
-    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
-    
-    /** The raw Xray configuration JSON string. */
-    var V2RAY_FULL_JSON_CONFIG: String = "",
-    
-    /** Whether to enable traffic statistics collection. */
-    var ENABLE_TRAFFIC_STATICS: Boolean = false,
-    
-    /** Remark/Name of the server configuration. */
-    var REMARK: String = "",
-    
-    /** Name of the application (displayed in notification). */
-    var APPLICATION_NAME: String = "Flutter Vless",
-    
-    /** Resource ID of the notification icon. */
-    var APPLICATION_ICON: Int = 0,
-    
-    /** Resource name of the notification icon (e.g. "ic_notification"). */
-    var NOTIFICATION_ICON_RESOURCE_NAME: String = "",
-    
-    /** Resource type of the notification icon (e.g. "drawable"). */
-    var NOTIFICATION_ICON_RESOURCE_TYPE: String = "",
-    
-    /** Text for the disconnect button in the notification. */
-    var NOTIFICATION_DISCONNECT_BUTTON_NAME: String = "Disconnect",
-    
-    /** Domain resolution strategy (e.g. "IPIfNonMatch"). */
-    var DOMAIN_STRATEGY: String = "",
-    
-    /** Routing domain strategy. */
-    var ROUTING_DOMAIN_STRATEGY: String = "",
-
-    /** Unique generation token used to reject stale native runtime events. */
-    var RUNTIME_TOKEN: String = ""
-) : Serializable

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/service/XrayVPNService.kt

@@ -1,827 +0,0 @@
-package com.github.tfox.flutter_vless.xray.service
-
-import android.app.AlarmManager
-import android.app.PendingIntent
-import android.content.Context
-import android.content.Intent
-import android.net.LocalSocket
-import android.net.LocalSocketAddress
-import android.net.VpnService
-import android.os.Build
-import android.os.Handler
-import android.os.Looper
-import android.os.ParcelFileDescriptor
-import android.os.SystemClock
-import android.util.Log
-import com.github.tfox.flutter_vless.xray.core.XrayCoreManager
-import com.github.tfox.flutter_vless.xray.dto.XrayConfig
-import com.github.tfox.flutter_vless.xray.utils.AppConfigs
-import com.github.tfox.flutter_vless.xray.utils.RevoltAlerts
-import org.json.JSONObject
-import java.io.File
-
-/**
- * Android VPN Service implementation.
- *
- * This service owns the TUN interface and keeps runtime state generation-scoped.
- * Session deadlines are enforced both by an in-process monotonic timer and by
- * AlarmManager, while only the non-secret token/deadline pair is persisted.
- * Per-session VLESS/SOCKS credentials remain memory-only.
- */
-class XrayVPNService : VpnService() {
-
-    private var mInterface: ParcelFileDescriptor? = null
-    private var tun2socksProcess: Process? = null
-    @Volatile private var isRunning = false
-    @Volatile private var recoveringXray = false
-    @Volatile private var recoveringTun2socks = false
-    private var tun2socksRecoveryAttempt = 0
-    private var currentConfig: XrayConfig? = null
-    private var currentProxyOnly = false
-    private var shuttingDownIntentionally = false
-
-    private val deadlineHandler = Handler(Looper.getMainLooper())
-    private var sessionDeadlineElapsed: Long? = null
-    private var sessionDeadlineToken: String? = null
-    private val sessionDeadlineRunnable = Runnable { enforceSessionDeadline() }
-
-    // The warning's own backstop, mirroring the deadline's. The alarm alone is
-    // not enough: it is inexact on purpose (no SCHEDULE_EXACT_ALARM), and with
-    // the app closed on a dozing device it was measured never arriving at all,
-    // while the deadline's Handler fired within a second of its target.
-    private val sessionWarningRunnable = Runnable {
-        handleSessionWarningAlarm(sessionDeadlineToken.orEmpty())
-    }
-
-    override fun onCreate() {
-        super.onCreate()
-    }
-
-    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        if (intent == null) {
-            if (isRunning && currentConfig != null) return START_REDELIVER_INTENT
-
-            // Session credentials intentionally stay memory-only. If Android
-            // cannot redeliver the original START intent, fail closed instead
-            // of rebuilding a tunnel from sensitive material stored on disk.
-            clearPersistedDeadline()
-            cancelSessionExpiryAlarm()
-            stopSelf()
-            return START_NOT_STICKY
-        }
-
-        if (intent.getBooleanExtra(EXTRA_SESSION_EXPIRED, false)) {
-            enforcePersistedDeadline(intent.getStringExtra("RUNTIME_TOKEN").orEmpty())
-            return START_NOT_STICKY
-        }
-
-        // Must stay above the command dispatch: an intent with no COMMAND
-        // falls through to the final else and stops the tunnel.
-        if (intent.getBooleanExtra(EXTRA_SESSION_WARNING, false)) {
-            handleSessionWarningAlarm(intent.getStringExtra("RUNTIME_TOKEN").orEmpty())
-            return START_NOT_STICKY
-        }
-
-        val command = if (Build.VERSION.SDK_INT >= 33) {
-            intent.getSerializableExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS::class.java)
-        } else {
-            @Suppress("DEPRECATION")
-            intent.getSerializableExtra("COMMAND") as? AppConfigs.V2RAY_SERVICE_COMMANDS
-        }
-
-        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) {
-            val requestedToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
-            val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
-            if (requestedToken.isEmpty() ||
-                (activeToken.isNotEmpty() && requestedToken != activeToken)
-            ) {
-                Log.w(TAG, "Ignoring STOP_SERVICE without matching runtime generation")
-                return START_NOT_STICKY
-            }
-            stopAll(requestedToken, userRequested = true)
-            return START_NOT_STICKY
-        }
-
-        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE) {
-            updateSessionDeadline(intent)
-            return if (isRunning) START_REDELIVER_INTENT else START_NOT_STICKY
-        }
-
-        createNotificationChannel()
-        val notification = createNotification("VPN Service Running")
-        try {
-            if (Build.VERSION.SDK_INT >= 34) {
-                startForeground(1, notification, FOREGROUND_SERVICE_TYPE_SPECIAL_USE)
-            } else {
-                startForeground(1, notification)
-            }
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to start foreground", e)
-            clearPersistedDeadline()
-            cancelSessionExpiryAlarm()
-            stopSelf()
-            return START_NOT_STICKY
-        }
-
-        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE) {
-            val config = if (Build.VERSION.SDK_INT >= 33) {
-                intent.getSerializableExtra("V2RAY_CONFIG", XrayConfig::class.java)
-            } else {
-                @Suppress("DEPRECATION")
-                intent.getSerializableExtra("V2RAY_CONFIG") as? XrayConfig
-            }
-
-            if (config != null) {
-                if (XrayCoreManager.isXrayRunning()) {
-                    Log.w(TAG, "Stopping stale Xray core before restart")
-                    XrayCoreManager.stopCore(this)
-                }
-                cleanup(clearDeadline = true)
-                RevoltAlerts.cancelAll(this)
-                shuttingDownIntentionally = false
-                currentConfig = config
-
-                val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false)
-                currentProxyOnly = proxyOnly
-                armSessionDeadline(config, BOOTSTRAP_SESSION_SECONDS)
-                if (shuttingDownIntentionally) return START_NOT_STICKY
-
-                if (XrayCoreManager.startCore(this, config)) {
-                    if (!proxyOnly) {
-                        setupVpn(config)
-                    } else {
-                        isRunning = true
-                        Log.d(TAG, "Starting in PROXY_ONLY mode")
-                        XrayCoreManager.markRuntimeReady(this, config)
-                    }
-                } else {
-                    stopAll(config.RUNTIME_TOKEN)
-                    return START_NOT_STICKY
-                }
-            } else {
-                Log.e(TAG, "START_SERVICE missing V2RAY_CONFIG")
-                stopAll()
-                return START_NOT_STICKY
-            }
-        } else {
-            stopAll()
-            return START_NOT_STICKY
-        }
-
-        return START_REDELIVER_INTENT
-    }
-
-    private fun setupVpn(config: XrayConfig) {
-        try {
-            if (mInterface != null) {
-                mInterface?.close()
-                mInterface = null
-            }
-
-            val builder = Builder()
-            builder.setSession(config.REMARK)
-            builder.setMtu(1500)
-            builder.addAddress("26.26.26.1", 30)
-            builder.addAddress("fd00:26:26::1", 126)
-
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-                builder.setMetered(false)
-            }
-
-            if (config.BLOCKED_APPS.isNotEmpty()) {
-                throw IllegalStateException("Per-app VPN bypass is disabled in ReVolt")
-            }
-            try {
-                builder.addDisallowedApplication(packageName)
-            } catch (e: Exception) {
-                throw IllegalStateException("Failed to exclude ReVolt from its own VPN", e)
-            }
-
-            builder.addRoute("0.0.0.0", 0)
-            builder.addRoute("::", 0)
-
-            try {
-                builder.addDnsServer("8.8.8.8")
-                builder.addDnsServer("1.1.1.1")
-            } catch (e: Exception) {
-                throw IllegalStateException("Failed to configure VPN DNS", e)
-            }
-
-            mInterface = builder.establish()
-                ?: throw IllegalStateException("Android refused to establish VPN interface")
-            isRunning = true
-            runTun2socks(config)
-
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to setup VPN", e)
-            stopAll()
-        }
-    }
-
-    private data class SecureSocksCredentials(
-        val port: Int,
-        val username: String,
-        val password: String,
-    )
-
-    private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? {
-        val inbounds = try {
-            JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds")
-        } catch (_: Exception) {
-            null
-        } ?: return null
-
-        for (i in 0 until inbounds.length()) {
-            val inbound = inbounds.optJSONObject(i) ?: continue
-            if (inbound.optString("tag") != "revolt-secure-socks") continue
-            if (inbound.optString("protocol") != "socks" ||
-                inbound.optString("listen") != "127.0.0.1"
-            ) return null
-
-            val settings = inbound.optJSONObject("settings") ?: return null
-            if (settings.optString("auth") != "password") return null
-            val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null
-            val port = inbound.optInt("port", -1)
-            val username = user.optString("user")
-            val password = user.optString("pass")
-            if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) {
-                return null
-            }
-            return SecureSocksCredentials(port, username, password)
-        }
-        return null
-    }
-
-    private fun scheduleTun2socksRecovery(config: XrayConfig, reason: String) {
-        if (!isRunning || currentConfig !== config || recoveringTun2socks) return
-        XrayCoreManager.markRuntimeConnecting(this, config)
-        recoveringTun2socks = true
-        val attempt = ++tun2socksRecoveryAttempt
-        val shift = (attempt - 1).coerceIn(0, 6)
-        val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L)
-        Log.w(TAG, "Scheduling tun2socks recovery attempt $attempt in ${delayMs}ms: $reason")
-
-        Thread {
-            try {
-                Thread.sleep(delayMs)
-            } catch (_: InterruptedException) {
-                recoveringTun2socks = false
-                return@Thread
-            }
-
-            recoveringTun2socks = false
-            if (isRunning && currentConfig === config) {
-                runTun2socks(config)
-            }
-        }.start()
-    }
-
-    private fun runTun2socks(config: XrayConfig) {
-        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
-        val socketFile = File(filesDir, "sock_path")
-        if (socketFile.exists() && !socketFile.delete()) {
-            Log.w(TAG, "Could not delete stale tun2socks socket")
-        }
-        val sockPath = socketFile.absolutePath
-
-        val secure = secureSocksCredentials(config)
-            ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing")
-        config.LOCAL_SOCKS5_PORT = secure.port
-
-        val cmd = arrayListOf(
-            tun2socksPath,
-            "-sock-path", sockPath,
-            "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}",
-            "-mtu", "1500",
-            "-loglevel", "debug"
-        )
-
-        Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")
-
-        try {
-            val pb = ProcessBuilder(cmd)
-            pb.redirectErrorStream(true)
-            pb.directory(filesDir)
-            val process = pb.start()
-            tun2socksProcess = process
-
-            Thread {
-                try {
-                    process.inputStream.bufferedReader().use { reader ->
-                        reader.forEachLine { _ -> }
-                    }
-
-                    process.waitFor()
-                    if (isRunning && tun2socksProcess === process && currentConfig === config) {
-                        Log.e(TAG, "tun2socks exited unexpectedly; keeping TUN fail-closed")
-                        tun2socksProcess = null
-                        scheduleTun2socksRecovery(config, "process exited")
-                    }
-                } catch (_: java.io.InterruptedIOException) {
-                    // Expected when stopping
-                } catch (_: InterruptedException) {
-                    // Expected when stopping
-                } catch (e: Exception) {
-                    Log.e(TAG, "Error reading tun2socks output", e)
-                }
-            }.start()
-
-            sendFd(process, config)
-
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to start tun2socks; keeping TUN fail-closed", e)
-            scheduleTun2socksRecovery(config, "start failure")
-        }
-    }
-
-    private fun sendFd(process: Process, config: XrayConfig) {
-        val fd = mInterface?.fileDescriptor ?: return
-        val sockFile = File(filesDir, "sock_path").absolutePath
-
-        Thread {
-            var tries = 0
-            while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) {
-                var localSocket: LocalSocket? = null
-                try {
-                    Thread.sleep(500)
-                    localSocket = LocalSocket()
-                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
-                    val out = localSocket.outputStream
-                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
-                    out.write(32)
-                    out.flush()
-                    localSocket.setFileDescriptorsForSend(null)
-                    localSocket.shutdownOutput()
-                    localSocket.close()
-                    if (isRunning && currentConfig === config && tun2socksProcess === process) {
-                        tun2socksRecoveryAttempt = 0
-                        XrayCoreManager.markRuntimeReady(this, config)
-                    }
-                    return@Thread
-                } catch (_: Exception) {
-                    tries++
-                    try {
-                        localSocket?.close()
-                    } catch (closeError: Exception) {
-                        Log.w(TAG, "Failed to close tun2socks handoff socket", closeError)
-                    }
-                }
-            }
-
-            if (isRunning && tun2socksProcess === process) {
-                Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN")
-                try {
-                    process.destroy()
-                } catch (e: Exception) {
-                    Log.w(TAG, "Failed to recycle tun2socks after FD handoff failure", e)
-                }
-            }
-        }.start()
-    }
-
-    fun handleXrayCoreExit(config: XrayConfig) {
-        if (!isRunning || currentConfig !== config || recoveringXray) return
-        XrayCoreManager.markRuntimeConnecting(this, config)
-        recoveringXray = true
-
-        Thread {
-            var attempt = 0
-            try {
-                while (isRunning && currentConfig === config) {
-                    attempt++
-                    val shift = (attempt - 1).coerceIn(0, 6)
-                    val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L)
-                    Log.w(TAG, "Recovering Xray core attempt $attempt in ${delayMs}ms")
-                    Thread.sleep(delayMs)
-                    if (!isRunning || currentConfig !== config) break
-
-                    if (XrayCoreManager.startCore(this, config)) {
-                        Log.w(TAG, "Xray core recovered without dropping TUN")
-                        if (currentProxyOnly || (mInterface != null && tun2socksProcess?.isAlive == true)) {
-                            XrayCoreManager.markRuntimeReady(this, config)
-                        }
-                        return@Thread
-                    }
-                }
-            } catch (_: InterruptedException) {
-                // Expected when stopping
-            } finally {
-                recoveringXray = false
-            }
-        }.start()
-    }
-
-    private fun cleanup(clearDeadline: Boolean = true) {
-        isRunning = false
-        if (clearDeadline) {
-            clearSessionDeadline()
-        } else {
-            deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
-            sessionDeadlineElapsed = null
-            sessionDeadlineToken = null
-        }
-        recoveringXray = false
-        recoveringTun2socks = false
-        tun2socksRecoveryAttempt = 0
-        currentProxyOnly = false
-        AppConfigs.RUNTIME_READY = false
-        tun2socksProcess?.destroy()
-        tun2socksProcess = null
-        try {
-            mInterface?.close()
-            mInterface = null
-        } catch (e: Exception) {
-            Log.w(TAG, "Failed to close VPN interface during cleanup", e)
-        }
-    }
-
-    // Anything that stops a live tunnel unasked must say so. isRunning is read
-    // before cleanup() clears it, which keeps a failed connect silent.
-    private fun stopAll(
-        confirmationToken: String = currentConfig?.RUNTIME_TOKEN.orEmpty(),
-        userRequested: Boolean = false,
-    ) {
-        if (shuttingDownIntentionally) return
-        val alertUser = isRunning && !userRequested
-        shuttingDownIntentionally = true
-        cleanup(clearDeadline = true)
-        currentConfig = null
-        XrayCoreManager.stopCore(this, confirmationToken)
-        stopForeground(true)
-        stopSelf()
-        if (alertUser) RevoltAlerts.postDisconnected(this)
-    }
-
-    private fun armSessionDeadline(config: XrayConfig, remainingSeconds: Long) {
-        val boundedSeconds = remainingSeconds
-            .coerceAtLeast(0L)
-            .coerceAtMost(Long.MAX_VALUE / 1000L)
-        val delayMs = boundedSeconds * 1000L
-        val nowEpochMs = System.currentTimeMillis()
-        val epochDeadline = if (Long.MAX_VALUE - nowEpochMs < delayMs) {
-            Long.MAX_VALUE
-        } else {
-            nowEpochMs + delayMs
-        }
-
-        sessionDeadlineToken = config.RUNTIME_TOKEN
-        sessionDeadlineElapsed = SystemClock.elapsedRealtime() + delayMs
-
-        if (!persistDeadline(config.RUNTIME_TOKEN, epochDeadline) ||
-            !scheduleSessionExpiryAlarm(config.RUNTIME_TOKEN, epochDeadline)
-        ) {
-            Log.e(TAG, "Could not arm OS-level session expiry; stopping fail-closed")
-            stopAll(config.RUNTIME_TOKEN)
-            return
-        }
-
-        armExpiryWarning(config.RUNTIME_TOKEN, epochDeadline)
-
-        deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
-        if (delayMs == 0L) deadlineHandler.post(sessionDeadlineRunnable)
-        else deadlineHandler.postDelayed(sessionDeadlineRunnable, delayMs)
-    }
-
-    // Advisory, unlike the deadline itself: nothing here fails closed. Dart
-    // re-pushes the deadline every sync, so this runs about once a minute.
-    private fun armExpiryWarning(runtimeToken: String, expiresAtEpochMs: Long) {
-        if (runtimeToken.isEmpty()) return
-
-        val warnAt = expiresAtEpochMs - RevoltAlerts.WARNING_LEAD_MS
-        // Inside the window already (or the short bootstrap deadline). Cancel
-        // nothing here: with no dedupe on the re-push, cancelling on this
-        // branch deletes the armed warning and never re-arms it.
-        if (warnAt <= System.currentTimeMillis() + WARNING_REARM_GRACE_MS) return
-
-        cancelSessionWarningAlarm()
-        // A warning on screen now belongs to an older deadline (top-up).
-        RevoltAlerts.cancelExpiryWarning(this)
-
-        try {
-            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
-            val pendingIntent = sessionWarningPendingIntent(runtimeToken)
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-                // Inexact on purpose - keeps this off SCHEDULE_EXACT_ALARM.
-                alarmManager.setAndAllowWhileIdle(
-                    AlarmManager.RTC_WAKEUP,
-                    warnAt,
-                    pendingIntent,
-                )
-            } else {
-                alarmManager.set(AlarmManager.RTC_WAKEUP, warnAt, pendingIntent)
-            }
-        } catch (e: Exception) {
-            Log.w(TAG, "Failed to schedule session-expiry warning", e)
-        }
-
-        // postDelayed runs on uptimeMillis, so a truly suspended device still
-        // fires this late - handleSessionWarningAlarm then rejects it on the
-        // window check rather than claiming "5 minutes" with seconds left.
-        // Whenever the process is merely backgrounded, which is the common
-        // case, this is what actually delivers the warning.
-        val warnDelay = warnAt - System.currentTimeMillis()
-        deadlineHandler.removeCallbacks(sessionWarningRunnable)
-        if (warnDelay > 0L) {
-            deadlineHandler.postDelayed(sessionWarningRunnable, warnDelay)
-        }
-    }
-
-    private fun handleSessionWarningAlarm(alarmToken: String) {
-        val config = currentConfig
-        if (config == null) {
-            // Woke a process with no live runtime; nothing to warn about.
-            stopSelf()
-            return
-        }
-        if (alarmToken.isEmpty() || alarmToken != config.RUNTIME_TOKEN) {
-            Log.w(TAG, "Ignoring session warning for stale runtime generation")
-            return
-        }
-
-        val deadline = sessionDeadlineElapsed ?: return
-        val remaining = deadline - SystemClock.elapsedRealtime()
-        if (remaining < WARNING_FLOOR_MS ||
-            remaining > RevoltAlerts.WARNING_LEAD_MS + WARNING_SLACK_MS
-        ) {
-            // Too late, or the deadline moved. Saying "5 minutes" with
-            // seconds left is worse than silence.
-            Log.w(TAG, "Ignoring session warning outside the warning window")
-            return
-        }
-
-        RevoltAlerts.postExpiryWarning(this)
-    }
-
-    private fun clearSessionDeadline() {
-        deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
-        sessionDeadlineElapsed = null
-        sessionDeadlineToken = null
-        clearPersistedDeadline()
-        cancelSessionExpiryAlarm()
-        cancelSessionWarningAlarm()
-        RevoltAlerts.cancelExpiryWarning(this)
-    }
-
-    private fun enforceSessionDeadline() {
-        val token = sessionDeadlineToken ?: return
-        val deadline = sessionDeadlineElapsed ?: return
-        val config = currentConfig ?: return
-        if (config.RUNTIME_TOKEN != token) return
-        val remaining = deadline - SystemClock.elapsedRealtime()
-        if (remaining > 0L) {
-            deadlineHandler.postDelayed(sessionDeadlineRunnable, remaining)
-            return
-        }
-        Log.w(TAG, "Native session deadline expired; stopping runtime fail-closed")
-        stopAll(token)
-    }
-
-    private fun updateSessionDeadline(intent: Intent) {
-        val config = currentConfig ?: return
-        val token = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
-        if (token.isEmpty() || token != config.RUNTIME_TOKEN) {
-            Log.w(TAG, "Ignoring session deadline update for stale runtime generation")
-            return
-        }
-        val remainingSeconds = intent.getLongExtra("REMAINING_SECONDS", -1L)
-        if (remainingSeconds < 0L) {
-            Log.w(TAG, "Ignoring invalid negative session deadline")
-            return
-        }
-        armSessionDeadline(config, remainingSeconds)
-    }
-
-    private fun persistDeadline(runtimeToken: String, expiresAtEpochMs: Long): Boolean {
-        return try {
-            getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
-                .edit()
-                .putString(PREF_RUNTIME_TOKEN, runtimeToken)
-                .putLong(PREF_EXPIRES_AT_MS, expiresAtEpochMs)
-                .commit()
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to persist non-secret session deadline", e)
-            false
-        }
-    }
-
-    private fun clearPersistedDeadline() {
-        try {
-            getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
-                .edit()
-                .remove(PREF_RUNTIME_TOKEN)
-                .remove(PREF_EXPIRES_AT_MS)
-                .apply()
-        } catch (e: Exception) {
-            Log.w(TAG, "Failed to clear persisted session deadline", e)
-        }
-    }
-
-    private fun enforcePersistedDeadline(alarmToken: String) {
-        val stored = try {
-            val prefs = getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
-            prefs.getString(PREF_RUNTIME_TOKEN, null).orEmpty() to
-                prefs.getLong(PREF_EXPIRES_AT_MS, 0L)
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to read persisted session deadline", e)
-            clearPersistedDeadline()
-            cancelSessionExpiryAlarm()
-            stopSelf()
-            return
-        }
-
-        val storedToken = stored.first
-        val storedDeadline = stored.second
-        if (alarmToken.isEmpty() || storedToken.isEmpty() || alarmToken != storedToken) {
-            Log.w(TAG, "Ignoring stale session-expiry alarm")
-            if (currentConfig == null) stopSelf()
-            return
-        }
-
-        val remaining = storedDeadline - System.currentTimeMillis()
-        if (storedDeadline > 0L && remaining > 0L) {
-            if (!scheduleSessionExpiryAlarm(storedToken, storedDeadline)) {
-                Log.e(TAG, "Failed to re-arm early session-expiry alarm")
-                val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
-                if (activeToken == storedToken) stopAll(storedToken) else stopSelf()
-                return
-            }
-            // An alarm can wake a fresh service process after clock changes.
-            // If there is no live runtime in this process, do not leave a
-            // background service instance hanging around just to hold a timer.
-            if (currentConfig == null) stopSelf()
-            return
-        }
-
-        Log.w(TAG, "OS session-expiry alarm fired; stopping runtime fail-closed")
-        val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
-        if (activeToken.isNotEmpty() && activeToken == storedToken) {
-            stopAll(storedToken)
-        } else {
-            clearPersistedDeadline()
-            cancelSessionExpiryAlarm()
-            cancelSessionWarningAlarm()
-            RevoltAlerts.cancelExpiryWarning(this)
-            stopForeground(true)
-            stopSelf()
-            // This arm does not go through stopAll, so it posts for itself.
-            RevoltAlerts.postDisconnected(this)
-        }
-    }
-
-    private fun scheduleSessionExpiryAlarm(runtimeToken: String, expiresAtEpochMs: Long): Boolean {
-        cancelSessionExpiryAlarm()
-        if (runtimeToken.isEmpty() || expiresAtEpochMs <= 0L) return false
-
-        return try {
-            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
-            val pendingIntent = sessionExpiryPendingIntent(runtimeToken)
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-                try {
-                    alarmManager.setExactAndAllowWhileIdle(
-                        AlarmManager.RTC_WAKEUP,
-                        expiresAtEpochMs,
-                        pendingIntent,
-                    )
-                } catch (_: SecurityException) {
-                    Log.w(TAG, "Exact alarm unavailable; using inexact idle-capable expiry alarm")
-                    alarmManager.setAndAllowWhileIdle(
-                        AlarmManager.RTC_WAKEUP,
-                        expiresAtEpochMs,
-                        pendingIntent,
-                    )
-                }
-            } else {
-                alarmManager.setExact(AlarmManager.RTC_WAKEUP, expiresAtEpochMs, pendingIntent)
-            }
-            true
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to schedule OS session-expiry alarm", e)
-            false
-        }
-    }
-
-    private fun cancelSessionExpiryAlarm() {
-        try {
-            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
-            alarmManager.cancel(sessionExpiryPendingIntent(""))
-        } catch (e: Exception) {
-            Log.w(TAG, "Failed to cancel session-expiry alarm", e)
-        }
-    }
-
-    private fun cancelSessionWarningAlarm() {
-        deadlineHandler.removeCallbacks(sessionWarningRunnable)
-        try {
-            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
-            // Look it up rather than build it: FLAG_UPDATE_CURRENT would
-            // rewrite the live alarm's RUNTIME_TOKEN to "" before cancelling.
-            existingSessionWarningPendingIntent()?.let { alarmManager.cancel(it) }
-        } catch (e: Exception) {
-            Log.w(TAG, "Failed to cancel session-warning alarm", e)
-        }
-    }
-
-    private fun existingSessionWarningPendingIntent(): PendingIntent? {
-        val intent = Intent(this, XrayVPNService::class.java)
-            .putExtra(EXTRA_SESSION_WARNING, true)
-        val flags = PendingIntent.FLAG_NO_CREATE or
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
-        return PendingIntent.getService(this, SESSION_WARNING_REQUEST_CODE, intent, flags)
-    }
-
-    // Identity is component + request code, not extras, so the warning needs
-    // its own code or it clobbers the expiry alarm.
-    private fun sessionWarningPendingIntent(runtimeToken: String): PendingIntent {
-        val intent = Intent(this, XrayVPNService::class.java)
-            .putExtra(EXTRA_SESSION_WARNING, true)
-            .putExtra("RUNTIME_TOKEN", runtimeToken)
-        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
-        return PendingIntent.getService(this, SESSION_WARNING_REQUEST_CODE, intent, flags)
-    }
-
-    private fun sessionExpiryPendingIntent(runtimeToken: String): PendingIntent {
-        val intent = Intent(this, XrayVPNService::class.java)
-            .putExtra(EXTRA_SESSION_EXPIRED, true)
-            .putExtra("RUNTIME_TOKEN", runtimeToken)
-        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
-        return PendingIntent.getService(this, SESSION_EXPIRY_REQUEST_CODE, intent, flags)
-    }
-
-    override fun onDestroy() {
-        if (!shuttingDownIntentionally) {
-            val confirmationToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
-            cleanup(clearDeadline = false)
-            currentConfig = null
-            XrayCoreManager.stopCore(this, confirmationToken)
-            stopForeground(true)
-        }
-        super.onDestroy()
-    }
-
-    override fun onRevoke() {
-        stopAll(userRequested = true)
-        super.onRevoke()
-    }
-
-    private fun createNotificationChannel() {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            val channelId = "REVOLT_VPN_SERVICE"
-            val channelName = "VPN Service"
-            val channel = android.app.NotificationChannel(
-                channelId,
-                channelName,
-                android.app.NotificationManager.IMPORTANCE_LOW
-            )
-            val manager = getSystemService(android.app.NotificationManager::class.java)
-            manager?.createNotificationChannel(channel)
-        }
-    }
-
-    private fun createNotification(content: String): android.app.Notification {
-        val channelId = "REVOLT_VPN_SERVICE"
-        val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            android.app.Notification.Builder(this, channelId)
-        } else {
-            @Suppress("DEPRECATION")
-            android.app.Notification.Builder(this)
-        }
-
-        val icon = resources.getIdentifier("notification_icon", "drawable", packageName)
-            .takeIf { it != 0 } ?: android.R.drawable.ic_dialog_info
-
-        val notification = builder
-            .setContentTitle("VPN Service")
-            .setContentText(content)
-            .setSmallIcon(icon)
-            .setOngoing(true)
-            .setAutoCancel(false)
-            .setOnlyAlertOnce(true)
-            .build()
-
-        notification.flags = notification.flags or
-            android.app.Notification.FLAG_ONGOING_EVENT or
-            android.app.Notification.FLAG_NO_CLEAR
-        return notification
-    }
-
-    companion object {
-        private const val TAG = "XrayVPNService"
-        private const val FOREGROUND_SERVICE_TYPE_SPECIAL_USE = 0x40000000
-        private const val BOOTSTRAP_SESSION_SECONDS = 120L
-        private const val DEADLINE_PREFS = "revolt_session_deadline"
-        private const val PREF_RUNTIME_TOKEN = "runtime_token"
-        private const val PREF_EXPIRES_AT_MS = "expires_at_ms"
-        private const val EXTRA_SESSION_EXPIRED = "SESSION_EXPIRED"
-        private const val EXTRA_SESSION_WARNING = "SESSION_WARNING"
-        private const val SESSION_EXPIRY_REQUEST_CODE = 1001
-        private const val SESSION_WARNING_REQUEST_CODE = 1002
-        // Drift allowed before a warning is treated as belonging elsewhere.
-        private const val WARNING_SLACK_MS = 60_000L
-        // Don't re-arm for a deadline that moved by round-trip jitter alone.
-        private const val WARNING_REARM_GRACE_MS = 15_000L
-        // Below this the warning has lost its point.
-        private const val WARNING_FLOOR_MS = 60_000L
-    }
-}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/AppConfigs.kt

@@ -1,49 +0,0 @@
-package com.github.tfox.flutter_vless.xray.utils
-
-import com.github.tfox.flutter_vless.xray.dto.XrayConfig
-import java.io.Serializable
-
-/**
- * Global application configuration and state.
- *
- * This object holds:
- * 1. Constants for Intent actions and Service commands.
- * 2. Enums for connection states and modes.
- * 3. Global state variables (current connection state, active config).
- * 4. Static storage for notification icon resources (passed from Flutter).
- */
-object AppConfigs {
-    const val V2RAY_CONNECTION_INFO = "com.github.tfox.flutter_vless.xray.V2RAY_CONNECTION_INFO"
-
-    /**
-     * Commands sent to the XrayVPNService via Intent.
-     */
-    enum class V2RAY_SERVICE_COMMANDS : Serializable {
-        START_SERVICE, STOP_SERVICE, RESTART_SERVICE, UPDATE_SESSION_DEADLINE
-    }
-
-    /**
-     * Connection states for the Xray Core.
-     */
-    enum class V2RAY_STATES : Serializable {
-        V2RAY_CONNECTED, V2RAY_DISCONNECTED, V2RAY_CONNECTING
-    }
-
-    /**
-     * Connection modes:
-     * - VPN_TUN: Standard VPN mode using Android VpnService (TUN device).
-     * - PROXY_ONLY: Runs Xray as a local SOCKS/HTTP proxy without establishing a VPN tunnel.
-     */
-    enum class V2RAY_CONNECTION_MODES : Serializable {
-        VPN_TUN, PROXY_ONLY
-    }
-
-    var V2RAY_STATE: V2RAY_STATES = V2RAY_STATES.V2RAY_DISCONNECTED
-    @Volatile var RUNTIME_READY: Boolean = false
-    var V2RAY_CONFIG: XrayConfig? = null
-    var V2RAY_CONNECTION_MODE: V2RAY_CONNECTION_MODES = V2RAY_CONNECTION_MODES.VPN_TUN
-
-    // Stores the resource name and type for the custom notification icon
-    var NOTIFICATION_ICON_RESOURCE_NAME: String = ""
-    var NOTIFICATION_ICON_RESOURCE_TYPE: String = ""
-}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/RevoltAlerts.kt

@@ -1,143 +0,0 @@
-package com.github.tfox.flutter_vless.xray.utils
-
-import android.app.Notification
-import android.app.NotificationChannel
-import android.app.NotificationManager
-import android.app.PendingIntent
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageManager
-import android.os.Build
-import android.util.Log
-
-// local_packages/.../xray/utils/RevoltAlerts.kt
-//
-// The two session alerts. Both XrayVPNService (:RunSoLibXrayDaemon) and
-// MainActivity post them, sharing ids so a second post replaces. Separate from
-// the foreground-service notification (id 1, IMPORTANCE_LOW): these must be
-// noticed, and must be dismissible.
-object RevoltAlerts {
-
-    const val CHANNEL_ID = "REVOLT_VPN_ALERTS"
-    const val WARNING_NOTIFICATION_ID = 2
-    const val DISCONNECTED_NOTIFICATION_ID = 3
-
-    const val WARNING_LEAD_MS = 5 * 60 * 1000L
-
-    private const val TAG = "RevoltAlerts"
-    private const val LAUNCH_REQUEST_CODE = 2001
-
-    // Neither line names a number or a mechanism, because this notification
-    // cannot honour either. The caller accepts it anywhere from WARNING_FLOOR_MS
-    // to WARNING_LEAD_MS + WARNING_SLACK_MS remaining, so "5 minutes" can be
-    // off by four of them; and "watch an ad" is a dead end in a release build,
-    // where the support bypass is still kDebugMode-gated (rule 87). Put the
-    // number back once the warning is punctual, and the ad back once the
-    // support button works without a debug build.
-    fun postExpiryWarning(context: Context) {
-        post(
-            context,
-            WARNING_NOTIFICATION_ID,
-            "Revolt VPN disconnects soon",
-            "Open the app to extend your session.",
-        )
-    }
-
-    fun postDisconnected(context: Context) {
-        post(
-            context,
-            DISCONNECTED_NOTIFICATION_ID,
-            "Revolt VPN disconnected",
-            "Your traffic is no longer protected. Tap to reconnect.",
-        )
-    }
-
-    fun cancelExpiryWarning(context: Context) = cancel(context, WARNING_NOTIFICATION_ID)
-
-    fun cancelDisconnected(context: Context) = cancel(context, DISCONNECTED_NOTIFICATION_ID)
-
-    fun cancelAll(context: Context) {
-        cancelExpiryWarning(context)
-        cancelDisconnected(context)
-    }
-
-    private fun cancel(context: Context, id: Int) {
-        try {
-            manager(context)?.cancel(id)
-        } catch (e: Exception) {
-            Log.w(TAG, "Failed to cancel alert $id", e)
-        }
-    }
-
-    private fun post(context: Context, id: Int, title: String, text: String) {
-        if (!canPost(context)) {
-            Log.w(TAG, "POST_NOTIFICATIONS not granted; dropping alert $id")
-            return
-        }
-
-        try {
-            val manager = manager(context) ?: return
-            ensureChannel(manager)
-
-            val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-                Notification.Builder(context, CHANNEL_ID)
-            } else {
-                @Suppress("DEPRECATION")
-                Notification.Builder(context).setPriority(Notification.PRIORITY_HIGH)
-            }
-
-            val icon = context.resources
-                .getIdentifier("notification_icon", "drawable", context.packageName)
-                .takeIf { it != 0 } ?: android.R.drawable.ic_dialog_info
-
-            builder
-                .setContentTitle(title)
-                .setContentText(text)
-                .setStyle(Notification.BigTextStyle().bigText(text))
-                .setSmallIcon(icon)
-                .setAutoCancel(true)
-                .setOngoing(false)
-                // A replacing post must not sound again.
-                .setOnlyAlertOnce(true)
-
-            launchIntent(context)?.let { builder.setContentIntent(it) }
-
-            manager.notify(id, builder.build())
-        } catch (e: Exception) {
-            Log.w(TAG, "Failed to post alert $id", e)
-        }
-    }
-
-    private fun canPost(context: Context): Boolean {
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) return true
-        return context.checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) ==
-            PackageManager.PERMISSION_GRANTED
-    }
-
-    private fun manager(context: Context): NotificationManager? =
-        context.getSystemService(Context.NOTIFICATION_SERVICE) as? NotificationManager
-
-    // Importance is fixed at creation, so ask for HIGH up front.
-    private fun ensureChannel(manager: NotificationManager) {
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
-        if (manager.getNotificationChannel(CHANNEL_ID) != null) return
-        val channel = NotificationChannel(
-            CHANNEL_ID,
-            "Session alerts",
-            NotificationManager.IMPORTANCE_HIGH,
-        )
-        channel.description = "Warns before a session ends and when protection stops."
-        manager.createNotificationChannel(channel)
-    }
-
-    private fun launchIntent(context: Context): PendingIntent? {
-        val intent = context.packageManager.getLaunchIntentForPackage(context.packageName)
-            ?: return null
-        intent.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or
-            Intent.FLAG_ACTIVITY_CLEAR_TOP or
-            Intent.FLAG_ACTIVITY_NEW_TASK
-        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
-        return PendingIntent.getActivity(context, LAUNCH_REQUEST_CODE, intent, flags)
-    }
-}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/Utilities.kt

@@ -1,62 +0,0 @@
-package com.github.tfox.flutter_vless.xray.utils
-
-import android.content.Context
-import java.io.File
-import java.io.FileOutputStream
-import java.io.IOException
-import java.io.InputStream
-import java.io.OutputStream
-
-object Utilities {
-
-    fun getUserAssetsPath(context: Context): String {
-        val dir = context.filesDir
-        if (!dir.exists()) {
-            dir.mkdirs()
-        }
-        return dir.absolutePath
-    }
-
-    fun copyAssets(context: Context) {
-        val assets = context.assets
-        val files = assets.list("") ?: return
-        for (filename in files) {
-            if (filename == "geoip.dat" || filename == "geosite.dat") {
-                var `in`: InputStream? = null
-                var out: OutputStream? = null
-                try {
-                    `in` = assets.open(filename)
-                    val outFile = File(getUserAssetsPath(context), filename)
-                    out = FileOutputStream(outFile)
-                    copyFile(`in`, out)
-                } catch (e: IOException) {
-                    e.printStackTrace()
-                } finally {
-                    if (`in` != null) {
-                        try {
-                            `in`.close()
-                        } catch (e: IOException) {
-                            e.printStackTrace()
-                        }
-                    }
-                    if (out != null) {
-                        try {
-                            out.close()
-                        } catch (e: IOException) {
-                            e.printStackTrace()
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    @Throws(IOException::class)
-    private fun copyFile(`in`: InputStream, out: OutputStream) {
-        val buffer = ByteArray(1024)
-        var read: Int
-        while (`in`.read(buffer).also { read = it } != -1) {
-            out.write(buffer, 0, read)
-        }
-    }
-}

local_packages/flutter_vless_android-1.1.5/android/src/test/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManagerTest.kt

@@ -1,178 +0,0 @@
-package com.github.tfox.flutter_vless.xray.core
-
-import com.github.tfox.flutter_vless.xray.dto.XrayConfig
-import java.io.File
-import org.json.JSONObject
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
-import org.junit.Assert.fail
-import org.junit.Test
-
-class XrayCoreManagerTest {
-    @Test
-    fun buildRuntimeConfigJson_keepsSecureSocksAndSanitizesLogs() {
-        val filesDir = File("build/test-files/runtime-secure")
-        val config = XrayConfig(
-            V2RAY_FULL_JSON_CONFIG = runtimeConfig(
-                extraLog = """
-                    "log": {
-                      "access": "/tmp/access.log",
-                      "error": "/tmp/error.log"
-                    },
-                """.trimIndent(),
-            )
-        )
-
-        val output = XrayCoreManager.buildRuntimeConfigJson(config, filesDir)
-        val log = output.getJSONObject("log")
-        val inbound = output.getJSONArray("inbounds").getJSONObject(0)
-        val user = output
-            .getJSONArray("outbounds")
-            .getJSONObject(0)
-            .getJSONObject("settings")
-            .getJSONArray("vnext")
-            .getJSONObject(0)
-            .getJSONArray("users")
-            .getJSONObject(0)
-
-        assertFalse(log.has("access"))
-        assertEquals(File(filesDir, "error.log").absolutePath, log.getString("error"))
-        assertEquals("revolt-secure-socks", inbound.getString("tag"))
-        assertEquals("password", inbound.getJSONObject("settings").getString("auth"))
-        assertEquals(19080, config.LOCAL_SOCKS5_PORT)
-        assertEquals(0, config.LOCAL_HTTP_PORT)
-        assertEquals(vlessEncryption, user.getString("encryption"))
-        assertEquals("xtls-rprx-vision", user.getString("flow"))
-    }
-
-    @Test
-    fun buildRuntimeConfigJson_rejectsInvalidSecureSocks() {
-        val config = XrayConfig(
-            V2RAY_FULL_JSON_CONFIG = """
-                {
-                  "inbounds": [
-                    {
-                      "tag": "revolt-secure-socks",
-                      "listen": "127.0.0.1",
-                      "port": 19080,
-                      "protocol": "socks",
-                      "settings": { "auth": "noauth", "users": [] }
-                    }
-                  ],
-                  "outbounds": []
-                }
-            """.trimIndent()
-        )
-
-        try {
-            XrayCoreManager.buildRuntimeConfigJson(
-                config,
-                File("build/test-files/runtime-invalid-socks"),
-            )
-            fail("Invalid secure SOCKS5 configuration must fail closed")
-        } catch (expected: IllegalStateException) {
-            assertTrue(expected.message.orEmpty().contains("Secure SOCKS5"))
-        }
-    }
-
-    @Test
-    fun buildRuntimeConfigJson_normalizesXrayRuntimeAliases() {
-        val config = XrayConfig(
-            V2RAY_FULL_JSON_CONFIG = """
-                {
-                  "inbounds": [
-                    {
-                      "tag": "revolt-secure-socks",
-                      "listen": "127.0.0.1",
-                      "port": 19080,
-                      "protocol": "socks",
-                      "settings": {
-                        "auth": "password",
-                        "users": [{"user": "runtime-user", "pass": "runtime-pass"}]
-                      }
-                    }
-                  ],
-                  "outbounds": [
-                    {
-                      "protocol": "vless",
-                      "settings": {
-                        "vnext": [
-                          {
-                            "address": "example.com",
-                            "port": 443,
-                            "users": [{"id": "11111111-1111-4111-8111-111111111111", "encryption": "none"}]
-                          }
-                        ]
-                      },
-                      "streamSettings": {
-                        "network": "XHTTP",
-                        "security": "tls",
-                        "tlsSettings": {"allowInsecure": false, "serverName": "example.com"},
-                        "xHTTPSettings": {"path": "/", "mode": "auto"},
-                        "httpUpgradeSettings": {"path": "/upgrade"},
-                        "splitHTTPSettings": {"path": "/split"}
-                      }
-                    }
-                  ]
-                }
-            """.trimIndent()
-        )
-
-        val output = XrayCoreManager.buildRuntimeConfigJson(
-            config,
-            File("build/test-files/runtime-aliases"),
-        )
-        val stream = output
-            .getJSONArray("outbounds")
-            .getJSONObject(0)
-            .getJSONObject("streamSettings")
-
-        assertEquals("xhttp", stream.getString("network"))
-        assertTrue(stream.has("xhttpSettings"))
-        assertTrue(stream.has("httpupgradeSettings"))
-        assertTrue(stream.has("splithttpSettings"))
-        assertFalse(stream.has("xHTTPSettings"))
-        assertFalse(stream.has("httpUpgradeSettings"))
-        assertFalse(stream.has("splitHTTPSettings"))
-        assertFalse(stream.getJSONObject("tlsSettings").has("allowInsecure"))
-    }
-
-    private fun runtimeConfig(extraLog: String = ""): String = """
-        {
-          $extraLog
-          "inbounds": [
-            {
-              "tag": "revolt-secure-socks",
-              "listen": "127.0.0.1",
-              "port": 19080,
-              "protocol": "socks",
-              "settings": {
-                "auth": "password",
-                "users": [{"user": "runtime-user", "pass": "runtime-pass"}]
-              }
-            }
-          ],
-          "outbounds": [
-            {
-              "tag": "proxy",
-              "protocol": "vless",
-              "settings": {
-                "address": "xhttp.example.com",
-                "port": 443,
-                "id": "b94da146-a56e-49d7-af4c-a68c9065cbfd",
-                "encryption": "$vlessEncryption",
-                "flow": "xtls-rprx-vision",
-                "level": 8
-              },
-              "streamSettings": {"network": "xhttp", "security": "none"}
-            }
-          ]
-        }
-    """.trimIndent()
-
-    private companion object {
-        const val vlessEncryption =
-            "mlkem768x25519plus.native.1rtt.100-500-2000.75-0-100.80-0-5000.gtmOXB2AN_r905czmOIr6dKq_YDdEJB8RWGqfsXurns"
-    }
-}

local_packages/flutter_vless_android-1.1.5/lib/flutter_vless_android.dart

@@ -1,13 +0,0 @@
-// Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
-// SPDX-License-Identifier: MIT
-
-import 'package:flutter_vless_platform_interface/flutter_vless_platform_interface.dart';
-
-/// Android implementation of [VlessPlatform] using MethodChannel.
-class FlutterVlessAndroid extends VlessMethodChannelAdapter {
-  /// Registers this class as the platform implementation.
-  /// This is called automatically by Flutter's plugin registry.
-  static void registerWith() {
-    VlessPlatform.instance = FlutterVlessAndroid();
-  }
-}

local_packages/flutter_vless_android-1.1.5/pubspec.yaml

@@ -1,31 +0,0 @@
-name: flutter_vless_android
-description: Android implementation of the flutter_vless plugin.
-version: 1.1.5
-homepage: https://tfox.dev
-repository: https://github.com/XIIIFOX/flutter_vless
-issue_tracker: https://github.com/XIIIFOX/flutter_vless/issues
-documentation: https://github.com/XIIIFOX/flutter_vless/blob/main/doc/platform/android.md
-funding:
-  - https://tfox.dev
-
-environment:
-  sdk: '>=3.4.0 <4.0.0'
-  flutter: '>=3.3.0'
-
-dependencies:
-  flutter:
-    sdk: flutter
-  flutter_vless_platform_interface: ^1.1.0
-
-dev_dependencies:
-  flutter_test:
-    sdk: flutter
-  flutter_lints: ^6.0.0
-
-flutter:
-  plugin:
-    implements: flutter_vless_platform_interface
-    platforms:
-      android:
-        package: com.github.tfox.flutter_vless
-        pluginClass: FlutterVlessPlugin

pubspec.lock

@@ -65,6 +65,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "3.0.7"
+  cupertino_icons:
+    dependency: "direct main"
+    description:
+      name: cupertino_icons
+      sha256: "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.9"
   fake_async:
     dependency: transitive
     description:
@@ -172,11 +180,12 @@ packages:
     source: hosted
     version: "1.1.5"
   flutter_vless_android:
-    dependency: "direct overridden"
+    dependency: transitive
     description:
-      path: "local_packages/flutter_vless_android-1.1.5"
-      relative: true
-    source: path
+      name: flutter_vless_android
+      sha256: "5e6fe73d3606ed8c73e87fac15efa7631e12ce18d39a4bd4e13b6c097c6d52b9"
+      url: "https://pub.dev"
+    source: hosted
     version: "1.1.5"
   flutter_vless_macos:
     dependency: transitive
@@ -207,6 +216,14 @@ packages:
     description: flutter
     source: sdk
     version: "0.0.0"
+  google_fonts:
+    dependency: "direct main"
+    description:
+      name: google_fonts
+      sha256: ba03d03bcaa2f6cb7bd920e3b5027181db75ab524f8891c8bc3aa603885b8055
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.3.3"
   google_mobile_ads:
     dependency: "direct main"
     description:
@@ -299,10 +316,10 @@ packages:
     dependency: transitive
     description:
       name: matcher
-      sha256: "31bd099b47c10cd1aeb55146a2d46ce0277630ecef3f7dae54ad7873f36696cd"
+      sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
       url: "https://pub.dev"
     source: hosted
-    version: "0.12.20"
+    version: "0.12.19"
   material_color_utilities:
     dependency: transitive
     description:
@@ -315,10 +332,10 @@ packages:
     dependency: transitive
     description:
       name: meta
-      sha256: "307249ce4ff29d58a18e97f6345f539382eb9c9c29ecda628900f31de0443dd9"
+      sha256: "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349"
       url: "https://pub.dev"
     source: hosted
-    version: "1.19.0"
+    version: "1.18.0"
   nested:
     dependency: transitive
     description:
@@ -368,7 +385,7 @@ packages:
     source: hosted
     version: "1.9.1"
   path_provider:
-    dependency: transitive
+    dependency: "direct main"
     description:
       name: path_provider
       sha256: "50c5dd5b6e1aaf6fb3a78b33f6aa3afca52bf903a8a5298f53101fdaee55bbcd"
@@ -560,10 +577,10 @@ packages:
     dependency: transitive
     description:
       name: test_api
-      sha256: "2a122cbe059f8b610d3a5415f42e255b6c17b1f21eee1d960f31080237fb4f11"
+      sha256: "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e"
       url: "https://pub.dev"
     source: hosted
-    version: "0.7.12"
+    version: "0.7.11"
   typed_data:
     dependency: transitive
     description:
@@ -648,10 +665,10 @@ packages:
     dependency: transitive
     description:
       name: vector_math
-      sha256: f36f9f3be64c6198714492bb455c11056e33e2f85d9a0b676a48301e44fdcf47
+      sha256: d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b
       url: "https://pub.dev"
     source: hosted
-    version: "2.4.2"
+    version: "2.2.0"
   vm_service:
     dependency: transitive
     description:
@@ -725,5 +742,5 @@ packages:
     source: hosted
     version: "3.1.3"
 sdks:
-  dart: ">=3.11.0-0 <4.0.0"
+  dart: ">=3.10.3 <4.0.0"
   flutter: ">=3.38.4"

pubspec.yaml

@@ -15,7 +15,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # In iOS, build-name is used as CFBundleShortVersionString while build-number used as CFBundleVersion.
 # Read more about iOS versioning at
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
-version: 3.3.8+34
+version: 3.3.4+30
 
 environment:
   sdk: ">=3.0.0 <4.0.0"
@@ -24,6 +24,10 @@ dependencies:
   flutter:
     sdk: flutter
 
+  # The following adds the Cupertino Icons font to your application.
+  # Use with the CupertinoIcons class for iOS style icons.
+  cupertino_icons: ^1.0.5
+  google_fonts: ^6.1.0
   provider: ^6.1.1
   google_mobile_ads: ^4.0.0
   flutter_vless: 1.1.5
@@ -32,6 +36,7 @@ dependencies:
   url_launcher: ^6.3.2
   flutter_secure_storage: ^10.3.1
   uuid: ^4.5.3
+  path_provider: ^2.1.5
   package_info_plus: ^6.0.0
 
 dev_dependencies:
@@ -78,7 +83,3 @@ flutter:
   #
   # For details regarding fonts from package dependencies,
   # see https://flutter.dev/custom-fonts/#from-packages
-
-dependency_overrides:
-  flutter_vless_android:
-    path: local_packages/flutter_vless_android-1.1.5

test/release_verification_regression_test.dart

@@ -1,87 +0,0 @@
-import 'dart:convert';
-import 'dart:io';
-
-import 'package:flutter_test/flutter_test.dart';
-import 'package:revoltvpn/logic/secure_socks_session.dart';
-
-void main() {
-  test('release verification stays fail-closed and reproducible', () {
-    final gradle = File('android/app/build.gradle.kts').readAsStringSync();
-    final workflow = File('.github/workflows/android-ci.yml').readAsStringSync();
-    final lockfile = File('pubspec.lock').readAsStringSync();
-    final wrapper =
-        File('android/gradle/wrapper/gradle-wrapper.properties').readAsStringSync();
-    final verification =
-        File('android/gradle/verification-metadata.xml').readAsStringSync();
-    final proguard = File('android/app/proguard-rules.pro').readAsStringSync();
-
-    expect(
-      wrapper,
-      contains(
-        'distributionSha256Sum='
-        'efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1',
-      ),
-    );
-    expect(wrapper, contains('validateDistributionUrl=true'));
-
-    expect(verification, contains('<verify-metadata>true</verify-metadata>'));
-    expect(verification, contains('<verify-signatures>false</verify-signatures>'));
-    expect(verification, contains('<sha256 value='));
-    expect(
-      verification,
-      contains('a804b261645ef8c13eb3d5c44a5c2fb0340c5539'),
-    );
-
-    expect(gradle, contains('REVOLT_APP_CONFIG_SHA256'));
-    expect(gradle, contains('verifyReleaseAppConfig'));
-    expect(gradle, contains('preReleaseBuild'));
-    expect(gradle, contains('isMinifyEnabled = true'));
-    expect(gradle, contains('isShrinkResources = true'));
-    expect(gradle, contains('REVOLT_CI_RELEASE_SMOKE'));
-    expect(gradle, contains('signingConfigs.getByName("release")'));
-
-    expect(workflow, contains("flutter-version: '3.47.2'"));
-    expect(workflow, contains('Verify Gradle supply chain'));
-    expect(workflow, contains('Verify dependency lock is committed'));
-    expect(workflow, contains('Verify production release config fails closed'));
-    expect(workflow, contains('Cold APK build'));
-    expect(workflow, contains('Warm APK build'));
-    expect(workflow, contains('Release R8 smoke build'));
-    expect(workflow, contains('Verify tracked build inputs stayed immutable'));
-    expect(workflow, contains('REVOLT_CI_RELEASE_SMOKE'));
-    expect(
-      workflow,
-      contains('actions/checkout@11d5960a326750d5838078e36cf38b85af677262'),
-    );
-    expect(
-      workflow,
-      contains('actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961'),
-    );
-    expect(lockfile, contains('dart: ">=3.11.0-0 <4.0.0"'));
-
-    expect(proguard, contains('-keep class io.flutter.** { *; }'));
-    expect(proguard, contains('-keep class xray.** { *; }'));
-  });
-
-  test('runtime keeps authenticated SOCKS on the IPv4 loopback', () async {
-    final session = await SecureSocksSession.create(jsonEncode({
-      'inbounds': <Object?>[],
-      'outbounds': <Object?>[],
-    }));
-    final config = jsonDecode(session.configJson) as Map<String, dynamic>;
-    final inbounds = config['inbounds'] as List<dynamic>;
-    final inbound = inbounds.single as Map<String, dynamic>;
-    final settings = inbound['settings'] as Map<String, dynamic>;
-    final users = settings['users'] as List<dynamic>;
-    final account = users.single as Map<String, dynamic>;
-
-    expect(inbound['tag'], SecureSocksSession.inboundTag);
-    expect(inbound['listen'], '127.0.0.1');
-    expect(inbound['port'], session.port);
-    expect(settings['auth'], 'password');
-    expect(account['user'], session.username);
-    expect(account['pass'], session.password);
-    expect(session.username, isNotEmpty);
-    expect(session.password, isNotEmpty);
-  });
-}

test/session_lifecycle_regression_test.dart

@@ -1,187 +0,0 @@
-import 'dart:io';
-
-import 'package:flutter_test/flutter_test.dart';
-
-// Source assertions, in the style of release_verification_regression_test.dart.
-// The behaviours below were all found broken on a device and fixed on
-// 2026-10-17 (internal/DEVICE_TEST_2026-10-17.md). None of them can be covered
-// by a Dart unit test - they live in the vendored Android runtime, and the one
-// that does not needs a live tunnel - but every one of them regresses silently
-// and looks like tidying when it does. Pin the shape instead of the behaviour.
-
-const _runtime = 'local_packages/flutter_vless_android-1.1.5/android/src/main/'
-    'kotlin/com/github/tfox/flutter_vless/xray';
-
-void main() {
-  test('Xray core recovery survives running off a bare thread', () {
-    final core = File('$_runtime/core/XrayCoreManager.kt').readAsStringSync();
-
-    // startTimer builds a CountDownTimer, which builds a Handler. Recovery runs
-    // on a plain Thread, so constructing it inline threw Looper.prepare() and
-    // killed every restart attempt.
-    expect(core, contains('Handler(Looper.getMainLooper())'));
-    expect(core, contains('runOnMain'));
-    expect(
-      core,
-      contains('runOnMain { startTimerOnMain(context, token) }'),
-      reason: 'startTimer must not construct the CountDownTimer inline',
-    );
-
-    // The post must not outlive the generation that scheduled it.
-    expect(core, contains('if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != token) return'));
-
-    // pb.start() succeeds before the throw, so the catch has to kill the
-    // process or each retry strands another live core.
-    expect(core, contains('val orphan = xrayProcess'));
-    expect(
-      core.indexOf('xrayProcess = null'),
-      lessThan(core.indexOf('orphan?.destroy()')),
-      reason: 'clear the field before destroying, so the monitor thread\'s '
-          'identity guard fails and recovery is not re-entered',
-    );
-  });
-
-  test('a failed Xray core still reports why, without logging destinations', () {
-    final core = File('$_runtime/core/XrayCoreManager.kt').readAsStringSync();
-
-    expect(core, contains('STARTUP_LOG_WINDOW_MS'));
-    expect(core, contains('STARTUP_LOG_MAX_LINES'));
-    expect(
-      core,
-      isNot(contains('reader.forEachLine { _ -> }')),
-      reason: 'discarding the core output leaves exit 23 undiagnosable',
-    );
-    // Rule 95: a core that has been up long enough to carry traffic must not
-    // have its log retained.
-    expect(core, contains('startupLog.clear()'));
-  });
-
-  test('the expiry warning has the same backstop as the deadline', () {
-    final service = File('$_runtime/service/XrayVPNService.kt').readAsStringSync();
-
-    // The alarm alone is inexact on purpose (no SCHEDULE_EXACT_ALARM) and Doze
-    // deferred it past the end of the session it was warning about.
-    expect(service, contains('sessionWarningRunnable'));
-    expect(
-      service,
-      contains('deadlineHandler.postDelayed(sessionWarningRunnable, warnDelay)'),
-      reason: 'without this the warning never arrives when the app is closed',
-    );
-    expect(
-      service,
-      contains('deadlineHandler.removeCallbacks(sessionWarningRunnable)'),
-      reason: 'a cancelled warning must drop its Handler callback too',
-    );
-    expect(service, isNot(contains('SCHEDULE_EXACT_ALARM"')));
-  });
-
-  test('the warning promises neither a number of minutes nor an ad', () {
-    final alerts = File('$_runtime/utils/RevoltAlerts.kt').readAsStringSync();
-
-    // It is accepted anywhere from WARNING_FLOOR_MS to LEAD + SLACK remaining,
-    // so a figure can be off by minutes; and the support bypass is still
-    // kDebugMode-gated (rule 87), so an ad is a dead end in release.
-    expect(alerts, isNot(contains('disconnects in 5 minutes')));
-    expect(alerts, isNot(contains('Watch an ad')));
-    expect(alerts, contains('Revolt VPN disconnects soon'));
-  });
-
-  test('the countdown notification is taken down when the tunnel stops', () {
-    final service = File('lib/logic/notification_service.dart').readAsStringSync();
-    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
-    final activity =
-        File('android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt')
-            .readAsStringSync();
-
-    // updateTimer re-posts an ongoing, non-dismissible notification every tick,
-    // so a tick after the service stops strands a frozen countdown.
-    expect(service, contains('cancelTimer'));
-    expect(activity, contains('"cancelNotification"'));
-    expect(timer, contains('await NotificationService.cancelTimer()'));
-
-    // Must run after the service is down, or the platform swallows the cancel.
-    expect(
-      timer.indexOf('await vpnConnection.disconnect();'),
-      lessThan(timer.indexOf('await NotificationService.cancelTimer()')),
-    );
-  });
-
-  test('only a user-requested disconnect hands the session back', () {
-    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
-    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
-
-    expect(hivemind, contains('releaseSession'));
-    expect(hivemind, contains("_publicUrl('/session/stop')"));
-
-    // /session/stop takes a device_id as its only proof of ownership, so it
-    // must never be reachable from an error path. disconnect() is called only
-    // by the connect button; _doDisconnect is every other ending.
-    final disconnectEntry = timer.indexOf('Future<void> disconnect({');
-    final doDisconnect = timer.indexOf('Future<void> _doDisconnect(');
-    final release = timer.indexOf('HivemindService.releaseSession()');
-    expect(release, greaterThan(disconnectEntry));
-    expect(
-      release,
-      lessThan(doDisconnect),
-      reason: 'releaseSession belongs in disconnect(), not _doDisconnect',
-    );
-    expect(
-      'HivemindService.releaseSession()'.allMatches(timer).length,
-      1,
-      reason: 'exactly one call site',
-    );
-  });
-
-  test('every session starts the same way - no re-attach path', () {
-    final mode =
-        File('lib/screens/settings/in_settings/connection_mode.dart')
-            .readAsStringSync();
-    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
-    final vpn = File('lib/logic/vpn_connection.dart').readAsStringSync();
-    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
-
-    // SOCKS5 Reconnect used to re-attach to the session already held. It was
-    // the only place a session began without an ad and without a nonce binding
-    // it, and it needed three parameters and a carve-out in rule 4 to support.
-    // Reconnect now ends the session and starts a fresh one, like the button.
-    expect(mode, contains("ad.showAd('main')"));
-    expect(mode, contains('vpn.connect(adNonce: adNonce)'));
-    expect(mode, isNot(contains('resume: true')));
-    expect(mode, isNot(contains('release: false')));
-    expect(mode, isNot(contains('resetSupportClaim')));
-
-    // The special cases that only existed for it are gone.
-    expect(hivemind, isNot(contains('bool resume')));
-    expect(vpn, isNot(contains('bool resume')));
-    expect(timer, isNot(contains('bool release')));
-    expect(timer, isNot(contains('resetSupportClaim')));
-
-    // So the nonce is now unconditional: no path accepts whatever the server
-    // happens to hold.
-    expect(
-      hivemind,
-      contains('if (serverNonce is! String || serverNonce != nonce) return null;'),
-      reason: 'the nonce check must not be skippable',
-    );
-  });
-
-  test('nothing probes the control plane while disconnected - rule 60', () {
-    final vpn = File('lib/logic/vpn_connection.dart').readAsStringSync();
-    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
-    final bar = File('lib/components/status_bar.dart').readAsStringSync();
-
-    // The runtime excludes the app from its own tunnel
-    // (XrayVPNService.kt addDisallowedApplication), so a periodic /health probe
-    // was a cleartext-SNI metronome to the API host - which resolves to the
-    // tunnel IP. It fed step 1 of the kill chain in KNOWN_SECURITY_ISSUES #3,
-    // in exchange for a green dot before the user had connected to anything.
-    expect(vpn, isNot(contains('_healthTimer')));
-    expect(vpn, isNot(contains('_checkHealth')));
-    expect(hivemind, isNot(contains('checkHealth')));
-    expect(hivemind, isNot(contains("'/health'")));
-
-    // Reachability is passive now: a session sync that succeeded, nothing else.
-    expect(bar, isNot(contains('serverReachable')));
-    expect(bar, contains('isConnected && timer.hasSyncedOnce'));
-  });
-}

tool/patch_flutter_vless_runtime_recovery.dart

@@ -0,0 +1,119 @@
+import 'dart:convert';
+import 'dart:io';
+
+const packageName = 'flutter_vless_android';
+const expectedVersionFragment = 'flutter_vless_android-1.1.5';
+
+Never fail(String message) {
+  stderr.writeln('[flutter_vless recovery patch] $message');
+  exit(1);
+}
+
+Directory packageRoot() {
+  final configFile = File('.dart_tool/package_config.json');
+  if (!configFile.existsSync()) {
+    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
+  }
+
+  final decoded = jsonDecode(configFile.readAsStringSync());
+  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
+    fail('package_config.json is invalid');
+  }
+
+  Map<String, dynamic>? package;
+  for (final item in decoded['packages'] as List) {
+    if (item is Map && item['name'] == packageName) {
+      package = Map<String, dynamic>.from(item);
+      break;
+    }
+  }
+  if (package == null) fail('$packageName was not found');
+
+  final rootUriValue = package['rootUri'];
+  if (rootUriValue is! String || rootUriValue.isEmpty) {
+    fail('$packageName has no rootUri');
+  }
+
+  final rootUri = Uri.parse(rootUriValue);
+  final resolved = rootUri.hasScheme
+      ? rootUri
+      : configFile.parent.absolute.uri.resolveUri(rootUri);
+  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
+
+  final root = Directory.fromUri(resolved);
+  final normalized = root.absolute.path.replaceAll('\\', '/');
+  if (!normalized.contains(expectedVersionFragment)) {
+    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
+  }
+  if (!root.existsSync()) fail('package root does not exist: ${root.path}');
+  return root;
+}
+
+void replaceOnce(
+  File file,
+  String oldValue,
+  String newValue,
+  String marker,
+) {
+  if (!file.existsSync()) fail('missing upstream source: ${file.path}');
+  final text = file.readAsStringSync();
+  if (text.contains(marker)) {
+    stdout.writeln('[flutter_vless recovery patch] already current: ${file.path}');
+    return;
+  }
+  if (!text.contains(oldValue)) {
+    fail('upstream source changed; expected block not found in ${file.path}');
+  }
+  file.writeAsStringSync(text.replaceFirst(oldValue, newValue));
+  stdout.writeln('[flutter_vless recovery patch] patched: ${file.path}');
+}
+
+void main() {
+  final root = packageRoot();
+  final kotlin = Directory(
+    '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless',
+  );
+
+  final serviceFile = File('${kotlin.path}/xray/service/XrayVPNService.kt');
+  if (!serviceFile.existsSync()) {
+    fail('pinned Android runtime service source is missing');
+  }
+
+  // A fast reconnect must not leave the previous Xray process owning the local
+  // SOCKS/HTTP ports.
+  replaceOnce(
+    serviceFile,
+    '''            if (config != null) {
+                // Ensure clean state before starting
+                cleanup()
+''',
+    '''            if (config != null) {
+                // A fast reconnect must not leave the previous Xray process
+                // owning the local SOCKS/HTTP ports.
+                if (XrayCoreManager.isXrayRunning()) {
+                    Log.w(TAG, "Stopping stale Xray core before restart")
+                    XrayCoreManager.stopCore(this)
+                }
+                cleanup()
+''',
+    'Stopping stale Xray core before restart',
+  );
+
+  // The tun2socks Unix socket must not survive a previous session.
+  replaceOnce(
+    serviceFile,
+    '''        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
+        val sockPath = File(filesDir, "sock_path").absolutePath
+''',
+    '''        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
+        val socketFile = File(filesDir, "sock_path")
+        if (socketFile.exists() && !socketFile.delete()) {
+            Log.w(TAG, "Could not delete stale tun2socks socket")
+        }
+        val sockPath = socketFile.absolutePath
+''',
+    'Could not delete stale tun2socks socket',
+  );
+
+  stdout.writeln('[flutter_vless recovery patch] runtime recovery patch is ready');
+}

tool/patch_flutter_vless_secure_socks_scope_fix.dart

@@ -0,0 +1,154 @@
+import 'dart:convert';
+import 'dart:io';
+
+const packageName = 'flutter_vless_android';
+const expectedVersionFragment = 'flutter_vless_android-1.1.5';
+
+Never fail(String message) {
+  stderr.writeln('[secure-socks scope fix] $message');
+  exit(1);
+}
+
+Directory packageRoot() {
+  final configFile = File('.dart_tool/package_config.json');
+  if (!configFile.existsSync()) {
+    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
+  }
+
+  final decoded = jsonDecode(configFile.readAsStringSync());
+  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
+    fail('package_config.json is invalid');
+  }
+
+  Map<String, dynamic>? package;
+  for (final item in decoded['packages'] as List) {
+    if (item is Map && item['name'] == packageName) {
+      package = Map<String, dynamic>.from(item);
+      break;
+    }
+  }
+  if (package == null) fail('$packageName was not found');
+
+  final rootUriValue = package['rootUri'];
+  if (rootUriValue is! String || rootUriValue.isEmpty) {
+    fail('$packageName has no rootUri');
+  }
+
+  final rootUri = Uri.parse(rootUriValue);
+  final resolved = rootUri.hasScheme
+      ? rootUri
+      : configFile.parent.absolute.uri.resolveUri(rootUri);
+  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
+
+  final root = Directory.fromUri(resolved);
+  final normalized = root.absolute.path.replaceAll('\\', '/');
+  if (!normalized.contains(expectedVersionFragment)) {
+    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
+  }
+  return root;
+}
+
+void patchCoreScope(File core) {
+  final before = core.readAsStringSync();
+
+  // The primary secure patcher used a file-wide check for
+  // `val process = pb.start()`. Stock 1.1.5 already contains that exact line
+  // in getV2rayTraffic(), so the startCore() capture could be skipped while
+  // its monitor was still rewritten to use `process`. Capture the active Xray
+  // process immediately before its monitor thread instead. This is deliberately
+  // a scope-only correction and does not alter the stable runtime sequence.
+  const directCapture =
+      '            val process = pb.start()\n            xrayProcess = process\n';
+  const scopedCapture =
+      '            val process = xrayProcess ?: return false\n            // Monitor process in a separate thread to detect crash\n';
+  const monitorMarker =
+      '            // Monitor process in a separate thread to detect crash\n';
+
+  if (before.contains(directCapture) || before.contains(scopedCapture)) {
+    stdout.writeln('[secure-socks scope fix] core already current: ${core.path}');
+    return;
+  }
+
+  if (!before.contains('process.inputStream.bufferedReader().use { reader ->') ||
+      !before.contains('val exitCode = process.waitFor()') ||
+      !before.contains('xrayProcess === process')) {
+    fail('secure Xray monitor patch is not in the expected state');
+  }
+  if (!before.contains('            xrayProcess = pb.start()\n')) {
+    fail('stock Xray start assignment is missing');
+  }
+  if (!before.contains(monitorMarker)) {
+    fail('Xray monitor insertion point is missing');
+  }
+
+  final after = before.replaceFirst(monitorMarker, scopedCapture);
+  core.writeAsStringSync(after);
+  stdout.writeln('[secure-socks scope fix] captured Xray process for monitor scope');
+}
+
+void patchOngoingNotification(File service) {
+  final before = service.readAsStringSync();
+
+  const marker = '.setOngoing(true)';
+  if (before.contains(marker) &&
+      before.contains('Notification.FLAG_NO_CLEAR') &&
+      before.contains('.setAutoCancel(false)')) {
+    stdout.writeln('[secure-socks scope fix] notification already ongoing: ${service.path}');
+    return;
+  }
+
+  const oldBlock = r'''        return builder
+            .setContentTitle("VPN Service")
+            .setContentText(content)
+            .setSmallIcon(icon)
+            .build()
+''';
+
+  const newBlock = r'''        val notification = builder
+            .setContentTitle("VPN Service")
+            .setContentText(content)
+            .setSmallIcon(icon)
+            .setOngoing(true)
+            .setAutoCancel(false)
+            .setOnlyAlertOnce(true)
+            .build()
+
+        // Keep the active VPN notification attached to the foreground service
+        // and resistant to bulk clearing on Android versions that honor these
+        // flags. Android 14+ may still allow an explicit user swipe while the
+        // device is unlocked; apps are not allowed to override that system UI.
+        notification.flags = notification.flags or
+            android.app.Notification.FLAG_ONGOING_EVENT or
+            android.app.Notification.FLAG_NO_CLEAR
+        return notification
+''';
+
+  if (!before.contains(oldBlock)) {
+    fail('VPN notification builder is not in the expected stock 1.1.5 state');
+  }
+
+  final after = before.replaceFirst(oldBlock, newBlock);
+  if (!after.contains(marker) ||
+      !after.contains('Notification.FLAG_NO_CLEAR') ||
+      !after.contains('.setAutoCancel(false)')) {
+    fail('ongoing VPN notification invariant failed');
+  }
+
+  service.writeAsStringSync(after);
+  stdout.writeln('[secure-socks scope fix] VPN notification marked ongoing/no-clear');
+}
+
+void main() {
+  final root = packageRoot();
+  final kotlin =
+      '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless';
+  final core = File('$kotlin/xray/core/XrayCoreManager.kt');
+  final service = File('$kotlin/xray/service/XrayVPNService.kt');
+
+  if (!core.existsSync()) fail('XrayCoreManager.kt is missing');
+  if (!service.existsSync()) fail('XrayVPNService.kt is missing');
+
+  patchCoreScope(core);
+  patchOngoingNotification(service);
+  stdout.writeln('[secure-socks scope fix] scope and notification patch ready');
+}

tool/patch_flutter_vless_secure_socks_v2.dart

@@ -0,0 +1,746 @@
+import 'dart:convert';
+import 'dart:io';
+
+const packageName = 'flutter_vless_android';
+const expectedVersionFragment = 'flutter_vless_android-1.1.5';
+
+Never fail(String message) {
+  stderr.writeln('[secure-socks patch] $message');
+  exit(1);
+}
+
+Directory packageRoot() {
+  final configFile = File('.dart_tool/package_config.json');
+  if (!configFile.existsSync()) {
+    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
+  }
+  final decoded = jsonDecode(configFile.readAsStringSync());
+  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
+    fail('package_config.json is invalid');
+  }
+
+  Map<String, dynamic>? package;
+  for (final item in decoded['packages'] as List) {
+    if (item is Map && item['name'] == packageName) {
+      package = Map<String, dynamic>.from(item);
+      break;
+    }
+  }
+  if (package == null) fail('$packageName was not found');
+
+  final rootUriValue = package['rootUri'];
+  if (rootUriValue is! String || rootUriValue.isEmpty) {
+    fail('$packageName has no rootUri');
+  }
+  final rootUri = Uri.parse(rootUriValue);
+  final resolved = rootUri.hasScheme
+      ? rootUri
+      : configFile.parent.absolute.uri.resolveUri(rootUri);
+  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
+
+  final root = Directory.fromUri(resolved);
+  final normalized = root.absolute.path.replaceAll('\\', '/');
+  if (!normalized.contains(expectedVersionFragment)) {
+    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
+  }
+  return root;
+}
+
+String replaceOnce(
+  String text,
+  String oldValue,
+  String newValue,
+  String label,
+) {
+  if (text.contains(newValue)) return text;
+  if (!text.contains(oldValue)) fail('missing expected source block: $label');
+  return text.replaceFirst(oldValue, newValue);
+}
+
+void writeIfChanged(File file, String before, String after) {
+  if (before == after) {
+    stdout.writeln('[secure-socks patch] already current: ${file.path}');
+    return;
+  }
+  file.writeAsStringSync(after);
+  stdout.writeln('[secure-socks patch] patched: ${file.path}');
+}
+
+void patchCore(File file) {
+  final before = file.readAsStringSync();
+  var text = before;
+
+  const secureValidation = r'''        var secureSocksEnabled = false
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.optJSONObject(i) ?: continue
+            if (inbound.optString("tag") != "revolt-secure-socks") continue
+
+            val settings = inbound.optJSONObject("settings")
+                ?: throw IllegalStateException("Secure SOCKS5 settings are missing")
+            val users = settings.optJSONArray("users")
+                ?: throw IllegalStateException("Secure SOCKS5 users are missing")
+            val account = users.optJSONObject(0)
+                ?: throw IllegalStateException("Secure SOCKS5 account is missing")
+            val port = inbound.optInt("port", -1)
+
+            if (inbound.optString("protocol") != "socks" ||
+                inbound.optString("listen") != "127.0.0.1" ||
+                port <= 1024 || port > 65535 ||
+                settings.optString("auth") != "password" ||
+                account.optString("user").isEmpty() ||
+                account.optString("pass").isEmpty()
+            ) {
+                throw IllegalStateException("Secure SOCKS5 session is invalid")
+            }
+
+            config.LOCAL_SOCKS5_PORT = port
+            config.LOCAL_HTTP_PORT = 0
+            secureSocksEnabled = true
+            break
+        }
+
+''';
+
+  if (!text.contains('var secureSocksEnabled = false')) {
+    text = replaceOnce(
+      text,
+      '        val usedPorts = mutableSetOf<Int>()\n',
+      '$secureValidation        val usedPorts = mutableSetOf<Int>()\n',
+      'secure SOCKS validation insertion',
+    );
+  }
+
+  text = replaceOnce(
+    text,
+    '        if (!hasHttpOnLocalPort) {\n',
+    '        if (!secureSocksEnabled && !hasHttpOnLocalPort) {\n',
+    'disable unauthenticated HTTP proxy in secure mode',
+  );
+
+  if (!text.contains('val process = pb.start()')) {
+    text = replaceOnce(
+      text,
+      '            xrayProcess = pb.start()\n',
+      '            val process = pb.start()\n            xrayProcess = process\n',
+      'capture Xray process identity',
+    );
+    text = replaceOnce(
+      text,
+      '            if (xrayProcess?.isAlive != true) {\n',
+      '            if (!process.isAlive) {\n',
+      'Xray startup liveness',
+    );
+    text = replaceOnce(
+      text,
+      '                val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()\n',
+      '                val output = process.inputStream.bufferedReader().readText()\n',
+      'Xray startup output',
+    );
+  }
+
+  if (!text.contains('Could not delete ephemeral Xray config')) {
+    const connectedLine =
+        '            AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED\n';
+    const deleteConfig = r'''            // config.json contains per-session SOCKS credentials. Xray has
+            // consumed it after the startup liveness check, so remove it now.
+            try {
+                val ephemeralConfig = File(configFilesDir, "config.json")
+                if (ephemeralConfig.exists() && !ephemeralConfig.delete()) {
+                    Log.w(TAG, "Could not delete ephemeral Xray config")
+                }
+            } catch (e: Exception) {
+                Log.w(TAG, "Could not delete ephemeral Xray config", e)
+            }
+
+''';
+    text = replaceOnce(
+      text,
+      connectedLine,
+      '$deleteConfig$connectedLine',
+      'ephemeral config deletion',
+    );
+  }
+
+  if (!text.contains('context.handleXrayCoreExit(config)')) {
+    text = replaceOnce(
+      text,
+      '                    xrayProcess?.inputStream?.bufferedReader()?.use { reader ->\n',
+      '                    process.inputStream.bufferedReader().use { reader ->\n',
+      'Xray monitor process stream',
+    );
+    text = replaceOnce(
+      text,
+      '                    val exitCode = xrayProcess?.waitFor()\n',
+      '                    val exitCode = process.waitFor()\n',
+      'Xray monitor process wait',
+    );
+
+    const oldExit = r'''                    if (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED) {
+                        // Unexpected exit
+                        stopCore(context)
+                    }
+''';
+    const newExit = r'''                    if (xrayProcess === process &&
+                        AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED
+                    ) {
+                        // Hold the Android TUN while the core is recovered. Killing
+                        // the VPN service here would allow direct-network fallback.
+                        xrayProcess = null
+                        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+                        if (context is XrayVPNService) {
+                            context.handleXrayCoreExit(config)
+                        } else {
+                            stopCore(context)
+                        }
+                    }
+''';
+    text = replaceOnce(text, oldExit, newExit, 'Xray fail-closed recovery');
+  }
+
+  writeIfChanged(file, before, text);
+}
+
+void patchService(File file) {
+  final before = file.readAsStringSync();
+  var text = before;
+
+  if (!text.contains('private var recoveringXray = false')) {
+    text = replaceOnce(
+      text,
+      '    private var isRunning = false\n',
+      '    @Volatile private var isRunning = false\n'
+          '    @Volatile private var recoveringXray = false\n'
+          '    private var currentConfig: XrayConfig? = null\n',
+      'service recovery fields',
+    );
+  }
+
+  if (!text.contains('private data class PersistedSession(')) {
+    const persistenceHelpers = r'''    private data class PersistedSession(
+        val proxyOnly: Boolean,
+        val config: XrayConfig,
+        val sessionExpiresAtMs: Long,
+    ) : java.io.Serializable
+
+    private var proxyOnlyMode = false
+    private var sessionExpiresAtMs = 0L
+
+    private val expiryHandler = android.os.Handler(android.os.Looper.getMainLooper())
+    private val expiryRunnable = Runnable {
+        if (sessionExpiresAtMs > 0 && System.currentTimeMillis() >= sessionExpiresAtMs) {
+            Log.w(TAG, "Session expired; tearing down VPN")
+            sessionExpiresAtMs = 0L
+            cancelExpiryAlarm()
+            postSessionExpiredNotification()
+            deletePersistedSession()
+            stopAll()
+        }
+    }
+
+    private fun scheduleExpiryCheck() {
+        expiryHandler.removeCallbacks(expiryRunnable)
+        if (sessionExpiresAtMs > 0) {
+            val delay = (sessionExpiresAtMs - System.currentTimeMillis()).coerceAtLeast(0)
+            expiryHandler.postDelayed(expiryRunnable, delay)
+        }
+        scheduleExpiryAlarm()
+    }
+
+    private fun scheduleExpiryAlarm() {
+        cancelExpiryAlarm()
+        if (sessionExpiresAtMs <= 0) return
+        try {
+            val alarmManager = getSystemService(android.content.Context.ALARM_SERVICE) as android.app.AlarmManager
+            try {
+                alarmManager.setExactAndAllowWhileIdle(
+                    android.app.AlarmManager.RTC_WAKEUP,
+                    sessionExpiresAtMs,
+                    sessionExpiredPendingIntent(),
+                )
+            } catch (e: SecurityException) {
+                alarmManager.setAndAllowWhileIdle(
+                    android.app.AlarmManager.RTC_WAKEUP,
+                    sessionExpiresAtMs,
+                    sessionExpiredPendingIntent(),
+                )
+            }
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to schedule expiry alarm", e)
+        }
+    }
+
+    private fun cancelExpiryAlarm() {
+        try {
+            val alarmManager = getSystemService(android.content.Context.ALARM_SERVICE) as android.app.AlarmManager
+            alarmManager.cancel(sessionExpiredPendingIntent())
+        } catch (e: Exception) {
+        }
+    }
+
+    private fun sessionExpiredPendingIntent(): android.app.PendingIntent {
+        val intent = Intent(this, XrayVPNService::class.java)
+        intent.putExtra("SESSION_EXPIRED", true)
+        val flags = android.app.PendingIntent.FLAG_UPDATE_CURRENT or
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                android.app.PendingIntent.FLAG_IMMUTABLE
+            } else {
+                0
+            }
+        return android.app.PendingIntent.getService(this, 1001, intent, flags)
+    }
+
+    private fun persistSession() {
+        val config = currentConfig ?: return
+        try {
+            java.io.ObjectOutputStream(
+                java.io.FileOutputStream(File(filesDir, "active_session.bin")),
+            ).use { it.writeObject(PersistedSession(proxyOnlyMode, config, sessionExpiresAtMs)) }
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to persist active session", e)
+        }
+    }
+
+    private fun loadPersistedSession(): PersistedSession? {
+        return try {
+            val file = File(filesDir, "active_session.bin")
+            if (!file.exists()) return null
+            java.io.ObjectInputStream(java.io.FileInputStream(file)).use {
+                it.readObject() as? PersistedSession
+            }
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to restore persisted session", e)
+            null
+        }
+    }
+
+    private fun deletePersistedSession() {
+        try {
+            File(filesDir, "active_session.bin").delete()
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to delete persisted session", e)
+        }
+    }
+
+    private fun postSessionExpiredNotification() {
+        try {
+            createNotificationChannel()
+            val launchIntent = packageManager.getLaunchIntentForPackage(packageName)
+            val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                android.app.PendingIntent.FLAG_IMMUTABLE or android.app.PendingIntent.FLAG_UPDATE_CURRENT
+            } else {
+                android.app.PendingIntent.FLAG_UPDATE_CURRENT
+            }
+            val contentIntent = if (launchIntent != null) {
+                android.app.PendingIntent.getActivity(this, 0, launchIntent, flags)
+            } else {
+                null
+            }
+            val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                android.app.Notification.Builder(this, "vpn_service_channel")
+            } else {
+                @Suppress("DEPRECATION")
+                android.app.Notification.Builder(this)
+            }
+            builder
+                .setContentTitle("Revolt VPN")
+                .setContentText("Session expired. Reconnect to continue.")
+                .setSmallIcon(android.R.drawable.ic_dialog_info)
+                .setAutoCancel(true)
+            if (contentIntent != null) {
+                builder.setContentIntent(contentIntent)
+            }
+            val manager = getSystemService(android.app.NotificationManager::class.java)
+            manager?.notify(2, builder.build())
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to post session expired notification", e)
+        }
+    }
+''';
+    text = replaceOnce(
+      text,
+      '    override fun onCreate() {\n        super.onCreate()\n    }\n',
+      '    override fun onCreate() {\n        super.onCreate()\n    }\n\n$persistenceHelpers',
+      'session persistence helpers',
+    );
+  }
+
+  // Snapshot the running config so a START_STICKY restart can re-establish it.
+  if (!text.contains('                currentConfig = config\n')) {
+    text = replaceOnce(
+      text,
+      '                cleanup()\n',
+      '                cleanup()\n                currentConfig = config\n',
+      'runtime config snapshot',
+    );
+  }
+
+  text = replaceOnce(
+    text,
+    '                val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false)\n',
+    '                val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false)\n                proxyOnlyMode = proxyOnly\n                persistSession()\n',
+    'persist session snapshot',
+  );
+
+  text = replaceOnce(
+    text,
+    '        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) {\n            stopAll()\n            return START_NOT_STICKY\n        }\n',
+    '        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) {\n            deletePersistedSession()\n            stopAll()\n            return START_NOT_STICKY\n        }\n',
+    'delete session on explicit stop',
+  );
+
+  const oldNullIntent = r'''        if (intent == null) {
+            stopSelf()
+            return START_NOT_STICKY
+        }
+''';
+  const newNullIntent = r'''        if (intent == null) {
+            if (isRunning && currentConfig != null) return START_STICKY
+            val persisted = loadPersistedSession()
+            if (persisted != null) {
+                Log.w(TAG, "Re-establishing VPN from persisted session")
+                createNotificationChannel()
+                val notification = createNotification("VPN Service Running")
+                try {
+                    if (Build.VERSION.SDK_INT >= 34) {
+                        startForeground(1, notification, FOREGROUND_SERVICE_TYPE_SPECIAL_USE)
+                    } else {
+                        startForeground(1, notification)
+                    }
+                } catch (e: Exception) {
+                    Log.e(TAG, "Failed to start foreground", e)
+                }
+                if (XrayCoreManager.isXrayRunning()) {
+                    Log.w(TAG, "Stopping stale Xray core before restart")
+                    XrayCoreManager.stopCore(this)
+                }
+                cleanup()
+                currentConfig = persisted.config
+                proxyOnlyMode = persisted.proxyOnly
+                sessionExpiresAtMs = persisted.sessionExpiresAtMs
+                if (XrayCoreManager.startCore(this, persisted.config)) {
+                    if (!persisted.proxyOnly) {
+                        setupVpn(persisted.config)
+                    } else {
+                        isRunning = true
+                    }
+                    scheduleExpiryCheck()
+                } else {
+                    stopSelf()
+                    return START_NOT_STICKY
+                }
+                return START_STICKY
+            }
+            stopSelf()
+            return START_NOT_STICKY
+        }
+''';
+  text = replaceOnce(
+    text,
+    oldNullIntent,
+    newNullIntent,
+    'null intent lifecycle',
+  );
+
+  text = replaceOnce(
+    text,
+    '        val command = if (Build.VERSION.SDK_INT >= 33) {\n',
+    '        if (intent.getBooleanExtra("SESSION_EXPIRED", false)) {\n            Log.w(TAG, "Session-expiry alarm fired; tearing down VPN")\n            sessionExpiresAtMs = 0L\n            cancelExpiryAlarm()\n            deletePersistedSession()\n            postSessionExpiredNotification()\n            stopAll()\n            return START_NOT_STICKY\n        }\n\n        if (intent.hasExtra("SESSION_EXPIRES_AT_MS")) {\n            sessionExpiresAtMs = intent.getLongExtra("SESSION_EXPIRES_AT_MS", 0L)\n            scheduleExpiryCheck()\n            persistSession()\n            return if (isRunning && currentConfig != null) START_STICKY else START_NOT_STICKY\n        }\n\n        val command = if (Build.VERSION.SDK_INT >= 33) {\n',
+    'session expiry update',
+  );
+
+
+  if (!text.contains('private data class SecureSocksCredentials(')) {
+    const credentialsHelper = r'''    private data class SecureSocksCredentials(
+        val port: Int,
+        val username: String,
+        val password: String,
+    )
+
+    private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? {
+        val inbounds = try {
+            JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds")
+        } catch (_: Exception) {
+            null
+        } ?: return null
+
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.optJSONObject(i) ?: continue
+            if (inbound.optString("tag") != "revolt-secure-socks") continue
+            if (inbound.optString("protocol") != "socks" ||
+                inbound.optString("listen") != "127.0.0.1"
+            ) return null
+
+            val settings = inbound.optJSONObject("settings") ?: return null
+            if (settings.optString("auth") != "password") return null
+            val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null
+            val port = inbound.optInt("port", -1)
+            val username = user.optString("user")
+            val password = user.optString("pass")
+            if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) {
+                return null
+            }
+            return SecureSocksCredentials(port, username, password)
+        }
+        return null
+    }
+
+''';
+    const runComment = r'''    /**
+     * Starts the tun2socks process and initiates the FD transfer.
+     */
+    private fun runTun2socks(config: XrayConfig) {
+''';
+    text = replaceOnce(
+      text,
+      runComment,
+      '$credentialsHelper$runComment',
+      'secure credentials helper',
+    );
+  }
+
+  if (!text.contains('Authenticated ReVolt SOCKS5 inbound missing')) {
+    const commandComment = r'''        // Command to start tun2socks. 
+        // Note: We pass -sock-path to tell it where to listen for the FD.
+''';
+    const securePrelude = r'''        val secure = secureSocksCredentials(config)
+            ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing")
+        config.LOCAL_SOCKS5_PORT = secure.port
+
+''';
+    text = replaceOnce(
+      text,
+      commandComment,
+      '$securePrelude$commandComment',
+      'secure tun2socks credentials',
+    );
+    text = replaceOnce(
+      text,
+      r'''            "-proxy", "socks5://127.0.0.1:${config.LOCAL_SOCKS5_PORT}",
+''',
+      r'''            "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}",
+''',
+      'authenticated tun2socks URL',
+    );
+    text = replaceOnce(
+      text,
+      r'''        Log.d(TAG, "tun2socks command: ${cmd.joinToString(" ")}")
+''',
+      '        Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")\n',
+      'credential-safe logging',
+    );
+  }
+
+  if (!text.contains('val process = pb.start()\n            tun2socksProcess = process')) {
+    text = replaceOnce(
+      text,
+      '            tun2socksProcess = pb.start()\n',
+      '            val process = pb.start()\n            tun2socksProcess = process\n',
+      'capture tun2socks process identity',
+    );
+    text = replaceOnce(
+      text,
+      '                    tun2socksProcess?.inputStream?.bufferedReader()?.use { reader ->\n',
+      '                    process.inputStream.bufferedReader().use { reader ->\n',
+      'tun2socks monitor stream',
+    );
+    text = replaceOnce(
+      text,
+      '                    tun2socksProcess?.waitFor()\n',
+      '                    process.waitFor()\n',
+      'tun2socks monitor wait',
+    );
+
+    const oldRestart = r'''                    if (isRunning) {
+                        // Restart if crashed and still supposed to be running
+                        Log.e(TAG, "tun2socks exited unexpectedly, restarting...")
+                        runTun2socks(config)
+                    }
+''';
+    const newRestart = r'''                    if (isRunning && tun2socksProcess === process && currentConfig === config) {
+                        Log.e(TAG, "tun2socks exited unexpectedly, recycling without dropping TUN")
+                        Thread.sleep(350)
+                        if (isRunning && currentConfig === config) runTun2socks(config)
+                    }
+''';
+    text = replaceOnce(
+      text,
+      oldRestart,
+      newRestart,
+      'tun2socks crash recovery',
+    );
+    text = replaceOnce(
+      text,
+      '            sendFd()\n',
+      '            sendFd(process)\n',
+      'FD handoff process identity',
+    );
+  }
+
+  const oldStartFailure = r'''        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start tun2socks", e)
+            stopAll()
+        }
+''';
+  const newStartFailure = r'''        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start tun2socks; retrying with TUN held", e)
+            if (isRunning && currentConfig === config) {
+                Thread {
+                    try {
+                        Thread.sleep(600)
+                        if (isRunning && currentConfig === config) runTun2socks(config)
+                    } catch (_: InterruptedException) {}
+                }.start()
+            }
+        }
+''';
+  text = replaceOnce(
+    text,
+    oldStartFailure,
+    newStartFailure,
+    'tun2socks start failure recovery',
+  );
+
+  if (!text.contains('FD handoff failed; recycling tun2socks without dropping TUN')) {
+    const oldSendFd = r'''    private fun sendFd() {
+        val fd = mInterface?.fileDescriptor ?: return
+        val sockFile = File(filesDir, "sock_path").absolutePath
+
+        Thread {
+            var tries = 0
+            while (tries < 10) {
+                try {
+                    Thread.sleep(500)
+                    val localSocket = LocalSocket()
+                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
+                    val out = localSocket.outputStream
+                    // This magic call attaches the FD to the socket message
+                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
+                    out.write(32) // Send a dummy byte to trigger the transfer
+                    localSocket.setFileDescriptorsForSend(null)
+                    localSocket.shutdownOutput()
+                    localSocket.close()
+                    break
+                } catch (e: Exception) {
+                    tries++
+                }
+            }
+        }.start()
+    }
+''';
+    const newSendFd = r'''    private fun sendFd(process: Process) {
+        val fd = mInterface?.fileDescriptor ?: return
+        val sockFile = File(filesDir, "sock_path").absolutePath
+
+        Thread {
+            var tries = 0
+            while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) {
+                var localSocket: LocalSocket? = null
+                try {
+                    Thread.sleep(500)
+                    localSocket = LocalSocket()
+                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
+                    val out = localSocket.outputStream
+                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
+                    out.write(32)
+                    out.flush()
+                    localSocket.setFileDescriptorsForSend(null)
+                    localSocket.shutdownOutput()
+                    localSocket.close()
+                    return@Thread
+                } catch (_: Exception) {
+                    tries++
+                    try { localSocket?.close() } catch (_: Exception) {}
+                }
+            }
+
+            if (isRunning && tun2socksProcess === process) {
+                Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN")
+                try { process.destroy() } catch (_: Exception) {}
+            }
+        }.start()
+    }
+''';
+    text = replaceOnce(text, oldSendFd, newSendFd, 'bounded FD recovery');
+  }
+
+  if (!text.contains('fun handleXrayCoreExit(config: XrayConfig)')) {
+    const cleanupComment = r'''    /**
+     * Cleans up resources (tun2socks process, VPN interface) without stopping the service completely.
+     * Used when restarting or switching configurations.
+     */
+''';
+    const recovery = r'''    fun handleXrayCoreExit(config: XrayConfig) {
+        if (!isRunning || currentConfig !== config || recoveringXray) return
+        recoveringXray = true
+
+        Thread {
+            var attempt = 0
+            try {
+                while (isRunning && currentConfig === config) {
+                    attempt++
+                    Thread.sleep(400L * attempt.coerceAtMost(5))
+                    if (!isRunning || currentConfig !== config) break
+
+                    Log.w(TAG, "Recovering Xray core attempt $attempt")
+                    if (XrayCoreManager.startCore(this, config)) {
+                        Log.w(TAG, "Xray core recovered without dropping TUN")
+                        return@Thread
+                    }
+
+                    if (attempt >= 3) {
+                        attempt = 0
+                        Thread.sleep(3000)
+                    }
+                }
+            } catch (_: InterruptedException) {
+            } finally {
+                recoveringXray = false
+            }
+        }.start()
+    }
+
+''';
+    text = replaceOnce(
+      text,
+      cleanupComment,
+      '$recovery$cleanupComment',
+      'Xray recovery loop',
+    );
+  }
+
+  if (!text.contains('        cancelExpiryAlarm()\n        tun2socksProcess?.destroy()')) {
+    text = replaceOnce(
+      text,
+      '        isRunning = false\n        tun2socksProcess?.destroy()\n',
+      '        isRunning = false\n        recoveringXray = false\n        expiryHandler.removeCallbacks(expiryRunnable)\n        cancelExpiryAlarm()\n        tun2socksProcess?.destroy()\n',
+      'cancel recovery and expiry on cleanup',
+    );
+  }
+
+  if (!text.contains('        currentConfig = null\n        XrayCoreManager.stopCore(this)')) {
+    text = replaceOnce(
+      text,
+      '        cleanup()\n        XrayCoreManager.stopCore(this)\n',
+      '        cleanup()\n        currentConfig = null\n        XrayCoreManager.stopCore(this)\n',
+      'clear config on explicit stop',
+    );
+  }
+
+  writeIfChanged(file, before, text);
+}
+
+void main() {
+  final root = packageRoot();
+  final kotlin = Directory(
+    '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless',
+  );
+  final core = File('${kotlin.path}/xray/core/XrayCoreManager.kt');
+  final service = File('${kotlin.path}/xray/service/XrayVPNService.kt');
+  if (!core.existsSync() || !service.existsSync()) {
+    fail('pinned Android runtime sources are missing');
+  }
+
+  patchCore(core);
+  patchService(service);
+  stdout.writeln('[secure-socks patch] stable-core security patch is ready');
+}