chore(release): prepare 3.3.6

- fix(app): Test Local SOCKS forces a round trip instead of trusting the CONNECT reply - changelog: notification icon + SOCKS test fixes Co-Authored-By: Claude Opus 5.5 <[email protected]>
notification fixed
2026-10-08 13:20:52 +03:00 · 2026-09-06 13:07:37 +03:00 · 2026-09-06 12:37:20 +03:00 · 2026-09-06 12:09:20 +03:00 · 2026-09-06 12:09:20 +03:00 · 2026-09-06 12:09:16 +03:00
72 changed files with 13263 additions and 1908 deletions
@@ -0,0 +1,135 @@
+name: Android CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  android:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Verify Gradle supply chain
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -x android/gradlew
+          test -f android/gradlew.bat
+          test -f android/gradle/wrapper/gradle-wrapper.jar
+          test -s android/gradle/verification-metadata.xml
+          test "$(sha256sum android/gradle/wrapper/gradle-wrapper.jar | awk '{print $1}')" = '7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172'
+          grep -qx 'distributionSha256Sum=efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1' android/gradle/wrapper/gradle-wrapper.properties
+          grep -q '<verify-metadata>true</verify-metadata>' android/gradle/verification-metadata.xml
+          ./android/gradlew --version
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+        with:
+          flutter-version: '3.47.2'
+          channel: stable
+          cache: false
+
+      - name: Create CI app config
+        run: cp lib/logic/app_config.example.dart lib/logic/app_config.dart
+
+      - name: Resolve dependencies
+        run: flutter pub get
+
+      - name: Verify dependency lock is committed
+        run: git diff --exit-code -- pubspec.lock
+
+      - name: Verify vendored runtime provenance
+        if: ${{ hashFiles('local_packages/flutter_vless_android-1.1.5/UPSTREAM') != '' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          PKG='local_packages/flutter_vless_android-1.1.5'
+          test -f "$PKG/UPSTREAM"
+          grep -q 'Tag: v1.1.5' "$PKG/UPSTREAM"
+          grep -q 'path: local_packages/flutter_vless_android-1.1.5' pubspec.yaml
+          ! grep -q 'patchFlutterVless' android/app/build.gradle.kts
+
+      - name: Analyze
+        run: flutter analyze
+
+      - name: Test
+        run: flutter test
+
+      - name: Android lint
+        working-directory: android
+        run: ./gradlew :app:lintDebug --no-daemon
+
+      - name: Verify production release config fails closed
+        shell: bash
+        working-directory: android
+        run: |
+          set -euo pipefail
+          set +e
+          output="$(./gradlew :app:verifyReleaseAppConfig --no-daemon 2>&1)"
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          test "$status" -ne 0
+          grep -Fq 'REVOLT_APP_CONFIG_SHA256 is required for production release builds' <<<"$output"
+
+      - name: Cold APK build
+        run: flutter build apk --debug
+
+      - name: Verify vendored native source stayed immutable
+        run: git diff --exit-code -- local_packages/flutter_vless_android-1.1.5
+
+      - name: Warm APK build
+        run: flutter build apk --debug
+
+      - name: Release R8 smoke build
+        env:
+          REVOLT_CI_RELEASE_SMOKE: 'true'
+        run: |
+          flutter build apk --release
+          test -f build/app/outputs/flutter-apk/app-release.apk
+          test -f build/app/outputs/mapping/release/mapping.txt
+
+      - name: Verify tracked build inputs stayed immutable
+        run: |
+          git diff --exit-code -- \
+            pubspec.yaml \
+            pubspec.lock \
+            local_packages/flutter_vless_android-1.1.5 \
+            android/app/build.gradle.kts \
+            android/app/proguard-rules.pro \
+            android/gradle/verification-metadata.xml \
+            android/gradle/wrapper/gradle-wrapper.properties \
+            android/gradle/wrapper/gradle-wrapper.jar \
+            android/gradlew \
+            android/gradlew.bat
+
+      - name: Upload APK
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: revoltvpn-debug-apk
+          if-no-files-found: error
+          path: build/app/outputs/flutter-apk/app-debug.apk
+
+      - name: Upload resolved lockfile
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: revoltvpn-resolved-lockfile
+          if-no-files-found: error
+          path: pubspec.lock
@@ -5,6 +5,154 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH

 ---

+## [3.3.6] — 2026-10-08
+
+### Fixed
+- **VPN service notification icon.** The ongoing notification now uses the
+  bundled `notification_icon` drawable instead of `notification_status_icon`,
+  and the vendored runtime resolves that drawable by name at runtime (falling
+  back to the platform icon only if it is missing), so the foreground-service
+  notification no longer shows the generic Android info icon.
+- **"Test Local SOCKS" no longer claims an outbound it never tested.** Xray
+  answers a SOCKS `CONNECT` before it dials upstream, so trusting the `0x00`
+  reply reported success for unroutable addresses and for hostnames that can
+  never resolve — meaning the test said OK while the server was down, which is
+  exactly when it gets run. It now forces a request/response round trip through
+  the tunnel and reports distinctly when the outbound never replies, drops the
+  connection, or returns unexpected data.
+
+---
+
+## [3.3.5] — 2026-09-06
+
+### Added
+- **Reproducible release verification.** The release build pins the production
+  `app_config.dart` by SHA-256 and fails closed on any mismatch, so a release
+  APK cannot silently ship a template or wrong server config.
+
+### Changed
+- **Vendored Android runtime.** The pinned `flutter_vless` Android runtime is now
+  vendored in-tree instead of being patched in the pub cache at build time.
+- **Harden the control-plane trust boundary.** `/session/status` fields are
+  strictly validated (nonce, destination IP, port, SNI, XHTTP path), control
+  responses are capped and never follow redirects, and the tunnel destination
+  is pinned to the compiled server — a compromised API can no longer redirect
+  user traffic.
+- **Authenticated local SOCKS5 is now mandatory.** The ephemeral local proxy
+  replaces rather than filters inbounds, so only the authenticated SOCKS5
+  listener can exist.
+- **Fail closed on connection-mode changes.** The mode is persisted before it is
+  applied, and a failed save leaves the UI and runtime unchanged instead of
+  silently selecting a weaker route.
+
+### Fixed
+- Connect button no longer leaks a listener into a disposed `AnimationController`
+  during teardown.
+- Disclosure acknowledgement is only persisted once the user accepts it.
+- Session countdown now uses a monotonic clock (cannot be extended by rolling the
+  device clock back) and a VPN error tears the tunnel down instead of freezing
+  the timer on a live session.
+- The VPN-service notification's disconnect action and countdown re-post are
+  aligned with the vendored runtime.
+
+### Removed
+- Unsupported server-selector UI (single server today; design retained for
+  multi-server later).
+- Unused Flutter dependencies and orphaned assets.
+- Dead Dart wrappers whose native handlers no longer exist.
+
+### Security & privacy
+- IPv6 is captured by the VPN interface (`::/0` route), closing a leak where
+  IPv6 traffic could bypass the tunnel on IPv6-capable carriers.
+
+---
+
+## [3.3.4] — 2026-09-02
+
+### Added
+- **OS-level session-expiry enforcement.** The VPN service now holds an absolute
+  deadline and tears the tunnel down on its own clock — a main-looper handler
+  plus an `AlarmManager` exact alarm (falling back to an inexact alarm on
+  Android 13+ when exact alarms aren't granted). The app pushes
+  `now + expires_in_seconds` on each session sync, so a session ends even if the
+  UI process has been killed.
+- **Session survival across process death.** The service persists the active
+  session and re-establishes it when Android restarts it (`START_STICKY`).
+- **Support-ad extension reflected immediately.** A rewarded "Support us" ad now
+  forces an immediate server sync, so the countdown and expiry deadline update
+  without waiting for the next heartbeat.
+
+### Changed
+- **Session-status beacon slowed.** Foreground poll: 5 s → 60 s; background poll:
+  30 s → 60 s.
+- **Background-reliability guidance.** The "Always-on VPN" settings deep-link was
+  removed; the battery-optimisation exemption remains, with expiry now enforced
+  by the service itself.
+
+### Removed
+- Legacy `ass` connection-mode migration — unrecognized persisted modes now
+  default to TUN.
+
+### Security & privacy
+- Session credentials and the per-user VLESS UUID are now held app-private on
+  disk (`active_session.bin`) for the session's lifetime and removed on
+  disconnect or expiry. Previously they were memory-only.
+
+---
+
+## [3.3.3] — 2026-09-01
+
+### Fixed
+- **The session clock stayed at 00:00:00 on a live tunnel, and the notification
+  countdown froze with it.** `SessionTimer` is built lazily, so when the app reattaches
+  to a tunnel that outlived its UI process, `VpnConnection` had already reported
+  "connected" before the timer existed — and a change listener does not replay events
+  it was not present for. The timer now evaluates the current connection state once at
+  construction instead of waiting for a transition, and is created eagerly alongside
+  `VpnConnection`. Because the timer is what pushes text to the foreground
+  notification, a stopped clock also meant a frozen countdown; both come from this.
+- Resuming the clock no longer requires `adoptedRunningRuntime` or a previous
+  successful sync, both of which are false in a freshly started process. A connected
+  tunnel with a stopped clock is now always treated as something to resume.
+
+## [3.3.2] — 2026-09-01
+
+Background reliability. 3.3.1 could show "connected" against a tunnel that was no
+longer running; this release fixes the cause rather than the symptom, and removes the
+machinery that existed to work around it.
+
+### Added
+- **Background reliability settings.** Android stops background services of apps that
+  are not exempt from Doze, and tears down the process group when a task is swiped
+  away. Two OS mechanisms prevent that, and the app now surfaces both: a one-tap
+  **battery optimisation exemption**, and a deep link to Android's **Always-on VPN**
+  settings (with a note about "Block connections without VPN"). Neither can be enabled
+  programmatically — each needs a single user tap, once.
+
+### Fixed
+- **The app could report "connected" with no traffic flowing.** Startup state came from
+  `getConnectedServerDelay()`, which measures through
+  `AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807`. `AppConfigs` lives in the VPN's
+  own process, so from the UI process it is always null and the port always fell back to
+  10807. That was accidentally correct while the SOCKS port was fixed; 3.3.1's
+  per-session ephemeral ports made it permanently wrong. Liveness is now determined from
+  the OS — whether our VPN service process is running, and whether a VPN transport is
+  actually present.
+- **A frozen countdown could outlive the tunnel.** The foreground notification (id 1) is
+  owned by the VPN service via `startForeground`, but the UI process was posting to the
+  same id. When that process died, its notification stayed on screen with nothing left to
+  update it. The app no longer posts for a runtime that is not alive, and clears a stale
+  notification instead.
+
+### Removed
+- **Standard/Extreme resilience modes** and the runtime-restart machinery behind them.
+  Recovery ran off a disconnect broadcast delivered to the app process, so it could never
+  fire in the case that actually matters — Android killing that process. It was
+  complexity substituting for background persistence.
+- **Startup restoration**, including the config-snapshot rebuild. With the tunnel kept
+  alive by the OS, there is nothing to restore; the app simply reports what is running.
+- The `resilience_mode` preference and its settings tile.
+
 ## [3.3.1] — 2026-08-31

 ### Added
@@ -14,7 +14,7 @@ As a contributor, here are the guidelines we would like you to follow:
  │       │             │
  │       │             └─⫸ Summary in present tense. Not capitalized. No period at the end.
  │       │
-  │       └─⫸ Commit Scope: app|server|xray|nginx|docs|config
+  │       └─⫸ Commit Scope: app|docs|config
  │
  └─⫸ Commit Type: build|ci|docs|feat|fix|perf|refactor|test
 ```
@@ -40,12 +40,12 @@ Must be one of the following:
 The scope should be the part of the project affected:

 * `app` — Flutter client (screens, components, logic)
-* `server` — Python Hivemind backend
-* `xray` — Xray Reality config or tunnel behavior
-* `nginx` — nginx routing, SSL, auth
 * `docs` — documentation files
 * `config` — app_config, .gitignore, pubspec

+The `server`, `xray` and `nginx` components are not in this repository, so
+contributions targeting them cannot be reviewed or tested here.
+
 ##### Summary

 Use the summary field to provide a succinct description of the change:
@@ -65,10 +65,9 @@ You can include a comparison of the previous behavior with the new behavior in o
 #### Examples

 ```
-feat(server): add swarm monitoring endpoint
+feat(app): add a server selector to the settings screen

-GET /api/swarm returns sorted drone list for the TUI dashboard.
-Persistent total GB saved to swarm_total.json, survives restarts.
+Lists the available exit locations and persists the user's choice locally.
 ```

 ```
@@ -1,6 +1,6 @@
 # Privacy Policy

-**Last updated:** August 2026
+**Last updated:** September 2026

 ReVoltVPN is a free VPN service built and operated by ReVolt Team.

@@ -27,7 +27,7 @@ Support ads (the "Support us" button) extend an active session by 30 minutes and

 ## Operational logs

-We keep a short in-memory log buffer (last 200 lines) for debugging and server health monitoring. These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs never leave the server, are not retained after a server restart, and are only accessible to the server operator via local console. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device.
+Server logs are written to the systemd journal (`journalctl -u hivemind`). These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs stay on the server and are accessible only to the server operator via local console; retention follows the server's systemd journal settings. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device.

 ## What we do not collect

@@ -23,7 +23,7 @@ No email. No password. No payment. The ad pays for the server.
 ## Protocol

 - **Transport** — VLESS over XHTTP (HTTP/2 multiplexed, path-hidden behind `/revolt`)
- **Obfuscation** — Xray Reality spoofs `some website's` TLS. To any DPI box, your tunnel looks like a browser visiting that website
+- **Obfuscation** — Xray Reality spoofs a real website's TLS. To any DPI box, your tunnel looks like a browser visiting that website
 - **Encryption** — TLS 1.3 with borrowed certificate (Reality). No certbot, no domain ownership required
 - **API** — Standard HTTPS to a separate domain. Tunnel destination is IP-pinned — domain compromise is DoS only

@@ -2,6 +2,8 @@ include: package:flutter_lints/flutter.yaml

 analyzer:
  exclude:
+    - build/**
+    - android/**
    - local_packages/**
    - whatsthis/**

@@ -1,132 +1,16 @@
 import java.util.Properties
 import java.io.File
 import java.io.FileInputStream
+import java.security.MessageDigest

 plugins {
    id("com.android.application")
    id("dev.flutter.flutter-gradle-plugin")
 }

-val projectRootDir = rootProject.projectDir.parentFile
-val localPropertiesFile = rootProject.file("local.properties")
-val localProperties = Properties().apply {
-    if (localPropertiesFile.exists()) {
-        localPropertiesFile.inputStream().use { load(it) }
-    }
-}
-val flutterSdkPath = localProperties.getProperty("flutter.sdk")
-    ?: throw GradleException("flutter.sdk not set in android/local.properties")
-val dartExecutable = File(
-    flutterSdkPath,
-    if (System.getProperty("os.name").lowercase().contains("windows")) {
-        "bin/cache/dart-sdk/bin/dart.exe"
-    } else {
-        "bin/cache/dart-sdk/bin/dart"
-    },
-)
-val flutterVlessPatchScript = File(
-    projectRootDir,
-    "tool/patch_flutter_vless_allowed_apps.dart",
-)
-val flutterVlessSecureSocksPatchScript = File(
-    projectRootDir,
-    "tool/patch_flutter_vless_secure_socks_v2.dart",
-)
-val flutterVlessSecureSocksScopeFixScript = File(
-    projectRootDir,
-    "tool/patch_flutter_vless_secure_socks_scope_fix.dart",
-)
-
-val patchFlutterVlessAllowedApps = tasks.register<Exec>("patchFlutterVlessAllowedApps") {
-    group = "build setup"
-    description = "Patch pinned flutter_vless_android 1.1.5 with ReVolt routing/runtime hardening"
-    workingDir(projectRootDir)
-
-    doFirst {
-        if (!dartExecutable.isFile) {
-            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
-        }
-        if (!flutterVlessPatchScript.isFile) {
-            throw GradleException("flutter_vless patch script missing: ${flutterVlessPatchScript.absolutePath}")
-        }
-        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
-            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
-        }
-    }
-
-    commandLine(
-        dartExecutable.absolutePath,
-        "run",
-        flutterVlessPatchScript.absolutePath,
-    )
-}
-
-val patchFlutterVlessSecureSocks = tasks.register<Exec>("patchFlutterVlessSecureSocks") {
-    group = "build setup"
-    description = "Add authenticated ephemeral SOCKS5 and fail-closed process recovery to pinned flutter_vless_android 1.1.5"
-    workingDir(projectRootDir)
-    dependsOn(patchFlutterVlessAllowedApps)
-
-    doFirst {
-        if (!dartExecutable.isFile) {
-            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
-        }
-        if (!flutterVlessSecureSocksPatchScript.isFile) {
-            throw GradleException("secure SOCKS patch script missing: ${flutterVlessSecureSocksPatchScript.absolutePath}")
-        }
-        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
-            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
-        }
-    }
-
-    commandLine(
-        dartExecutable.absolutePath,
-        "run",
-        flutterVlessSecureSocksPatchScript.absolutePath,
-    )
-}
-
-val patchFlutterVlessSecureSocksScopeFix = tasks.register<Exec>("patchFlutterVlessSecureSocksScopeFix") {
-    group = "build setup"
-    description = "Repair the secure Xray process monitor capture without changing stock 1.1.5 runtime sequencing"
-    workingDir(projectRootDir)
-    dependsOn(patchFlutterVlessSecureSocks)
-
-    doFirst {
-        if (!dartExecutable.isFile) {
-            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
-        }
-        if (!flutterVlessSecureSocksScopeFixScript.isFile) {
-            throw GradleException("secure SOCKS scope fix script missing: ${flutterVlessSecureSocksScopeFixScript.absolutePath}")
-        }
-        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
-            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
-        }
-    }
-
-    commandLine(
-        dartExecutable.absolutePath,
-        "run",
-        flutterVlessSecureSocksScopeFixScript.absolutePath,
-    )
-}
-
-// App compilation and the transitive Android plugin compilation must both wait
-// for the pinned runtime patches. Plain `flutter build apk` must behave like CI
-// instead of relying on a hidden manual pre-build step.
-tasks.configureEach {
-    if (name == "preBuild") {
-        dependsOn(patchFlutterVlessSecureSocksScopeFix)
-    }
-}
-
-gradle.projectsEvaluated {
-    rootProject.findProject(":flutter_vless_android")
-        ?.tasks
-        ?.matching { it.name == "preBuild" }
-        ?.configureEach {
-            dependsOn(patchFlutterVlessSecureSocksScopeFix)
-        }
+fun sha256Hex(file: File): String {
+    val digest = MessageDigest.getInstance("SHA-256").digest(file.readBytes())
+    return digest.joinToString("") { "%02x".format(it.toInt() and 0xff) }
 }

 android {
@@ -140,10 +24,6 @@ android {
        targetCompatibility = JavaVersion.VERSION_17
    }

-    packaging {
-        resources.excludes.add("META-INF/**")
-    }
-
    val keystorePropertiesFile = rootProject.file("key.properties")
    val keystoreProperties = Properties()
    if (keystorePropertiesFile.exists()) {
@@ -156,6 +36,68 @@ android {
        admobProperties.load(FileInputStream(admobPropertiesFile))
    }

+    // Explicit opt-in used only by GitHub Actions to exercise the real
+    // release/R8 graph. Production release signing and config pinning remain
+    // fail-closed outside that CI smoke path.
+    val ciReleaseSmoke =
+        System.getenv("GITHUB_ACTIONS") == "true" &&
+            System.getenv("REVOLT_CI_RELEASE_SMOKE") == "true"
+
+    val appConfigFile = rootProject.file("../lib/logic/app_config.dart")
+    val verifyReleaseAppConfig = tasks.register("verifyReleaseAppConfig") {
+        group = "verification"
+        description = "Verify the production Dart app config against REVOLT_APP_CONFIG_SHA256."
+        doLast {
+            if (ciReleaseSmoke) {
+                logger.lifecycle("Skipping production app-config pin for CI release smoke build")
+                return@doLast
+            }
+
+            val expected = System.getenv("REVOLT_APP_CONFIG_SHA256")?.trim()?.lowercase()
+            if (expected.isNullOrEmpty()) {
+                throw org.gradle.api.GradleException(
+                    "REVOLT_APP_CONFIG_SHA256 is required for production release builds"
+                )
+            }
+            if (!Regex("[0-9a-f]{64}").matches(expected)) {
+                throw org.gradle.api.GradleException(
+                    "REVOLT_APP_CONFIG_SHA256 must be exactly 64 lowercase hexadecimal characters"
+                )
+            }
+            if (!appConfigFile.isFile) {
+                throw org.gradle.api.GradleException(
+                    "Production app config is missing: ${appConfigFile.absolutePath}"
+                )
+            }
+
+            val configText = appConfigFile.readText()
+            val templateMarkers = listOf(
+                "'0.0.0.0'",
+                "YOUR_DOMAIN",
+                "YOUR_GITHUB_USERNAME",
+                "YOUR_REPO_NAME",
+                "ca-app-pub-0000000000000000/0000000000",
+            )
+            val remainingMarker = templateMarkers.firstOrNull(configText::contains)
+            if (remainingMarker != null) {
+                throw org.gradle.api.GradleException(
+                    "Production app config still contains template marker: $remainingMarker"
+                )
+            }
+
+            val actual = sha256Hex(appConfigFile)
+            if (actual != expected) {
+                throw org.gradle.api.GradleException(
+                    "Production app config SHA-256 mismatch: expected $expected, got $actual"
+                )
+            }
+        }
+    }
+
+    tasks.matching { it.name == "preReleaseBuild" }.configureEach {
+        dependsOn(verifyReleaseAppConfig)
+    }
+
    defaultConfig {
        applicationId = "com.paladinvpn.app"
        minSdk = flutter.minSdkVersion
@@ -176,7 +118,11 @@ android {

    buildTypes {
        release {
-            signingConfig = signingConfigs.getByName("release")
+            signingConfig = if (ciReleaseSmoke) {
+                signingConfigs.getByName("debug")
+            } else {
+                signingConfigs.getByName("release")
+            }
            isMinifyEnabled = true
            isShrinkResources = true
            proguardFiles(
@@ -1,4 +1,4 @@
-# PaladinVPN ProGuard / R8 Rules
+# ReVoltVPN ProGuard / R8 Rules
 # ==============================================================================
 # These rules prevent R8 from stripping classes and methods that are accessed
 # via JNI (Java Native Interface) or reflection, which would cause
@@ -11,9 +11,8 @@
 -keep class xray.** { *; }

 # ── Flutter / Platform Channels ───────────────────────────────────────────────
+# io.flutter.** already includes embedding and plugin subpackages.
 -keep class io.flutter.** { *; }
-keep class io.flutter.embedding.** { *; }
-keep class io.flutter.plugin.** { *; }

 # ── Google Mobile Ads (AdMob) ─────────────────────────────────────────────────
 -keep class com.google.android.gms.ads.** { *; }
@@ -7,6 +7,9 @@
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"/>
    <uses-permission android:name="android.permission.VIBRATE"/>
+    <!-- Doze/App Standby stop background services of non-exempt apps. A VPN
+         cannot stay up without this; Play allows it for VPN functionality. -->
+    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"/>

    <!-- flutter_vless 1.1.5 declares this legacy permission. ReVolt never needs it. -->
    <uses-permission
@@ -11,14 +11,15 @@ import android.net.ConnectivityManager
 import android.net.Network
 import android.net.NetworkCapabilities
 import android.net.NetworkRequest
+import android.net.Uri
 import android.os.Build
+import android.os.PowerManager
 import android.os.VibrationEffect
 import android.os.Vibrator
 import android.os.VibratorManager
+import android.provider.Settings
 import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
-import com.github.tfox.flutter_vless.xray.service.XrayVPNService
-import com.github.tfox.flutter_vless.xray.utils.AppConfigs
 import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
 import io.flutter.plugin.common.EventChannel
@@ -29,6 +30,7 @@ class MainActivity : FlutterActivity() {
    private val notificationChannel = "com.revoltvpn.app/notification"
    private val hapticsChannel = "com.revoltvpn.app/haptics"
    private val networkChannel = "com.revoltvpn.app/network"
+    private val powerChannel = "com.revoltvpn.app/power"

    private var notificationChannelReady = false
    private var networkCallback: ConnectivityManager.NetworkCallback? = null
@@ -46,6 +48,17 @@ class MainActivity : FlutterActivity() {
                }
            }

+        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, powerChannel)
+            .setMethodCallHandler { call, result ->
+                when (call.method) {
+                    "isIgnoringBatteryOptimizations" ->
+                        result.success(isIgnoringBatteryOptimizations())
+                    "requestIgnoreBatteryOptimizations" ->
+                        result.success(requestIgnoreBatteryOptimizations())
+                    else -> result.notImplemented()
+                }
+            }
+
        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, notificationChannel)
            .setMethodCallHandler { call, result ->
                if (call.method == "updateNotificationText") {
@@ -88,6 +101,37 @@ class MainActivity : FlutterActivity() {
        super.onDestroy()
    }

+    private fun isIgnoringBatteryOptimizations(): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
+        return try {
+            val pm = getSystemService(Context.POWER_SERVICE) as PowerManager
+            pm.isIgnoringBatteryOptimizations(packageName)
+        } catch (_: Exception) {
+            false
+        }
+    }
+
+    private fun requestIgnoreBatteryOptimizations(): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
+        if (isIgnoringBatteryOptimizations()) return true
+        return try {
+            startActivity(
+                Intent(
+                    Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS,
+                    Uri.parse("package:$packageName"),
+                ),
+            )
+            true
+        } catch (_: Exception) {
+            try {
+                startActivity(Intent(Settings.ACTION_IGNORE_BATTERY_OPTIMIZATION_SETTINGS))
+                true
+            } catch (_: Exception) {
+                false
+            }
+        }
+    }
+
    private fun updateVpnNotification(title: String, text: String, actionLabel: String) {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
            checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) !=
@@ -105,28 +149,38 @@ class MainActivity : FlutterActivity() {
        }

        val launchIntent = packageManager.getLaunchIntentForPackage(packageName)
-        launchIntent?.action = "FROM_DISCONNECT_BTN"
        launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or
            Intent.FLAG_ACTIVITY_CLEAR_TOP or
            Intent.FLAG_ACTIVITY_NEW_TASK

-        val stopIntent = Intent(this, XrayVPNService::class.java)
-        stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
-        val stopPendingIntent = PendingIntent.getService(this, 0, stopIntent, flags)
+        // The VPN service owns the authoritative Disconnect PendingIntent and
+        // embeds the current runtime-generation token in it. Never recreate an
+        // unscoped STOP intent from the UI process: a stale notification could
+        // otherwise stop a newer tunnel. Reuse the live service action when the
+        // platform exposes it; on older Android versions omit the action rather
+        // than weaken generation scoping.
+        val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        val serviceStopAction = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+            manager.activeNotifications
+                .firstOrNull { it.id == NOTIFICATION_ID }
+                ?.notification
+                ?.actions
+                ?.firstOrNull()
+                ?.actionIntent
+        } else {
+            null
+        }

-        // Public lock-screen preview: keep the VPN status visible but hide the
-        // session countdown/speed so usage metadata never reaches the lock screen.
        val publicVersion = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
-            .setSmallIcon(R.drawable.notification_status_icon)
+            .setSmallIcon(R.drawable.notification_icon)
            .setContentTitle("Revolt VPN")
            .setContentText("VPN is active")
            .build()

        val builder = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
-            .setSmallIcon(R.drawable.notification_status_icon)
+            .setSmallIcon(R.drawable.notification_icon)
            .setContentTitle(title)
            .setContentText(text)
-            .addAction(0, actionLabel, stopPendingIntent)
            .setColorized(true)
            .setColor(0xFF0D1117.toInt())
            .setOngoing(true)
@@ -138,6 +192,10 @@ class MainActivity : FlutterActivity() {
            .setVisibility(NotificationCompat.VISIBILITY_PRIVATE)
            .setPublicVersion(publicVersion)

+        if (serviceStopAction != null) {
+            builder.addAction(0, actionLabel, serviceStopAction)
+        }
+
        if (launchIntent != null) {
            builder.setContentIntent(PendingIntent.getActivity(this, 0, launchIntent, flags))
        }
@@ -344,6 +402,6 @@ class MainActivity : FlutterActivity() {

    companion object {
        private const val NOTIFICATION_ID = 1
-        private const val NOTIFICATION_CHANNEL_ID = "XRAY_SERVICE_CHANNEL"
+        private const val NOTIFICATION_CHANNEL_ID = "REVOLT_VPN_SERVICE"
    }
 }
@@ -0,0 +1,251 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH="\\\"\\\""
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS=-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega
@@ -19,6 +19,7 @@ class _ConnectButtonState extends State<ConnectButton>
  DateTime _lastTap = DateTime.fromMillisecondsSinceEpoch(0);
  AnimationController? _pulse;
  Animation<double>? _pulseAnim;
+  VpnConnection? _vpn;

  double get _pulseValue => _pulseAnim?.value ?? 0.0;

@@ -35,20 +36,25 @@ class _ConnectButtonState extends State<ConnectButton>
    );
    WidgetsBinding.instance.addObserver(this);
    WidgetsBinding.instance.addPostFrameCallback((_) {
-      if (mounted) context.read<VpnConnection>().addListener(_onVpnChanged);
+      if (!mounted || _vpn != null) return;
+      final vpn = context.read<VpnConnection>();
+      _vpn = vpn;
+      vpn.addListener(_onVpnChanged);
+      _onVpnChanged();
    });
  }

  @override
  void dispose() {
    WidgetsBinding.instance.removeObserver(this);
-    context.read<VpnConnection>().removeListener(_onVpnChanged);
+    _vpn?.removeListener(_onVpnChanged);
    _pulse?.dispose();
    super.dispose();
  }

  void _onVpnChanged() {
-    final vpn = context.read<VpnConnection>();
+    final vpn = _vpn;
+    if (vpn == null) return;
    if (vpn.status == VpnStatus.connected) {
      _pulse?.repeat(reverse: true);
    } else {
@@ -60,14 +66,12 @@ class _ConnectButtonState extends State<ConnectButton>
  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
    if (!mounted) return;
-    if (state == AppLifecycleState.paused ||
-        state == AppLifecycleState.detached) {
+    if (state != AppLifecycleState.resumed) {
      _pulse?.stop();
-    } else if (state == AppLifecycleState.resumed) {
-      final vpn = context.read<VpnConnection>();
-      if (vpn.status == VpnStatus.connected) {
-        _pulse?.repeat(reverse: true);
+      return;
    }
+    if (_vpn?.status == VpnStatus.connected) {
+      _pulse?.repeat(reverse: true);
    }
  }

@@ -19,23 +19,28 @@ class DataDisclosureDialog {

    if (!context.mounted) return;

-    await showDialog(
+    final accepted = await showDialog<bool>(
      context: context,
      barrierDismissible: false, // Must tap Continue — no tap-outside dismiss.
-      builder: (_) => _DisclosureDialog(
-        onContinue: () {
-          prefs.setBool(_key, true);
-          Navigator.of(context).pop(); // Dismiss the dialog.
-        },
-      ),
+      builder: (_) => const _DisclosureDialog(),
    );
+    if (accepted != true) return;
+
+    // Persist only after the user action is complete. If storage fails, do not
+    // invent an accepted state; the disclosure will simply reappear later.
+    try {
+      final saved = await prefs.setBool(_key, true);
+      if (!saved) {
+        debugPrint('[Disclosure] Preference write was rejected');
+      }
+    } catch (e) {
+      debugPrint('[Disclosure] Failed to persist acknowledgement: $e');
+    }
  }
 }

 class _DisclosureDialog extends StatelessWidget {
-  final VoidCallback onContinue;
-
-  const _DisclosureDialog({required this.onContinue});
+  const _DisclosureDialog();

  @override
  Widget build(BuildContext context) {
@@ -49,7 +54,6 @@ class _DisclosureDialog extends StatelessWidget {
          mainAxisSize: MainAxisSize.min,
          crossAxisAlignment: CrossAxisAlignment.start,
          children: [
-            // Title
            const Text(
              'Before you connect',
              style: TextStyle(
@@ -59,8 +63,6 @@ class _DisclosureDialog extends StatelessWidget {
              ),
            ),
            const SizedBox(height: 16),
-
-            // Body
            const Text(
              'Revolt VPN creates a secure VPN tunnel to protect your '
              'traffic. To enforce your data/time quota, we log your '
@@ -76,12 +78,10 @@ class _DisclosureDialog extends StatelessWidget {
              ),
            ),
            const SizedBox(height: 24),
-
-            // Continue button — full-width, accent
            SizedBox(
              width: double.infinity,
              child: ElevatedButton(
-                onPressed: onContinue,
+                onPressed: () => Navigator.of(context).pop(true),
                style: ElevatedButton.styleFrom(
                  backgroundColor: AppColors.accent,
                  foregroundColor: AppColors.bgDeep,
@@ -182,7 +182,7 @@ class _LightningPainter extends CustomPainter {

  @override
  void paint(Canvas canvas, Size size) {
-    final toScreen = (Offset p) => Offset(p.dx * size.width, p.dy * size.height);
+    Offset toScreen(Offset p) => Offset(p.dx * size.width, p.dy * size.height);
    final scaledMain = bolt.mainPath.map(toScreen).toList();
    final scaledBranches = bolt.branches
        .map((b) => b.map(toScreen).toList())
@@ -14,8 +14,8 @@ class DiscordLinkButton extends StatelessWidget {

  @override
  Widget build(BuildContext context) {
-    return IconButton(
-      icon: const Icon(Icons.discord, color: AppColors.textWhite, size: 28),
+    return const IconButton(
+      icon: Icon(Icons.discord, color: AppColors.textWhite, size: 28),
      onPressed: launchDiscord,
      tooltip: 'Join Discord',
      splashRadius: 24,
@@ -76,8 +76,8 @@ class GdprButton extends StatelessWidget {

  @override
  Widget build(BuildContext context) {
-    return IconButton(
-      icon: const Icon(Icons.admin_panel_settings_outlined,
+    return const IconButton(
+      icon: Icon(Icons.admin_panel_settings_outlined,
          color: AppColors.textWhite, size: 28),
      onPressed: showConsentForm,
      tooltip: 'Ad consent & privacy choices',
@@ -14,8 +14,8 @@ class InfoButton extends StatelessWidget {

  @override
  Widget build(BuildContext context) {
-    return IconButton(
-      icon: const Icon(Icons.help_outline, color: AppColors.textWhite, size: 28),
+    return const IconButton(
+      icon: Icon(Icons.help_outline, color: AppColors.textWhite, size: 28),
      onPressed: launchGitHub,
      tooltip: 'About ReVoltVPN',
      splashRadius: 24,
@@ -14,8 +14,8 @@ class PrivacyPolicyButton extends StatelessWidget {

  @override
  Widget build(BuildContext context) {
-    return IconButton(
-      icon: const Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28),
+    return const IconButton(
+      icon: Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28),
      onPressed: launchPrivacyPolicy,
      tooltip: 'Privacy Policy',
      splashRadius: 24,
@@ -14,8 +14,8 @@ class WebsiteButton extends StatelessWidget {

  @override
  Widget build(BuildContext context) {
-    return IconButton(
-      icon: const Icon(Icons.language, color: AppColors.textWhite, size: 28),
+    return const IconButton(
+      icon: Icon(Icons.language, color: AppColors.textWhite, size: 28),
      onPressed: launchWebsite,
      tooltip: 'Website',
      splashRadius: 24,
@@ -1,11 +1,9 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
-import 'package:revoltvpn/logic/app_colors.dart';
-import 'package:revoltvpn/logic/vpn_connection.dart';
-import 'package:revoltvpn/logic/session_timer.dart';
-import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/components/online_dot.dart';
-import 'package:revoltvpn/screens/server_selector/selection_screen.dart';
+import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/logic/session_timer.dart';
+import 'package:revoltvpn/logic/vpn_connection.dart';

 class StatusBar extends StatelessWidget {
  const StatusBar({super.key});
@@ -26,37 +24,12 @@ class StatusBar extends StatelessWidget {
                ? 'Connecting…'
                : (vpn.serverReachable ? 'Ready' : 'Offline'));

-        final server = context.watch<ServerList>().selected;
-
        return Padding(
          padding: const EdgeInsets.symmetric(horizontal: 24),
          child: Column(
            mainAxisSize: MainAxisSize.min,
            children: [
-              GestureDetector(
-                onTap: () {
-                  Navigator.of(context).push(
-                    PageRouteBuilder(
-                      transitionDuration: const Duration(milliseconds: 300),
-                      pageBuilder: (_, __, ___) => const SelectionScreen(),
-                      transitionsBuilder: (_, animation, __, child) {
-                        return SlideTransition(
-                          position: Tween<Offset>(
-                            begin: const Offset(1.0, 0.0),
-                            end: Offset.zero,
-                          ).animate(
-                            CurvedAnimation(
-                              parent: animation,
-                              curve: Curves.easeOut,
-                            ),
-                          ),
-                          child: child,
-                        );
-                      },
-                    ),
-                  );
-                },
-                child: Container(
+              Container(
                padding:
                    const EdgeInsets.symmetric(horizontal: 20, vertical: 12),
                decoration: BoxDecoration(
@@ -66,12 +39,16 @@ class StatusBar extends StatelessWidget {
                ),
                child: Row(
                  children: [
-                      Image.asset(server.flagAsset, width: 20, height: 20),
+                    Image.asset(
+                      'assets/finland_flag_256.png',
+                      width: 20,
+                      height: 20,
+                    ),
                    const SizedBox(width: 8),
-                      Expanded(
+                    const Expanded(
                      child: Text(
-                          server.name,
-                          style: const TextStyle(
+                        'Helsinki, Finland',
+                        style: TextStyle(
                          color: AppColors.accent,
                          fontWeight: FontWeight.w600,
                          fontSize: 13,
@@ -79,15 +56,9 @@ class StatusBar extends StatelessWidget {
                        ),
                      ),
                    ),
-                      const Icon(
-                        Icons.chevron_right,
-                        color: AppColors.textDim,
-                        size: 20,
-                      ),
                  ],
                ),
              ),
-              ),
              const SizedBox(height: 8),
              Container(
                padding:
@@ -34,6 +34,7 @@ class _SupportButtonState extends State<SupportButton> {
      final rewarded = await ad.showAd('support');
      if (rewarded) {
        await timer.markSupportRewardClaimed();
+        await timer.syncNow();
      }
    } finally {
      if (mounted) setState(() => _busy = false);
@@ -1,20 +1,17 @@
+import 'package:flutter/foundation.dart';
 import 'package:shared_preferences/shared_preferences.dart';

 enum ConnectionMode { tun, proxy }
-enum ResilienceMode { standard, extreme }

 abstract final class ConnectionSettings {
  ConnectionSettings._();

  static const String _modeKey = 'connection_mode';
-  static const String _resilienceModeKey = 'resilience_mode';

  static ConnectionMode _mode = ConnectionMode.tun;
-  static ResilienceMode _resilienceMode = ResilienceMode.standard;
  static bool _initialized = false;

  static ConnectionMode get mode => _mode;
-  static ResilienceMode get resilienceMode => _resilienceMode;

  static Future<void> initialize() async {
    if (_initialized) return;
@@ -22,35 +19,37 @@ abstract final class ConnectionSettings {
    final prefs = await SharedPreferences.getInstance();
    final storedMode = prefs.getString(_modeKey);

-    // Legacy 'ass' was the pre-V3 SOCKS5 label; map it to proxy. Everything
-    // else (including the old 'auto') is TUN — there is no runtime auto mode.
-    _mode = storedMode == ConnectionMode.proxy.name || storedMode == 'ass'
+    // Only the explicit current proxy value restores SOCKS5. Unknown and
+    // obsolete values, including the pre-V3 'auto' label, fail closed to
+    // full-tunnel TUN instead of silently selecting a weaker route.
+    _mode = storedMode == ConnectionMode.proxy.name
        ? ConnectionMode.proxy
        : ConnectionMode.tun;

-    _resilienceMode =
-        prefs.getString(_resilienceModeKey) == ResilienceMode.extreme.name
-            ? ResilienceMode.extreme
-            : ResilienceMode.standard;
-
    if (storedMode != _mode.name) {
-      await prefs.setString(_modeKey, _mode.name);
+      // Best-effort. _mode is already the safe TUN default in memory, so a
+      // failed write leaves nothing insecure — it only means the migration
+      // is retried next launch. initialize() runs from main() before
+      // runApp(), with no zone guard, so throwing here would black-screen
+      // the app on the fresh-install path for no security gain.
+      final migrated = await prefs.setString(_modeKey, _mode.name);
+      if (!migrated) {
+        debugPrint('[ConnectionSettings] Could not persist migrated mode.');
+      }
    }

    _initialized = true;
  }

-  static Future<void> setMode(ConnectionMode mode) async {
+  static Future<bool> setMode(ConnectionMode mode) async {
+    if (_initialized && _mode == mode) return true;
+
+    final prefs = await SharedPreferences.getInstance();
+    final saved = await prefs.setString(_modeKey, mode.name);
+    if (!saved) return false;
+
    _mode = mode;
    _initialized = true;
-    final prefs = await SharedPreferences.getInstance();
-    await prefs.setString(_modeKey, mode.name);
-  }
-
-  static Future<void> setResilienceMode(ResilienceMode mode) async {
-    _resilienceMode = mode;
-    _initialized = true;
-    final prefs = await SharedPreferences.getInstance();
-    await prefs.setString(_resilienceModeKey, mode.name);
+    return true;
  }
 }
@@ -13,6 +13,7 @@ class HivemindService {

  static const _ua = 'Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 '
      '(KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36';
+  static const int _maxControlResponseBytes = 256 * 1024;
  static const _pollBackoff = <Duration>[
    Duration(seconds: 1),
    Duration(seconds: 2),
@@ -24,10 +25,61 @@ class HivemindService {
    Uri uri, {
    Duration timeout = const Duration(seconds: 5),
  }) {
-    return http.get(uri, headers: {'User-Agent': _ua}).timeout(timeout);
+    return controlGet(uri, timeout: timeout);
  }

-  static void cancel() => _currentCallId++;
+  static Future<http.Response> controlGet(
+    Uri uri, {
+    Duration timeout = const Duration(seconds: 5),
+  }) async {
+    final client = http.Client();
+    final request = http.Request('GET', uri)
+      ..headers['User-Agent'] = _ua
+      ..followRedirects = false;
+
+    Future<http.Response> read() async {
+      final streamed = await client.send(request);
+      final declaredLength = streamed.contentLength;
+      if (declaredLength != null && declaredLength > _maxControlResponseBytes) {
+        throw const FormatException('Control response is too large.');
+      }
+
+      final bytes = <int>[];
+      await for (final chunk in streamed.stream) {
+        if (bytes.length + chunk.length > _maxControlResponseBytes) {
+          throw const FormatException('Control response is too large.');
+        }
+        bytes.addAll(chunk);
+      }
+
+      return http.Response.bytes(
+        bytes,
+        streamed.statusCode,
+        headers: streamed.headers,
+        isRedirect: streamed.isRedirect,
+        persistentConnection: streamed.persistentConnection,
+        reasonPhrase: streamed.reasonPhrase,
+        request: request,
+      );
+    }
+
+    try {
+      return await read().timeout(
+        timeout,
+        onTimeout: () {
+          client.close();
+          throw TimeoutException('Control request timed out.', timeout);
+        },
+      );
+    } finally {
+      client.close();
+    }
+  }
+
+  static void cancel() {
+    _currentCallId++;
+    _expectedNonce = null;
+  }

  static void setExpectedNonce(String nonce) {
    _expectedNonce = nonce;
@@ -37,13 +89,19 @@ class HivemindService {
    void Function(int attempt, int total)? onAttempt,
    bool skipAdBypass = false,
  }) async {
-    final deviceId = await CryptoService.getDeviceId();
+    // Capture the generation before the first await. Otherwise a disconnect
+    // that lands while secure storage is resolving the device ID can be lost
+    // and the cancelled call can resume network work with a fresh generation.
    final callId = ++_currentCallId;
+    final deviceId = await CryptoService.getDeviceId();
+    _throwIfCancelled(callId);
+
    final nonce = _newNonce();
    _expectedNonce = nonce;

    if (!skipAdBypass) {
      await _runConfiguredBypass(deviceId, nonce);
+      _throwIfCancelled(callId);
    }

    const maxAttempts = 5;
@@ -53,6 +111,7 @@ class HivemindService {

      try {
        final session = await _fetchActiveSession(deviceId, nonce);
+        _throwIfCancelled(callId);
        if (session != null) {
          _expectedNonce = null;
          return session.toVlessUrl();
@@ -73,7 +132,7 @@ class HivemindService {

  static Future<bool> checkHealth() async {
    try {
-      final response = await directGet(
+      final response = await controlGet(
        _publicUrl('/health'),
        timeout: const Duration(seconds: 3),
      );
@@ -109,15 +168,15 @@ class HivemindService {
    final statusUri = _publicUrl('/session/status').replace(
      queryParameters: {'device_id': deviceId},
    );
-    final response = await directGet(statusUri);
+    final response = await controlGet(statusUri);
    if (response.statusCode != 200) return null;

    final decoded = jsonDecode(response.body);
    if (decoded is! Map<String, dynamic>) return null;

    final serverNonce = decoded['nonce'];
-    if (_expectedNonce != null &&
-        serverNonce is String &&
+    if (_expectedNonce != nonce ||
+        serverNonce is! String ||
        serverNonce != nonce) {
      return null;
    }
@@ -141,6 +200,13 @@ class HivemindService {
 }

 class _HivemindSessionConfig {
+  static final RegExp _uuidPattern = RegExp(
+    r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$',
+    caseSensitive: false,
+  );
+  static final RegExp _shortIdPattern =
+      RegExp(r'^[0-9a-f]{0,16}$', caseSensitive: false);
+
  final String uuid;
  final String host;
  final int port;
@@ -162,50 +228,174 @@ class _HivemindSessionConfig {
  });

  factory _HivemindSessionConfig.fromJson(Map<String, dynamic> json) {
-    final uuid = _requiredString(json, 'vless_uuid');
-    final host = _stringOr(json['vless_ip'], AppConfig.serverIp);
-    final port = _portOr(json['vless_port'], 443);
-    final sni = _requiredString(json, 'reality_sni');
+    final uuid = _requiredString(json, 'vless_uuid', maxLength: 64);
+    if (!_uuidPattern.hasMatch(uuid)) {
+      throw const FormatException('Invalid VLESS UUID');
+    }
+
+    // The API may rotate credentials and Reality parameters, but it must never
+    // choose the tunnel destination. Keep that trust anchor compiled into the
+    // app so an API/domain compromise can cause denial of service, not redirect
+    // VPN traffic to an attacker-controlled server.
+    final pinnedHost = _validatedPublicIp(AppConfig.serverIp, 'serverIp');
+    final advertisedHost = json['vless_ip'];
+    if (advertisedHost != null) {
+      if (advertisedHost is! String || advertisedHost.trim() != pinnedHost) {
+        throw const FormatException(
+          'Session VLESS host does not match compiled server pin',
+        );
+      }
+    }
+    final host = pinnedHost;
+
+    final advertisedPort = json['vless_port'];
+    if (advertisedPort != null &&
+        (advertisedPort is! num || advertisedPort.toInt() != 443)) {
+      throw const FormatException('Session VLESS port does not match compiled pin');
+    }
+    const port = 443;
+    final sni = _validatedHost(
+      _requiredString(json, 'reality_sni', maxLength: 253),
+      'reality_sni',
+    );
+    final publicKey = _requiredString(json, 'reality_pbk', maxLength: 128);
+    final shortId = _stringOr(json['reality_sid'], '').trim();
+    if (!_shortIdPattern.hasMatch(shortId)) {
+      throw const FormatException('Invalid Reality short ID');
+    }
+
+    final fingerprint =
+        _boundedString(json['reality_fp'], AppConfig.realityFp, 32, 'reality_fp');
+    final path =
+        _boundedString(json['xhttp_path'], AppConfig.vlessPath, 2048, 'xhttp_path');
+    if (!path.startsWith('/')) {
+      throw const FormatException('Invalid XHTTP path');
+    }

    return _HivemindSessionConfig(
      uuid: uuid,
      host: host,
      port: port,
-      publicKey: _stringOr(json['reality_pbk'], ''),
-      shortId: _stringOr(json['reality_sid'], ''),
+      publicKey: publicKey,
+      shortId: shortId,
      sni: sni,
-      fingerprint: _stringOr(json['reality_fp'], AppConfig.realityFp),
-      path: _stringOr(json['xhttp_path'], AppConfig.vlessPath),
+      fingerprint: fingerprint,
+      path: path,
    );
  }

  String toVlessUrl() {
-    return 'vless://$uuid@$host:$port'
-        '?security=${AppConfig.vlessSecurity}'
-        '&type=${AppConfig.vlessType}'
-        '&path=$path'
-        '&pbk=${Uri.encodeComponent(publicKey)}'
-        '&sni=${Uri.encodeComponent(sni)}'
-        '&sid=${Uri.encodeComponent(shortId)}'
-        '&fp=${Uri.encodeComponent(fingerprint)}'
-        '#Revolt VPN';
+    return Uri(
+      scheme: 'vless',
+      userInfo: uuid,
+      host: host,
+      port: port,
+      queryParameters: <String, String>{
+        'security': AppConfig.vlessSecurity,
+        'type': AppConfig.vlessType,
+        'path': path,
+        'pbk': publicKey,
+        'sni': sni,
+        'sid': shortId,
+        'fp': fingerprint,
+      },
+      fragment: 'Revolt VPN',
+    ).toString();
  }

-  static String _requiredString(Map<String, dynamic> json, String key) {
+  static String _requiredString(
+    Map<String, dynamic> json,
+    String key, {
+    int maxLength = 4096,
+  }) {
    final value = json[key];
-    if (value is String && value.trim().isNotEmpty) return value.trim();
+    if (value is! String) {
      throw FormatException('Missing required session field: $key');
    }
+    final trimmed = value.trim();
+    if (trimmed.isEmpty || trimmed.length > maxLength) {
+      throw FormatException('Invalid session field: $key');
+    }
+    return trimmed;
+  }

  static String _stringOr(Object? value, String fallback) {
-    return value is String && value.isNotEmpty ? value : fallback;
+    return value is String && value.trim().isNotEmpty ? value.trim() : fallback;
  }

-  static int _portOr(Object? value, int fallback) {
-    final parsed = value is num ? value.toInt() : fallback;
-    if (parsed <= 0 || parsed > 65535) {
-      throw const FormatException('Invalid VLESS port');
+  static String _boundedString(
+    Object? value,
+    String fallback,
+    int maxLength,
+    String field,
+  ) {
+    final result = _stringOr(value, fallback);
+    if (result.isEmpty || result.length > maxLength) {
+      throw FormatException('Invalid session field: $field');
    }
-    return parsed;
+    return result;
+  }
+
+  static String _validatedHost(String input, String field) {
+    final value = input.trim();
+    if (value.isEmpty ||
+        value.length > 253 ||
+        value.contains(RegExp(r'[\s/@?#]'))) {
+      throw FormatException('Invalid session host: $field');
+    }
+    try {
+      final probe = Uri(scheme: 'https', host: value);
+      if (probe.host.isEmpty) {
+        throw FormatException('Invalid session host: $field');
+      }
+    } on FormatException {
+      throw FormatException('Invalid session host: $field');
+    }
+    return value;
+  }
+
+  static String _validatedPublicIp(String input, String field) {
+    final value = input.trim().toLowerCase();
+    if (_isPublicIpv4(value) || _isPublicIpv6(value)) return value;
+    throw FormatException('Invalid public IP pin: $field');
+  }
+
+  static bool _isPublicIpv4(String value) {
+    final parts = value.split('.');
+    if (parts.length != 4) return false;
+    final octets = <int>[];
+    for (final part in parts) {
+      if (part.isEmpty || (part.length > 1 && part.startsWith('0'))) return false;
+      final parsed = int.tryParse(part);
+      if (parsed == null || parsed < 0 || parsed > 255) return false;
+      octets.add(parsed);
+    }
+    final a = octets[0];
+    final b = octets[1];
+    if (a == 0 || a == 10 || a == 127 || a >= 224) return false;
+    if (a == 100 && b >= 64 && b <= 127) return false;
+    if (a == 169 && b == 254) return false;
+    if (a == 172 && b >= 16 && b <= 31) return false;
+    if (a == 192 && b == 168) return false;
+    if (a == 192 && b == 0 && octets[2] == 2) return false;
+    if (a == 198 && b == 51 && octets[2] == 100) return false;
+    if (a == 203 && b == 0 && octets[2] == 113) return false;
+    return true;
+  }
+
+  static bool _isPublicIpv6(String value) {
+    if (!value.contains(':') || value.contains('.')) return false;
+    try {
+      final parsed = Uri.parse('https://[$value]/');
+      if (parsed.host.isEmpty || !parsed.host.contains(':')) return false;
+    } on FormatException {
+      return false;
+    }
+    if (value == '::' || value == '::1') return false;
+    if (value.startsWith('fc') || value.startsWith('fd')) return false;
+    if (value.startsWith('fe8') || value.startsWith('fe9') || value.startsWith('fea') || value.startsWith('feb')) return false;
+    if (value.startsWith('ff')) return false;
+    if (value.startsWith('2001:db8:') || value == '2001:db8::') return false;
+    return true;
  }
 }
@@ -20,13 +20,13 @@ abstract final class LocalSocksTester {

  /// Fast local readiness probe used while starting the VPN.
  ///
-  /// This stops after SOCKS5 authentication. Startup must not depend on an
-  /// unrelated external host being reachable.
+  /// This stops after authenticated SOCKS5 negotiation. Startup must not depend
+  /// on an unrelated external host being reachable.
  static Future<LocalSocksTestResult> testListener({
    String host = '127.0.0.1',
-    int port = 10807,
-    String? username,
-    String? password,
+    required int port,
+    required String username,
+    required String password,
  }) async {
    final stopwatch = Stopwatch()..start();
    Socket? socket;
@@ -86,26 +86,47 @@ abstract final class LocalSocksTester {
    }
  }

-  /// Full user-facing test: authenticated local SOCKS handshake plus outbound
-  /// CONNECT. Credentials are optional so the helper remains usable for legacy
-  /// no-auth diagnostic builds.
+  /// Full user-facing test: authenticated local SOCKS handshake, an outbound
+  /// CONNECT through the active ReVolt route, and — critically — a real
+  /// request/response exchange over that CONNECT.
+  ///
+  /// The exchange is not optional politeness. Xray answers a SOCKS CONNECT
+  /// before it dials upstream, so the reply code alone says nothing about the
+  /// outbound: it returns success for unroutable addresses and for hostnames
+  /// that can never resolve. Without a round trip this test reports OK while
+  /// the server is down, which is precisely when a user runs it.
  static Future<LocalSocksTestResult> test({
    String host = '127.0.0.1',
-    int port = 10807,
-    String? username,
-    String? password,
-    String targetHost = 'paladinvpn.duckdns.org',
-    int targetPort = 443,
+    required int port,
+    required String username,
+    required String password,
+    String targetHost = 'example.com',
+    int targetPort = 80,
  }) async {
+    const totalTimeout = Duration(seconds: 8);
    final stopwatch = Stopwatch()..start();
    Socket? socket;
    _SocketReader? reader;

+    Duration remaining() {
+      final micros = totalTimeout.inMicroseconds - stopwatch.elapsedMicroseconds;
+      if (micros <= 0) throw TimeoutException('SOCKS5 test timed out.', totalTimeout);
+      return Duration(microseconds: micros);
+    }
+
    try {
+      if (targetPort <= 0 || targetPort > 65535) {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message: 'SOCKS5 test target is invalid.',
+        );
+      }
+
      socket = await Socket.connect(
        host,
        port,
-        timeout: const Duration(seconds: 3),
+        timeout: remaining(),
      );
      socket.setOption(SocketOption.tcpNoDelay, true);
      reader = _SocketReader(socket);
@@ -115,6 +136,7 @@ abstract final class LocalSocksTester {
        socket,
        username: username,
        password: password,
+        timeout: remaining(),
      );
      if (!authenticated) {
        return const LocalSocksTestResult(
@@ -145,7 +167,7 @@ abstract final class LocalSocksTester {
      ]);
      await socket.flush();

-      final replyHead = await reader.readExactly(4);
+      final replyHead = await reader.readExactly(4, timeout: remaining());
      if (replyHead[0] != 0x05 || replyHead[1] != 0x00) {
        return const LocalSocksTestResult(
          ok: false,
@@ -155,7 +177,44 @@ abstract final class LocalSocksTester {
        );
      }

-      await _consumeAddress(reader, replyHead[3]);
+      await _consumeAddress(reader, replyHead[3], timeout: remaining());
+
+      // The CONNECT reply above is not evidence of an outbound. Force a round
+      // trip and require the peer's answer before claiming the route works.
+      socket.add(
+        utf8.encode(
+          'GET / HTTP/1.1\r\nHost: $targetHost\r\nConnection: close\r\n\r\n',
+        ),
+      );
+      await socket.flush();
+
+      List<int> banner;
+      try {
+        banner = await reader.readExactly(5, timeout: remaining());
+      } on TimeoutException {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message: 'Local SOCKS5 is up, but the ReVolt outbound never replied.',
+        );
+      } on SocketException {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message:
+              'Local SOCKS5 is up, but the ReVolt outbound dropped the connection.',
+        );
+      }
+
+      if (String.fromCharCodes(banner) != 'HTTP/') {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message:
+              'Local SOCKS5 is up, but the ReVolt outbound returned unexpected data.',
+        );
+      }
+
      stopwatch.stop();
      return LocalSocksTestResult(
        ok: true,
@@ -189,23 +248,10 @@ abstract final class LocalSocksTester {
  static Future<bool> _authenticate(
    _SocketReader reader,
    Socket socket, {
-    required String? username,
-    required String? password,
+    required String username,
+    required String password,
    Duration timeout = const Duration(seconds: 4),
  }) async {
-    final passwordAuth = username != null && password != null;
-    if ((username == null) != (password == null)) return false;
-
-    socket.add(passwordAuth
-        ? const <int>[0x05, 0x01, 0x02]
-        : const <int>[0x05, 0x01, 0x00]);
-    await socket.flush();
-
-    final greeting = await reader.readExactly(2, timeout: timeout);
-    if (greeting[0] != 0x05) return false;
-    if (!passwordAuth) return greeting[1] == 0x00;
-    if (greeting[1] != 0x02) return false;
-
    final userBytes = utf8.encode(username);
    final passBytes = utf8.encode(password);
    if (userBytes.isEmpty ||
@@ -215,6 +261,15 @@ abstract final class LocalSocksTester {
      return false;
    }

+    // ReVolt never accepts unauthenticated local SOCKS. Advertising only RFC
+    // 1929 username/password auth makes a future credential-plumbing regression
+    // fail closed instead of silently falling back to method 0x00.
+    socket.add(const <int>[0x05, 0x01, 0x02]);
+    await socket.flush();
+
+    final greeting = await reader.readExactly(2, timeout: timeout);
+    if (greeting[0] != 0x05 || greeting[1] != 0x02) return false;
+
    socket.add(<int>[
      0x01,
      userBytes.length,
@@ -229,18 +284,24 @@ abstract final class LocalSocksTester {
  }

  static Future<void> _consumeAddress(
-      _SocketReader reader, int addressType) async {
+    _SocketReader reader,
+    int addressType, {
+    required Duration timeout,
+  }) async {
    if (addressType == 0x01) {
-      await reader.readExactly(4 + 2);
+      await reader.readExactly(4 + 2, timeout: timeout);
      return;
    }
    if (addressType == 0x04) {
-      await reader.readExactly(16 + 2);
+      await reader.readExactly(16 + 2, timeout: timeout);
      return;
    }
    if (addressType == 0x03) {
-      final length = (await reader.readExactly(1)).first;
-      await reader.readExactly(length + 2);
+      final length = (await reader.readExactly(1, timeout: timeout)).first;
+      if (length == 0) {
+        throw const FormatException('Invalid SOCKS5 domain length');
+      }
+      await reader.readExactly(length + 2, timeout: timeout);
      return;
    }
    throw const FormatException('Unsupported SOCKS5 address type');
@@ -257,8 +318,15 @@ class _SocketReader {
    int count, {
    Duration timeout = const Duration(seconds: 4),
  }) async {
+    final elapsed = Stopwatch()..start();
    while (_buffer.length < count) {
-      final hasNext = await _iterator.moveNext().timeout(timeout);
+      final remainingMicros = timeout.inMicroseconds - elapsed.elapsedMicroseconds;
+      if (remainingMicros <= 0) {
+        throw TimeoutException('Socket read timed out', timeout);
+      }
+      final hasNext = await _iterator.moveNext().timeout(
+            Duration(microseconds: remainingMicros),
+          );
      if (!hasNext) {
        throw const SocketException('Socket closed early');
      }
@@ -16,16 +16,17 @@ class NotificationService {
  /// Sets the notification's content text to [text].
  ///
  /// The native side rebuilds the whole notification, so skip the round-trip
-  /// when the text has not changed.
+  /// when the text has not changed. A failed native update is intentionally
+  /// not cached so the next tick can retry it.
  static Future<void> updateTimer(String text) async {
    if (text == _lastText) return;
-    _lastText = text;
    try {
      await _channel.invokeMethod<void>('updateNotificationText', {
        'title': 'Revolt VPN',
        'text': text,
        'disconnectLabel': 'Disconnect',
      });
+      _lastText = text;
    } catch (_) {
      // Cosmetic.
    }
@@ -0,0 +1,44 @@
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
+
+/// Background-survival controls.
+///
+/// Android stops background services of apps that are not exempt from Doze and
+/// App Standby, and it tears down the whole process group when a task is swiped
+/// away. Those are OS behaviours, not app bugs; the battery-optimisation
+/// exemption is the one sanctioned way an app can ask for around them, and it
+/// still needs one user tap.
+abstract final class PowerSettings {
+  PowerSettings._();
+
+  static const MethodChannel _channel = MethodChannel(
+    'com.revoltvpn.app/power',
+  );
+
+  /// Whether the OS has exempted this app from Doze / App Standby.
+  static Future<bool> isBatteryOptimisationDisabled() async {
+    if (kIsWeb) return true;
+    try {
+      return await _channel.invokeMethod<bool>(
+            'isIgnoringBatteryOptimizations',
+          ) ??
+          false;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  /// Shows the system exemption dialog. Returns false only when no system UI
+  /// could be opened at all — a user declining still returns true.
+  static Future<bool> requestDisableBatteryOptimisation() async {
+    if (kIsWeb) return true;
+    try {
+      return await _channel.invokeMethod<bool>(
+            'requestIgnoreBatteryOptimizations',
+          ) ??
+          false;
+    } catch (_) {
+      return false;
+    }
+  }
+}
@@ -39,22 +39,11 @@ class SecureSocksSession {
    final username = _token(16);
    final password = _token(32);

-    final sourceInbounds = decoded['inbounds'];
-    final inbounds = <dynamic>[];
-    if (sourceInbounds is List) {
-      for (final value in sourceInbounds) {
-        if (value is Map) {
-          final protocol = value['protocol']?.toString().toLowerCase();
-          // ReVolt owns local proxy ingress on Android. Drop imported SOCKS/HTTP
-          // listeners so a stale no-auth proxy cannot remain reachable beside
-          // the authenticated session listener.
-          if (protocol == 'socks' || protocol == 'http') continue;
-        }
-        inbounds.add(value);
-      }
-    }
-
-    inbounds.add(<String, dynamic>{
+    // ReVolt owns local ingress. Never accept listeners supplied by a remote
+    // or imported Xray config; the client exposes exactly one authenticated
+    // loopback SOCKS5 listener for the current ephemeral session.
+    decoded['inbounds'] = <Map<String, dynamic>>[
+      <String, dynamic>{
        'tag': inboundTag,
        'port': port,
        'listen': '127.0.0.1',
@@ -71,8 +60,8 @@ class SecureSocksSession {
          'enabled': true,
          'destOverride': <String>['http', 'tls'],
        },
-    });
-    decoded['inbounds'] = inbounds;
+      },
+    ];

    return SecureSocksSession._(
      port: port,
@@ -1,69 +0,0 @@
-import 'package:flutter/foundation.dart';
-import 'package:shared_preferences/shared_preferences.dart';
-
-// ── lib/logic/server_list.dart ──────────────────────────────────────────────
-// Server data model and ChangeNotifier — shared by StatusBar (shows current
-// server name/flag) and SelectionScreen (lets user pick a server).
-//
-// Each server is defined by its tunnel IP/port. Reality credentials (public
-// key, shortId) come from /session/status per session; only the transport
-// parameters live in AppConfig.
-//
-// When multi-server ships:
-//   - _all becomes a fetched list (from /api/servers or bundled config)
-//   - SelectionScreen shows multiple rows
-//   - select() triggers a disconnect/reconnect cycle if the tunnel is active
-
-class ServerInfo {
-  final String id;
-  final String name;
-  final String flagAsset;
-  final String ip;
-  final int port;
-
-  const ServerInfo({
-    required this.id,
-    required this.name,
-    required this.flagAsset,
-    required this.ip,
-    required this.port,
-  });
-}
-
-class ServerList extends ChangeNotifier {
-  static const _all = [
-    ServerInfo(
-      id: 'finland',
-      name: 'Helsinki, Finland',
-      flagAsset: 'assets/finland_flag_256.png',
-      ip: '204.168.246.88',
-      port: 443,
-    ),
-  ];
-
-  int _selectedIndex = 0;
-
-  List<ServerInfo> get all => _all;
-  int get selectedIndex => _selectedIndex;
-  ServerInfo get selected => _all[_selectedIndex];
-
-  // Loads persisted selection from SharedPreferences.
-  // Fire-and-forget — UI starts with default, updates when prefs load.
-  Future<void> init() async {
-    final prefs = await SharedPreferences.getInstance();
-    final saved = prefs.getInt('selected_server_index') ?? 0;
-    if (saved >= 0 && saved < _all.length && saved != _selectedIndex) {
-      _selectedIndex = saved;
-      notifyListeners();
-    }
-  }
-
-  // Switches to a different server. Persists the choice.
-  Future<void> select(int index) async {
-    if (index == _selectedIndex || index < 0 || index >= _all.length) return;
-    _selectedIndex = index;
-    notifyListeners();
-    final prefs = await SharedPreferences.getInstance();
-    await prefs.setInt('selected_server_index', index);
-  }
-}
@@ -23,7 +23,10 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
  bool _hasSyncedOnce = false;
  int _consecutiveFailures = 0;
  bool _isDisconnecting = false;
-  bool _syncInProgress = false;
+  int? _syncEpochInProgress;
+  Completer<void>? _syncCompletion;
+  int _sessionEpoch = 0;
+
  bool _supportRewardClaimed = false;
  bool _supportRewardStateLoaded = false;
  int _supportStateEpoch = 0;
@@ -36,17 +39,22 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
  static const int _maxOfflineSeconds = 120;
  int _offlineSeconds = 0;

-  static const int _pollIntervalSeconds = 5;
-  static const int _backgroundPollIntervalSeconds = 30;
+  static const int _pollIntervalSeconds = 60;
+  static const int _backgroundPollIntervalSeconds = 60;

  int _lastUsedBytes = 0;
-  DateTime? _lastSuccessfulSyncAt;
+  Stopwatch? _sinceLastSuccessfulSync;
  double _currentSpeedKBps = 0.0;

  SessionTimer({required this.vpnConnection}) {
    WidgetsBinding.instance.addObserver(this);
    vpnConnection.addListener(_onVpnConnectionChanged);
    unawaited(_loadSupportRewardState());
+
+    // VpnConnection is eager and can report an already-running native tunnel
+    // before this provider is created. ChangeNotifier listeners do not replay
+    // old events, so always evaluate the current state once after construction.
+    unawaited(Future.microtask(_onVpnConnectionChanged));
  }

  int get remaining => _remainingSeconds;
@@ -102,18 +110,12 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
  }

  void _onVpnConnectionChanged() {
+    // A live tunnel with a stopped clock is always wrong, whether this process
+    // adopted an existing runtime, attached late, or recovered from a blip.
    if (vpnConnection.status == VpnStatus.connected &&
        !isRunning &&
-        vpnConnection.isStartupRestoration) {
-      _resumeTicking();
-      return;
-    }
-
-    if (vpnConnection.status == VpnStatus.connected &&
-        !isRunning &&
-        !_isDisconnecting &&
-        _hasSyncedOnce) {
-      debugPrint('[Timer] VPN reconnected after blip - resuming.');
+        !_isDisconnecting) {
+      debugPrint('[Timer] Connected with a stopped clock - resuming.');
      _resumeTicking();
      return;
    }
@@ -122,7 +124,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
    if (!hadActiveSession || _isDisconnecting) return;

    if (vpnConnection.status == VpnStatus.error) {
-      _stopForVpnFailure('VPN entered error state');
+      unawaited(_doDisconnect('VPN entered error state'));
      return;
    }

@@ -131,30 +133,14 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
    }
  }

-  void _stopForVpnFailure(String reason) {
-    if (_isDisconnecting) return;
-    _isDisconnecting = true;
-    debugPrint('[Timer] Stopping after VPN failure: $reason');
-
-    _timer?.cancel();
-    _timer = null;
-    _currentSpeedKBps = 0.0;
-    _remainingSeconds = 0;
-    _remainingAtLastSync = 0;
-    _hasSyncedOnce = false;
-    _lastSuccessfulSyncAt = null;
-    _consecutiveFailures = 0;
-    _offlineSeconds = 0;
-    NotificationService.reset();
-    notifyListeners();
-  }
-
  Future<void> start() async {
+    _sessionEpoch++;
    _remainingSeconds = 0;
    _remainingAtLastSync = 0;
    _usedBytes = 0;
    _lastUsedBytes = 0;
-    _lastSuccessfulSyncAt = null;
+    _sinceLastSuccessfulSync?.stop();
+    _sinceLastSuccessfulSync = null;
    _currentSpeedKBps = 0.0;
    _tickCount = 0;
    _hasSyncedOnce = false;
@@ -179,7 +165,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
  void _tick(Timer t) {
    if (_isDisconnecting) return;

-    if (_hasSyncedOnce && _consecutiveFailures < _maxConsecutiveFailures) {
+    if (_hasSyncedOnce) {
      _reconcileElapsedTime();
    }

@@ -211,6 +197,24 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
    }
  }

+  /// Force a control-plane refresh after an event that changes the session
+  /// server-side. If a periodic sync is already in flight, wait for it and
+  /// issue a fresh request so the event cannot be hidden behind the busy guard.
+  Future<void> syncNow() async {
+    final requestedEpoch = _sessionEpoch;
+    while (requestedEpoch == _sessionEpoch && !_isDisconnecting) {
+      final active = _syncEpochInProgress == requestedEpoch
+          ? _syncCompletion
+          : null;
+      if (active != null) {
+        await active.future;
+        continue;
+      }
+      await _syncWithHivemind();
+      return;
+    }
+  }
+
  Future<void> disconnect({String reason = 'User requested'}) async {
    await _doDisconnect(reason);
  }
@@ -218,6 +222,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
  Future<void> _doDisconnect(String reason) async {
    if (_isDisconnecting) return;
    _isDisconnecting = true;
+    _sessionEpoch++;
    debugPrint('[Timer] Disconnecting: $reason');

    _timer?.cancel();
@@ -226,13 +231,13 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
    _remainingSeconds = 0;
    _remainingAtLastSync = 0;
    _hasSyncedOnce = false;
-    _lastSuccessfulSyncAt = null;
+    _sinceLastSuccessfulSync?.stop();
+    _sinceLastSuccessfulSync = null;
    NotificationService.reset();
    notifyListeners();

    await vpnConnection.disconnect();

-    if (!_isDisconnecting) return;
    _isDisconnecting = false;
    notifyListeners();
  }
@@ -244,20 +249,28 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
  }

  Future<void> _syncWithHivemind() async {
-    if (_isDisconnecting || _syncInProgress) return;
-    _syncInProgress = true;
+    if (_isDisconnecting) return;
+    final epoch = _sessionEpoch;
+    if (_syncEpochInProgress == epoch) return;
+
+    final completion = Completer<void>();
+    _syncCompletion = completion;
+    _syncEpochInProgress = epoch;
+
    try {
      final deviceId = await CryptoService.getDeviceId();
+      if (epoch != _sessionEpoch || _isDisconnecting) return;
+
      final base = Uri.parse('${AppConfig.hivemindApiPublic}/session/status');
      final url = base.replace(queryParameters: {'device_id': deviceId});
      final response = await HivemindService.directGet(url);
-      if (_isDisconnecting) return;
+      if (epoch != _sessionEpoch || _isDisconnecting) return;

      if (response.statusCode == 200) {
        final decoded = jsonDecode(response.body);
        if (decoded is! Map<String, dynamic>) {
          debugPrint('[Timer] Invalid session payload type.');
-          _markSyncFailure();
+          _markSyncFailure(epoch);
          return;
        }
        final data = decoded;
@@ -265,7 +278,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
        final activeValue = data['active'];
        if (activeValue is! bool) {
          debugPrint('[Timer] Session payload missing boolean active state.');
-          _markSyncFailure();
+          _markSyncFailure(epoch);
          return;
        }
        if (!activeValue) {
@@ -278,53 +291,66 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
            !expiresValue.isFinite ||
            expiresValue < 0) {
          debugPrint('[Timer] Session payload has invalid expiry.');
-          _markSyncFailure();
+          _markSyncFailure(epoch);
          return;
        }

+        final elapsedMs = _sinceLastSuccessfulSync?.elapsedMilliseconds;
        _remainingAtLastSync = expiresValue.toInt();
        _remainingSeconds = _remainingAtLastSync;
        _usedBytes = _readNonNegativeInt(data['used_bytes'], _usedBytes);

-        final now = DateTime.now();
-        final previousSyncAt = _lastSuccessfulSyncAt;
        final deltaBytes = _usedBytes - _lastUsedBytes;
-        if (_hasSyncedOnce && previousSyncAt != null) {
-          final elapsedMs = now.difference(previousSyncAt).inMilliseconds;
-          if (deltaBytes > 0 && elapsedMs > 0) {
-            _currentSpeedKBps = (deltaBytes / (elapsedMs / 1000.0)) / 1000.0;
-          } else {
-            _currentSpeedKBps = 0.0;
-          }
+        if (_hasSyncedOnce && elapsedMs != null && elapsedMs > 0) {
+          _currentSpeedKBps = deltaBytes > 0
+              ? (deltaBytes / (elapsedMs / 1000.0)) / 1000.0
+              : 0.0;
        } else {
          _currentSpeedKBps = 0.0;
        }
        _lastUsedBytes = _usedBytes;
-        _lastSuccessfulSyncAt = now;
+        _sinceLastSuccessfulSync?.stop();
+        _sinceLastSuccessfulSync = Stopwatch()..start();

        if (data['cap_exhausted'] == true) {
          await _doDisconnect('Data cap reached');
          return;
        }

+        if (epoch != _sessionEpoch || _isDisconnecting) return;
+        try {
+          await vpnConnection.setNativeSessionDeadline(_remainingAtLastSync);
+        } catch (e) {
+          debugPrint('[Timer] Failed to arm native session deadline: $e');
+          await _doDisconnect('Native session deadline unavailable');
+          return;
+        }
+        if (epoch != _sessionEpoch || _isDisconnecting) return;
        _consecutiveFailures = 0;
        _offlineSeconds = 0;
        _hasSyncedOnce = true;
        notifyListeners();
      } else {
-        _markSyncFailure();
+        _markSyncFailure(epoch);
      }
    } catch (e) {
-      if (!_isDisconnecting) {
+      if (epoch == _sessionEpoch && !_isDisconnecting) {
        debugPrint('Hivemind sync error: $e');
-        _markSyncFailure();
+        _markSyncFailure(epoch);
      }
    } finally {
-      _syncInProgress = false;
+      if (_syncEpochInProgress == epoch) {
+        _syncEpochInProgress = null;
+      }
+      if (identical(_syncCompletion, completion)) {
+        _syncCompletion = null;
+      }
+      if (!completion.isCompleted) completion.complete();
    }
  }

-  void _markSyncFailure() {
+  void _markSyncFailure(int epoch) {
+    if (epoch != _sessionEpoch || _isDisconnecting) return;
    _consecutiveFailures++;
    if (_consecutiveFailures >= _maxConsecutiveFailures) {
      notifyListeners();
@@ -332,10 +358,10 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
  }

  void _reconcileElapsedTime() {
-    final syncedAt = _lastSuccessfulSyncAt;
-    if (!_hasSyncedOnce || syncedAt == null) return;
+    final clock = _sinceLastSuccessfulSync;
+    if (!_hasSyncedOnce || clock == null) return;

-    final elapsed = DateTime.now().difference(syncedAt).inSeconds;
+    final elapsed = clock.elapsed.inSeconds;
    _remainingSeconds =
        (_remainingAtLastSync - elapsed).clamp(0, 1 << 31).toInt();
  }
@@ -375,9 +401,15 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {

  @override
  void dispose() {
+    // Invalidate every asynchronous generation before removing listeners so
+    // late storage/network completions cannot notify a disposed notifier.
+    _sessionEpoch++;
+    _supportStateEpoch++;
+    _isDisconnecting = true;
    WidgetsBinding.instance.removeObserver(this);
    vpnConnection.removeListener(_onVpnConnectionChanged);
    _timer?.cancel();
+    _sinceLastSuccessfulSync?.stop();
    super.dispose();
  }
 }
@@ -189,7 +189,7 @@ class Updater {
    }

    try {
-      final result = await MethodChannel('com.revoltvpn.app/installer')
+      final result = await const MethodChannel('com.revoltvpn.app/installer')
          .invokeMethod<String>('getInstallerPackage');
      _cachedSource = (result == 'com.android.vending')
          ? InstallSource.playStore
@@ -1,6 +1,7 @@
 import 'dart:async';

 import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
 import 'package:flutter_vless/flutter_vless.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
@@ -17,9 +18,12 @@ enum VpnStatus {
 }

 class VpnConnection extends ChangeNotifier {
-  static const int _maxExtremeRecoveryAttempts = 2;
+  static const MethodChannel _nativeControl = MethodChannel('flutter_vless');
+
+  int _connectEpoch = 0;
+  bool _suppressNativeConnect = false;
+  bool _disposed = false;

-  bool _cancelled = false;
  VpnStatus _status = VpnStatus.disconnected;
  VpnStatus get status => _status;

@@ -29,8 +33,10 @@ class VpnConnection extends ChangeNotifier {
  String? _errorMessage;
  String? get errorMessage => _errorMessage;

-  bool _isStartupRestoration = false;
-  bool get isStartupRestoration => _isStartupRestoration;
+  /// True when the UI attached to a tunnel that was already running, rather
+  /// than starting one itself. The session timer uses this to resume ticking.
+  bool _adoptedRunningRuntime = false;
+  bool get adoptedRunningRuntime => _adoptedRunningRuntime;

  bool _serverReachable = false;
  bool get serverReachable => _serverReachable;
@@ -38,15 +44,13 @@ class VpnConnection extends ChangeNotifier {
  ConnectionMode _activeMode = ConnectionMode.tun;
  ConnectionMode get activeMode => _activeMode;

-  ResilienceMode _activeResilienceMode = ResilienceMode.standard;
-  ResilienceMode get activeResilienceMode => _activeResilienceMode;
-
  String _networkTransport = 'unknown';
  String get networkTransport => _networkTransport;

  SecureSocksSession? get activeSocksSession => _lastSecureSocks;

  bool get canTestActiveLocalSocks =>
+      !_disposed &&
      _status == VpnStatus.connected &&
      _activeMode == ConnectionMode.proxy &&
      _lastSecureSocks != null;
@@ -70,16 +74,10 @@ class VpnConnection extends ChangeNotifier {
  }

  Timer? _healthTimer;
-  Timer? _restartTimer;
  StreamSubscription<NetworkSnapshot>? _networkSubscription;

-  String? _lastBaseConfig;
-  String _lastRemark = 'Revolt VPN';
-  bool _lastVerifyLocalSocks = false;
  SecureSocksSession? _lastSecureSocks;
-  bool _restartInProgress = false;
  bool _userDisconnecting = false;
-  int _connectionEpoch = 0;

  late final FlutterVless _vless;
  bool _initialized = false;
@@ -88,7 +86,6 @@ class VpnConnection extends ChangeNotifier {

  VpnConnection() {
    _activeMode = ConnectionSettings.mode;
-    _activeResilienceMode = ConnectionSettings.resilienceMode;
    _init();
  }

@@ -103,11 +100,11 @@ class VpnConnection extends ChangeNotifier {
  }

  Future<void> _startEngine() async {
-    if (kIsWeb) return;
+    if (kIsWeb || _disposed) return;

    await ConnectionSettings.initialize();
+    if (_disposed) return;
    _activeMode = ConnectionSettings.mode;
-    _activeResilienceMode = ConnectionSettings.resilienceMode;

    _vless = FlutterVless(
      onStatusChanged: (status) {
@@ -123,15 +120,18 @@ class VpnConnection extends ChangeNotifier {
      await _vless.initializeVless(
        providerBundleIdentifier: 'com.paladinvpn.app',
        notificationIconResourceType: 'drawable',
-        notificationIconResourceName: 'notification_status_icon',
+        notificationIconResourceName: 'notification_icon',
      );
+      if (_disposed) return;
      _initialized = true;
    } catch (e) {
      debugPrint('[VPN] VLESS init error (expected on emulator): $e');
    }
+    if (_disposed) return;

    _networkSubscription = NetworkMonitor.changes.listen(
      (snapshot) {
+        if (_disposed) return;
        // ConnectivityManager is informational only. Restarting from every
        // callback caused the old VPN-created-network reconnect loop.
        _networkTransport = snapshot.transport;
@@ -149,63 +149,12 @@ class VpnConnection extends ChangeNotifier {

    try {
      final coreVersion = await _vless.getCoreVersion();
+      if (!_disposed) {
        debugPrint('[VPN] Xray core version: $coreVersion');
-
-      final delay = await _vless.getConnectedServerDelay();
-      if (delay > 0) {
-        _isStartupRestoration = true;
-        _lastVerifyLocalSocks = _activeMode == ConnectionMode.proxy;
-        _setStatus(VpnStatus.connected, _connectedLabel);
-        unawaited(_restoreRecoverySnapshot());
      }
    } catch (_) {}
  }

-  /// Android can kill the Dart process while the VPN foreground service keeps
-  /// running, which leaves a fresh [VpnConnection] attached to a live tunnel it
-  /// holds no config snapshot for — so Extreme recovery has nothing to restart
-  /// from. The Hivemind session is still active, so `/session/status` returns
-  /// the same VLESS parameters and the snapshot can be rebuilt without opening
-  /// a new session or running the ad bypass.
-  ///
-  /// TUN only. This mints *fresh* SOCKS credentials, which is invisible in TUN
-  /// because only tun2socks consumes them. In proxy mode those credentials are
-  /// the user's own client configuration, so rotating them behind their back
-  /// would silently break it — that case is surfaced in the UI instead.
-  Future<void> _restoreRecoverySnapshot() async {
-    if (kIsWeb || _activeMode != ConnectionMode.tun) return;
-
-    final epoch = _connectionEpoch;
-    bool stale() =>
-        _connectionEpoch != epoch ||
-        _userDisconnecting ||
-        _status != VpnStatus.connected;
-
-    try {
-      final realUrl = await HivemindService.fetchConfigDirectly(
-        skipAdBypass: true,
-      );
-      // A real connect() may have landed while the fetch was in flight; never
-      // overwrite a snapshot that belongs to a live connection.
-      if (stale() || _lastBaseConfig != null) return;
-
-      final parsed = FlutterVless.parse(realUrl);
-      final secureSocks = await SecureSocksSession.create(
-        parsed.getFullConfiguration(),
-      );
-      if (stale() || _lastBaseConfig != null) return;
-
-      _lastBaseConfig = secureSocks.configJson;
-      _lastRemark = parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN';
-      _lastVerifyLocalSocks = false;
-      debugPrint('[VPN] Recovery snapshot rebuilt after process restart');
-    } catch (e) {
-      // Best-effort: without it the tunnel still works, only Extreme recovery
-      // stays unavailable until the next manual connect.
-      debugPrint('[VPN] Could not rebuild recovery snapshot: $e');
-    }
-  }
-
  String get _connectedLabel {
    switch (_activeMode) {
      case ConnectionMode.proxy:
@@ -215,47 +164,36 @@ class VpnConnection extends ChangeNotifier {
    }
  }

+  bool _isCurrentConnect(int epoch) =>
+      !_disposed && epoch == _connectEpoch && !_userDisconnecting;
+
  void _mapStatus(VlessStatus status) {
+    if (_disposed) return;
    switch (status.connectionState) {
      case VlessConnectionState.connected:
+        if (_suppressNativeConnect || _userDisconnecting) return;
+        if (_connectEpoch == 0) _adoptedRunningRuntime = true;
        _setStatus(VpnStatus.connected, _connectedLabel);
        break;

      case VlessConnectionState.disconnected:
-        // Repeated DISCONNECTED broadcasts during an Extreme recovery debounce
-        // must not clear the config snapshot the pending recovery needs.
-        if (_restartInProgress || (_restartTimer?.isActive ?? false)) return;
-
-        final canRecover = !_userDisconnecting &&
-            _activeResilienceMode == ResilienceMode.extreme &&
-            _lastBaseConfig != null &&
-            _status == VpnStatus.connected;
-        if (canRecover) {
-          _scheduleRuntimeRestart('Runtime disconnected');
-          return;
-        }
-
        _clearRuntimeSnapshot();
        _setStatus(VpnStatus.disconnected, 'Tap to connect');
        break;

      case VlessConnectionState.connecting:
-        if (!_restartInProgress) {
+        if (_suppressNativeConnect || _userDisconnecting) return;
        _setStatus(VpnStatus.connecting, 'Establishing tunnel…');
-        }
        break;

      case VlessConnectionState.disconnecting:
-        _isStartupRestoration = false;
-        if (!_restartInProgress) {
        _setStatus(VpnStatus.disconnecting, 'Tearing down…');
-        }
        break;

      case VlessConnectionState.unknown:
+        if (_suppressNativeConnect || _userDisconnecting) return;
        if (_status != VpnStatus.connected &&
-            _status != VpnStatus.disconnected &&
-            !_restartInProgress) {
+            _status != VpnStatus.disconnected) {
          _setStatus(VpnStatus.error, 'Connection failed');
        }
        break;
@@ -263,30 +201,34 @@ class VpnConnection extends ChangeNotifier {
  }

  Future<bool> connect({bool skipAdBypass = false}) async {
-    if (_status == VpnStatus.connected || _status == VpnStatus.connecting) {
+    if (_disposed ||
+        _userDisconnecting ||
+        _status == VpnStatus.connected ||
+        _status == VpnStatus.connecting ||
+        _status == VpnStatus.disconnecting) {
      return false;
    }

-    _cancelled = false;
+    final connectEpoch = ++_connectEpoch;
+    _suppressNativeConnect = false;
    _userDisconnecting = false;
-    _restartTimer?.cancel();
-    _connectionEpoch++;

    await ConnectionSettings.initialize();
+    if (!_isCurrentConnect(connectEpoch)) return false;
    _activeMode = ConnectionSettings.mode;
-    _activeResilienceMode = ConnectionSettings.resilienceMode;

    if (!kIsWeb && !_initialized) {
+      _suppressNativeConnect = true;
      _errorMessage = 'VPN service unavailable.';
      _setStatus(VpnStatus.error, 'Service unavailable');
      return false;
    }

-    // TUN needs the Android VPN permission; SOCKS5 proxy mode runs a local
-    // authenticated proxy without a VpnService, so no VPN permission is needed.
    if (!kIsWeb && _activeMode == ConnectionMode.tun) {
      final ok = await _vless.requestPermission();
+      if (!_isCurrentConnect(connectEpoch)) return false;
      if (!ok) {
+        _suppressNativeConnect = true;
        _errorMessage = 'VPN permission denied.';
        _setStatus(VpnStatus.error, 'Permission required');
        return false;
@@ -302,6 +244,7 @@ class VpnConnection extends ChangeNotifier {

    if (kIsWeb) {
      await Future.delayed(const Duration(seconds: 1));
+      if (!_isCurrentConnect(connectEpoch)) return false;
      _setStatus(VpnStatus.connected, 'Secured (dev mode)');
      return true;
    }
@@ -313,6 +256,7 @@ class VpnConnection extends ChangeNotifier {
      realUrl = await HivemindService.fetchConfigDirectly(
        skipAdBypass: skipAdBypass,
        onAttempt: (attempt, total) {
+          if (!_isCurrentConnect(connectEpoch)) return;
          _setStatus(
            VpnStatus.connecting,
            'Contacting server ($attempt/$total)…',
@@ -320,9 +264,11 @@ class VpnConnection extends ChangeNotifier {
        },
      );
    } catch (e) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
      debugPrint('[VPN] Config fetch error: $e');
      final raw = e.toString().replaceAll('Exception: ', '');
      if (raw.contains('Cancelled')) return false;
+      _suppressNativeConnect = true;
      if (raw.contains('timed out') || raw.contains('Session not activated')) {
        _errorMessage =
            'The server did not respond in time.\nCheck your connection and try again.';
@@ -334,11 +280,7 @@ class VpnConnection extends ChangeNotifier {
      return false;
    }

-    if (_cancelled) {
-      _setStatus(VpnStatus.disconnected, 'Tap to connect');
-      return false;
-    }
-
+    if (!_isCurrentConnect(connectEpoch)) return false;
    _setStatus(VpnStatus.connecting, 'Starting secure route…');

    try {
@@ -346,6 +288,7 @@ class VpnConnection extends ChangeNotifier {
      final baseConfig = parsed.getFullConfiguration();
      final remark = parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN';
      final secureSocks = await SecureSocksSession.create(baseConfig);
+      if (!_isCurrentConnect(connectEpoch)) return false;
      final verifyLocalSocks = _activeMode == ConnectionMode.proxy;

      await _startRuntime(
@@ -353,29 +296,45 @@ class VpnConnection extends ChangeNotifier {
        remark: remark,
        proxyOnly: verifyLocalSocks,
      );
+      if (!_isCurrentConnect(connectEpoch)) return false;

      _setStatus(
        VpnStatus.connecting,
-        verifyLocalSocks ? 'Waiting for local SOCKS5…' : 'Waiting for VPN interface…',
+        verifyLocalSocks
+            ? 'Waiting for local SOCKS5…'
+            : 'Waiting for VPN interface…',
      );
-      if (!await _waitForNativeConnected()) {
+      if (!await _waitForNativeConnected(connectEpoch)) {
        throw StateError('VPN runtime did not report CONNECTED');
      }

      if (verifyLocalSocks) {
+        if (!_isCurrentConnect(connectEpoch)) return false;
        _setStatus(VpnStatus.connecting, 'Checking Local SOCKS5…');
-        if (!await _waitForLocalSocksListener(secureSocks)) {
+        if (!await _waitForLocalSocksListener(
+          secureSocks,
+          connectEpoch,
+        )) {
          throw StateError('Local SOCKS5 listener did not become ready');
        }
      }

-      _lastBaseConfig = secureSocks.configJson;
+      if (!_isCurrentConnect(connectEpoch)) return false;
      _lastSecureSocks = secureSocks;
-      _lastRemark = remark;
-      _lastVerifyLocalSocks = verifyLocalSocks;
    } catch (e) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
      debugPrint('[VPN] Tunnel start error: $e');
+      _suppressNativeConnect = true;
+      try {
        await _stopRuntime();
+      } catch (stopError) {
+        debugPrint('[VPN] Runtime cleanup failed after start error: $stopError');
+        if (!_isCurrentConnect(connectEpoch)) return false;
+        _errorMessage = 'VPN failed to shut down cleanly.\nPlease restart the app.';
+        _setStatus(VpnStatus.error, 'Shutdown failed');
+        return false;
+      }
+      if (!_isCurrentConnect(connectEpoch)) return false;
      _clearRuntimeSnapshot();
      _errorMessage = _activeMode == ConnectionMode.proxy
          ? 'SOCKS5 gateway failed to start.\nTry reconnecting.'
@@ -384,6 +343,7 @@ class VpnConnection extends ChangeNotifier {
      return false;
    }

+    if (!_isCurrentConnect(connectEpoch)) return false;
    _setStatus(VpnStatus.connected, _connectedLabel);
    return true;
  }
@@ -400,22 +360,20 @@ class VpnConnection extends ChangeNotifier {
    );
  }

-  Future<bool> _waitForLocalSocksListener([
-    SecureSocksSession? session,
-  ]) async {
-    final active = session ?? _lastSecureSocks;
-    if (active == null) return false;
-
+  Future<bool> _waitForLocalSocksListener(
+    SecureSocksSession session,
+    int connectEpoch,
+  ) async {
    for (var attempt = 0; attempt < 4; attempt++) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
      final result = await LocalSocksTester.testListener(
        host: '127.0.0.1',
-        port: active.port,
-        username: active.username,
-        password: active.password,
+        port: session.port,
+        username: session.username,
+        password: session.password,
      );
-      if (result.ok) {
-        return true;
-      }
+      if (!_isCurrentConnect(connectEpoch)) return false;
+      if (result.ok) return true;
      if (attempt < 3) {
        await Future.delayed(const Duration(milliseconds: 250));
      }
@@ -423,145 +381,59 @@ class VpnConnection extends ChangeNotifier {
    return false;
  }

-  Future<bool> _waitForNativeConnected() async {
-    // startVless() queues the Android foreground service. Wait for the native
-    // service/core broadcast rather than treating MethodChannel completion as
-    // proof that a TUN interface was established.
+  Future<bool> _waitForNativeConnected(int connectEpoch) async {
    for (var attempt = 0; attempt < 24; attempt++) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
      if (_status == VpnStatus.connected) return true;
-      if (_status == VpnStatus.error) return false;
-      if (_cancelled || _userDisconnecting) return false;
+      if (_status == VpnStatus.error || _status == VpnStatus.disconnected) {
+        return false;
+      }
      await Future.delayed(const Duration(milliseconds: 250));
    }
-    return _status == VpnStatus.connected;
-  }
-
-  void _scheduleRuntimeRestart(String reason) {
-    if (_activeResilienceMode != ResilienceMode.extreme ||
-        _restartInProgress ||
-        _userDisconnecting ||
-        _lastBaseConfig == null ||
-        (_restartTimer?.isActive ?? false)) {
-      return;
-    }
-
-    _setStatus(VpnStatus.connecting, 'Reconnecting…');
-    _restartTimer = Timer(const Duration(milliseconds: 1200), () {
-      unawaited(_restartActiveRuntime(reason));
-    });
-  }
-
-  Future<void> _restartActiveRuntime(String reason) async {
-    if (_restartInProgress || _userDisconnecting || _lastBaseConfig == null) {
-      return;
-    }
-
-    _restartInProgress = true;
-    final epoch = _connectionEpoch;
-    Object? lastError;
-
-    try {
-      for (var attempt = 1; attempt <= _maxExtremeRecoveryAttempts; attempt++) {
-        if (_connectionEpoch != epoch || _userDisconnecting || _lastBaseConfig == null) return;
-
-        try {
-          debugPrint(
-            '[VPN] Extreme recovery attempt '
-            '$attempt/$_maxExtremeRecoveryAttempts: $reason',
-          );
-
-          await _stopRuntime();
-          if (_userDisconnecting) return;
-
-          await Future.delayed(
-            Duration(milliseconds: attempt == 1 ? 600 : 900),
-          );
-          if (_userDisconnecting || _lastBaseConfig == null) return;
-
-          await _startRuntime(
-            config: _lastBaseConfig!,
-            remark: _lastRemark,
-            proxyOnly: _activeMode == ConnectionMode.proxy,
-          );
-
-          if (!await _waitForNativeConnected()) {
-            throw StateError('VPN runtime did not recover');
-          }
-          if (_lastVerifyLocalSocks && !(await _waitForLocalSocksListener())) {
-            throw StateError('Local SOCKS5 listener did not recover');
-          }
-
-          if (_userDisconnecting) return;
-
-          _errorMessage = null;
-          _setStatus(VpnStatus.connected, _connectedLabel);
-          return;
-        } catch (e) {
-          lastError = e;
-          debugPrint(
-            '[VPN] Extreme recovery attempt '
-            '$attempt/$_maxExtremeRecoveryAttempts failed: $e',
-          );
-          await _stopRuntime();
-          if (_userDisconnecting) return;
-
-          if (attempt < _maxExtremeRecoveryAttempts) {
-            _setStatus(
-              VpnStatus.connecting,
-              'Reconnecting… (${attempt + 1}/$_maxExtremeRecoveryAttempts)',
-            );
-            await Future.delayed(const Duration(milliseconds: 700));
-          }
-        }
-      }
-
-      if (_userDisconnecting) return;
-
-      debugPrint('[VPN] Extreme recovery exhausted: $lastError');
-      _clearRuntimeSnapshot();
-      _errorMessage = 'Could not restore the connection.';
-      _setStatus(VpnStatus.error, 'Reconnect failed');
-    } finally {
-      _restartInProgress = false;
-    }
+    return _isCurrentConnect(connectEpoch) &&
+        _status == VpnStatus.connected;
  }

  Future<void> _stopRuntime() async {
-    try {
-      await _vless.stopVless().timeout(const Duration(seconds: 5));
-    } catch (_) {}
+    await _vless.stopVless().timeout(const Duration(seconds: 8));
+  }
+
+  Future<void> setNativeSessionDeadline(int remainingSeconds) async {
+    if (kIsWeb) return;
+    if (_disposed) throw StateError('VPN connection has been disposed');
+    if (!_initialized) throw StateError('VPN native service is not initialized');
+    if (remainingSeconds < 0) {
+      throw ArgumentError.value(remainingSeconds, 'remainingSeconds');
+    }
+    await _nativeControl.invokeMethod<void>(
+      'setSessionDeadline',
+      <String, Object>{'remainingSeconds': remainingSeconds},
+    );
  }

  Future<void> disconnect() async {
-    _cancelled = true;
-    _userDisconnecting = true;
-    _restartTimer?.cancel();
-    HivemindService.cancel();
+    if (_disposed || _status == VpnStatus.disconnecting) return;

-    if (_status == VpnStatus.disconnected ||
-        _status == VpnStatus.disconnecting) {
-      _clearRuntimeSnapshot();
-      _userDisconnecting = false;
-      return;
-    }
+    _connectEpoch++;
+    _suppressNativeConnect = true;
+    _userDisconnecting = true;
+    HivemindService.cancel();

    _setStatus(VpnStatus.disconnecting, 'Tearing down…');

    if (kIsWeb) {
      await Future.delayed(const Duration(milliseconds: 500));
+      if (_disposed) return;
      _clearRuntimeSnapshot();
      _setStatus(VpnStatus.disconnected, 'Tap to connect');
      _userDisconnecting = false;
      return;
    }

-    bool timedOut = false;
    try {
-      await _vless.stopVless().timeout(
-            const Duration(seconds: 5),
-            onTimeout: () => timedOut = true,
-          );
+      await _vless.stopVless().timeout(const Duration(seconds: 8));
    } catch (e) {
+      if (_disposed) return;
      debugPrint('[VPN] VLESS stop error: $e');
      _errorMessage = 'VPN shutdown error.\nPlease restart the app.';
      _clearRuntimeSnapshot();
@@ -570,15 +442,7 @@ class VpnConnection extends ChangeNotifier {
      return;
    }

-    if (timedOut) {
-      debugPrint('[VPN] stopVless() timed out after 5 s.');
-      _errorMessage = 'VPN did not shut down cleanly.\nPlease restart the app.';
-      _clearRuntimeSnapshot();
-      _setStatus(VpnStatus.error, 'Shutdown failed');
-      _userDisconnecting = false;
-      return;
-    }
-
+    if (_disposed) return;
    _errorMessage = null;
    _clearRuntimeSnapshot();
    _setStatus(VpnStatus.disconnected, 'Tap to connect');
@@ -586,30 +450,33 @@ class VpnConnection extends ChangeNotifier {
  }

  void _clearRuntimeSnapshot() {
-    _lastBaseConfig = null;
-    _lastVerifyLocalSocks = false;
    _lastSecureSocks = null;
-    _isStartupRestoration = false;
+    _adoptedRunningRuntime = false;
  }

  void _setStatus(VpnStatus status, String message) {
+    if (_disposed) return;
    _status = status;
    _statusMessage = message;
    notifyListeners();
  }

  Future<void> _checkHealth() async {
-    // A live tunnel already proves reachability; only probe while disconnected
-    // so we don't add direct /health traffic while the VPN is active.
-    if (_status == VpnStatus.connected) return;
-    _serverReachable = await HivemindService.checkHealth();
+    if (_disposed || _status == VpnStatus.connected) return;
+    final reachable = await HivemindService.checkHealth();
+    if (_disposed || _status == VpnStatus.connected) return;
+    _serverReachable = reachable;
    notifyListeners();
  }

  @override
  void dispose() {
+    _disposed = true;
+    _connectEpoch++;
+    _suppressNativeConnect = true;
+    _userDisconnecting = true;
+    HivemindService.cancel();
    _healthTimer?.cancel();
-    _restartTimer?.cancel();
    _networkSubscription?.cancel();
    // Provider/UI disposal is not a user disconnect command. Keeping teardown
    // in disconnect() prevents lifecycle churn from silently dropping the VPN.
@@ -7,7 +7,6 @@ import 'package:revoltvpn/logic/ad_manager.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/haptic_settings.dart';
-import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/screens/intro.dart';
@@ -47,16 +46,15 @@ class ReVoltApp extends StatelessWidget {
      providers: [
        ChangeNotifierProvider(create: (_) => VpnConnection(), lazy: false),
        ChangeNotifierProxyProvider<VpnConnection, SessionTimer>(
+          // Eager, like VpnConnection: the timer has to be listening before the
+          // engine reports an already-running tunnel, not after the intro.
+          lazy: false,
          create: (ctx) =>
              SessionTimer(vpnConnection: ctx.read<VpnConnection>()),
          update: (_, vpn, prev) =>
              prev ?? SessionTimer(vpnConnection: vpn),
        ),
        ChangeNotifierProvider(create: (_) => AdManager()),
-        ChangeNotifierProvider(
-          create: (_) => ServerList()..init(),
-          lazy: false,
-        ),
      ],
      child: MaterialApp(
        title: 'ReVolt VPN',
@@ -1,63 +0,0 @@
-import 'package:flutter/material.dart';
-import 'package:provider/provider.dart';
-import 'package:revoltvpn/logic/app_colors.dart';
-import 'package:revoltvpn/logic/server_list.dart';
-
-// ── lib/screens/server_selector/selection_screen.dart ──────────────────────
-// Server picker — reads the server list from the ServerList provider.
-// Each row shows a flag + city name.  Tapping a row persists the choice
-// and pops back.  No latency measurement — the app runs inside a Reality
-// tunnel and must not emit separate probe traffic.
-
-class SelectionScreen extends StatelessWidget {
-  const SelectionScreen({super.key});
-
-  @override
-  Widget build(BuildContext context) {
-    final serverList = context.watch<ServerList>();
-
-    return Scaffold(
-      backgroundColor: AppColors.bgDeep,
-      appBar: AppBar(
-        backgroundColor: AppColors.bgSurface,
-        elevation: 0,
-        leading: IconButton(
-          icon: const Icon(Icons.arrow_back, color: AppColors.textWhite),
-          onPressed: () => Navigator.of(context).pop(),
-        ),
-        title: const Text(
-          'Select Server',
-          style: TextStyle(
-            color: AppColors.textWhite,
-            fontWeight: FontWeight.w600,
-          ),
-        ),
-      ),
-      body: ListView.builder(
-        itemCount: serverList.all.length,
-        itemBuilder: (context, index) {
-          final server = serverList.all[index];
-          final isSelected = index == serverList.selectedIndex;
-
-          return ListTile(
-            leading: Image.asset(server.flagAsset, width: 28, height: 28),
-            title: Text(server.name,
-                style: TextStyle(
-                  color: isSelected ? AppColors.accent : AppColors.textWhite,
-                  fontWeight: FontWeight.w600,
-                )),
-            trailing: isSelected
-                ? const Icon(Icons.check, color: AppColors.accent)
-                : null,
-            onTap: () {
-              serverList.select(index);
-              Navigator.of(context).pop();
-            },
-            contentPadding:
-                const EdgeInsets.symmetric(horizontal: 20, vertical: 8),
-          );
-        },
-      ),
-    );
-  }
-}
@@ -0,0 +1,107 @@
+import 'package:flutter/material.dart';
+import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/logic/power_settings.dart';
+
+/// Keeping the tunnel alive is an OS concern, not an app one.
+///
+/// Android stops background services of apps that are not exempt from Doze, and
+/// removes the whole process group when its task is swiped away. There are
+/// exactly two sanctioned ways around that, both requiring one user tap, and
+/// neither can be enabled programmatically. This tile surfaces both.
+class BackgroundReliabilityTile extends StatefulWidget {
+  const BackgroundReliabilityTile({super.key});
+
+  @override
+  State<BackgroundReliabilityTile> createState() =>
+      _BackgroundReliabilityTileState();
+}
+
+class _BackgroundReliabilityTileState extends State<BackgroundReliabilityTile>
+    with WidgetsBindingObserver {
+  bool? _batteryExempt;
+
+  @override
+  void initState() {
+    super.initState();
+    WidgetsBinding.instance.addObserver(this);
+    _refresh();
+  }
+
+  @override
+  void dispose() {
+    WidgetsBinding.instance.removeObserver(this);
+    super.dispose();
+  }
+
+  @override
+  void didChangeAppLifecycleState(AppLifecycleState state) {
+    // The exemption is granted in a system dialog, so the only reliable moment
+    // to re-read it is when we come back to the foreground.
+    if (state == AppLifecycleState.resumed) _refresh();
+  }
+
+  Future<void> _refresh() async {
+    final exempt = await PowerSettings.isBatteryOptimisationDisabled();
+    if (mounted) setState(() => _batteryExempt = exempt);
+  }
+
+  Future<void> _requestExemption() async {
+    final opened = await PowerSettings.requestDisableBatteryOptimisation();
+    if (!mounted || opened) return;
+    ScaffoldMessenger.of(context).showSnackBar(
+      const SnackBar(
+        content: Text('Could not open battery settings on this device.'),
+      ),
+    );
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final exempt = _batteryExempt;
+
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.stretch,
+      children: [
+        const ListTile(
+          title: Text(
+            'Background reliability',
+            style: TextStyle(color: AppColors.textWhite, fontSize: 15),
+          ),
+          subtitle: Text(
+            'Android stops background apps to save power. Disabling battery '
+            'optimisation is what keeps the VPN running when the app is closed.',
+            style: TextStyle(color: AppColors.textDim, fontSize: 12),
+          ),
+        ),
+        Padding(
+          padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              Text(
+                exempt == null
+                    ? 'Battery optimisation: checking…'
+                    : exempt
+                        ? 'Battery optimisation: disabled for Revolt VPN ✓'
+                        : 'Battery optimisation: still active — the system may '
+                            'stop the VPN in the background.',
+                style: TextStyle(
+                  color: exempt == true ? AppColors.accent : AppColors.textMuted,
+                  fontSize: 12,
+                ),
+              ),
+              if (exempt == false) ...[
+                const SizedBox(height: 8),
+                OutlinedButton.icon(
+                  onPressed: _requestExemption,
+                  icon: const Icon(Icons.battery_saver),
+                  label: const Text('Allow background activity'),
+                ),
+              ],
+            ],
+          ),
+        ),
+      ],
+    );
+  }
+}
@@ -51,8 +51,14 @@ class _ConnectionModeTileState extends State<ConnectionModeTile> {
      return;
    }

-    await ConnectionSettings.setMode(next);
+    final saved = await ConnectionSettings.setMode(next);
    if (!mounted) return;
+    if (!saved) {
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(content: Text('Could not save connection mode.')),
+      );
+      return;
+    }

    setState(() {
      _mode = next;
@@ -94,7 +100,7 @@ class _ConnectionModeTileState extends State<ConnectionModeTile> {

    if (vpn.status != VpnStatus.connected || !vpn.canTestActiveLocalSocks) {
      final orphaned =
-          vpn.status == VpnStatus.connected && vpn.isStartupRestoration;
+          vpn.status == VpnStatus.connected && vpn.adoptedRunningRuntime;
      ScaffoldMessenger.of(context).showSnackBar(
        SnackBar(
          content: Text(
@@ -174,7 +180,7 @@ class _ConnectionModeTileState extends State<ConnectionModeTile> {
                // memory that died with it. Saying "Connect" there would be a
                // lie — the user is already connected.
                final orphaned = vpn.status == VpnStatus.connected &&
-                    vpn.isStartupRestoration;
+                    vpn.adoptedRunningRuntime;
                if (orphaned) {
                  return Padding(
                    padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
@@ -1,84 +0,0 @@
-import 'package:flutter/material.dart';
-import 'package:provider/provider.dart';
-import 'package:revoltvpn/logic/app_colors.dart';
-import 'package:revoltvpn/logic/connection_settings.dart';
-import 'package:revoltvpn/logic/vpn_connection.dart';
-
-class ResilienceModeTile extends StatefulWidget {
-  const ResilienceModeTile({super.key});
-
-  @override
-  State<ResilienceModeTile> createState() => _ResilienceModeTileState();
-}
-
-class _ResilienceModeTileState extends State<ResilienceModeTile> {
-  ResilienceMode _mode = ConnectionSettings.resilienceMode;
-
-  @override
-  void initState() {
-    super.initState();
-    _load();
-  }
-
-  Future<void> _load() async {
-    await ConnectionSettings.initialize();
-    if (mounted) setState(() => _mode = ConnectionSettings.resilienceMode);
-  }
-
-  bool _vpnBusy() {
-    final status = context.read<VpnConnection>().status;
-    return status == VpnStatus.connected ||
-        status == VpnStatus.connecting ||
-        status == VpnStatus.disconnecting;
-  }
-
-  Future<void> _change(ResilienceMode? next) async {
-    if (next == null || next == _mode) return;
-    if (_vpnBusy()) {
-      ScaffoldMessenger.of(context).showSnackBar(
-        const SnackBar(
-          content: Text('Disconnect before changing resilience mode.'),
-        ),
-      );
-      return;
-    }
-
-    await ConnectionSettings.setResilienceMode(next);
-    if (mounted) setState(() => _mode = next);
-  }
-
-  @override
-  Widget build(BuildContext context) {
-    final extreme = _mode == ResilienceMode.extreme;
-
-    return ListTile(
-      title: const Text(
-        'Network resilience',
-        style: TextStyle(color: AppColors.textWhite, fontSize: 15),
-      ),
-      subtitle: Text(
-        extreme
-            ? 'Extreme: keeps the exact server transport unchanged and makes up to two controlled recovery attempts after each real Xray disconnect.'
-            : 'Standard: keeps the exact server transport unchanged and does not force health-check reconnects.',
-        style: const TextStyle(color: AppColors.textDim, fontSize: 12),
-      ),
-      trailing: DropdownButtonHideUnderline(
-        child: DropdownButton<ResilienceMode>(
-          value: _mode,
-          dropdownColor: AppColors.bgCard,
-          onChanged: _change,
-          items: const [
-            DropdownMenuItem(
-              value: ResilienceMode.standard,
-              child: Text('Standard'),
-            ),
-            DropdownMenuItem(
-              value: ResilienceMode.extreme,
-              child: Text('Extreme'),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-}
@@ -1,10 +1,10 @@
 import 'package:flutter/material.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/screens/settings/in_settings/background_reliability.dart';
 import 'package:revoltvpn/screens/settings/in_settings/connection_mode.dart';
 import 'package:revoltvpn/screens/settings/in_settings/haptic.dart';
 import 'package:revoltvpn/screens/settings/in_settings/lightning.dart';
 import 'package:revoltvpn/screens/settings/in_settings/rain.dart';
-import 'package:revoltvpn/screens/settings/in_settings/resilience.dart';

 class SettingsScreen extends StatelessWidget {
  const SettingsScreen({super.key});
@@ -32,7 +32,7 @@ class SettingsScreen extends StatelessWidget {
        padding: const EdgeInsets.symmetric(vertical: 8),
        children: const [
          ConnectionModeTile(),
-          ResilienceModeTile(),
+          BackgroundReliabilityTile(),
          HapticFeedbackTile(),
          RainToggleTile(),
          LightningToggleTile(),
@@ -0,0 +1,30 @@
+# This file tracks properties of this Flutter project.
+# Used by Flutter tool to assess capabilities and perform upgrades etc.
+#
+# This file should be version controlled and should not be manually edited.
+
+version:
+  revision: "adc901062556672b4138e18a4dc62a4be8f4b3c2"
+  channel: "stable"
+
+project_type: plugin
+
+# Tracks metadata for the flutter migrate command
+migration:
+  platforms:
+    - platform: root
+      create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
+      base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
+    - platform: android
+      create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
+      base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
+
+  # User provided section
+
+  # List of Local paths (relative to this file) that should be
+  # ignored by the migrate tool.
+  #
+  # Files that are not part of the templates will be ignored by default.
+  unmanaged_files:
+    - 'lib/main.dart'
+    - 'ios/Runner.xcodeproj/project.pbxproj'
@@ -0,0 +1,49 @@
+## 1.1.5
+
+* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.7.11`.
+* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.7.11`.
+* Fixed Android VPN app routing: all configured blocked apps are now applied to `VpnService.Builder` as disallowed applications and bypass the Xray VPN tunnel.
+
+## 1.1.4
+
+* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.27.1`.
+* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.27`.
+
+## 1.1.3
+
+* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.22`.
+* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.22`.
+
+## 1.1.2
+
+* Clarified that Android device and emulator runtime binaries are delivered through the main Maven `xray-android` AAR.
+* Kept the Android runtime dependency on `dev.tfox.fluttervless:xray-android:26.6.1.1`.
+
+## 1.1.1
+
+* Updated the Android device runtime `libxray.so` binaries to Xray-core `v26.6.1`.
+* Kept Android 15+ 16KB page-size linker alignment for the rebuilt ARM binaries.
+* Moved Android runtime binaries and geodata into the Maven `dev.tfox.fluttervless:xray-android:26.6.1.1` AAR dependency.
+* Included device and emulator ABIs (`armeabi-v7a`, `arm64-v8a`, `x86`, `x86_64`) in the main Maven runtime AAR.
+* Removed raw device `jniLibs` and geodata files from the Pub.dev wrapper package; the wrapper now resolves the runtime from Maven Central.
+
+## 1.1.0
+
+* Replaced Android Dart boilerplate with the shared `VlessMethodChannelAdapter`.
+* Removed template `getPlatformVersion` scaffold files.
+* Moved `flutter_lints` to `dev_dependencies`.
+* Removed publish-time dependency overrides from `pubspec.yaml`.
+
+## 1.0.2
+
+* XRay version up
+
+## 1.0.1
+
+*   XRay version up
+
+## 1.0.0
+
+*   Initial release of the Android implementation for `flutter_vless`.
+*   Supports VLESS/VMESS protocols using Xray core.
+*   Implements `VlessPlatform` interface.
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 13FOX Studio / tfox.dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,13 @@
+flutter_vless_android
+
+Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
+
+This package is the Android implementation of the official flutter_vless
+project maintained by 13FOX Studio.
+
+Official project: https://github.com/XIIIFOX/flutter_vless
+Official publisher: https://pub.dev/publishers/tfox.dev
+Website: https://tfox.dev
+
+Redistributions, forks, and derived packages must preserve the copyright notice
+and MIT license notice where required by the license.
@@ -0,0 +1,14 @@
+# flutter_vless_android
+
+The Android implementation of the `flutter_vless` plugin.
+
+## Runtime
+
+Android runtime binaries and geodata are delivered through the Maven Central AAR dependency `dev.tfox.fluttervless:xray-android:26.7.11`. This keeps the Pub.dev package lightweight while preserving the same packaged Xray files in the final Android app.
+
+Do not add raw `android/src/main/jniLibs` or geodata files back to this package. Rebuild runtime files in `android_runtime/xray_android/src/main`, publish the Maven AAR, then publish this wrapper package.
+
+## Emulator Support
+
+The current Maven runtime AAR includes `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64`.
+This covers both physical Android devices and Android emulators.
@@ -0,0 +1,4 @@
+Upstream: https://github.com/XIIIFOX/flutter_vless
+Tag: v1.1.5
+Android package: flutter_vless_android 1.1.5
+ReVolt hardening is pre-applied to this vendored package.
@@ -0,0 +1,4 @@
+include: package:flutter_lints/flutter.yaml
+
+# Additional information about this file can be found at
+# https://dart.dev/guides/language/analysis-options
@@ -0,0 +1,9 @@
+*.iml
+.gradle
+/local.properties
+/.idea/workspace.xml
+/.idea/libraries
+.DS_Store
+/build
+/captures
+.cxx
@@ -0,0 +1,92 @@
+# Xray & Tun2socks Android Build Guide
+
+This guide explains how to build the native libraries (`libxray.so` and `libtun2socks.so`) for the Flutter Vless plugin.
+
+Android runtime files are stored in `android_runtime/xray_android/src/main` and published as the Maven Central AAR `dev.tfox.fluttervless:xray-android`. They are not stored in the `flutter_vless_android` Pub.dev package.
+
+**Key Features:**
+- ✅ **Android 15+ Support**: Builds with 16KB page size alignment.
+- ✅ **Socket FD Passing**: `tun2socks` is patched to receive the TUN file descriptor via a Unix socket (bypassing Android process restrictions).
+
+## Prerequisites
+
+1. **Go (Golang)**: Version 1.21+ installed.
+2. **Android NDK**: Version r27+ (recommended).
+3. **macOS/Linux**: Build scripts are designed for Unix-like environments.
+
+## 1. Environment Setup
+
+Export the path to your Android NDK.
+
+```bash
+# Example (Adjust path to your NDK installation)
+export ANDROID_NDK_HOME="$HOME/Library/Android/sdk/ndk/27.0.12077973"
+```
+
+## 2. Build Xray (`libxray.so`)
+
+This script builds the Xray core for Android device and emulator architectures (`arm64-v8a`, `armeabi-v7a`, `x86`, `x86_64`) by default and writes them to the Maven runtime module.
+
+```bash
+cd android
+chmod +x build_xray.sh
+./build_xray.sh
+```
+
+## 3. Build Tun2socks (`libtun2socks.so`)
+
+We use a custom Go-based build script (`build_tun2socks.sh`) instead of the old C-based one. This ensures 16KB page alignment and includes the socket-based FD passing logic.
+
+```bash
+cd android
+chmod +x build_tun2socks.sh
+./build_tun2socks.sh
+```
+
+## 4. Verification (16KB Page Size)
+
+To confirm that the libraries are compatible with Android 15+ (16KB page size), check the `LOAD` segment alignment using `llvm-readelf`.
+
+```bash
+# Check alignment (should be 0x4000)
+$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/darwin-x86_64/bin/llvm-readelf -l ../../../android_runtime/xray_android/src/main/jniLibs/arm64-v8a/libtun2socks.so | grep LOAD | head -1
+```
+
+**Expected Output:**
+```
+LOAD           ... 0x4000
+```
+If you see `0x1000`, it is **NOT** compatible with 16KB devices.
+
+## 5. Package The Maven Runtime AAR
+
+The `flutter_vless_android` Pub.dev package consumes the Android device runtime through the Maven artifact:
+
+```text
+dev.tfox.fluttervless:xray-android:26.7.11
+```
+
+After rebuilding `libxray.so`, `libtun2socks.so`, or the geodata files in `android_runtime/xray_android/src/main`, build the local Maven repository from the repository root:
+
+```bash
+tool/build_android_runtime_maven.sh
+```
+
+For local Android wrapper or example builds before Maven Central publication, pass the local repository path:
+
+```bash
+cd example/android
+./gradlew :app:assembleDebug \
+  -PflutterVlessAndroidRuntimeRepo="$PWD/../../android_runtime/xray_android/build/repo"
+```
+
+To upload the signed bundle to Maven Central, configure the Central Portal and signing environment variables documented in `android_runtime/xray_android/README.md`, then run:
+
+```bash
+tool/publish_android_runtime_maven.sh
+```
+
+## 6. Troubleshooting
+
+- **"bad file descriptor"**: This means the socket FD passing failed. Ensure `XrayVPNService.kt` is correctly sending the FD to the socket path specified in `-sock-path`.
+- **"permission denied"**: Ensure the app has permissions to write to the socket file in its private directory.
@@ -0,0 +1,95 @@
+group 'com.github.tfox.flutter_vless'
+version '1.0'
+
+buildscript {
+    ext.kotlin_version = '2.2.20'
+    repositories {
+        google()
+        mavenCentral()
+    }
+
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.1.0'
+        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
+    }
+}
+
+rootProject.allprojects {
+    repositories {
+        def localRuntimeRepo = findProperty('flutterVlessAndroidRuntimeRepo') ?: System.getenv('FLUTTER_VLESS_ANDROID_RUNTIME_REPO')
+        if (localRuntimeRepo) {
+            maven { url uri(localRuntimeRepo) }
+        }
+        google()
+        mavenCentral()
+    }
+}
+
+apply plugin: 'com.android.library'
+apply plugin: 'kotlin-android'
+
+android {
+    if (project.android.hasProperty("namespace")) {
+        namespace 'com.github.tfox.flutter_vless'
+    }
+
+    compileSdkVersion 34
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_1_8
+        targetCompatibility JavaVersion.VERSION_1_8
+    }
+
+    kotlinOptions {
+        jvmTarget = '1.8'
+    }
+
+    defaultConfig {
+        minSdkVersion 23
+        targetSdkVersion 35
+        
+        // 16KB page size support for Android 15+
+        ndk {
+            abiFilters 'armeabi-v7a', 'arm64-v8a', 'x86', 'x86_64'
+        }
+    }
+    
+    // Configure 16KB page alignment
+    buildFeatures {
+        prefab true
+    }
+
+    dependencies {
+        testImplementation 'junit:junit:4.13.2'
+        testImplementation 'org.mockito:mockito-core:5.0.0'
+        testImplementation 'org.json:json:20240303'
+    }
+
+    testOptions {
+        unitTests.returnDefaultValues = true
+        unitTests.all {
+            testLogging {
+               events "passed", "skipped", "failed", "standardOut", "standardError"
+               outputs.upToDateWhen {false}
+               showStandardStreams = true
+            }
+        }
+    }
+
+    sourceSets {
+        main {
+            java.srcDirs += 'src/main/kotlin'
+        }
+    }
+    packaging {
+        jniLibs {
+            pickFirsts += ['lib/**/libc++_shared.so']
+        }
+    }
+}
+
+dependencies {
+    implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
+    implementation 'androidx.appcompat:appcompat:1.6.1'
+    implementation 'com.google.code.gson:gson:2.10.1'
+    implementation "dev.tfox.fluttervless:xray-android:${findProperty('flutterVlessXrayRuntimeVersion') ?: '26.7.11'}"
+}
@@ -0,0 +1,122 @@
+#!/bin/bash
+set -euo pipefail
+
+# Build script for tun2socks (Go version) with 16KB page size support
+# This is required for Android 15+ compatibility
+
+# Configuration
+TUN2SOCKS_REPO="https://github.com/xjasonlyu/tun2socks"
+TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}"
+NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}"
+
+# Check NDK
+if [ ! -d "$NDK_PATH" ]; then
+    echo "Error: NDK not found at $NDK_PATH"
+    echo "Please export ANDROID_NDK_HOME pointing to your NDK installation."
+    exit 1
+fi
+
+echo "Using NDK at: $NDK_PATH"
+
+case "$(uname -s)" in
+    Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;;
+    Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;;
+    *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;;
+esac
+if [ ! -d "$TOOLCHAIN" ]; then
+    echo "Error: NDK toolchain not found at $TOOLCHAIN"
+    echo "Please check ANDROID_NDK_HOME and host OS."
+    exit 1
+fi
+
+# Clone tun2socks if not exists
+if [ ! -d "tun2socks-go" ]; then
+    echo "Cloning tun2socks (Go version)..."
+    git clone "$TUN2SOCKS_REPO" tun2socks-go
+else
+    echo "tun2socks-go directory exists, pulling latest..."
+    cd tun2socks-go && git pull && cd ..
+fi
+
+# Build Function
+build_tun2socks() {
+    local ARCH_NAME=$1
+    local GO_ARCH=$2
+    local GO_ARM=$3
+    local ANDROID_TARGET=$4
+    local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}"
+
+    echo "Building tun2socks for ${ARCH_NAME}..."
+    
+    mkdir -p "$OUTPUT_DIR"
+
+    export CGO_ENABLED=1
+    export GOOS=android
+    export GOARCH=$GO_ARCH
+    export GOARM=$GO_ARM
+    
+    export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang"
+    export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++"
+    
+    # Verify compiler exists
+    if [ ! -f "$CC" ]; then
+        echo "Error: Compiler not found at $CC"
+        return 1
+    fi
+
+    cd tun2socks-go
+    
+    # Build with 16KB page alignment - same flags as xray
+    go build -v -trimpath -ldflags "-s -w -buildid= -linkmode=external -extldflags '-Wl,-z,max-page-size=16384'" -buildmode=pie -o "../${OUTPUT_DIR}/libtun2socks.so" .
+
+    echo "Success: ${OUTPUT_DIR}/libtun2socks.so created."
+
+    # Verify 16KB alignment
+    if [ -x "${TOOLCHAIN}/bin/llvm-readelf" ]; then
+        echo "Verifying 16KB alignment:"
+        ALIGN=$("${TOOLCHAIN}/bin/llvm-readelf" -l "../${OUTPUT_DIR}/libtun2socks.so" | grep "LOAD" | head -1 | awk '{print $NF}')
+        if [ "$ALIGN" = "0x4000" ]; then
+            echo "Alignment: $ALIGN (16KB) - correct"
+        else
+            echo "Warning: alignment is $ALIGN; expected 0x4000"
+        fi
+    fi
+
+    cd ..
+}
+
+# Build for Architectures
+echo "Building tun2socks (Go version) with 16KB page size support..."
+
+# ARM64
+if [ "${TUN2SOCKS_BUILD_ARM64:-1}" = "1" ]; then
+    build_tun2socks "arm64-v8a" "arm64" "" "aarch64-linux-android21"
+fi
+
+# ARMv7
+if [ "${TUN2SOCKS_BUILD_ARMV7:-1}" = "1" ]; then
+    build_tun2socks "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21"
+fi
+
+# x86 is included in the main runtime AAR.
+if [ "${TUN2SOCKS_BUILD_X86:-1}" = "1" ]; then
+    build_tun2socks "x86" "386" "" "i686-linux-android21"
+fi
+
+# x86_64 is included in the main runtime AAR.
+if [ "${TUN2SOCKS_BUILD_X86_64:-1}" = "1" ]; then
+    build_tun2socks "x86_64" "amd64" "" "x86_64-linux-android21"
+fi
+
+echo ""
+echo "========================================="
+echo "Build process finished!"
+echo "========================================="
+echo ""
+echo "Verification:"
+echo "Run this command to check all libraries:"
+echo ""
+echo "for arch in armeabi-v7a arm64-v8a x86 x86_64; do"
+echo "  echo \"=== \$arch ===\";"
+echo "  ${TOOLCHAIN}/bin/llvm-readelf -l ${TARGET_DIR}/\$arch/libtun2socks.so | grep LOAD | head -1;"
+echo "done"
@@ -0,0 +1,116 @@
+#!/bin/bash
+set -euo pipefail
+
+# Configuration
+XRAY_REPO="https://github.com/XTLS/Xray-core"
+XRAY_VERSION="${XRAY_VERSION:-v26.7.11}"
+TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}"
+NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}"
+
+# Check NDK
+if [ ! -d "$NDK_PATH" ]; then
+    echo "Error: NDK not found at $NDK_PATH"
+    echo "Please export ANDROID_NDK_HOME pointing to your NDK installation."
+    exit 1
+fi
+
+echo "Using NDK at: $NDK_PATH"
+
+# MacOS NDK Toolchain path
+case "$(uname -s)" in
+    Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;;
+    Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;;
+    *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;;
+esac
+if [ ! -d "$TOOLCHAIN" ]; then
+    echo "Error: NDK toolchain not found at $TOOLCHAIN"
+    echo "Are you on macOS? If not, please edit the script to match your OS."
+    exit 1
+fi
+
+# Clone Xray if not exists
+if [ ! -d "Xray-core" ]; then
+    echo "Cloning Xray-core..."
+    git clone "$XRAY_REPO"
+else
+    echo "Xray-core directory exists, pulling latest..."
+    cd Xray-core && git fetch --tags && cd ..
+fi
+
+cd Xray-core
+git fetch --tags
+git checkout "$XRAY_VERSION"
+cd ..
+
+# Build Function
+build_xray() {
+    local ARCH_NAME=$1
+    local GO_ARCH=$2
+    local GO_ARM=$3
+    local ANDROID_TARGET=$4
+    local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}"
+
+    echo "Building for ${ARCH_NAME}..."
+    
+    mkdir -p "$OUTPUT_DIR"
+
+    export CGO_ENABLED=1
+    export GOOS=android
+    export GOARCH=$GO_ARCH
+    export GOARM=$GO_ARM
+    
+    export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang"
+    export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++"
+    
+    # 16KB page size support for Android 15+
+    export LDFLAGS="-Wl,-z,max-page-size=16384"
+    
+    # Verify compiler exists
+    if [ ! -f "$CC" ]; then
+        echo "Error: Compiler not found at $CC"
+        # Try older NDK naming convention if new one fails (API 21 is standard)
+        # Some NDKs use specific API levels in clang name
+        return 1
+    fi
+
+    cd Xray-core
+    
+    # Build with 16KB page alignment
+    if go build -v -trimpath -buildvcs=false \
+        -gcflags "all=-l=4" \
+        -ldflags "-X github.com/xtls/xray-core/core.build=${XRAY_VERSION} -s -w -buildid= -checklinkname=0 -linkmode=external -extldflags=${LDFLAGS}" \
+        -buildmode=pie \
+        -o "../${OUTPUT_DIR}/libxray.so" ./main; then
+        echo "Success: ${OUTPUT_DIR}/libxray.so created."
+    else
+        echo "Failed to build for ${ARCH_NAME}"
+        return 1
+    fi
+    
+    cd ..
+}
+
+# Build for Architectures
+# API Level 21 is generally safe for modern Flutter apps (Android 5.0+)
+
+# ARM64
+if [ "${XRAY_BUILD_ARM64:-1}" = "1" ]; then
+    build_xray "arm64-v8a" "arm64" "" "aarch64-linux-android21"
+fi
+
+# ARMv7
+if [ "${XRAY_BUILD_ARMV7:-1}" = "1" ]; then
+    build_xray "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21"
+fi
+
+# x86 is included in the main runtime AAR.
+if [ "${XRAY_BUILD_X86:-1}" = "1" ]; then
+    build_xray "x86" "386" "" "i686-linux-android21"
+fi
+
+# x86_64 is included in the main runtime AAR.
+if [ "${XRAY_BUILD_X86_64:-1}" = "1" ]; then
+    build_xray "x86_64" "amd64" "" "x86_64-linux-android21"
+fi
+
+echo "Build process finished."
@@ -0,0 +1 @@
+rootProject.name = 'flutter_vless_android'
@@ -0,0 +1,31 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.github.tfox.flutter_vless">
+
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission
+        android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"
+        android:minSdkVersion="34" />
+
+    <application>
+        <service
+            android:name="com.github.tfox.flutter_vless.xray.service.XrayVPNService"
+            android:enabled="true"
+            android:exported="false"
+            android:foregroundServiceType="specialUse"
+            android:permission="android.permission.BIND_VPN_SERVICE"
+            android:process=":RunSoLibXrayDaemon">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="vpn" />
+            <intent-filter>
+                <action android:name="android.net.VpnService" />
+            </intent-filter>
+            <meta-data
+                android:name="android.net.VpnService.SUPPORTS_ALWAYS_ON"
+                android:value="false" />
+        </service>
+    </application>
+</manifest>
@@ -0,0 +1,402 @@
+// Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
+// SPDX-License-Identifier: MIT
+
+package com.github.tfox.flutter_vless
+
+import android.Manifest
+import android.app.Activity
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.content.pm.PackageManager
+import android.net.VpnService
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.util.Log
+import androidx.core.app.ActivityCompat
+import androidx.core.content.ContextCompat
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import com.github.tfox.flutter_vless.xray.service.XrayVPNService
+import com.github.tfox.flutter_vless.xray.utils.AppConfigs
+import io.flutter.embedding.engine.plugins.FlutterPlugin
+import io.flutter.embedding.engine.plugins.activity.ActivityAware
+import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
+import io.flutter.plugin.common.EventChannel
+import io.flutter.plugin.common.MethodCall
+import io.flutter.plugin.common.MethodChannel
+import io.flutter.plugin.common.PluginRegistry
+import java.io.BufferedReader
+import java.io.File
+import java.io.InputStreamReader
+import java.util.ArrayList
+import java.util.UUID
+import java.util.concurrent.Executors
+
+/**
+ * Main entry point for the Flutter Vless plugin on Android.
+ *
+ * ReVolt keeps this bridge deliberately narrow: start/stop, session deadline,
+ * permission handling, core version and private runtime status only.
+ */
+class FlutterVlessPlugin : FlutterPlugin, ActivityAware, PluginRegistry.ActivityResultListener, MethodChannel.MethodCallHandler {
+
+    private val executor = Executors.newSingleThreadExecutor()
+    private lateinit var vpnControlMethod: MethodChannel
+    private lateinit var vpnStatusEvent: EventChannel
+    private var vpnStatusSink: EventChannel.EventSink? = null
+    private var activity: Activity? = null
+    private var xrayReceiver: BroadcastReceiver? = null
+    private var pendingResult: MethodChannel.Result? = null
+    private lateinit var context: Context
+    private var expectedRuntimeToken: String? = null
+    private var pendingStopResult: MethodChannel.Result? = null
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private val stopTimeoutRunnable = Runnable {
+        val pending = pendingStopResult ?: return@Runnable
+        pendingStopResult = null
+        pending.error("STOP_TIMEOUT", "VPN service did not confirm shutdown", null)
+    }
+
+    companion object {
+        private const val TAG = "FlutterVlessPlugin"
+        private const val REQUEST_CODE_VPN_PERMISSION = 24
+        private const val REQUEST_CODE_POST_NOTIFICATIONS = 1
+    }
+
+    override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+        context = binding.applicationContext
+        vpnControlMethod = MethodChannel(binding.binaryMessenger, "flutter_vless")
+        vpnStatusEvent = EventChannel(binding.binaryMessenger, "flutter_vless/status")
+
+        vpnControlMethod.setMethodCallHandler(this)
+        vpnStatusEvent.setStreamHandler(object : EventChannel.StreamHandler {
+            override fun onListen(arguments: Any?, events: EventChannel.EventSink?) {
+                vpnStatusSink = events
+                registerReceiver()
+            }
+
+            override fun onCancel(arguments: Any?) {
+                vpnStatusSink = null
+                unregisterReceiver()
+            }
+        })
+    }
+
+    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
+        when (call.method) {
+            "startVless" -> {
+                if (pendingStopResult != null) {
+                    result.error("STOP_IN_PROGRESS", "VPN shutdown is still in progress", null)
+                    return
+                }
+
+                val config = XrayConfig()
+                val runtimeToken = UUID.randomUUID().toString()
+                expectedRuntimeToken = runtimeToken
+                config.RUNTIME_TOKEN = runtimeToken
+                config.REMARK = call.argument("remark") ?: ""
+                config.V2RAY_FULL_JSON_CONFIG = call.argument("config") ?: ""
+                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
+                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
+                config.NOTIFICATION_DISCONNECT_BUTTON_NAME = call.argument("notificationDisconnectButtonName") ?: "Disconnect"
+
+                if (AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME.isNotEmpty() && AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE.isNotEmpty()) {
+                    config.NOTIFICATION_ICON_RESOURCE_NAME = AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME
+                    config.NOTIFICATION_ICON_RESOURCE_TYPE = AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE
+                    val resId = context.resources.getIdentifier(
+                        AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME,
+                        AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE,
+                        context.packageName
+                    )
+                    config.APPLICATION_ICON = resId
+                }
+
+                if (call.argument<Boolean>("proxy_only") == true) {
+                    AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.PROXY_ONLY
+                } else {
+                    AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.VPN_TUN
+                }
+
+                try {
+                    val jsonConfig = org.json.JSONObject(config.V2RAY_FULL_JSON_CONFIG)
+                    val outbounds = jsonConfig.optJSONArray("outbounds")
+                    if (outbounds != null && outbounds.length() > 0) {
+                        val firstOutbound = outbounds.getJSONObject(0)
+                        val settings = firstOutbound.optJSONObject("settings")
+                        val vnext = settings?.optJSONArray("vnext")
+                        if (vnext != null && vnext.length() > 0) {
+                            val server = vnext.getJSONObject(0)
+                            config.CONNECTED_V2RAY_SERVER_ADDRESS = server.optString("address", "")
+                            config.CONNECTED_V2RAY_SERVER_PORT = server.optInt("port", 0).toString()
+                        } else if (settings != null) {
+                            config.CONNECTED_V2RAY_SERVER_ADDRESS = settings.optString("address", "")
+                            config.CONNECTED_V2RAY_SERVER_PORT = settings.optInt("port", 0).toString()
+                        }
+                    }
+                } catch (_: Exception) {
+                    // Optional metadata only; runtime config validation happens downstream.
+                }
+
+                val intent = Intent(context, XrayVPNService::class.java)
+                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE)
+                intent.putExtra("V2RAY_CONFIG", config)
+                intent.putExtra("PROXY_ONLY", call.argument<Boolean>("proxy_only") ?: false)
+
+                try {
+                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                        context.startForegroundService(intent)
+                    } else {
+                        context.startService(intent)
+                    }
+                    result.success(null)
+                } catch (e: Exception) {
+                    if (expectedRuntimeToken == runtimeToken) expectedRuntimeToken = null
+                    result.error("START_FAILED", e.message ?: "Could not start VPN service", null)
+                }
+            }
+
+            "stopVless" -> {
+                if (pendingStopResult != null) {
+                    result.error("STOP_IN_PROGRESS", "VPN shutdown is already in progress", null)
+                    return
+                }
+
+                // A STOP without a generation token can kill a newer runtime after
+                // UI/process churn. No token means this bridge owns nothing to stop.
+                val token = expectedRuntimeToken
+                if (token == null) {
+                    result.success(null)
+                    return
+                }
+
+                val intent = Intent(context, XrayVPNService::class.java)
+                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
+                intent.putExtra("RUNTIME_TOKEN", token)
+
+                try {
+                    context.startService(intent)
+                    pendingStopResult = result
+                    mainHandler.removeCallbacks(stopTimeoutRunnable)
+                    mainHandler.postDelayed(stopTimeoutRunnable, 6_000L)
+                } catch (e: Exception) {
+                    pendingStopResult = null
+                    mainHandler.removeCallbacks(stopTimeoutRunnable)
+                    result.error("STOP_FAILED", e.message ?: "Could not stop VPN service", null)
+                }
+            }
+
+            "setSessionDeadline" -> {
+                val token = expectedRuntimeToken
+                val remainingSeconds = call.argument<Number>("remainingSeconds")?.toLong()
+                if (token == null) {
+                    result.error("NO_RUNTIME", "No active runtime token", null)
+                    return
+                }
+                if (remainingSeconds == null || remainingSeconds < 0) {
+                    result.error("INVALID_DEADLINE", "remainingSeconds must be non-negative", null)
+                    return
+                }
+
+                val intent = Intent(context, XrayVPNService::class.java)
+                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE)
+                intent.putExtra("RUNTIME_TOKEN", token)
+                intent.putExtra("REMAINING_SECONDS", remainingSeconds)
+                try {
+                    context.startService(intent)
+                    result.success(null)
+                } catch (e: Exception) {
+                    result.error("DEADLINE_FAILED", e.message ?: "Could not update session deadline", null)
+                }
+            }
+
+            "initializeVless" -> {
+                val iconResourceName = call.argument<String>("notificationIconResourceName")
+                val iconResourceType = call.argument<String>("notificationIconResourceType")
+                if (iconResourceName != null && iconResourceType != null) {
+                    AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME = iconResourceName
+                    AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE = iconResourceType
+                }
+                result.success(null)
+            }
+
+            "getCoreVersion" -> {
+                executor.submit {
+                    try {
+                        val nativeLibraryDir = context.applicationInfo.nativeLibraryDir
+                        val xrayExecutable = File(nativeLibraryDir, "libxray.so")
+                        if (xrayExecutable.exists()) {
+                            val p = Runtime.getRuntime().exec(arrayOf(xrayExecutable.absolutePath, "-version"))
+                            val reader = BufferedReader(InputStreamReader(p.inputStream))
+                            val version = reader.readLine()
+                            result.success(version)
+                        } else {
+                            result.success("Xray not found")
+                        }
+                    } catch (e: Exception) {
+                        result.success("Error: ${e.message}")
+                    }
+                }
+            }
+
+            "requestPermission" -> {
+                val currentActivity = activity
+                if (currentActivity == null) {
+                    result.error("NO_ACTIVITY", "Activity is not attached", null)
+                    return
+                }
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                    if (ActivityCompat.checkSelfPermission(currentActivity, Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
+                        ActivityCompat.requestPermissions(currentActivity, arrayOf(Manifest.permission.POST_NOTIFICATIONS), REQUEST_CODE_POST_NOTIFICATIONS)
+                    }
+                }
+                val request = VpnService.prepare(currentActivity)
+                if (request != null) {
+                    pendingResult = result
+                    currentActivity.startActivityForResult(request, REQUEST_CODE_VPN_PERMISSION)
+                } else {
+                    result.success(true)
+                }
+            }
+
+            else -> result.notImplemented()
+        }
+    }
+
+    private fun registerReceiver() {
+        if (activity == null) return
+        if (xrayReceiver == null) {
+            xrayReceiver = object : BroadcastReceiver() {
+                override fun onReceive(context: Context?, intent: Intent?) {
+                    if (intent == null || vpnStatusSink == null) return
+                    val state = intent.getSerializableExtra("STATE") as? AppConfigs.V2RAY_STATES
+                    val runtimeToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
+                    val runtimeReady = intent.getBooleanExtra("RUNTIME_READY", false)
+                    val duration = intent.getStringExtra("DURATION")
+                    val uploadSpeed = intent.getLongExtra("UPLOAD_SPEED", 0)
+                    val downloadSpeed = intent.getLongExtra("DOWNLOAD_SPEED", 0)
+                    val uploadTraffic = intent.getLongExtra("UPLOAD_TRAFFIC", 0)
+                    val downloadTraffic = intent.getLongExtra("DOWNLOAD_TRAFFIC", 0)
+
+                    val currentToken = expectedRuntimeToken
+                    if (currentToken == null) {
+                        if (runtimeToken.isNotEmpty() &&
+                            (state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
+                             state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING)
+                        ) {
+                            expectedRuntimeToken = runtimeToken
+                        } else {
+                            return
+                        }
+                    } else if (runtimeToken != currentToken) {
+                        return
+                    }
+
+                    val stateName = when (state) {
+                        AppConfigs.V2RAY_STATES.V2RAY_CONNECTED -> if (runtimeReady) "CONNECTED" else "CONNECTING"
+                        AppConfigs.V2RAY_STATES.V2RAY_CONNECTING -> "CONNECTING"
+                        else -> "DISCONNECTED"
+                    }
+
+                    val data = ArrayList<String>()
+                    data.add(duration ?: "0")
+                    data.add(uploadSpeed.toString())
+                    data.add(downloadSpeed.toString())
+                    data.add(uploadTraffic.toString())
+                    data.add(downloadTraffic.toString())
+                    data.add(stateName)
+
+                    if (state == AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED &&
+                        runtimeToken.isNotEmpty() && runtimeToken == expectedRuntimeToken
+                    ) {
+                        expectedRuntimeToken = null
+                        mainHandler.removeCallbacks(stopTimeoutRunnable)
+                        pendingStopResult?.success(null)
+                        pendingStopResult = null
+                    }
+
+                    vpnStatusSink?.success(data)
+                }
+            }
+        }
+
+        val filter = IntentFilter(AppConfigs.V2RAY_CONNECTION_INFO)
+        val currentActivity = activity ?: return
+        ContextCompat.registerReceiver(
+            currentActivity,
+            xrayReceiver,
+            filter,
+            ContextCompat.RECEIVER_NOT_EXPORTED,
+        )
+    }
+
+    private fun unregisterReceiver() {
+        val currentActivity = activity
+        val receiver = xrayReceiver
+        if (currentActivity != null && receiver != null) {
+            try {
+                currentActivity.unregisterReceiver(receiver)
+            } catch (e: Exception) {
+                Log.w(TAG, "Receiver was already detached during lifecycle cleanup", e)
+            }
+        }
+        xrayReceiver = null
+    }
+
+    private fun failPendingPermission(code: String, message: String) {
+        pendingResult?.error(code, message, null)
+        pendingResult = null
+    }
+
+    override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+        mainHandler.removeCallbacks(stopTimeoutRunnable)
+        pendingStopResult?.error("ENGINE_DETACHED", "Flutter engine detached during VPN shutdown", null)
+        pendingStopResult = null
+        failPendingPermission("ENGINE_DETACHED", "Flutter engine detached during VPN permission request")
+        unregisterReceiver()
+        vpnControlMethod.setMethodCallHandler(null)
+        vpnStatusEvent.setStreamHandler(null)
+        executor.shutdown()
+    }
+
+    override fun onAttachedToActivity(binding: ActivityPluginBinding) {
+        activity = binding.activity
+        binding.addActivityResultListener(this)
+        if (vpnStatusSink != null) {
+            registerReceiver()
+        }
+    }
+
+    override fun onDetachedFromActivityForConfigChanges() {
+        unregisterReceiver()
+        activity = null
+    }
+
+    override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
+        activity = binding.activity
+        binding.addActivityResultListener(this)
+        if (vpnStatusSink != null) {
+            registerReceiver()
+        }
+    }
+
+    override fun onDetachedFromActivity() {
+        failPendingPermission("NO_ACTIVITY", "Activity detached during VPN permission request")
+        unregisterReceiver()
+        activity = null
+    }
+
+    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
+        if (requestCode == REQUEST_CODE_VPN_PERMISSION) {
+            if (resultCode == Activity.RESULT_OK) {
+                pendingResult?.success(true)
+            } else {
+                pendingResult?.success(false)
+            }
+            pendingResult = null
+            return true
+        }
+        return false
+    }
+}
@@ -0,0 +1,642 @@
+package com.github.tfox.flutter_vless.xray.core
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.graphics.Color
+import android.os.Build
+import android.os.CountDownTimer
+import android.util.Log
+import androidx.core.app.ActivityCompat
+import androidx.core.app.NotificationCompat
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import com.github.tfox.flutter_vless.xray.service.XrayVPNService
+import com.github.tfox.flutter_vless.xray.utils.AppConfigs
+import com.github.tfox.flutter_vless.xray.utils.Utilities
+import org.json.JSONObject
+import org.json.JSONArray
+import java.io.File
+import java.io.FileOutputStream
+
+/**
+ * Manages the Xray Core process (libxray.so).
+ * 
+ * This singleton object is responsible for:
+ * 1. Generating the final Xray configuration file (config.json).
+ * 2. Injecting necessary inbounds (SOCKS, HTTP, API) into the user-provided config.
+ * 3. Starting and monitoring the Xray process.
+ * 4. Collecting traffic statistics via the Xray API.
+ * 5. Showing the persistent foreground notification.
+ */
+object XrayCoreManager {
+
+    private const val NOTIFICATION_ID = 1
+    private const val TAG = "XrayCoreManager"
+    private var xrayProcess: Process? = null
+    private var countDownTimer: CountDownTimer? = null
+    private var seconds = 0
+
+    private fun deleteEphemeralConfigOnFailure(filesDir: File) {
+        try {
+            val config = File(filesDir, "config.json")
+            if (config.exists() && !config.delete()) {
+                Log.w(TAG, "Could not delete failed ephemeral Xray config")
+            }
+        } catch (e: Exception) {
+            Log.w(TAG, "Could not delete failed ephemeral Xray config", e)
+        }
+    }
+
+    private fun nextFreePort(preferredPort: Int, usedPorts: Set<Int>): Int {
+        var port = preferredPort
+        while (usedPorts.contains(port)) {
+            port++
+        }
+        return port
+    }
+
+    private fun uniqueInboundTag(inbounds: JSONArray, preferredTag: String): String {
+        val tags = mutableSetOf<String>()
+        for (i in 0 until inbounds.length()) {
+            val tag = inbounds.optJSONObject(i)?.optString("tag").orEmpty()
+            if (tag.isNotEmpty()) tags.add(tag)
+        }
+
+        if (!tags.contains(preferredTag)) return preferredTag
+
+        var index = 1
+        var candidate = "${preferredTag}_$index"
+        while (tags.contains(candidate)) {
+            index++
+            candidate = "${preferredTag}_$index"
+        }
+        return candidate
+    }
+
+    private fun normalizeRuntimeConfig(value: Any?): Any? {
+        return when (value) {
+            is JSONObject -> {
+                val normalized = JSONObject()
+                val aliases = mapOf(
+                    "xHTTPSettings" to "xhttpSettings",
+                    "httpUpgradeSettings" to "httpupgradeSettings",
+                    "splitHTTPSettings" to "splithttpSettings"
+                )
+                val keys = value.keys()
+                while (keys.hasNext()) {
+                    val key = keys.next()
+                    if (key == "allowInsecure") continue
+
+                    val targetKey = aliases[key] ?: key
+                    if (aliases.containsKey(key) && value.has(targetKey)) continue
+
+                    val normalizedValue = normalizeRuntimeConfig(value.opt(key))
+                    if (targetKey == "network" && normalizedValue is String) {
+                        normalized.put(targetKey, normalizedValue.lowercase())
+                    } else {
+                        normalized.put(targetKey, normalizedValue)
+                    }
+                }
+                normalized
+            }
+            is JSONArray -> {
+                val normalized = JSONArray()
+                for (i in 0 until value.length()) {
+                    normalized.put(normalizeRuntimeConfig(value.opt(i)))
+                }
+                normalized
+            }
+            else -> value
+        }
+    }
+
+    private fun normalizeVlessOutbounds(configJson: JSONObject) {
+        val outbounds = configJson.optJSONArray("outbounds") ?: return
+        for (i in 0 until outbounds.length()) {
+            val outbound = outbounds.optJSONObject(i) ?: continue
+            if (outbound.optString("protocol") != "vless") continue
+
+            val settings = outbound.optJSONObject("settings") ?: continue
+            if (settings.has("vnext")) continue
+
+            val address = settings.optString("address")
+            val id = settings.optString("id")
+            val port = settings.optInt("port", 0)
+            if (address.isEmpty() || id.isEmpty() || port <= 0) continue
+
+            val user = JSONObject()
+            user.put("id", id)
+            user.put("encryption", settings.optString("encryption", "none"))
+            user.put("flow", settings.optString("flow", ""))
+            user.put("level", settings.optInt("level", 8))
+
+            val server = JSONObject()
+            server.put("address", address)
+            server.put("port", port)
+            server.put("users", JSONArray().put(user))
+
+            val normalizedSettings = JSONObject()
+            normalizedSettings.put("vnext", JSONArray().put(server))
+            outbound.put("settings", normalizedSettings)
+            Log.d(TAG, "Normalized flat VLESS outbound settings for $address:$port")
+        }
+    }
+
+    private fun sanitizeLogPaths(configJson: JSONObject, filesDir: File) {
+        val log = configJson.optJSONObject("log") ?: return
+
+        // The VPN client never needs destination/access logs. A server-provided
+        // config must not silently enable browsing metadata collection locally.
+        log.remove("access")
+        try { File(filesDir, "access.log").delete() } catch (_: Exception) {}
+
+        val errorPath = log.optString("error")
+        if (errorPath.isNotEmpty()) {
+            log.put("error", File(filesDir, "error.log").absolutePath)
+        }
+    }
+
+    internal fun buildRuntimeConfigJson(config: XrayConfig, filesDir: File): JSONObject {
+        val configJson = normalizeRuntimeConfig(
+            JSONObject(config.V2RAY_FULL_JSON_CONFIG)
+        ) as JSONObject
+        normalizeVlessOutbounds(configJson)
+        sanitizeLogPaths(configJson, filesDir)
+
+        // ReVolt needs only its authenticated local SOCKS ingress.
+        val inbounds = configJson.optJSONArray("inbounds") ?: JSONArray()
+        var secureSocksEnabled = false
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.optJSONObject(i) ?: continue
+            if (inbound.optString("tag") != "revolt-secure-socks") continue
+
+            val settings = inbound.optJSONObject("settings")
+                ?: throw IllegalStateException("Secure SOCKS5 settings are missing")
+            val users = settings.optJSONArray("users")
+                ?: throw IllegalStateException("Secure SOCKS5 users are missing")
+            val account = users.optJSONObject(0)
+                ?: throw IllegalStateException("Secure SOCKS5 account is missing")
+            val port = inbound.optInt("port", -1)
+
+            if (inbound.optString("protocol") != "socks" ||
+                inbound.optString("listen") != "127.0.0.1" ||
+                port <= 1024 || port > 65535 ||
+                settings.optString("auth") != "password" ||
+                account.optString("user").isEmpty() ||
+                account.optString("pass").isEmpty()
+            ) {
+                throw IllegalStateException("Secure SOCKS5 session is invalid")
+            }
+
+            config.LOCAL_SOCKS5_PORT = port
+            config.LOCAL_HTTP_PORT = 0
+            secureSocksEnabled = true
+            break
+        }
+
+        val usedPorts = mutableSetOf<Int>()
+        var hasSocksOnLocalPort = false
+        var hasHttpOnLocalPort = false
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.getJSONObject(i)
+            val protocol = inbound.optString("protocol")
+            val port = inbound.optInt("port", -1)
+            if (port > 0) usedPorts.add(port)
+            if (protocol == "socks" && port == config.LOCAL_SOCKS5_PORT) hasSocksOnLocalPort = true
+            if (protocol == "http" && port == config.LOCAL_HTTP_PORT) hasHttpOnLocalPort = true
+        }
+
+        if (!hasSocksOnLocalPort) {
+            if (usedPorts.contains(config.LOCAL_SOCKS5_PORT)) {
+                config.LOCAL_SOCKS5_PORT = nextFreePort(config.LOCAL_SOCKS5_PORT, usedPorts)
+            }
+            val socksInbound = JSONObject()
+            socksInbound.put("tag", uniqueInboundTag(inbounds, "socks"))
+            socksInbound.put("port", config.LOCAL_SOCKS5_PORT)
+            socksInbound.put("listen", "127.0.0.1")
+            socksInbound.put("protocol", "socks")
+            socksInbound.put("settings", JSONObject().put("auth", "noauth").put("udp", true))
+            socksInbound.put(
+                "sniffing",
+                JSONObject().put("enabled", true).put("destOverride", JSONArray().put("http").put("tls"))
+            )
+            inbounds.put(socksInbound)
+            usedPorts.add(config.LOCAL_SOCKS5_PORT)
+            Log.d(TAG, "Injected SOCKS inbound on port ${config.LOCAL_SOCKS5_PORT}")
+        }
+
+        if (!secureSocksEnabled && !hasHttpOnLocalPort) {
+            if (usedPorts.contains(config.LOCAL_HTTP_PORT)) {
+                config.LOCAL_HTTP_PORT = nextFreePort(config.LOCAL_HTTP_PORT, usedPorts)
+            }
+            val httpInbound = JSONObject()
+            httpInbound.put("tag", uniqueInboundTag(inbounds, "http"))
+            httpInbound.put("port", config.LOCAL_HTTP_PORT)
+            httpInbound.put("listen", "127.0.0.1")
+            httpInbound.put("protocol", "http")
+            inbounds.put(httpInbound)
+            usedPorts.add(config.LOCAL_HTTP_PORT)
+            Log.d(TAG, "Injected HTTP inbound on port ${config.LOCAL_HTTP_PORT}")
+        }
+
+        return configJson
+    }
+
+    internal fun buildDelayConfigJson(configJson: String, proxyPort: Int, filesDir: File): Pair<JSONObject, Int> {
+        val delayConfig = XrayConfig(
+            V2RAY_FULL_JSON_CONFIG = configJson,
+            LOCAL_SOCKS5_PORT = proxyPort,
+            LOCAL_HTTP_PORT = proxyPort + 1,
+            LOCAL_API_PORT = proxyPort + 2
+        )
+        val runtimeJson = buildRuntimeConfigJson(delayConfig, filesDir)
+        return Pair(runtimeJson, delayConfig.LOCAL_SOCKS5_PORT)
+    }
+
+    /**
+     * Starts the Xray Core process.
+     * 
+     * @param context The service context (needed for file access and notifications).
+     * @param config The configuration object containing the user's settings.
+     * @return true if started successfully, false otherwise.
+     */
+    fun startCore(context: Service, config: XrayConfig): Boolean {
+        AppConfigs.RUNTIME_READY = false
+        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+        AppConfigs.V2RAY_CONFIG = config
+
+        // 1. Prepare the configuration file
+        val configFilesDir = context.filesDir
+        
+        try {
+            val configJson = buildRuntimeConfigJson(config, configFilesDir)
+            val configFile = File(context.filesDir, "config.json")
+            configFile.writeText(configJson.toString())
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to write config file", e)
+            deleteEphemeralConfigOnFailure(configFilesDir)
+            return false
+        }
+
+        // 2. Find Xray executable (libxray.so)
+        val nativeLibraryDir = context.applicationInfo.nativeLibraryDir
+        val xrayExecutable = File(nativeLibraryDir, "libxray.so")
+        if (!xrayExecutable.exists()) {
+            Log.e(TAG, "Xray executable not found at ${xrayExecutable.absolutePath}")
+            deleteEphemeralConfigOnFailure(configFilesDir)
+            return false
+        }
+
+        // 3. Prepare assets (geoip, geosite)
+        try {
+            Utilities.copyAssets(context)
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to prepare Xray assets", e)
+            deleteEphemeralConfigOnFailure(configFilesDir)
+            return false
+        }
+
+        // 4. Run Xray
+        try {
+            val cmd = listOf(
+                xrayExecutable.absolutePath,
+                "-config", File(configFilesDir, "config.json").absolutePath
+            )
+            val pb = ProcessBuilder(cmd)
+            pb.directory(configFilesDir)
+            pb.redirectErrorStream(true)
+            
+            // Set environment variables (XRAY_LOCATION_ASSET is crucial for finding geoip/geosite)
+            val env = pb.environment()
+            env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context)
+
+            xrayProcess = pb.start()
+            Thread.sleep(300)
+            if (xrayProcess?.isAlive != true) {
+                val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()
+                Log.e(TAG, "Xray process exited during startup. Output: $output")
+                xrayProcess = null
+                AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED
+                deleteEphemeralConfigOnFailure(configFilesDir)
+                return false
+            }
+            
+            // config.json contains per-session SOCKS credentials. Xray has
+            // consumed it after the startup liveness check, so remove it now.
+            try {
+                val ephemeralConfig = File(configFilesDir, "config.json")
+                if (ephemeralConfig.exists() && !ephemeralConfig.delete()) {
+                    Log.w(TAG, "Could not delete ephemeral Xray config")
+                }
+            } catch (e: Exception) {
+                Log.w(TAG, "Could not delete ephemeral Xray config", e)
+            }
+
+            AppConfigs.RUNTIME_READY = false
+            AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+            startTimer(context)
+            showNotification(context, config)
+            sendStatusBroadcast(context, config)
+            
+            val process = xrayProcess ?: return false
+            // Monitor process in a separate thread to detect crash
+            Thread {
+                try {
+                    process.inputStream.bufferedReader().use { reader ->
+                        reader.forEachLine { _ -> }
+                    }
+                    
+                    val exitCode = process.waitFor()
+                    Log.e(TAG, "Xray process exited with code $exitCode")
+                    if (xrayProcess === process &&
+                        AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN == config.RUNTIME_TOKEN &&
+                        (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
+                         AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING)
+                    ) {
+                        // Hold the Android TUN while the core is recovered. Killing
+                        // the VPN service here would allow direct-network fallback.
+                        xrayProcess = null
+                        AppConfigs.RUNTIME_READY = false
+                        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+                        sendStatusBroadcast(context, config)
+                        if (context is XrayVPNService) {
+                            context.handleXrayCoreExit(config)
+                        } else {
+                            stopCore(context)
+                        }
+                    }
+                } catch (e: java.io.InterruptedIOException) {
+                    // Expected when stopping
+                } catch (e: InterruptedException) {
+                    // Expected when stopping
+                } catch (e: Exception) {
+                    Log.e(TAG, "Error reading xray output", e)
+                }
+            }.start()
+
+            return true
+
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start Xray process", e)
+            deleteEphemeralConfigOnFailure(configFilesDir)
+            return false
+        }
+    }
+
+    /**
+     * Stops the Xray Core process and cleans up notifications.
+     */
+    fun stopCore(context: Service, confirmationToken: String? = AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN) {
+        try {
+            xrayProcess?.destroy()
+            xrayProcess = null
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to destroy Xray process", e)
+        }
+
+        AppConfigs.RUNTIME_READY = false
+        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED
+        stopTimer()
+        val notificationManager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        notificationManager.cancel(NOTIFICATION_ID)
+        sendDisconnectedBroadcast(context, confirmationToken.orEmpty())
+        AppConfigs.V2RAY_CONFIG = null
+    }
+
+    fun markRuntimeConnecting(context: Context, config: XrayConfig) {
+        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return
+        AppConfigs.RUNTIME_READY = false
+        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+        sendStatusBroadcast(context, config)
+    }
+
+    fun markRuntimeReady(context: Service, config: XrayConfig) {
+        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return
+        AppConfigs.RUNTIME_READY = true
+        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED
+        showNotification(context, config)
+        sendStatusBroadcast(context, config)
+    }
+
+    fun isXrayRunning(): Boolean {
+        // Check state instead of process because VPN runs in separate service process
+        return AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
+               AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+    }
+
+    private fun startTimer(context: Context) {
+        countDownTimer?.cancel()
+        seconds = 0
+        countDownTimer = object : CountDownTimer(Long.MAX_VALUE, 1000) {
+            override fun onTick(millisUntilFinished: Long) {
+                seconds++
+                val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
+                intent.putExtra("STATE", AppConfigs.V2RAY_STATE)
+                intent.putExtra("RUNTIME_TOKEN", AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN.orEmpty())
+                intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY)
+                intent.putExtra("DURATION", seconds.toString())
+                
+                intent.putExtra("UPLOAD_SPEED", 0L)
+                intent.putExtra("DOWNLOAD_SPEED", 0L)
+                intent.putExtra("UPLOAD_TRAFFIC", 0L)
+                intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
+                
+                context.sendBroadcast(intent)
+            }
+
+            override fun onFinish() {}
+        }.start()
+    }
+
+    private fun stopTimer() {
+        countDownTimer?.cancel()
+        countDownTimer = null
+        seconds = 0
+    }
+
+    fun sendStatusBroadcast(context: Context, config: XrayConfig) {
+        val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
+        intent.putExtra("STATE", AppConfigs.V2RAY_STATE)
+        intent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN)
+        intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY)
+        intent.putExtra("DURATION", seconds.toString())
+        intent.putExtra("UPLOAD_SPEED", 0L)
+        intent.putExtra("DOWNLOAD_SPEED", 0L)
+        intent.putExtra("UPLOAD_TRAFFIC", 0L)
+        intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
+        context.sendBroadcast(intent)
+    }
+
+    private fun sendDisconnectedBroadcast(context: Context, runtimeToken: String) {
+        val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
+        intent.putExtra("STATE", AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED)
+        intent.putExtra("RUNTIME_TOKEN", runtimeToken)
+        intent.putExtra("RUNTIME_READY", false)
+        intent.putExtra("DURATION", "0")
+        intent.putExtra("UPLOAD_SPEED", 0L)
+        intent.putExtra("DOWNLOAD_SPEED", 0L)
+        intent.putExtra("UPLOAD_TRAFFIC", 0L)
+        intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
+        context.sendBroadcast(intent)
+    }
+
+    private fun showNotification(context: Service, config: XrayConfig) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            if (ActivityCompat.checkSelfPermission(context, android.Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
+                return
+            }
+        }
+
+        val channelId = createNotificationChannel(context, config.APPLICATION_NAME)
+        
+        val launchIntent = context.packageManager.getLaunchIntentForPackage(context.packageName)
+        launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_NEW_TASK
+        
+        val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT else PendingIntent.FLAG_UPDATE_CURRENT
+        val contentPendingIntent = PendingIntent.getActivity(context, 0, launchIntent, flags)
+
+        val stopIntent = Intent(context, XrayVPNService::class.java)
+        stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
+        stopIntent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN)
+        val stopPendingIntent = PendingIntent.getService(context, 0, stopIntent, flags)
+        val smallIcon = if (config.APPLICATION_ICON != 0) config.APPLICATION_ICON else android.R.drawable.ic_dialog_info
+
+        val builder = NotificationCompat.Builder(context, channelId)
+            .setSmallIcon(smallIcon)
+            .setContentTitle(config.REMARK)
+            .setContentText(if (AppConfigs.RUNTIME_READY) "Connected" else "Connecting")
+            .addAction(0, config.NOTIFICATION_DISCONNECT_BUTTON_NAME, stopPendingIntent)
+            .setContentIntent(contentPendingIntent)
+            .setPriority(NotificationCompat.PRIORITY_MIN)
+            .setOngoing(true)
+            .setShowWhen(true)
+
+        context.startForeground(NOTIFICATION_ID, builder.build())
+    }
+
+    fun getConnectedV2rayServerDelay(context: Context, url: String): Long {
+        // Use the configured SOCKS port (default 10807)
+        val port = AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807
+        Log.d(TAG, "getConnectedV2rayServerDelay: Testing delay to $url via SOCKS port $port")
+        
+        return try {
+            val start = System.currentTimeMillis()
+            val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", port))
+            val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection
+            connection.connectTimeout = 5000
+            connection.readTimeout = 5000
+            connection.requestMethod = "HEAD"
+            val responseCode = connection.responseCode
+            val end = System.currentTimeMillis()
+            val delay = end - start
+            connection.disconnect()
+            Log.d(TAG, "getConnectedV2rayServerDelay: Success! Response code: $responseCode, Delay: ${delay}ms")
+            delay
+        } catch (e: Exception) {
+            Log.e(TAG, "getConnectedV2rayServerDelay: Failed to measure delay (VPN may not be running)", e)
+            -1L
+        }
+    }
+
+    /**
+     * Measure delay for a server configuration (when not connected).
+     * Temporarily starts Xray with the provided config, measures delay, then stops it.
+     */
+    fun getServerDelay(context: Context, configJson: String, url: String): Long {
+        Log.d(TAG, "getServerDelay: Starting temporary Xray instance")
+        
+        var tempProcess: Process? = null
+        try {
+            // Find a random free port to avoid conflict with running VPN
+            val freePort = try {
+                val socket = java.net.ServerSocket(0)
+                val port = socket.localPort
+                socket.close()
+                port
+            } catch (e: Exception) {
+                10806 // Fallback
+            }
+            
+            val (json, socksPort) = buildDelayConfigJson(configJson, freePort, context.filesDir)
+            Log.d(TAG, "getServerDelay: Using SOCKS port $socksPort")
+            
+            // Write temp config file
+            val tempConfigFile = File(context.filesDir, "temp_delay_config.json")
+            tempConfigFile.writeText(json.toString())
+            
+            // Copy assets
+            Utilities.copyAssets(context)
+            
+            // Start Xray process
+            val xrayExecutable = File(context.applicationInfo.nativeLibraryDir, "libxray.so")
+            if (!xrayExecutable.exists()) {
+                Log.e(TAG, "getServerDelay: Xray executable not found")
+                return -1L
+            }
+            
+            val cmd = listOf(
+                xrayExecutable.absolutePath,
+                "-config", tempConfigFile.absolutePath
+            )
+            
+            val pb = ProcessBuilder(cmd)
+            pb.directory(context.filesDir)
+            val env = pb.environment()
+            env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context)
+            
+            tempProcess = pb.start()
+            
+            // Wait a bit for Xray to start
+            Thread.sleep(1000)
+            
+            // Measure delay
+            val delay = try {
+                val start = System.currentTimeMillis()
+                val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", socksPort))
+                val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection
+                connection.connectTimeout = 5000
+                connection.readTimeout = 5000
+                connection.requestMethod = "HEAD"
+                val responseCode = connection.responseCode
+                val end = System.currentTimeMillis()
+                connection.disconnect()
+                val result = end - start
+                Log.d(TAG, "getServerDelay: Success! Response code: $responseCode, Delay: ${result}ms")
+                result
+            } catch (e: Exception) {
+                Log.e(TAG, "getServerDelay: Failed to measure delay", e)
+                -1L
+            }
+            
+            // Stop temp process
+            tempProcess?.destroy()
+            tempConfigFile.delete()
+            
+            return delay
+            
+        } catch (e: Exception) {
+            Log.e(TAG, "getServerDelay: Error starting temp Xray", e)
+            tempProcess?.destroy()
+            return -1L
+        }
+    }
+
+    private fun createNotificationChannel(context: Context, appName: String): String {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val channelId = "REVOLT_VPN_SERVICE"
+            val channelName = "$appName Background Service"
+            val channel = NotificationChannel(channelId, channelName, NotificationManager.IMPORTANCE_LOW)
+            channel.lightColor = Color.BLUE
+            channel.lockscreenVisibility = Notification.VISIBILITY_PRIVATE
+            val manager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+            manager.createNotificationChannel(channel)
+            return channelId
+        }
+        return ""
+    }
+}
@@ -0,0 +1,71 @@
+package com.github.tfox.flutter_vless.xray.dto
+
+import java.io.Serializable
+import java.util.ArrayList
+
+/**
+ * Data class representing the Xray configuration and app settings.
+ * 
+ * This class is passed from Flutter to Android and contains:
+ * 1. The full Xray JSON configuration (V2RAY_FULL_JSON_CONFIG).
+ * 2. App-specific settings like blocked apps, notification text, etc.
+ * 3. Connection parameters (server address, ports).
+ */
+data class XrayConfig(
+    /** The IP address of the connected server (used to exclude it from VPN routing). */
+    var CONNECTED_V2RAY_SERVER_ADDRESS: String = "",
+    
+    /** The port of the connected server. */
+    var CONNECTED_V2RAY_SERVER_PORT: String = "",
+    
+    /** Local port for SOCKS5 proxy (default: 10807). used by tun2socks. */
+    var LOCAL_SOCKS5_PORT: Int = 10807,
+    
+    /** Local port for HTTP proxy (default: 10808). */
+    var LOCAL_HTTP_PORT: Int = 10808,
+    
+    /** Local port for Xray API (stats, etc.) (default: 10809). */
+    var LOCAL_API_PORT: Int = 10809,
+    
+    /** Timeout for connections in milliseconds. */
+    var ALLOWED_TIMEOUT_MS: Int = 0,
+    
+    /** List of subnets to bypass (not routed through VPN). */
+    var BYPASS_SUBNETS: ArrayList<String> = ArrayList(),
+    
+    /** List of app package names to exclude from VPN. */
+    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
+    
+    /** The raw Xray configuration JSON string. */
+    var V2RAY_FULL_JSON_CONFIG: String = "",
+    
+    /** Whether to enable traffic statistics collection. */
+    var ENABLE_TRAFFIC_STATICS: Boolean = false,
+    
+    /** Remark/Name of the server configuration. */
+    var REMARK: String = "",
+    
+    /** Name of the application (displayed in notification). */
+    var APPLICATION_NAME: String = "Flutter Vless",
+    
+    /** Resource ID of the notification icon. */
+    var APPLICATION_ICON: Int = 0,
+    
+    /** Resource name of the notification icon (e.g. "ic_notification"). */
+    var NOTIFICATION_ICON_RESOURCE_NAME: String = "",
+    
+    /** Resource type of the notification icon (e.g. "drawable"). */
+    var NOTIFICATION_ICON_RESOURCE_TYPE: String = "",
+    
+    /** Text for the disconnect button in the notification. */
+    var NOTIFICATION_DISCONNECT_BUTTON_NAME: String = "Disconnect",
+    
+    /** Domain resolution strategy (e.g. "IPIfNonMatch"). */
+    var DOMAIN_STRATEGY: String = "",
+    
+    /** Routing domain strategy. */
+    var ROUTING_DOMAIN_STRATEGY: String = "",
+
+    /** Unique generation token used to reject stale native runtime events. */
+    var RUNTIME_TOKEN: String = ""
+) : Serializable
@@ -0,0 +1,686 @@
+package com.github.tfox.flutter_vless.xray.service
+
+import android.app.AlarmManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.net.LocalSocket
+import android.net.LocalSocketAddress
+import android.net.VpnService
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.os.ParcelFileDescriptor
+import android.os.SystemClock
+import android.util.Log
+import com.github.tfox.flutter_vless.xray.core.XrayCoreManager
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import com.github.tfox.flutter_vless.xray.utils.AppConfigs
+import org.json.JSONObject
+import java.io.File
+
+/**
+ * Android VPN Service implementation.
+ *
+ * This service owns the TUN interface and keeps runtime state generation-scoped.
+ * Session deadlines are enforced both by an in-process monotonic timer and by
+ * AlarmManager, while only the non-secret token/deadline pair is persisted.
+ * Per-session VLESS/SOCKS credentials remain memory-only.
+ */
+class XrayVPNService : VpnService() {
+
+    private var mInterface: ParcelFileDescriptor? = null
+    private var tun2socksProcess: Process? = null
+    @Volatile private var isRunning = false
+    @Volatile private var recoveringXray = false
+    @Volatile private var recoveringTun2socks = false
+    private var tun2socksRecoveryAttempt = 0
+    private var currentConfig: XrayConfig? = null
+    private var currentProxyOnly = false
+    private var shuttingDownIntentionally = false
+
+    private val deadlineHandler = Handler(Looper.getMainLooper())
+    private var sessionDeadlineElapsed: Long? = null
+    private var sessionDeadlineToken: String? = null
+    private val sessionDeadlineRunnable = Runnable { enforceSessionDeadline() }
+
+    override fun onCreate() {
+        super.onCreate()
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent == null) {
+            if (isRunning && currentConfig != null) return START_REDELIVER_INTENT
+
+            // Session credentials intentionally stay memory-only. If Android
+            // cannot redeliver the original START intent, fail closed instead
+            // of rebuilding a tunnel from sensitive material stored on disk.
+            clearPersistedDeadline()
+            cancelSessionExpiryAlarm()
+            stopSelf()
+            return START_NOT_STICKY
+        }
+
+        if (intent.getBooleanExtra(EXTRA_SESSION_EXPIRED, false)) {
+            enforcePersistedDeadline(intent.getStringExtra("RUNTIME_TOKEN").orEmpty())
+            return START_NOT_STICKY
+        }
+
+        val command = if (Build.VERSION.SDK_INT >= 33) {
+            intent.getSerializableExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS::class.java)
+        } else {
+            @Suppress("DEPRECATION")
+            intent.getSerializableExtra("COMMAND") as? AppConfigs.V2RAY_SERVICE_COMMANDS
+        }
+
+        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) {
+            val requestedToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
+            val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
+            if (requestedToken.isEmpty() ||
+                (activeToken.isNotEmpty() && requestedToken != activeToken)
+            ) {
+                Log.w(TAG, "Ignoring STOP_SERVICE without matching runtime generation")
+                return START_NOT_STICKY
+            }
+            stopAll(requestedToken)
+            return START_NOT_STICKY
+        }
+
+        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE) {
+            updateSessionDeadline(intent)
+            return if (isRunning) START_REDELIVER_INTENT else START_NOT_STICKY
+        }
+
+        createNotificationChannel()
+        val notification = createNotification("VPN Service Running")
+        try {
+            if (Build.VERSION.SDK_INT >= 34) {
+                startForeground(1, notification, FOREGROUND_SERVICE_TYPE_SPECIAL_USE)
+            } else {
+                startForeground(1, notification)
+            }
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start foreground", e)
+            clearPersistedDeadline()
+            cancelSessionExpiryAlarm()
+            stopSelf()
+            return START_NOT_STICKY
+        }
+
+        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE) {
+            val config = if (Build.VERSION.SDK_INT >= 33) {
+                intent.getSerializableExtra("V2RAY_CONFIG", XrayConfig::class.java)
+            } else {
+                @Suppress("DEPRECATION")
+                intent.getSerializableExtra("V2RAY_CONFIG") as? XrayConfig
+            }
+
+            if (config != null) {
+                if (XrayCoreManager.isXrayRunning()) {
+                    Log.w(TAG, "Stopping stale Xray core before restart")
+                    XrayCoreManager.stopCore(this)
+                }
+                cleanup(clearDeadline = true)
+                shuttingDownIntentionally = false
+                currentConfig = config
+
+                val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false)
+                currentProxyOnly = proxyOnly
+                armSessionDeadline(config, BOOTSTRAP_SESSION_SECONDS)
+                if (shuttingDownIntentionally) return START_NOT_STICKY
+
+                if (XrayCoreManager.startCore(this, config)) {
+                    if (!proxyOnly) {
+                        setupVpn(config)
+                    } else {
+                        isRunning = true
+                        Log.d(TAG, "Starting in PROXY_ONLY mode")
+                        XrayCoreManager.markRuntimeReady(this, config)
+                    }
+                } else {
+                    stopAll(config.RUNTIME_TOKEN)
+                    return START_NOT_STICKY
+                }
+            } else {
+                Log.e(TAG, "START_SERVICE missing V2RAY_CONFIG")
+                stopAll()
+                return START_NOT_STICKY
+            }
+        } else {
+            stopAll()
+            return START_NOT_STICKY
+        }
+
+        return START_REDELIVER_INTENT
+    }
+
+    private fun setupVpn(config: XrayConfig) {
+        try {
+            if (mInterface != null) {
+                mInterface?.close()
+                mInterface = null
+            }
+
+            val builder = Builder()
+            builder.setSession(config.REMARK)
+            builder.setMtu(1500)
+            builder.addAddress("26.26.26.1", 30)
+            builder.addAddress("fd00:26:26::1", 126)
+
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                builder.setMetered(false)
+            }
+
+            if (config.BLOCKED_APPS.isNotEmpty()) {
+                throw IllegalStateException("Per-app VPN bypass is disabled in ReVolt")
+            }
+            try {
+                builder.addDisallowedApplication(packageName)
+            } catch (e: Exception) {
+                throw IllegalStateException("Failed to exclude ReVolt from its own VPN", e)
+            }
+
+            builder.addRoute("0.0.0.0", 0)
+            builder.addRoute("::", 0)
+
+            try {
+                builder.addDnsServer("8.8.8.8")
+                builder.addDnsServer("1.1.1.1")
+            } catch (e: Exception) {
+                throw IllegalStateException("Failed to configure VPN DNS", e)
+            }
+
+            mInterface = builder.establish()
+                ?: throw IllegalStateException("Android refused to establish VPN interface")
+            isRunning = true
+            runTun2socks(config)
+
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to setup VPN", e)
+            stopAll()
+        }
+    }
+
+    private data class SecureSocksCredentials(
+        val port: Int,
+        val username: String,
+        val password: String,
+    )
+
+    private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? {
+        val inbounds = try {
+            JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds")
+        } catch (_: Exception) {
+            null
+        } ?: return null
+
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.optJSONObject(i) ?: continue
+            if (inbound.optString("tag") != "revolt-secure-socks") continue
+            if (inbound.optString("protocol") != "socks" ||
+                inbound.optString("listen") != "127.0.0.1"
+            ) return null
+
+            val settings = inbound.optJSONObject("settings") ?: return null
+            if (settings.optString("auth") != "password") return null
+            val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null
+            val port = inbound.optInt("port", -1)
+            val username = user.optString("user")
+            val password = user.optString("pass")
+            if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) {
+                return null
+            }
+            return SecureSocksCredentials(port, username, password)
+        }
+        return null
+    }
+
+    private fun scheduleTun2socksRecovery(config: XrayConfig, reason: String) {
+        if (!isRunning || currentConfig !== config || recoveringTun2socks) return
+        XrayCoreManager.markRuntimeConnecting(this, config)
+        recoveringTun2socks = true
+        val attempt = ++tun2socksRecoveryAttempt
+        val shift = (attempt - 1).coerceIn(0, 6)
+        val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L)
+        Log.w(TAG, "Scheduling tun2socks recovery attempt $attempt in ${delayMs}ms: $reason")
+
+        Thread {
+            try {
+                Thread.sleep(delayMs)
+            } catch (_: InterruptedException) {
+                recoveringTun2socks = false
+                return@Thread
+            }
+
+            recoveringTun2socks = false
+            if (isRunning && currentConfig === config) {
+                runTun2socks(config)
+            }
+        }.start()
+    }
+
+    private fun runTun2socks(config: XrayConfig) {
+        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
+        val socketFile = File(filesDir, "sock_path")
+        if (socketFile.exists() && !socketFile.delete()) {
+            Log.w(TAG, "Could not delete stale tun2socks socket")
+        }
+        val sockPath = socketFile.absolutePath
+
+        val secure = secureSocksCredentials(config)
+            ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing")
+        config.LOCAL_SOCKS5_PORT = secure.port
+
+        val cmd = arrayListOf(
+            tun2socksPath,
+            "-sock-path", sockPath,
+            "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}",
+            "-mtu", "1500",
+            "-loglevel", "debug"
+        )
+
+        Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")
+
+        try {
+            val pb = ProcessBuilder(cmd)
+            pb.redirectErrorStream(true)
+            pb.directory(filesDir)
+            val process = pb.start()
+            tun2socksProcess = process
+
+            Thread {
+                try {
+                    process.inputStream.bufferedReader().use { reader ->
+                        reader.forEachLine { _ -> }
+                    }
+
+                    process.waitFor()
+                    if (isRunning && tun2socksProcess === process && currentConfig === config) {
+                        Log.e(TAG, "tun2socks exited unexpectedly; keeping TUN fail-closed")
+                        tun2socksProcess = null
+                        scheduleTun2socksRecovery(config, "process exited")
+                    }
+                } catch (_: java.io.InterruptedIOException) {
+                    // Expected when stopping
+                } catch (_: InterruptedException) {
+                    // Expected when stopping
+                } catch (e: Exception) {
+                    Log.e(TAG, "Error reading tun2socks output", e)
+                }
+            }.start()
+
+            sendFd(process, config)
+
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start tun2socks; keeping TUN fail-closed", e)
+            scheduleTun2socksRecovery(config, "start failure")
+        }
+    }
+
+    private fun sendFd(process: Process, config: XrayConfig) {
+        val fd = mInterface?.fileDescriptor ?: return
+        val sockFile = File(filesDir, "sock_path").absolutePath
+
+        Thread {
+            var tries = 0
+            while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) {
+                var localSocket: LocalSocket? = null
+                try {
+                    Thread.sleep(500)
+                    localSocket = LocalSocket()
+                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
+                    val out = localSocket.outputStream
+                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
+                    out.write(32)
+                    out.flush()
+                    localSocket.setFileDescriptorsForSend(null)
+                    localSocket.shutdownOutput()
+                    localSocket.close()
+                    if (isRunning && currentConfig === config && tun2socksProcess === process) {
+                        tun2socksRecoveryAttempt = 0
+                        XrayCoreManager.markRuntimeReady(this, config)
+                    }
+                    return@Thread
+                } catch (_: Exception) {
+                    tries++
+                    try {
+                        localSocket?.close()
+                    } catch (closeError: Exception) {
+                        Log.w(TAG, "Failed to close tun2socks handoff socket", closeError)
+                    }
+                }
+            }
+
+            if (isRunning && tun2socksProcess === process) {
+                Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN")
+                try {
+                    process.destroy()
+                } catch (e: Exception) {
+                    Log.w(TAG, "Failed to recycle tun2socks after FD handoff failure", e)
+                }
+            }
+        }.start()
+    }
+
+    fun handleXrayCoreExit(config: XrayConfig) {
+        if (!isRunning || currentConfig !== config || recoveringXray) return
+        XrayCoreManager.markRuntimeConnecting(this, config)
+        recoveringXray = true
+
+        Thread {
+            var attempt = 0
+            try {
+                while (isRunning && currentConfig === config) {
+                    attempt++
+                    val shift = (attempt - 1).coerceIn(0, 6)
+                    val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L)
+                    Log.w(TAG, "Recovering Xray core attempt $attempt in ${delayMs}ms")
+                    Thread.sleep(delayMs)
+                    if (!isRunning || currentConfig !== config) break
+
+                    if (XrayCoreManager.startCore(this, config)) {
+                        Log.w(TAG, "Xray core recovered without dropping TUN")
+                        if (currentProxyOnly || (mInterface != null && tun2socksProcess?.isAlive == true)) {
+                            XrayCoreManager.markRuntimeReady(this, config)
+                        }
+                        return@Thread
+                    }
+                }
+            } catch (_: InterruptedException) {
+                // Expected when stopping
+            } finally {
+                recoveringXray = false
+            }
+        }.start()
+    }
+
+    private fun cleanup(clearDeadline: Boolean = true) {
+        isRunning = false
+        if (clearDeadline) {
+            clearSessionDeadline()
+        } else {
+            deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
+            sessionDeadlineElapsed = null
+            sessionDeadlineToken = null
+        }
+        recoveringXray = false
+        recoveringTun2socks = false
+        tun2socksRecoveryAttempt = 0
+        currentProxyOnly = false
+        AppConfigs.RUNTIME_READY = false
+        tun2socksProcess?.destroy()
+        tun2socksProcess = null
+        try {
+            mInterface?.close()
+            mInterface = null
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to close VPN interface during cleanup", e)
+        }
+    }
+
+    private fun stopAll(confirmationToken: String = currentConfig?.RUNTIME_TOKEN.orEmpty()) {
+        if (shuttingDownIntentionally) return
+        shuttingDownIntentionally = true
+        cleanup(clearDeadline = true)
+        currentConfig = null
+        XrayCoreManager.stopCore(this, confirmationToken)
+        stopForeground(true)
+        stopSelf()
+    }
+
+    private fun armSessionDeadline(config: XrayConfig, remainingSeconds: Long) {
+        val boundedSeconds = remainingSeconds
+            .coerceAtLeast(0L)
+            .coerceAtMost(Long.MAX_VALUE / 1000L)
+        val delayMs = boundedSeconds * 1000L
+        val nowEpochMs = System.currentTimeMillis()
+        val epochDeadline = if (Long.MAX_VALUE - nowEpochMs < delayMs) {
+            Long.MAX_VALUE
+        } else {
+            nowEpochMs + delayMs
+        }
+
+        sessionDeadlineToken = config.RUNTIME_TOKEN
+        sessionDeadlineElapsed = SystemClock.elapsedRealtime() + delayMs
+
+        if (!persistDeadline(config.RUNTIME_TOKEN, epochDeadline) ||
+            !scheduleSessionExpiryAlarm(config.RUNTIME_TOKEN, epochDeadline)
+        ) {
+            Log.e(TAG, "Could not arm OS-level session expiry; stopping fail-closed")
+            stopAll(config.RUNTIME_TOKEN)
+            return
+        }
+
+        deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
+        if (delayMs == 0L) deadlineHandler.post(sessionDeadlineRunnable)
+        else deadlineHandler.postDelayed(sessionDeadlineRunnable, delayMs)
+    }
+
+    private fun clearSessionDeadline() {
+        deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
+        sessionDeadlineElapsed = null
+        sessionDeadlineToken = null
+        clearPersistedDeadline()
+        cancelSessionExpiryAlarm()
+    }
+
+    private fun enforceSessionDeadline() {
+        val token = sessionDeadlineToken ?: return
+        val deadline = sessionDeadlineElapsed ?: return
+        val config = currentConfig ?: return
+        if (config.RUNTIME_TOKEN != token) return
+        val remaining = deadline - SystemClock.elapsedRealtime()
+        if (remaining > 0L) {
+            deadlineHandler.postDelayed(sessionDeadlineRunnable, remaining)
+            return
+        }
+        Log.w(TAG, "Native session deadline expired; stopping runtime fail-closed")
+        stopAll(token)
+    }
+
+    private fun updateSessionDeadline(intent: Intent) {
+        val config = currentConfig ?: return
+        val token = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
+        if (token.isEmpty() || token != config.RUNTIME_TOKEN) {
+            Log.w(TAG, "Ignoring session deadline update for stale runtime generation")
+            return
+        }
+        val remainingSeconds = intent.getLongExtra("REMAINING_SECONDS", -1L)
+        if (remainingSeconds < 0L) {
+            Log.w(TAG, "Ignoring invalid negative session deadline")
+            return
+        }
+        armSessionDeadline(config, remainingSeconds)
+    }
+
+    private fun persistDeadline(runtimeToken: String, expiresAtEpochMs: Long): Boolean {
+        return try {
+            getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
+                .edit()
+                .putString(PREF_RUNTIME_TOKEN, runtimeToken)
+                .putLong(PREF_EXPIRES_AT_MS, expiresAtEpochMs)
+                .commit()
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to persist non-secret session deadline", e)
+            false
+        }
+    }
+
+    private fun clearPersistedDeadline() {
+        try {
+            getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
+                .edit()
+                .remove(PREF_RUNTIME_TOKEN)
+                .remove(PREF_EXPIRES_AT_MS)
+                .apply()
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to clear persisted session deadline", e)
+        }
+    }
+
+    private fun enforcePersistedDeadline(alarmToken: String) {
+        val stored = try {
+            val prefs = getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
+            prefs.getString(PREF_RUNTIME_TOKEN, null).orEmpty() to
+                prefs.getLong(PREF_EXPIRES_AT_MS, 0L)
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to read persisted session deadline", e)
+            clearPersistedDeadline()
+            cancelSessionExpiryAlarm()
+            stopSelf()
+            return
+        }
+
+        val storedToken = stored.first
+        val storedDeadline = stored.second
+        if (alarmToken.isEmpty() || storedToken.isEmpty() || alarmToken != storedToken) {
+            Log.w(TAG, "Ignoring stale session-expiry alarm")
+            if (currentConfig == null) stopSelf()
+            return
+        }
+
+        val remaining = storedDeadline - System.currentTimeMillis()
+        if (storedDeadline > 0L && remaining > 0L) {
+            if (!scheduleSessionExpiryAlarm(storedToken, storedDeadline)) {
+                Log.e(TAG, "Failed to re-arm early session-expiry alarm")
+                val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
+                if (activeToken == storedToken) stopAll(storedToken) else stopSelf()
+                return
+            }
+            // An alarm can wake a fresh service process after clock changes.
+            // If there is no live runtime in this process, do not leave a
+            // background service instance hanging around just to hold a timer.
+            if (currentConfig == null) stopSelf()
+            return
+        }
+
+        Log.w(TAG, "OS session-expiry alarm fired; stopping runtime fail-closed")
+        val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
+        if (activeToken.isNotEmpty() && activeToken == storedToken) {
+            stopAll(storedToken)
+        } else {
+            clearPersistedDeadline()
+            cancelSessionExpiryAlarm()
+            stopForeground(true)
+            stopSelf()
+        }
+    }
+
+    private fun scheduleSessionExpiryAlarm(runtimeToken: String, expiresAtEpochMs: Long): Boolean {
+        cancelSessionExpiryAlarm()
+        if (runtimeToken.isEmpty() || expiresAtEpochMs <= 0L) return false
+
+        return try {
+            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
+            val pendingIntent = sessionExpiryPendingIntent(runtimeToken)
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                try {
+                    alarmManager.setExactAndAllowWhileIdle(
+                        AlarmManager.RTC_WAKEUP,
+                        expiresAtEpochMs,
+                        pendingIntent,
+                    )
+                } catch (_: SecurityException) {
+                    Log.w(TAG, "Exact alarm unavailable; using inexact idle-capable expiry alarm")
+                    alarmManager.setAndAllowWhileIdle(
+                        AlarmManager.RTC_WAKEUP,
+                        expiresAtEpochMs,
+                        pendingIntent,
+                    )
+                }
+            } else {
+                alarmManager.setExact(AlarmManager.RTC_WAKEUP, expiresAtEpochMs, pendingIntent)
+            }
+            true
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to schedule OS session-expiry alarm", e)
+            false
+        }
+    }
+
+    private fun cancelSessionExpiryAlarm() {
+        try {
+            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
+            alarmManager.cancel(sessionExpiryPendingIntent(""))
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to cancel session-expiry alarm", e)
+        }
+    }
+
+    private fun sessionExpiryPendingIntent(runtimeToken: String): PendingIntent {
+        val intent = Intent(this, XrayVPNService::class.java)
+            .putExtra(EXTRA_SESSION_EXPIRED, true)
+            .putExtra("RUNTIME_TOKEN", runtimeToken)
+        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
+        return PendingIntent.getService(this, SESSION_EXPIRY_REQUEST_CODE, intent, flags)
+    }
+
+    override fun onDestroy() {
+        if (!shuttingDownIntentionally) {
+            val confirmationToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
+            cleanup(clearDeadline = false)
+            currentConfig = null
+            XrayCoreManager.stopCore(this, confirmationToken)
+            stopForeground(true)
+        }
+        super.onDestroy()
+    }
+
+    override fun onRevoke() {
+        stopAll()
+        super.onRevoke()
+    }
+
+    private fun createNotificationChannel() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val channelId = "REVOLT_VPN_SERVICE"
+            val channelName = "VPN Service"
+            val channel = android.app.NotificationChannel(
+                channelId,
+                channelName,
+                android.app.NotificationManager.IMPORTANCE_LOW
+            )
+            val manager = getSystemService(android.app.NotificationManager::class.java)
+            manager?.createNotificationChannel(channel)
+        }
+    }
+
+    private fun createNotification(content: String): android.app.Notification {
+        val channelId = "REVOLT_VPN_SERVICE"
+        val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            android.app.Notification.Builder(this, channelId)
+        } else {
+            @Suppress("DEPRECATION")
+            android.app.Notification.Builder(this)
+        }
+
+        val icon = resources.getIdentifier("notification_icon", "drawable", packageName)
+            .takeIf { it != 0 } ?: android.R.drawable.ic_dialog_info
+
+        val notification = builder
+            .setContentTitle("VPN Service")
+            .setContentText(content)
+            .setSmallIcon(icon)
+            .setOngoing(true)
+            .setAutoCancel(false)
+            .setOnlyAlertOnce(true)
+            .build()
+
+        notification.flags = notification.flags or
+            android.app.Notification.FLAG_ONGOING_EVENT or
+            android.app.Notification.FLAG_NO_CLEAR
+        return notification
+    }
+
+    companion object {
+        private const val TAG = "XrayVPNService"
+        private const val FOREGROUND_SERVICE_TYPE_SPECIAL_USE = 0x40000000
+        private const val BOOTSTRAP_SESSION_SECONDS = 120L
+        private const val DEADLINE_PREFS = "revolt_session_deadline"
+        private const val PREF_RUNTIME_TOKEN = "runtime_token"
+        private const val PREF_EXPIRES_AT_MS = "expires_at_ms"
+        private const val EXTRA_SESSION_EXPIRED = "SESSION_EXPIRED"
+        private const val SESSION_EXPIRY_REQUEST_CODE = 1001
+    }
+}
@@ -0,0 +1,49 @@
+package com.github.tfox.flutter_vless.xray.utils
+
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import java.io.Serializable
+
+/**
+ * Global application configuration and state.
+ *
+ * This object holds:
+ * 1. Constants for Intent actions and Service commands.
+ * 2. Enums for connection states and modes.
+ * 3. Global state variables (current connection state, active config).
+ * 4. Static storage for notification icon resources (passed from Flutter).
+ */
+object AppConfigs {
+    const val V2RAY_CONNECTION_INFO = "com.github.tfox.flutter_vless.xray.V2RAY_CONNECTION_INFO"
+
+    /**
+     * Commands sent to the XrayVPNService via Intent.
+     */
+    enum class V2RAY_SERVICE_COMMANDS : Serializable {
+        START_SERVICE, STOP_SERVICE, RESTART_SERVICE, UPDATE_SESSION_DEADLINE
+    }
+
+    /**
+     * Connection states for the Xray Core.
+     */
+    enum class V2RAY_STATES : Serializable {
+        V2RAY_CONNECTED, V2RAY_DISCONNECTED, V2RAY_CONNECTING
+    }
+
+    /**
+     * Connection modes:
+     * - VPN_TUN: Standard VPN mode using Android VpnService (TUN device).
+     * - PROXY_ONLY: Runs Xray as a local SOCKS/HTTP proxy without establishing a VPN tunnel.
+     */
+    enum class V2RAY_CONNECTION_MODES : Serializable {
+        VPN_TUN, PROXY_ONLY
+    }
+
+    var V2RAY_STATE: V2RAY_STATES = V2RAY_STATES.V2RAY_DISCONNECTED
+    @Volatile var RUNTIME_READY: Boolean = false
+    var V2RAY_CONFIG: XrayConfig? = null
+    var V2RAY_CONNECTION_MODE: V2RAY_CONNECTION_MODES = V2RAY_CONNECTION_MODES.VPN_TUN
+
+    // Stores the resource name and type for the custom notification icon
+    var NOTIFICATION_ICON_RESOURCE_NAME: String = ""
+    var NOTIFICATION_ICON_RESOURCE_TYPE: String = ""
+}
@@ -0,0 +1,62 @@
+package com.github.tfox.flutter_vless.xray.utils
+
+import android.content.Context
+import java.io.File
+import java.io.FileOutputStream
+import java.io.IOException
+import java.io.InputStream
+import java.io.OutputStream
+
+object Utilities {
+
+    fun getUserAssetsPath(context: Context): String {
+        val dir = context.filesDir
+        if (!dir.exists()) {
+            dir.mkdirs()
+        }
+        return dir.absolutePath
+    }
+
+    fun copyAssets(context: Context) {
+        val assets = context.assets
+        val files = assets.list("") ?: return
+        for (filename in files) {
+            if (filename == "geoip.dat" || filename == "geosite.dat") {
+                var `in`: InputStream? = null
+                var out: OutputStream? = null
+                try {
+                    `in` = assets.open(filename)
+                    val outFile = File(getUserAssetsPath(context), filename)
+                    out = FileOutputStream(outFile)
+                    copyFile(`in`, out)
+                } catch (e: IOException) {
+                    e.printStackTrace()
+                } finally {
+                    if (`in` != null) {
+                        try {
+                            `in`.close()
+                        } catch (e: IOException) {
+                            e.printStackTrace()
+                        }
+                    }
+                    if (out != null) {
+                        try {
+                            out.close()
+                        } catch (e: IOException) {
+                            e.printStackTrace()
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    @Throws(IOException::class)
+    private fun copyFile(`in`: InputStream, out: OutputStream) {
+        val buffer = ByteArray(1024)
+        var read: Int
+        while (`in`.read(buffer).also { read = it } != -1) {
+            out.write(buffer, 0, read)
+        }
+    }
+}
@@ -0,0 +1,178 @@
+package com.github.tfox.flutter_vless.xray.core
+
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import java.io.File
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Test
+
+class XrayCoreManagerTest {
+    @Test
+    fun buildRuntimeConfigJson_keepsSecureSocksAndSanitizesLogs() {
+        val filesDir = File("build/test-files/runtime-secure")
+        val config = XrayConfig(
+            V2RAY_FULL_JSON_CONFIG = runtimeConfig(
+                extraLog = """
+                    "log": {
+                      "access": "/tmp/access.log",
+                      "error": "/tmp/error.log"
+                    },
+                """.trimIndent(),
+            )
+        )
+
+        val output = XrayCoreManager.buildRuntimeConfigJson(config, filesDir)
+        val log = output.getJSONObject("log")
+        val inbound = output.getJSONArray("inbounds").getJSONObject(0)
+        val user = output
+            .getJSONArray("outbounds")
+            .getJSONObject(0)
+            .getJSONObject("settings")
+            .getJSONArray("vnext")
+            .getJSONObject(0)
+            .getJSONArray("users")
+            .getJSONObject(0)
+
+        assertFalse(log.has("access"))
+        assertEquals(File(filesDir, "error.log").absolutePath, log.getString("error"))
+        assertEquals("revolt-secure-socks", inbound.getString("tag"))
+        assertEquals("password", inbound.getJSONObject("settings").getString("auth"))
+        assertEquals(19080, config.LOCAL_SOCKS5_PORT)
+        assertEquals(0, config.LOCAL_HTTP_PORT)
+        assertEquals(vlessEncryption, user.getString("encryption"))
+        assertEquals("xtls-rprx-vision", user.getString("flow"))
+    }
+
+    @Test
+    fun buildRuntimeConfigJson_rejectsInvalidSecureSocks() {
+        val config = XrayConfig(
+            V2RAY_FULL_JSON_CONFIG = """
+                {
+                  "inbounds": [
+                    {
+                      "tag": "revolt-secure-socks",
+                      "listen": "127.0.0.1",
+                      "port": 19080,
+                      "protocol": "socks",
+                      "settings": { "auth": "noauth", "users": [] }
+                    }
+                  ],
+                  "outbounds": []
+                }
+            """.trimIndent()
+        )
+
+        try {
+            XrayCoreManager.buildRuntimeConfigJson(
+                config,
+                File("build/test-files/runtime-invalid-socks"),
+            )
+            fail("Invalid secure SOCKS5 configuration must fail closed")
+        } catch (expected: IllegalStateException) {
+            assertTrue(expected.message.orEmpty().contains("Secure SOCKS5"))
+        }
+    }
+
+    @Test
+    fun buildRuntimeConfigJson_normalizesXrayRuntimeAliases() {
+        val config = XrayConfig(
+            V2RAY_FULL_JSON_CONFIG = """
+                {
+                  "inbounds": [
+                    {
+                      "tag": "revolt-secure-socks",
+                      "listen": "127.0.0.1",
+                      "port": 19080,
+                      "protocol": "socks",
+                      "settings": {
+                        "auth": "password",
+                        "users": [{"user": "runtime-user", "pass": "runtime-pass"}]
+                      }
+                    }
+                  ],
+                  "outbounds": [
+                    {
+                      "protocol": "vless",
+                      "settings": {
+                        "vnext": [
+                          {
+                            "address": "example.com",
+                            "port": 443,
+                            "users": [{"id": "11111111-1111-4111-8111-111111111111", "encryption": "none"}]
+                          }
+                        ]
+                      },
+                      "streamSettings": {
+                        "network": "XHTTP",
+                        "security": "tls",
+                        "tlsSettings": {"allowInsecure": false, "serverName": "example.com"},
+                        "xHTTPSettings": {"path": "/", "mode": "auto"},
+                        "httpUpgradeSettings": {"path": "/upgrade"},
+                        "splitHTTPSettings": {"path": "/split"}
+                      }
+                    }
+                  ]
+                }
+            """.trimIndent()
+        )
+
+        val output = XrayCoreManager.buildRuntimeConfigJson(
+            config,
+            File("build/test-files/runtime-aliases"),
+        )
+        val stream = output
+            .getJSONArray("outbounds")
+            .getJSONObject(0)
+            .getJSONObject("streamSettings")
+
+        assertEquals("xhttp", stream.getString("network"))
+        assertTrue(stream.has("xhttpSettings"))
+        assertTrue(stream.has("httpupgradeSettings"))
+        assertTrue(stream.has("splithttpSettings"))
+        assertFalse(stream.has("xHTTPSettings"))
+        assertFalse(stream.has("httpUpgradeSettings"))
+        assertFalse(stream.has("splitHTTPSettings"))
+        assertFalse(stream.getJSONObject("tlsSettings").has("allowInsecure"))
+    }
+
+    private fun runtimeConfig(extraLog: String = ""): String = """
+        {
+          $extraLog
+          "inbounds": [
+            {
+              "tag": "revolt-secure-socks",
+              "listen": "127.0.0.1",
+              "port": 19080,
+              "protocol": "socks",
+              "settings": {
+                "auth": "password",
+                "users": [{"user": "runtime-user", "pass": "runtime-pass"}]
+              }
+            }
+          ],
+          "outbounds": [
+            {
+              "tag": "proxy",
+              "protocol": "vless",
+              "settings": {
+                "address": "xhttp.example.com",
+                "port": 443,
+                "id": "b94da146-a56e-49d7-af4c-a68c9065cbfd",
+                "encryption": "$vlessEncryption",
+                "flow": "xtls-rprx-vision",
+                "level": 8
+              },
+              "streamSettings": {"network": "xhttp", "security": "none"}
+            }
+          ]
+        }
+    """.trimIndent()
+
+    private companion object {
+        const val vlessEncryption =
+            "mlkem768x25519plus.native.1rtt.100-500-2000.75-0-100.80-0-5000.gtmOXB2AN_r905czmOIr6dKq_YDdEJB8RWGqfsXurns"
+    }
+}
@@ -0,0 +1,13 @@
+// Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
+// SPDX-License-Identifier: MIT
+
+import 'package:flutter_vless_platform_interface/flutter_vless_platform_interface.dart';
+
+/// Android implementation of [VlessPlatform] using MethodChannel.
+class FlutterVlessAndroid extends VlessMethodChannelAdapter {
+  /// Registers this class as the platform implementation.
+  /// This is called automatically by Flutter's plugin registry.
+  static void registerWith() {
+    VlessPlatform.instance = FlutterVlessAndroid();
+  }
+}
@@ -0,0 +1,31 @@
+name: flutter_vless_android
+description: Android implementation of the flutter_vless plugin.
+version: 1.1.5
+homepage: https://tfox.dev
+repository: https://github.com/XIIIFOX/flutter_vless
+issue_tracker: https://github.com/XIIIFOX/flutter_vless/issues
+documentation: https://github.com/XIIIFOX/flutter_vless/blob/main/doc/platform/android.md
+funding:
+  - https://tfox.dev
+
+environment:
+  sdk: '>=3.4.0 <4.0.0'
+  flutter: '>=3.3.0'
+
+dependencies:
+  flutter:
+    sdk: flutter
+  flutter_vless_platform_interface: ^1.1.0
+
+dev_dependencies:
+  flutter_test:
+    sdk: flutter
+  flutter_lints: ^6.0.0
+
+flutter:
+  plugin:
+    implements: flutter_vless_platform_interface
+    platforms:
+      android:
+        package: com.github.tfox.flutter_vless
+        pluginClass: FlutterVlessPlugin
@@ -65,14 +65,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "3.0.7"
-  cupertino_icons:
-    dependency: "direct main"
-    description:
-      name: cupertino_icons
-      sha256: "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd"
-      url: "https://pub.dev"
-    source: hosted
-    version: "1.0.9"
  fake_async:
    dependency: transitive
    description:
@@ -180,12 +172,11 @@ packages:
    source: hosted
    version: "1.1.5"
  flutter_vless_android:
-    dependency: transitive
+    dependency: "direct overridden"
    description:
-      name: flutter_vless_android
-      sha256: "5e6fe73d3606ed8c73e87fac15efa7631e12ce18d39a4bd4e13b6c097c6d52b9"
-      url: "https://pub.dev"
-    source: hosted
+      path: "local_packages/flutter_vless_android-1.1.5"
+      relative: true
+    source: path
    version: "1.1.5"
  flutter_vless_macos:
    dependency: transitive
@@ -216,14 +207,6 @@ packages:
    description: flutter
    source: sdk
    version: "0.0.0"
-  google_fonts:
-    dependency: "direct main"
-    description:
-      name: google_fonts
-      sha256: ba03d03bcaa2f6cb7bd920e3b5027181db75ab524f8891c8bc3aa603885b8055
-      url: "https://pub.dev"
-    source: hosted
-    version: "6.3.3"
  google_mobile_ads:
    dependency: "direct main"
    description:
@@ -316,10 +299,10 @@ packages:
    dependency: transitive
    description:
      name: matcher
-      sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
+      sha256: "31bd099b47c10cd1aeb55146a2d46ce0277630ecef3f7dae54ad7873f36696cd"
      url: "https://pub.dev"
    source: hosted
-    version: "0.12.19"
+    version: "0.12.20"
  material_color_utilities:
    dependency: transitive
    description:
@@ -332,10 +315,10 @@ packages:
    dependency: transitive
    description:
      name: meta
-      sha256: "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349"
+      sha256: "307249ce4ff29d58a18e97f6345f539382eb9c9c29ecda628900f31de0443dd9"
      url: "https://pub.dev"
    source: hosted
-    version: "1.18.0"
+    version: "1.19.0"
  nested:
    dependency: transitive
    description:
@@ -385,7 +368,7 @@ packages:
    source: hosted
    version: "1.9.1"
  path_provider:
-    dependency: "direct main"
+    dependency: transitive
    description:
      name: path_provider
      sha256: "50c5dd5b6e1aaf6fb3a78b33f6aa3afca52bf903a8a5298f53101fdaee55bbcd"
@@ -577,10 +560,10 @@ packages:
    dependency: transitive
    description:
      name: test_api
-      sha256: "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e"
+      sha256: "2a122cbe059f8b610d3a5415f42e255b6c17b1f21eee1d960f31080237fb4f11"
      url: "https://pub.dev"
    source: hosted
-    version: "0.7.11"
+    version: "0.7.12"
  typed_data:
    dependency: transitive
    description:
@@ -665,10 +648,10 @@ packages:
    dependency: transitive
    description:
      name: vector_math
-      sha256: d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b
+      sha256: f36f9f3be64c6198714492bb455c11056e33e2f85d9a0b676a48301e44fdcf47
      url: "https://pub.dev"
    source: hosted
-    version: "2.2.0"
+    version: "2.4.2"
  vm_service:
    dependency: transitive
    description:
@@ -742,5 +725,5 @@ packages:
    source: hosted
    version: "3.1.3"
 sdks:
-  dart: ">=3.10.3 <4.0.0"
+  dart: ">=3.11.0-0 <4.0.0"
  flutter: ">=3.38.4"
@@ -15,7 +15,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # In iOS, build-name is used as CFBundleShortVersionString while build-number used as CFBundleVersion.
 # Read more about iOS versioning at
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
-version: 3.3.1+27
+version: 3.3.6+32

 environment:
  sdk: ">=3.0.0 <4.0.0"
@@ -24,10 +24,6 @@ dependencies:
  flutter:
    sdk: flutter

-  # The following adds the Cupertino Icons font to your application.
-  # Use with the CupertinoIcons class for iOS style icons.
-  cupertino_icons: ^1.0.5
-  google_fonts: ^6.1.0
  provider: ^6.1.1
  google_mobile_ads: ^4.0.0
  flutter_vless: 1.1.5
@@ -36,7 +32,6 @@ dependencies:
  url_launcher: ^6.3.2
  flutter_secure_storage: ^10.3.1
  uuid: ^4.5.3
-  path_provider: ^2.1.5
  package_info_plus: ^6.0.0

 dev_dependencies:
@@ -83,3 +78,7 @@ flutter:
  #
  # For details regarding fonts from package dependencies,
  # see https://flutter.dev/custom-fonts/#from-packages
+
+dependency_overrides:
+  flutter_vless_android:
+    path: local_packages/flutter_vless_android-1.1.5
@@ -0,0 +1,87 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:revoltvpn/logic/secure_socks_session.dart';
+
+void main() {
+  test('release verification stays fail-closed and reproducible', () {
+    final gradle = File('android/app/build.gradle.kts').readAsStringSync();
+    final workflow = File('.github/workflows/android-ci.yml').readAsStringSync();
+    final lockfile = File('pubspec.lock').readAsStringSync();
+    final wrapper =
+        File('android/gradle/wrapper/gradle-wrapper.properties').readAsStringSync();
+    final verification =
+        File('android/gradle/verification-metadata.xml').readAsStringSync();
+    final proguard = File('android/app/proguard-rules.pro').readAsStringSync();
+
+    expect(
+      wrapper,
+      contains(
+        'distributionSha256Sum='
+        'efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1',
+      ),
+    );
+    expect(wrapper, contains('validateDistributionUrl=true'));
+
+    expect(verification, contains('<verify-metadata>true</verify-metadata>'));
+    expect(verification, contains('<verify-signatures>false</verify-signatures>'));
+    expect(verification, contains('<sha256 value='));
+    expect(
+      verification,
+      contains('a804b261645ef8c13eb3d5c44a5c2fb0340c5539'),
+    );
+
+    expect(gradle, contains('REVOLT_APP_CONFIG_SHA256'));
+    expect(gradle, contains('verifyReleaseAppConfig'));
+    expect(gradle, contains('preReleaseBuild'));
+    expect(gradle, contains('isMinifyEnabled = true'));
+    expect(gradle, contains('isShrinkResources = true'));
+    expect(gradle, contains('REVOLT_CI_RELEASE_SMOKE'));
+    expect(gradle, contains('signingConfigs.getByName("release")'));
+
+    expect(workflow, contains("flutter-version: '3.47.2'"));
+    expect(workflow, contains('Verify Gradle supply chain'));
+    expect(workflow, contains('Verify dependency lock is committed'));
+    expect(workflow, contains('Verify production release config fails closed'));
+    expect(workflow, contains('Cold APK build'));
+    expect(workflow, contains('Warm APK build'));
+    expect(workflow, contains('Release R8 smoke build'));
+    expect(workflow, contains('Verify tracked build inputs stayed immutable'));
+    expect(workflow, contains('REVOLT_CI_RELEASE_SMOKE'));
+    expect(
+      workflow,
+      contains('actions/checkout@11d5960a326750d5838078e36cf38b85af677262'),
+    );
+    expect(
+      workflow,
+      contains('actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961'),
+    );
+    expect(lockfile, contains('dart: ">=3.11.0-0 <4.0.0"'));
+
+    expect(proguard, contains('-keep class io.flutter.** { *; }'));
+    expect(proguard, contains('-keep class xray.** { *; }'));
+  });
+
+  test('runtime keeps authenticated SOCKS on the IPv4 loopback', () async {
+    final session = await SecureSocksSession.create(jsonEncode({
+      'inbounds': <Object?>[],
+      'outbounds': <Object?>[],
+    }));
+    final config = jsonDecode(session.configJson) as Map<String, dynamic>;
+    final inbounds = config['inbounds'] as List<dynamic>;
+    final inbound = inbounds.single as Map<String, dynamic>;
+    final settings = inbound['settings'] as Map<String, dynamic>;
+    final users = settings['users'] as List<dynamic>;
+    final account = users.single as Map<String, dynamic>;
+
+    expect(inbound['tag'], SecureSocksSession.inboundTag);
+    expect(inbound['listen'], '127.0.0.1');
+    expect(inbound['port'], session.port);
+    expect(settings['auth'], 'password');
+    expect(account['user'], session.username);
+    expect(account['pass'], session.password);
+    expect(session.username, isNotEmpty);
+    expect(session.password, isNotEmpty);
+  });
+}
@@ -1,293 +0,0 @@
-import 'dart:convert';
-import 'dart:io';
-
-const packageName = 'flutter_vless_android';
-const expectedVersionFragment = 'flutter_vless_android-1.1.5';
-
-Never fail(String message) {
-  stderr.writeln('[flutter_vless patch] $message');
-  exit(1);
-}
-
-Directory packageRoot() {
-  final configFile = File('.dart_tool/package_config.json');
-  if (!configFile.existsSync()) {
-    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
-  }
-
-  final decoded = jsonDecode(configFile.readAsStringSync());
-  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
-    fail('package_config.json is invalid');
-  }
-
-  Map<String, dynamic>? package;
-  for (final item in decoded['packages'] as List) {
-    if (item is Map && item['name'] == packageName) {
-      package = Map<String, dynamic>.from(item);
-      break;
-    }
-  }
-  if (package == null) fail('$packageName was not found');
-
-  final rootUriValue = package['rootUri'];
-  if (rootUriValue is! String || rootUriValue.isEmpty) {
-    fail('$packageName has no rootUri');
-  }
-
-  final rootUri = Uri.parse(rootUriValue);
-  final resolved = rootUri.hasScheme
-      ? rootUri
-      : configFile.parent.absolute.uri.resolveUri(rootUri);
-  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
-
-  final root = Directory.fromUri(resolved);
-  final normalized = root.absolute.path.replaceAll('\\', '/');
-  if (!normalized.contains(expectedVersionFragment)) {
-    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
-  }
-  if (!root.existsSync()) fail('package root does not exist: ${root.path}');
-  return root;
-}
-
-void replaceOnce(
-  File file,
-  String oldValue,
-  String newValue,
-  String marker,
-) {
-  if (!file.existsSync()) fail('missing upstream source: ${file.path}');
-  final text = file.readAsStringSync();
-  if (text.contains(marker)) {
-    stdout.writeln('[flutter_vless patch] already current: ${file.path}');
-    return;
-  }
-  if (!text.contains(oldValue)) {
-    fail('upstream source changed; expected block not found in ${file.path}');
-  }
-  file.writeAsStringSync(text.replaceFirst(oldValue, newValue));
-  stdout.writeln('[flutter_vless patch] patched: ${file.path}');
-}
-
-void replaceOneOf(
-  File file,
-  Map<String, String> replacements,
-  String marker,
-) {
-  if (!file.existsSync()) fail('missing upstream source: ${file.path}');
-  var text = file.readAsStringSync();
-  if (text.contains(marker)) {
-    stdout.writeln('[flutter_vless patch] already current: ${file.path}');
-    return;
-  }
-  for (final entry in replacements.entries) {
-    if (!text.contains(entry.key)) continue;
-    text = text.replaceFirst(entry.key, entry.value);
-    file.writeAsStringSync(text);
-    stdout.writeln('[flutter_vless patch] patched/upgraded: ${file.path}');
-    return;
-  }
-  fail('upstream/legacy patch shape not recognized in ${file.path}');
-}
-
-void main() {
-  final root = packageRoot();
-  final kotlin = Directory(
-    '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless',
-  );
-
-  final configFile = File('${kotlin.path}/xray/dto/XrayConfig.kt');
-  replaceOnce(
-    configFile,
-    '''    /** List of app package names to exclude from VPN. */
-    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
-''',
-    '''    /** List of app package names to exclude from VPN. */
-    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
-
-    /** List of app package names that are exclusively allowed into VPN. */
-    var ALLOWED_APPS: ArrayList<String> = ArrayList(),
-''',
-    'var ALLOWED_APPS:',
-  );
-
-  final pluginFile = File('${kotlin.path}/FlutterVlessPlugin.kt');
-  replaceOnce(
-    pluginFile,
-    '''    private lateinit var context: Context
-''',
-    '''    private lateinit var context: Context
-    private var allowedApps: ArrayList<String> = ArrayList()
-''',
-    'private var allowedApps:',
-  );
-
-  const currentAllowedHandler = '''            "setAllowedApps" -> {
-                val requested = call.argument<ArrayList<String>>("allowed_apps") ?: ArrayList()
-                allowedApps = ArrayList(
-                    requested
-                        .map { it.trim() }
-                        .filter { it.isNotEmpty() && it != context.packageName }
-                        .distinct()
-                        .sorted()
-                )
-                result.success(null)
-            }
-''';
-  const legacyAllowedHandler = '''            "setAllowedApps" -> {
-                val requested = call.argument<ArrayList<String>>("allowed_apps") ?: ArrayList()
-                allowedApps = ArrayList(
-                    requested.map { it.trim() }.filter { it.isNotEmpty() }.distinct()
-                )
-                result.success(null)
-            }
-''';
-  replaceOneOf(
-    pluginFile,
-    <String, String>{
-      legacyAllowedHandler: currentAllowedHandler,
-      '''        when (call.method) {
-            "startVless" -> {
-''': '''        when (call.method) {
-$currentAllowedHandler            "startVless" -> {
-''',
-    },
-    'it.isNotEmpty() && it != context.packageName',
-  );
-
-  replaceOnce(
-    pluginFile,
-    '''                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
-                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
-''',
-    '''                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
-                config.ALLOWED_APPS = ArrayList(allowedApps)
-                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
-''',
-    'config.ALLOWED_APPS = ArrayList(allowedApps)',
-  );
-
-  final serviceFile = File('${kotlin.path}/xray/service/XrayVPNService.kt');
-  replaceOnce(
-    serviceFile,
-    '''            if (config != null) {
-                // Ensure clean state before starting
-                cleanup()
-''',
-    '''            if (config != null) {
-                // A fast reconnect must not leave the previous Xray process
-                // owning the local SOCKS/HTTP ports.
-                if (XrayCoreManager.isXrayRunning()) {
-                    Log.w(TAG, "Stopping stale Xray core before restart")
-                    XrayCoreManager.stopCore(this)
-                }
-                cleanup()
-''',
-    'Stopping stale Xray core before restart',
-  );
-
-  replaceOnce(
-    serviceFile,
-    '''        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
-        val sockPath = File(filesDir, "sock_path").absolutePath
-''',
-    '''        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
-        val socketFile = File(filesDir, "sock_path")
-        if (socketFile.exists() && !socketFile.delete()) {
-            Log.w(TAG, "Could not delete stale tun2socks socket")
-        }
-        val sockPath = socketFile.absolutePath
-''',
-    'Could not delete stale tun2socks socket',
-  );
-
-  final upstreamPolicy = r'''          try {
-    builder.addDisallowedApplication(packageName)
-} catch (e: Exception) {
-    Log.e(TAG, \"Failed to exclude app from VPN\", e)
-}
-
-for (pkg in config.BLOCKED_APPS) {
-    try {
-        builder.addDisallowedApplication(pkg)
-        Log.d(TAG, \"Excluded from VPN: $pkg\")
-    } catch (e: Exception) {
-        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
-    }
-}
-'''.replaceAll(r'\"', '"');
-
-  final legacyPatchedPolicy = r'''            if (config.ALLOWED_APPS.isNotEmpty()) {
-                for (pkg in config.ALLOWED_APPS) {
-                    try {
-                        builder.addAllowedApplication(pkg)
-                        Log.d(TAG, \"Allowed into VPN: $pkg\")
-                    } catch (e: Exception) {
-                        Log.e(TAG, \"Failed to allow $pkg into VPN\", e)
-                    }
-                }
-            } else {
-                try {
-                    builder.addDisallowedApplication(packageName)
-                } catch (e: Exception) {
-                    Log.e(TAG, \"Failed to exclude app from VPN\", e)
-                }
-
-                for (pkg in config.BLOCKED_APPS) {
-                    try {
-                        builder.addDisallowedApplication(pkg)
-                        Log.d(TAG, \"Excluded from VPN: $pkg\")
-                    } catch (e: Exception) {
-                        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
-                    }
-                }
-            }
-'''.replaceAll(r'\"', '"');
-
-  final hardenedPolicy = r'''            if (config.ALLOWED_APPS.isNotEmpty() && config.BLOCKED_APPS.isNotEmpty()) {
-                throw IllegalStateException(\"Allowed and blocked app policies cannot be mixed\")
-            }
-
-            if (config.ALLOWED_APPS.isNotEmpty()) {
-                var allowedCount = 0
-                for (pkg in config.ALLOWED_APPS) {
-                    try {
-                        builder.addAllowedApplication(pkg)
-                        allowedCount++
-                        Log.d(TAG, \"Allowed into VPN: $pkg\")
-                    } catch (e: Exception) {
-                        throw IllegalStateException(\"Failed to allow selected app $pkg\", e)
-                    }
-                }
-                if (allowedCount == 0) {
-                    throw IllegalStateException(\"Selected-only routing has no valid applications\")
-                }
-            } else {
-                try {
-                    builder.addDisallowedApplication(packageName)
-                } catch (e: Exception) {
-                    Log.e(TAG, \"Failed to exclude app from VPN\", e)
-                }
-
-                for (pkg in config.BLOCKED_APPS) {
-                    try {
-                        builder.addDisallowedApplication(pkg)
-                        Log.d(TAG, \"Excluded from VPN: $pkg\")
-                    } catch (e: Exception) {
-                        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
-                    }
-                }
-            }
-'''.replaceAll(r'\"', '"');
-
-  // Support both pristine 1.1.5 and the earlier local allowlist patch.
-  replaceOneOf(
-    serviceFile,
-    <String, String>{
-      legacyPatchedPolicy: hardenedPolicy,
-      upstreamPolicy: hardenedPolicy,
-    },
-    'Allowed and blocked app policies cannot be mixed',
-  );
-
-  stdout.writeln('[flutter_vless patch] allowed-app routing patch is ready');
-}
@@ -1,154 +0,0 @@
-import 'dart:convert';
-import 'dart:io';
-
-const packageName = 'flutter_vless_android';
-const expectedVersionFragment = 'flutter_vless_android-1.1.5';
-
-Never fail(String message) {
-  stderr.writeln('[secure-socks scope fix] $message');
-  exit(1);
-}
-
-Directory packageRoot() {
-  final configFile = File('.dart_tool/package_config.json');
-  if (!configFile.existsSync()) {
-    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
-  }
-
-  final decoded = jsonDecode(configFile.readAsStringSync());
-  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
-    fail('package_config.json is invalid');
-  }
-
-  Map<String, dynamic>? package;
-  for (final item in decoded['packages'] as List) {
-    if (item is Map && item['name'] == packageName) {
-      package = Map<String, dynamic>.from(item);
-      break;
-    }
-  }
-  if (package == null) fail('$packageName was not found');
-
-  final rootUriValue = package['rootUri'];
-  if (rootUriValue is! String || rootUriValue.isEmpty) {
-    fail('$packageName has no rootUri');
-  }
-
-  final rootUri = Uri.parse(rootUriValue);
-  final resolved = rootUri.hasScheme
-      ? rootUri
-      : configFile.parent.absolute.uri.resolveUri(rootUri);
-  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
-
-  final root = Directory.fromUri(resolved);
-  final normalized = root.absolute.path.replaceAll('\\', '/');
-  if (!normalized.contains(expectedVersionFragment)) {
-    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
-  }
-  return root;
-}
-
-void patchCoreScope(File core) {
-  final before = core.readAsStringSync();
-
-  // The primary secure patcher used a file-wide check for
-  // `val process = pb.start()`. Stock 1.1.5 already contains that exact line
-  // in getV2rayTraffic(), so the startCore() capture could be skipped while
-  // its monitor was still rewritten to use `process`. Capture the active Xray
-  // process immediately before its monitor thread instead. This is deliberately
-  // a scope-only correction and does not alter the stable runtime sequence.
-  const directCapture =
-      '            val process = pb.start()\n            xrayProcess = process\n';
-  const scopedCapture =
-      '            val process = xrayProcess ?: return false\n            // Monitor process in a separate thread to detect crash\n';
-  const monitorMarker =
-      '            // Monitor process in a separate thread to detect crash\n';
-
-  if (before.contains(directCapture) || before.contains(scopedCapture)) {
-    stdout.writeln('[secure-socks scope fix] core already current: ${core.path}');
-    return;
-  }
-
-  if (!before.contains('process.inputStream.bufferedReader().use { reader ->') ||
-      !before.contains('val exitCode = process.waitFor()') ||
-      !before.contains('xrayProcess === process')) {
-    fail('secure Xray monitor patch is not in the expected state');
-  }
-  if (!before.contains('            xrayProcess = pb.start()\n')) {
-    fail('stock Xray start assignment is missing');
-  }
-  if (!before.contains(monitorMarker)) {
-    fail('Xray monitor insertion point is missing');
-  }
-
-  final after = before.replaceFirst(monitorMarker, scopedCapture);
-  core.writeAsStringSync(after);
-  stdout.writeln('[secure-socks scope fix] captured Xray process for monitor scope');
-}
-
-void patchOngoingNotification(File service) {
-  final before = service.readAsStringSync();
-
-  const marker = '.setOngoing(true)';
-  if (before.contains(marker) &&
-      before.contains('Notification.FLAG_NO_CLEAR') &&
-      before.contains('.setAutoCancel(false)')) {
-    stdout.writeln('[secure-socks scope fix] notification already ongoing: ${service.path}');
-    return;
-  }
-
-  const oldBlock = r'''        return builder
-            .setContentTitle("VPN Service")
-            .setContentText(content)
-            .setSmallIcon(icon)
-            .build()
-''';
-
-  const newBlock = r'''        val notification = builder
-            .setContentTitle("VPN Service")
-            .setContentText(content)
-            .setSmallIcon(icon)
-            .setOngoing(true)
-            .setAutoCancel(false)
-            .setOnlyAlertOnce(true)
-            .build()
-
-        // Keep the active VPN notification attached to the foreground service
-        // and resistant to bulk clearing on Android versions that honor these
-        // flags. Android 14+ may still allow an explicit user swipe while the
-        // device is unlocked; apps are not allowed to override that system UI.
-        notification.flags = notification.flags or
-            android.app.Notification.FLAG_ONGOING_EVENT or
-            android.app.Notification.FLAG_NO_CLEAR
-        return notification
-''';
-
-  if (!before.contains(oldBlock)) {
-    fail('VPN notification builder is not in the expected stock 1.1.5 state');
-  }
-
-  final after = before.replaceFirst(oldBlock, newBlock);
-  if (!after.contains(marker) ||
-      !after.contains('Notification.FLAG_NO_CLEAR') ||
-      !after.contains('.setAutoCancel(false)')) {
-    fail('ongoing VPN notification invariant failed');
-  }
-
-  service.writeAsStringSync(after);
-  stdout.writeln('[secure-socks scope fix] VPN notification marked ongoing/no-clear');
-}
-
-void main() {
-  final root = packageRoot();
-  final kotlin =
-      '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless';
-  final core = File('$kotlin/xray/core/XrayCoreManager.kt');
-  final service = File('$kotlin/xray/service/XrayVPNService.kt');
-
-  if (!core.existsSync()) fail('XrayCoreManager.kt is missing');
-  if (!service.existsSync()) fail('XrayVPNService.kt is missing');
-
-  patchCoreScope(core);
-  patchOngoingNotification(service);
-  stdout.writeln('[secure-socks scope fix] scope and notification patch ready');
-}
@@ -1,546 +0,0 @@
-import 'dart:convert';
-import 'dart:io';
-
-const packageName = 'flutter_vless_android';
-const expectedVersionFragment = 'flutter_vless_android-1.1.5';
-
-Never fail(String message) {
-  stderr.writeln('[secure-socks patch] $message');
-  exit(1);
-}
-
-Directory packageRoot() {
-  final configFile = File('.dart_tool/package_config.json');
-  if (!configFile.existsSync()) {
-    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
-  }
-  final decoded = jsonDecode(configFile.readAsStringSync());
-  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
-    fail('package_config.json is invalid');
-  }
-
-  Map<String, dynamic>? package;
-  for (final item in decoded['packages'] as List) {
-    if (item is Map && item['name'] == packageName) {
-      package = Map<String, dynamic>.from(item);
-      break;
-    }
-  }
-  if (package == null) fail('$packageName was not found');
-
-  final rootUriValue = package['rootUri'];
-  if (rootUriValue is! String || rootUriValue.isEmpty) {
-    fail('$packageName has no rootUri');
-  }
-  final rootUri = Uri.parse(rootUriValue);
-  final resolved = rootUri.hasScheme
-      ? rootUri
-      : configFile.parent.absolute.uri.resolveUri(rootUri);
-  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
-
-  final root = Directory.fromUri(resolved);
-  final normalized = root.absolute.path.replaceAll('\\', '/');
-  if (!normalized.contains(expectedVersionFragment)) {
-    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
-  }
-  return root;
-}
-
-String replaceOnce(
-  String text,
-  String oldValue,
-  String newValue,
-  String label,
-) {
-  if (text.contains(newValue)) return text;
-  if (!text.contains(oldValue)) fail('missing expected source block: $label');
-  return text.replaceFirst(oldValue, newValue);
-}
-
-void writeIfChanged(File file, String before, String after) {
-  if (before == after) {
-    stdout.writeln('[secure-socks patch] already current: ${file.path}');
-    return;
-  }
-  file.writeAsStringSync(after);
-  stdout.writeln('[secure-socks patch] patched: ${file.path}');
-}
-
-void patchCore(File file) {
-  final before = file.readAsStringSync();
-  var text = before;
-
-  const secureValidation = r'''        var secureSocksEnabled = false
-        for (i in 0 until inbounds.length()) {
-            val inbound = inbounds.optJSONObject(i) ?: continue
-            if (inbound.optString("tag") != "revolt-secure-socks") continue
-
-            val settings = inbound.optJSONObject("settings")
-                ?: throw IllegalStateException("Secure SOCKS5 settings are missing")
-            val users = settings.optJSONArray("users")
-                ?: throw IllegalStateException("Secure SOCKS5 users are missing")
-            val account = users.optJSONObject(0)
-                ?: throw IllegalStateException("Secure SOCKS5 account is missing")
-            val port = inbound.optInt("port", -1)
-
-            if (inbound.optString("protocol") != "socks" ||
-                inbound.optString("listen") != "127.0.0.1" ||
-                port <= 1024 || port > 65535 ||
-                settings.optString("auth") != "password" ||
-                account.optString("user").isEmpty() ||
-                account.optString("pass").isEmpty()
-            ) {
-                throw IllegalStateException("Secure SOCKS5 session is invalid")
-            }
-
-            config.LOCAL_SOCKS5_PORT = port
-            config.LOCAL_HTTP_PORT = 0
-            secureSocksEnabled = true
-            break
-        }
-
-''';
-
-  if (!text.contains('var secureSocksEnabled = false')) {
-    text = replaceOnce(
-      text,
-      '        val usedPorts = mutableSetOf<Int>()\n',
-      '$secureValidation        val usedPorts = mutableSetOf<Int>()\n',
-      'secure SOCKS validation insertion',
-    );
-  }
-
-  text = replaceOnce(
-    text,
-    '        if (!hasHttpOnLocalPort) {\n',
-    '        if (!secureSocksEnabled && !hasHttpOnLocalPort) {\n',
-    'disable unauthenticated HTTP proxy in secure mode',
-  );
-
-  if (!text.contains('val process = pb.start()')) {
-    text = replaceOnce(
-      text,
-      '            xrayProcess = pb.start()\n',
-      '            val process = pb.start()\n            xrayProcess = process\n',
-      'capture Xray process identity',
-    );
-    text = replaceOnce(
-      text,
-      '            if (xrayProcess?.isAlive != true) {\n',
-      '            if (!process.isAlive) {\n',
-      'Xray startup liveness',
-    );
-    text = replaceOnce(
-      text,
-      '                val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()\n',
-      '                val output = process.inputStream.bufferedReader().readText()\n',
-      'Xray startup output',
-    );
-  }
-
-  if (!text.contains('Could not delete ephemeral Xray config')) {
-    const connectedLine =
-        '            AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED\n';
-    const deleteConfig = r'''            // config.json contains per-session SOCKS credentials. Xray has
-            // consumed it after the startup liveness check, so remove it now.
-            try {
-                val ephemeralConfig = File(configFilesDir, "config.json")
-                if (ephemeralConfig.exists() && !ephemeralConfig.delete()) {
-                    Log.w(TAG, "Could not delete ephemeral Xray config")
-                }
-            } catch (e: Exception) {
-                Log.w(TAG, "Could not delete ephemeral Xray config", e)
-            }
-
-''';
-    text = replaceOnce(
-      text,
-      connectedLine,
-      '$deleteConfig$connectedLine',
-      'ephemeral config deletion',
-    );
-  }
-
-  if (!text.contains('context.handleXrayCoreExit(config)')) {
-    text = replaceOnce(
-      text,
-      '                    xrayProcess?.inputStream?.bufferedReader()?.use { reader ->\n',
-      '                    process.inputStream.bufferedReader().use { reader ->\n',
-      'Xray monitor process stream',
-    );
-    text = replaceOnce(
-      text,
-      '                    val exitCode = xrayProcess?.waitFor()\n',
-      '                    val exitCode = process.waitFor()\n',
-      'Xray monitor process wait',
-    );
-
-    const oldExit = r'''                    if (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED) {
-                        // Unexpected exit
-                        stopCore(context)
-                    }
-''';
-    const newExit = r'''                    if (xrayProcess === process &&
-                        AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED
-                    ) {
-                        // Hold the Android TUN while the core is recovered. Killing
-                        // the VPN service here would allow direct-network fallback.
-                        xrayProcess = null
-                        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
-                        if (context is XrayVPNService) {
-                            context.handleXrayCoreExit(config)
-                        } else {
-                            stopCore(context)
-                        }
-                    }
-''';
-    text = replaceOnce(text, oldExit, newExit, 'Xray fail-closed recovery');
-  }
-
-  writeIfChanged(file, before, text);
-}
-
-void patchService(File file) {
-  final before = file.readAsStringSync();
-  var text = before;
-
-  if (!text.contains('private var recoveringXray = false')) {
-    text = replaceOnce(
-      text,
-      '    private var isRunning = false\n',
-      '    @Volatile private var isRunning = false\n'
-          '    @Volatile private var recoveringXray = false\n'
-          '    private var currentConfig: XrayConfig? = null\n',
-      'service recovery fields',
-    );
-  }
-
-  const oldNullIntent = r'''        if (intent == null) {
-            stopSelf()
-            return START_NOT_STICKY
-        }
-''';
-  const newNullIntent = r'''        if (intent == null) {
-            if (isRunning && currentConfig != null) return START_REDELIVER_INTENT
-            stopSelf()
-            return START_NOT_STICKY
-        }
-''';
-  text = replaceOnce(
-    text,
-    oldNullIntent,
-    newNullIntent,
-    'null intent lifecycle',
-  );
-
-  if (!text.contains('                currentConfig = config\n')) {
-    text = replaceOnce(
-      text,
-      '                cleanup()\n',
-      '                cleanup()\n                currentConfig = config\n',
-      'runtime config snapshot',
-    );
-  }
-
-  text = replaceOnce(
-    text,
-    '        return START_STICKY\n',
-    '        return START_REDELIVER_INTENT\n',
-    'redeliver START command',
-  );
-
-  if (!text.contains('private data class SecureSocksCredentials(')) {
-    const credentialsHelper = r'''    private data class SecureSocksCredentials(
-        val port: Int,
-        val username: String,
-        val password: String,
-    )
-
-    private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? {
-        val inbounds = try {
-            JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds")
-        } catch (_: Exception) {
-            null
-        } ?: return null
-
-        for (i in 0 until inbounds.length()) {
-            val inbound = inbounds.optJSONObject(i) ?: continue
-            if (inbound.optString("tag") != "revolt-secure-socks") continue
-            if (inbound.optString("protocol") != "socks" ||
-                inbound.optString("listen") != "127.0.0.1"
-            ) return null
-
-            val settings = inbound.optJSONObject("settings") ?: return null
-            if (settings.optString("auth") != "password") return null
-            val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null
-            val port = inbound.optInt("port", -1)
-            val username = user.optString("user")
-            val password = user.optString("pass")
-            if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) {
-                return null
-            }
-            return SecureSocksCredentials(port, username, password)
-        }
-        return null
-    }
-
-''';
-    const runComment = r'''    /**
-     * Starts the tun2socks process and initiates the FD transfer.
-     */
-    private fun runTun2socks(config: XrayConfig) {
-''';
-    text = replaceOnce(
-      text,
-      runComment,
-      '$credentialsHelper$runComment',
-      'secure credentials helper',
-    );
-  }
-
-  if (!text.contains('Authenticated ReVolt SOCKS5 inbound missing')) {
-    const commandComment = r'''        // Command to start tun2socks. 
-        // Note: We pass -sock-path to tell it where to listen for the FD.
-''';
-    const securePrelude = r'''        val secure = secureSocksCredentials(config)
-            ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing")
-        config.LOCAL_SOCKS5_PORT = secure.port
-
-''';
-    text = replaceOnce(
-      text,
-      commandComment,
-      '$securePrelude$commandComment',
-      'secure tun2socks credentials',
-    );
-    text = replaceOnce(
-      text,
-      r'''            "-proxy", "socks5://127.0.0.1:${config.LOCAL_SOCKS5_PORT}",
-''',
-      r'''            "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}",
-''',
-      'authenticated tun2socks URL',
-    );
-    text = replaceOnce(
-      text,
-      r'''        Log.d(TAG, "tun2socks command: ${cmd.joinToString(" ")}")
-''',
-      '        Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")\n',
-      'credential-safe logging',
-    );
-  }
-
-  if (!text.contains('val process = pb.start()\n            tun2socksProcess = process')) {
-    text = replaceOnce(
-      text,
-      '            tun2socksProcess = pb.start()\n',
-      '            val process = pb.start()\n            tun2socksProcess = process\n',
-      'capture tun2socks process identity',
-    );
-    text = replaceOnce(
-      text,
-      '                    tun2socksProcess?.inputStream?.bufferedReader()?.use { reader ->\n',
-      '                    process.inputStream.bufferedReader().use { reader ->\n',
-      'tun2socks monitor stream',
-    );
-    text = replaceOnce(
-      text,
-      '                    tun2socksProcess?.waitFor()\n',
-      '                    process.waitFor()\n',
-      'tun2socks monitor wait',
-    );
-
-    const oldRestart = r'''                    if (isRunning) {
-                        // Restart if crashed and still supposed to be running
-                        Log.e(TAG, "tun2socks exited unexpectedly, restarting...")
-                        runTun2socks(config)
-                    }
-''';
-    const newRestart = r'''                    if (isRunning && tun2socksProcess === process && currentConfig === config) {
-                        Log.e(TAG, "tun2socks exited unexpectedly, recycling without dropping TUN")
-                        Thread.sleep(350)
-                        if (isRunning && currentConfig === config) runTun2socks(config)
-                    }
-''';
-    text = replaceOnce(
-      text,
-      oldRestart,
-      newRestart,
-      'tun2socks crash recovery',
-    );
-    text = replaceOnce(
-      text,
-      '            sendFd()\n',
-      '            sendFd(process)\n',
-      'FD handoff process identity',
-    );
-  }
-
-  const oldStartFailure = r'''        } catch (e: Exception) {
-            Log.e(TAG, "Failed to start tun2socks", e)
-            stopAll()
-        }
-''';
-  const newStartFailure = r'''        } catch (e: Exception) {
-            Log.e(TAG, "Failed to start tun2socks; retrying with TUN held", e)
-            if (isRunning && currentConfig === config) {
-                Thread {
-                    try {
-                        Thread.sleep(600)
-                        if (isRunning && currentConfig === config) runTun2socks(config)
-                    } catch (_: InterruptedException) {}
-                }.start()
-            }
-        }
-''';
-  text = replaceOnce(
-    text,
-    oldStartFailure,
-    newStartFailure,
-    'tun2socks start failure recovery',
-  );
-
-  if (!text.contains('FD handoff failed; recycling tun2socks without dropping TUN')) {
-    const oldSendFd = r'''    private fun sendFd() {
-        val fd = mInterface?.fileDescriptor ?: return
-        val sockFile = File(filesDir, "sock_path").absolutePath
-
-        Thread {
-            var tries = 0
-            while (tries < 10) {
-                try {
-                    Thread.sleep(500)
-                    val localSocket = LocalSocket()
-                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
-                    val out = localSocket.outputStream
-                    // This magic call attaches the FD to the socket message
-                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
-                    out.write(32) // Send a dummy byte to trigger the transfer
-                    localSocket.setFileDescriptorsForSend(null)
-                    localSocket.shutdownOutput()
-                    localSocket.close()
-                    break
-                } catch (e: Exception) {
-                    tries++
-                }
-            }
-        }.start()
-    }
-''';
-    const newSendFd = r'''    private fun sendFd(process: Process) {
-        val fd = mInterface?.fileDescriptor ?: return
-        val sockFile = File(filesDir, "sock_path").absolutePath
-
-        Thread {
-            var tries = 0
-            while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) {
-                var localSocket: LocalSocket? = null
-                try {
-                    Thread.sleep(500)
-                    localSocket = LocalSocket()
-                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
-                    val out = localSocket.outputStream
-                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
-                    out.write(32)
-                    out.flush()
-                    localSocket.setFileDescriptorsForSend(null)
-                    localSocket.shutdownOutput()
-                    localSocket.close()
-                    return@Thread
-                } catch (_: Exception) {
-                    tries++
-                    try { localSocket?.close() } catch (_: Exception) {}
-                }
-            }
-
-            if (isRunning && tun2socksProcess === process) {
-                Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN")
-                try { process.destroy() } catch (_: Exception) {}
-            }
-        }.start()
-    }
-''';
-    text = replaceOnce(text, oldSendFd, newSendFd, 'bounded FD recovery');
-  }
-
-  if (!text.contains('fun handleXrayCoreExit(config: XrayConfig)')) {
-    const cleanupComment = r'''    /**
-     * Cleans up resources (tun2socks process, VPN interface) without stopping the service completely.
-     * Used when restarting or switching configurations.
-     */
-''';
-    const recovery = r'''    fun handleXrayCoreExit(config: XrayConfig) {
-        if (!isRunning || currentConfig !== config || recoveringXray) return
-        recoveringXray = true
-
-        Thread {
-            var attempt = 0
-            try {
-                while (isRunning && currentConfig === config) {
-                    attempt++
-                    Thread.sleep(400L * attempt.coerceAtMost(5))
-                    if (!isRunning || currentConfig !== config) break
-
-                    Log.w(TAG, "Recovering Xray core attempt $attempt")
-                    if (XrayCoreManager.startCore(this, config)) {
-                        Log.w(TAG, "Xray core recovered without dropping TUN")
-                        return@Thread
-                    }
-
-                    if (attempt >= 3) {
-                        attempt = 0
-                        Thread.sleep(3000)
-                    }
-                }
-            } catch (_: InterruptedException) {
-            } finally {
-                recoveringXray = false
-            }
-        }.start()
-    }
-
-''';
-    text = replaceOnce(
-      text,
-      cleanupComment,
-      '$recovery$cleanupComment',
-      'Xray recovery loop',
-    );
-  }
-
-  if (!text.contains('        recoveringXray = false\n        tun2socksProcess?.destroy()')) {
-    text = replaceOnce(
-      text,
-      '        isRunning = false\n        tun2socksProcess?.destroy()\n',
-      '        isRunning = false\n        recoveringXray = false\n        tun2socksProcess?.destroy()\n',
-      'cancel recovery on cleanup',
-    );
-  }
-
-  if (!text.contains('        currentConfig = null\n        XrayCoreManager.stopCore(this)')) {
-    text = replaceOnce(
-      text,
-      '        cleanup()\n        XrayCoreManager.stopCore(this)\n',
-      '        cleanup()\n        currentConfig = null\n        XrayCoreManager.stopCore(this)\n',
-      'clear config on explicit stop',
-    );
-  }
-
-  writeIfChanged(file, before, text);
-}
-
-void main() {
-  final root = packageRoot();
-  final kotlin = Directory(
-    '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless',
-  );
-  final core = File('${kotlin.path}/xray/core/XrayCoreManager.kt');
-  final service = File('${kotlin.path}/xray/service/XrayVPNService.kt');
-  if (!core.existsSync() || !service.existsSync()) {
-    fail('pinned Android runtime sources are missing');
-  }
-
-  patchCore(core);
-  patchService(service);
-  stdout.writeln('[secure-socks patch] stable-core security patch is ready');
-}
Author	SHA1	Message	Date
esefxdzandClaude Opus 5.5	e14e900276	chore(release): prepare 3.3.6 - fix(app): Test Local SOCKS forces a round trip instead of trusting the CONNECT reply - changelog: notification icon + SOCKS test fixes Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-08 13:20:52 +03:00
esefxdz	6d8a923475	notification fixed	2026-09-06 13:07:37 +03:00
esefxdz	4718a5912a	build(android): pin Windows aapt2 checksum for local release builds	2026-09-06 12:37:20 +03:00
esefxdz	5d2683f354	chore(release): prepare 3.3.5	2026-09-06 12:09:20 +03:00
esefxdz	08b21dc5d9	docs(contributing): drop server/xray/nginx scopes	2026-09-06 12:09:20 +03:00
esefxdz	bbc83ea425	chore(app): lint cleanups (const constructors, local function)	2026-09-06 12:09:16 +03:00
esefxdzandClaude Opus 5	9d67679fa8	fix(app): do not throw from ConnectionSettings.initialize The migration write is best-effort again. `_mode` is already the safe TUN default in memory by the time it runs, so a failed write leaves nothing insecure -- it only means the migration is retried on the next launch. Throwing there was a startup brick rather than a fail-closed guard. `initialize()` is awaited from `main()` at lib/main.dart:19, before `runApp()`, with no try/catch and no `runZonedGuarded`; `FlutterError.onError` and `PlatformDispatcher.onError` are installed later and would not catch it either. The branch also runs on every fresh install, since `storedMode` is null and `null != 'tun'`. A `setString` returning false would therefore have meant a black screen with no error UI, repeating every launch, in exchange for no security benefit. Also restores two comments this PR removed from code it does not otherwise touch -- the `_reconnect` note on why the repair path shows no rewarded ad, and the explanation of how an orphaned proxy outlives the app process -- and drops a stray 'ass' from the legacy-values comment. The `setMode` half of the PR is unchanged: persisting before mutating memory and surfacing failures to the UI is the right behaviour. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_019HT2x2JvJNg7XNsJubfHFf	2026-09-06 11:51:52 +03:00
Naveax	3f7aead263	fix(app): fail closed on invalid connection mode state Restore SOCKS5 only from the current proxy value and keep UI state unchanged when persistence fails.	2026-09-06 11:51:52 +03:00
Naveax	b6ed976346	fix(app): harden Hivemind control-plane trust boundaries (#8 ) Bound and nonce-bind control responses, reject redirects, and pin session tunnel coordinates so control-plane compromise cannot redirect VPN traffic.	2026-09-06 11:34:06 +03:00
esefxdzandClaude Opus 5	bd41a3c693	refactor(app): drop Dart wrappers whose native handlers no longer exist #17 removed the `setSessionExpiry` and `isVpnRuntimeAlive` MethodChannel handlers from MainActivity, and #18 removed their last callers. The Dart wrappers stayed behind. Both swallow their errors, so a future caller would not fail loudly — it would get a silent no-op from `setSessionExpiry` and a permanent `processAlive: false` from `runtimeState()`, which previously read as "the tunnel is dead". Deleting them keeps that trap out of the codebase. `VpnRuntimeState` goes with them; runtime liveness now arrives through the native status stream, which is generation-scoped. The battery-optimisation methods are untouched and still used by background_reliability.dart. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_019HT2x2JvJNg7XNsJubfHFf	2026-09-06 11:28:52 +03:00
esefxdzandClaude Opus 5	061bd41920	Merge pull request #19 from Naveax/pr/add-android-supply-chain-ci build: add reproducible Android release verification Resolved a conflict in android/app/build.gradle.kts. #19 was written against the pre-#10 file and re-added the pub-cache patch tasks that #10 deleted; only `sha256Hex()` was kept from that block, since `verifyReleaseAppConfig` needs it. Also restored `import java.io.File`, which #10 removed along with the patch tasks. #19's `sha256Hex(file: File)` names the type in its signature, and Kotlin does not auto-import `java.io.File`, so the release build would have failed at Gradle configuration without it. Verified after resolution: no orphaned references to `projectRootDir`, `localProperties`, `flutterSdkPath` or `patchFlutterVless`; both tests in test/release_verification_regression_test.dart pass; `flutter analyze` reports no errors or warnings. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_019HT2x2JvJNg7XNsJubfHFf	2026-09-06 11:27:28 +03:00
Naveax	ba89e35442	fix(app): harden session runtime lifecycle (#18 ) Scope asynchronous connect, disconnect, sync, and reattachment work to the active session so stale work cannot mutate newer VPN state.	2026-09-06 11:24:03 +03:00
Naveax	321bbae44d	fix(app): align Android VPN runtime integration (#17 ) Remove obsolete UI-process runtime plumbing and reuse the native service-owned notification and generation-scoped control path.	2026-09-06 11:23:55 +03:00
Naveax	5f851f3485	build: vendor pinned flutter_vless Android runtime (#10 ) Replace build-time pub-cache mutation with a repository-owned pinned runtime so reviewed native source is the source compiled into the app.	2026-09-06 11:23:48 +03:00
esefxdzandClaude Opus 5	e818d54b0e	build(config): delete orphaned assets instead of narrowing the manifest #16 replaced the `assets/` wildcard with three explicit paths. That is correct today but makes the failure mode for a forgotten registration an `Unable to load asset` exception at runtime rather than at build time, which neither `flutter analyze` nor the build would catch. Restore the wildcard and delete the three files it was working around instead. All are unreferenced in tracked source: `logo.png` has no callers and no `flutter_launcher_icons` config, while `notification_icon.png` and `notification_banner.png` are stale copies of the real Android drawables in `android/app/src/main/res/`, which the notification reaches via `R.drawable.notification_status_icon` and never through the Flutter bundle. Same APK-size win, no hand-maintained list, and the dead files leave the repo. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_019HT2x2JvJNg7XNsJubfHFf	2026-09-06 11:20:08 +03:00
Naveax	74e522e982	build(config): remove unused Flutter dependencies (#16 ) Remove dependencies and asset declarations that are no longer referenced so the resolved package graph stays smaller and easier to verify.	2026-09-06 11:18:43 +03:00
Naveax	d2283c07cc	fix(app): enforce authenticated ephemeral local SOCKS5 (#9 ) Require the active per-session loopback SOCKS credentials and remove unauthenticated fallback behavior from the client diagnostic path.	2026-09-06 11:18:35 +03:00
Naveax	ecdf6e549f	refactor(app): remove unsupported server selector state (#6 ) Remove UI and provider state that does not control the authoritative tunnel destination while preserving the existing connection-health status behavior.	2026-09-06 11:18:28 +03:00
Naveax	6da601b565	fix(app): persist disclosure acknowledgement after acceptance (#5 ) Write the disclosure preference only after explicit confirmation so failed persistence does not create a false accepted state.	2026-09-06 11:18:24 +03:00
Naveax	14403e1d76	fix(app): make ConnectButton listener lifecycle-safe (#4 ) Keep the exact VpnConnection instance used for listener registration so lifecycle cleanup does not depend on a deactivated BuildContext.	2026-09-06 11:17:19 +03:00
Naveax	915f8260d5	build: add reproducible Android release verification Pin Gradle inputs and dependency metadata, then enforce analyze, lint, build, R8, immutability, and focused regression gates in CI.	2026-09-04 02:01:21 +03:00
esefxdz	9ac236a981	feat(app): OS session-expiry enforcement, session persistence, support sync Enforce session expiry at the OS level (AlarmManager + handler) so the tunnel dies even if the UI process is killed; persist the session so a START_STICKY restart re-establishes it; sync immediately after a support top-up; slow the session beacon 5s/30s -> 60s/60s; drop the Always-on-VPN deep-link and the legacy 'ass' migration. Docs: CHANGELOG 3.3.4, privacy-policy log disclosure, README.	2026-09-02 20:33:33 +03:00
esefxdzandClaude Opus 5	dfeb7f161c	fix(app): resume the session clock when attaching to a live tunnel The clock sat at 00:00:00 on a connected tunnel, and the notification countdown froze with it. SessionTimer is built lazily, so when the app reattaches to a tunnel that outlived its UI process, VpnConnection had already reported CONNECTED before the timer existed. A change listener does not replay events it was not present for, so the timer never learned it should be running. The notification text is pushed by that same timer, which is why the countdown froze at the same moment -- one cause, both symptoms. The timer now evaluates the current connection state once at construction rather than waiting for a transition, and is created eagerly alongside VpnConnection so it is listening from the start. Resuming also no longer requires adoptedRunningRuntime or a previous successful sync. Both are false in a freshly started process, which is exactly the case that needed to work. A connected tunnel with a stopped clock is now always resumed. Version 3.3.3+29. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-01 00:39:22 +03:00
esefxdzandClaude Opus 5	186dc906da	feat(app): keep the tunnel alive via the OS, drop the workarounds 3.3.1 could display "connected" against a tunnel that was no longer running, with a frozen countdown and no traffic. Three causes, and the fix for each removes more code than it adds. Liveness was read from getConnectedServerDelay(), which measures through AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807. AppConfigs lives in the :RunSoLibXrayDaemon process, so from the UI process it is always null and the port always fell back to 10807 -- accidentally correct while the SOCKS port was fixed, permanently wrong once 3.3.1 made it ephemeral. Liveness now comes from the OS: is our service process running, and is a VPN transport actually present. The foreground notification (id 1) is owned by XrayVPNService via startForeground, but MainActivity was posting to the same id from the UI process. When that process died its notification stayed on screen with nothing left to update it. MainActivity now refuses to post for a dead runtime and clears the stale notification instead. Nothing ever asked Android for permission to stay alive. Adds the battery-optimisation exemption prompt and a deep link to Always-on VPN -- the two sanctioned mechanisms for background survival, each needing one user tap. Removes Standard/Extreme resilience and the runtime-restart machinery: recovery ran off a disconnect broadcast delivered to the app process, so it could never fire when Android killed that process. Removes startup restoration and the config-snapshot rebuild along with it; with the OS keeping the tunnel up there is nothing to restore. Version 3.3.2+28. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-01 00:16:05 +03:00