fix(app): stop probing the control plane while disconnected

VpnConnection._init() started a 30 s /health poll from the constructor
with no lifecycle gating, so it ran for the life of the app process -
backgrounded, and whether or not the user ever connected. The app is
excluded from its own tunnel, so those requests left in the clear. A
periodic request that fires while the user is deliberately not connected
is an avoidable fingerprint, and rule 60 already ruled probes out:
reachability is meant to be passive.

All it bought was the status dot before the first connect, and it got
that wrong in both directions - "Offline" on a transient resolver
failure against a server that was fine.

Reachability now comes from a session sync that succeeded. serverHealthy
is isConnected && hasSyncedOnce, so a green dot means a working session
rather than a check made beforehand; while disconnected the bar reads
"Ready" and claims nothing either way.

checkHealth() goes with it. Nothing calls it, and leaving a probe helper
in place invites its reuse.

Pinned in test/session_lifecycle_regression_test.dart so it cannot come
back as a tidy-up. flutter analyze clean, 10/10 tests pass.

Co-Authored-By: Claude Opus 5 <[email protected]>

.github/workflows/android-ci.yml

@@ -0,0 +1,135 @@
+name: Android CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  android:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Verify Gradle supply chain
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -x android/gradlew
+          test -f android/gradlew.bat
+          test -f android/gradle/wrapper/gradle-wrapper.jar
+          test -s android/gradle/verification-metadata.xml
+          test "$(sha256sum android/gradle/wrapper/gradle-wrapper.jar | awk '{print $1}')" = '7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172'
+          grep -qx 'distributionSha256Sum=efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1' android/gradle/wrapper/gradle-wrapper.properties
+          grep -q '<verify-metadata>true</verify-metadata>' android/gradle/verification-metadata.xml
+          ./android/gradlew --version
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+        with:
+          flutter-version: '3.47.2'
+          channel: stable
+          cache: false
+
+      - name: Create CI app config
+        run: cp lib/logic/app_config.example.dart lib/logic/app_config.dart
+
+      - name: Resolve dependencies
+        run: flutter pub get
+
+      - name: Verify dependency lock is committed
+        run: git diff --exit-code -- pubspec.lock
+
+      - name: Verify vendored runtime provenance
+        if: ${{ hashFiles('local_packages/flutter_vless_android-1.1.5/UPSTREAM') != '' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          PKG='local_packages/flutter_vless_android-1.1.5'
+          test -f "$PKG/UPSTREAM"
+          grep -q 'Tag: v1.1.5' "$PKG/UPSTREAM"
+          grep -q 'path: local_packages/flutter_vless_android-1.1.5' pubspec.yaml
+          ! grep -q 'patchFlutterVless' android/app/build.gradle.kts
+
+      - name: Analyze
+        run: flutter analyze
+
+      - name: Test
+        run: flutter test
+
+      - name: Android lint
+        working-directory: android
+        run: ./gradlew :app:lintDebug --no-daemon
+
+      - name: Verify production release config fails closed
+        shell: bash
+        working-directory: android
+        run: |
+          set -euo pipefail
+          set +e
+          output="$(./gradlew :app:verifyReleaseAppConfig --no-daemon 2>&1)"
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          test "$status" -ne 0
+          grep -Fq 'REVOLT_APP_CONFIG_SHA256 is required for production release builds' <<<"$output"
+
+      - name: Cold APK build
+        run: flutter build apk --debug
+
+      - name: Verify vendored native source stayed immutable
+        run: git diff --exit-code -- local_packages/flutter_vless_android-1.1.5
+
+      - name: Warm APK build
+        run: flutter build apk --debug
+
+      - name: Release R8 smoke build
+        env:
+          REVOLT_CI_RELEASE_SMOKE: 'true'
+        run: |
+          flutter build apk --release
+          test -f build/app/outputs/flutter-apk/app-release.apk
+          test -f build/app/outputs/mapping/release/mapping.txt
+
+      - name: Verify tracked build inputs stayed immutable
+        run: |
+          git diff --exit-code -- \
+            pubspec.yaml \
+            pubspec.lock \
+            local_packages/flutter_vless_android-1.1.5 \
+            android/app/build.gradle.kts \
+            android/app/proguard-rules.pro \
+            android/gradle/verification-metadata.xml \
+            android/gradle/wrapper/gradle-wrapper.properties \
+            android/gradle/wrapper/gradle-wrapper.jar \
+            android/gradlew \
+            android/gradlew.bat
+
+      - name: Upload APK
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: revoltvpn-debug-apk
+          if-no-files-found: error
+          path: build/app/outputs/flutter-apk/app-debug.apk
+
+      - name: Upload resolved lockfile
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: revoltvpn-resolved-lockfile
+          if-no-files-found: error
+          path: pubspec.lock

CHANGELOG.md

@@ -5,6 +5,201 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH
 
 ---
 
+## [Unreleased]
+
+### Removed
+- **The background server check while disconnected.** The app no longer contacts
+  the server every 30 seconds while you are not connected to it. Nothing about
+  the connected session changes.
+
+### Changed
+- **The status bar no longer guesses whether the server is up.** It reads
+  "Ready" while disconnected and shows "Online" once a session has synced, so a
+  green dot now means a session that is actually working rather than a
+  reachability check made beforehand.
+
+## [3.3.8] — 2026-10-17
+
+### Changed
+- **Reconnecting always starts a fresh session.** In SOCKS5 mode, the
+  **Reconnect** button used to re-attach to the session you already had. It now
+  ends that session and starts a new one, exactly as the connect button does —
+  one way to begin a session instead of two, and you get a full window back
+  rather than the remainder of a broken one.
+
+### Fixed
+- **SOCKS5 "Reconnect" works again.** In 3.3.7 it ended your session and then
+  asked for the session it had just ended, failing with "Session not activated".
+
+---
+
+## [3.3.7] — 2026-10-17
+
+> **Known issue — fixed in 3.3.8.** In SOCKS5 mode, the **Reconnect**
+> button in Settings ends your session instead of re-attaching to it, and then
+> fails with "Session not activated". It only appears when a proxy session has
+> been orphaned, and you lose the rest of that session rather than anything
+> worse. Workaround: connect again from the main screen. The "SOCKS5 Reconnect"
+> entry below describes the intended behaviour, which this build does not have.
+
+### Added
+- **A warning before a session ends.** The VPN service schedules it off the same
+  deadline it already enforces, so it arrives even with the app closed, and a
+  support top-up moves it with the deadline. It does not promise an exact number
+  of minutes: on a deeply sleeping phone Android can hold it back past the end
+  of the session, in which case it is skipped rather than shown late.
+- **A "disconnected — not protected" notification** when a session ends without
+  you asking: the 2-hour expiry, the data limit, or the server ending the
+  session.
+- **SOCKS5 mode now asks for the notification permission.** It never did,
+  because it never raises the VPN consent dialog, so on Android 13+ these
+  alerts would have been dropped before they were shown.
+- **The app now shows what went wrong.** Connect errors, the reason a session
+  ended, and progress while connecting appear under the status bar instead of
+  the button silently going back to idle.
+
+### Changed
+- **A control-plane outage no longer tears down a working tunnel.** The app used
+  to disconnect itself after about two minutes of failed status polls, putting
+  you back on your real IP; it now keeps the tunnel up and shows
+  "Can't reach the server — still connected". Expiry is still enforced by the
+  VPN service's own deadline, which keeps running regardless.
+
+### Fixed
+- **The countdown no longer over-reports after the phone sleeps**, and a clock
+  moved backwards can no longer stretch a session.
+- **A session that expired while the phone was asleep is recognised on waking**,
+  by wall clock rather than by time the device spent awake.
+- **Disconnecting from Android's VPN settings no longer leaves a countdown in
+  the notification shade.** It used to sit there frozen, showing time remaining
+  on a tunnel that was already gone.
+- **The VPN recovers after the tunnel core stops.** Recovery never worked:
+  every attempt failed on the same internal error, and each one left another
+  copy of the core running in the background. It now usually comes back on the
+  first retry, without dropping the connection.
+- **Disconnecting with the app's own button now releases your session on the
+  server** instead of leaving it open until it expires.
+- **SOCKS5 "Reconnect" re-attaches to the current session** instead of
+  requesting a new one — see the known issue above; this does not work in 3.3.7.
+- **A core that fails to start now logs why.** Its output was being discarded,
+  so the only trace was an exit code.
+
+### Groundwork
+- **Rewarded-ad plumbing.** Ads are switched off in this build, so none of this
+  is reachable yet: the ad's verification nonce is now carried through to the
+  connect call rather than being minted twice, and the client waits longer
+  (~36 s) for Google's callback. Reviewed, not yet exercised end to end.
+
+## [3.3.6] — 2026-10-08
+
+### Fixed
+- **VPN service notification icon.** The ongoing notification now uses the
+  bundled `notification_icon` drawable instead of `notification_status_icon`,
+  and the vendored runtime resolves that drawable by name at runtime (falling
+  back to the platform icon only if it is missing), so the foreground-service
+  notification no longer shows the generic Android info icon.
+- **"Test Local SOCKS" no longer claims an outbound it never tested.** Xray
+  answers a SOCKS `CONNECT` before it dials upstream, so trusting the `0x00`
+  reply reported success for unroutable addresses and for hostnames that can
+  never resolve — meaning the test said OK while the server was down, which is
+  exactly when it gets run. It now forces a request/response round trip through
+  the tunnel and reports distinctly when the outbound never replies, drops the
+  connection, or returns unexpected data.
+
+---
+
+## [3.3.5] — 2026-09-06
+
+### Added
+- **Reproducible release verification.** The release build pins the production
+  `app_config.dart` by SHA-256 and fails closed on any mismatch, so a release
+  APK cannot silently ship a template or wrong server config.
+
+### Changed
+- **Vendored Android runtime.** The pinned `flutter_vless` Android runtime is now
+  vendored in-tree instead of being patched in the pub cache at build time.
+- **Harden the control-plane trust boundary.** `/session/status` fields are
+  strictly validated (nonce, destination IP, port, SNI, XHTTP path), control
+  responses are capped and never follow redirects, and the tunnel destination
+  is pinned to the compiled server — a compromised API can no longer redirect
+  user traffic.
+- **Authenticated local SOCKS5 is now mandatory.** The ephemeral local proxy
+  replaces rather than filters inbounds, so only the authenticated SOCKS5
+  listener can exist.
+- **Fail closed on connection-mode changes.** The mode is persisted before it is
+  applied, and a failed save leaves the UI and runtime unchanged instead of
+  silently selecting a weaker route.
+
+### Fixed
+- Connect button no longer leaks a listener into a disposed `AnimationController`
+  during teardown.
+- Disclosure acknowledgement is only persisted once the user accepts it.
+- Session countdown now uses a monotonic clock (cannot be extended by rolling the
+  device clock back) and a VPN error tears the tunnel down instead of freezing
+  the timer on a live session.
+- The VPN-service notification's disconnect action and countdown re-post are
+  aligned with the vendored runtime.
+
+### Removed
+- Unsupported server-selector UI (single server today; design retained for
+  multi-server later).
+- Unused Flutter dependencies and orphaned assets.
+- Dead Dart wrappers whose native handlers no longer exist.
+
+### Security & privacy
+- IPv6 is captured by the VPN interface (`::/0` route), closing a leak where
+  IPv6 traffic could bypass the tunnel on IPv6-capable carriers.
+
+---
+
+## [3.3.4] — 2026-09-02
+
+### Added
+- **OS-level session-expiry enforcement.** The VPN service now holds an absolute
+  deadline and tears the tunnel down on its own clock — a main-looper handler
+  plus an `AlarmManager` exact alarm (falling back to an inexact alarm on
+  Android 13+ when exact alarms aren't granted). The app pushes
+  `now + expires_in_seconds` on each session sync, so a session ends even if the
+  UI process has been killed.
+- **Session survival across process death.** The service persists the active
+  session and re-establishes it when Android restarts it (`START_STICKY`).
+- **Support-ad extension reflected immediately.** A rewarded "Support us" ad now
+  forces an immediate server sync, so the countdown and expiry deadline update
+  without waiting for the next heartbeat.
+
+### Changed
+- **Session-status beacon slowed.** Foreground poll: 5 s → 60 s; background poll:
+  30 s → 60 s.
+- **Background-reliability guidance.** The "Always-on VPN" settings deep-link was
+  removed; the battery-optimisation exemption remains, with expiry now enforced
+  by the service itself.
+
+### Removed
+- Legacy `ass` connection-mode migration — unrecognized persisted modes now
+  default to TUN.
+
+### Security & privacy
+- Session credentials and the per-user VLESS UUID are now held app-private on
+  disk (`active_session.bin`) for the session's lifetime and removed on
+  disconnect or expiry. Previously they were memory-only.
+
+---
+
+## [3.3.3] — 2026-09-01
+
+### Fixed
+- **The session clock stayed at 00:00:00 on a live tunnel, and the notification
+  countdown froze with it.** `SessionTimer` is built lazily, so when the app reattaches
+  to a tunnel that outlived its UI process, `VpnConnection` had already reported
+  "connected" before the timer existed — and a change listener does not replay events
+  it was not present for. The timer now evaluates the current connection state once at
+  construction instead of waiting for a transition, and is created eagerly alongside
+  `VpnConnection`. Because the timer is what pushes text to the foreground
+  notification, a stopped clock also meant a frozen countdown; both come from this.
+- Resuming the clock no longer requires `adoptedRunningRuntime` or a previous
+  successful sync, both of which are false in a freshly started process. A connected
+  tunnel with a stopped clock is now always treated as something to resume.
+
 ## [3.3.2] — 2026-09-01
 
 Background reliability. 3.3.1 could show "connected" against a tunnel that was no

CONTRIBUTING.md

@@ -14,7 +14,7 @@ As a contributor, here are the guidelines we would like you to follow:
   │       │             │
   │       │             └─⫸ Summary in present tense. Not capitalized. No period at the end.
   │       │
-  │       └─⫸ Commit Scope: app|server|xray|nginx|docs|config
+  │       └─⫸ Commit Scope: app|docs|config
   │
   └─⫸ Commit Type: build|ci|docs|feat|fix|perf|refactor|test
 ```
@@ -40,12 +40,12 @@ Must be one of the following:
 The scope should be the part of the project affected:
 
 * `app` — Flutter client (screens, components, logic)
-* `server` — Python Hivemind backend
-* `xray` — Xray Reality config or tunnel behavior
-* `nginx` — nginx routing, SSL, auth
 * `docs` — documentation files
 * `config` — app_config, .gitignore, pubspec
 
+The `server`, `xray` and `nginx` components are not in this repository, so
+contributions targeting them cannot be reviewed or tested here.
+
 ##### Summary
 
 Use the summary field to provide a succinct description of the change:
@@ -65,10 +65,9 @@ You can include a comparison of the previous behavior with the new behavior in o
 #### Examples
 
 ```
-feat(server): add swarm monitoring endpoint
+feat(app): add a server selector to the settings screen
 
-GET /api/swarm returns sorted drone list for the TUI dashboard.
+Lists the available exit locations and persists the user's choice locally.
-Persistent total GB saved to swarm_total.json, survives restarts.
 ```
 
 ```

PRIVACY_POLICY.md

@@ -1,6 +1,6 @@
 # Privacy Policy
 
-**Last updated:** August 2026
+**Last updated:** September 2026
 
 ReVoltVPN is a free VPN service built and operated by ReVolt Team.
 
@@ -27,7 +27,7 @@ Support ads (the "Support us" button) extend an active session by 30 minutes and
 
 ## Operational logs
 
-We keep a short in-memory log buffer (last 200 lines) for debugging and server health monitoring. These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs never leave the server, are not retained after a server restart, and are only accessible to the server operator via local console. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device.
+Server logs are written to the systemd journal (`journalctl -u hivemind`). These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs stay on the server and are accessible only to the server operator via local console; retention follows the server's systemd journal settings. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device.
 
 ## What we do not collect
 

README.md

@@ -23,7 +23,7 @@ No email. No password. No payment. The ad pays for the server.
 ## Protocol
 
 - **Transport** — VLESS over XHTTP (HTTP/2 multiplexed, path-hidden behind `/revolt`)
-- **Obfuscation** — Xray Reality spoofs `some website's` TLS. To any DPI box, your tunnel looks like a browser visiting that website
+- **Obfuscation** — Xray Reality spoofs a real website's TLS. To any DPI box, your tunnel looks like a browser visiting that website
 - **Encryption** — TLS 1.3 with borrowed certificate (Reality). No certbot, no domain ownership required
 - **API** — Standard HTTPS to a separate domain. Tunnel destination is IP-pinned — domain compromise is DoS only
 

analysis_options.yaml

@@ -2,6 +2,8 @@ include: package:flutter_lints/flutter.yaml
 
 analyzer:
   exclude:
+    - build/**
+    - android/**
     - local_packages/**
     - whatsthis/**
 

android/app/build.gradle.kts

@@ -1,132 +1,16 @@
 import java.util.Properties
 import java.io.File
 import java.io.FileInputStream
+import java.security.MessageDigest
 
 plugins {
     id("com.android.application")
     id("dev.flutter.flutter-gradle-plugin")
 }
 
-val projectRootDir = rootProject.projectDir.parentFile
+fun sha256Hex(file: File): String {
-val localPropertiesFile = rootProject.file("local.properties")
+    val digest = MessageDigest.getInstance("SHA-256").digest(file.readBytes())
-val localProperties = Properties().apply {
+    return digest.joinToString("") { "%02x".format(it.toInt() and 0xff) }
-    if (localPropertiesFile.exists()) {
-        localPropertiesFile.inputStream().use { load(it) }
-    }
-}
-val flutterSdkPath = localProperties.getProperty("flutter.sdk")
-    ?: throw GradleException("flutter.sdk not set in android/local.properties")
-val dartExecutable = File(
-    flutterSdkPath,
-    if (System.getProperty("os.name").lowercase().contains("windows")) {
-        "bin/cache/dart-sdk/bin/dart.exe"
-    } else {
-        "bin/cache/dart-sdk/bin/dart"
-    },
-)
-val flutterVlessPatchScript = File(
-    projectRootDir,
-    "tool/patch_flutter_vless_allowed_apps.dart",
-)
-val flutterVlessSecureSocksPatchScript = File(
-    projectRootDir,
-    "tool/patch_flutter_vless_secure_socks_v2.dart",
-)
-val flutterVlessSecureSocksScopeFixScript = File(
-    projectRootDir,
-    "tool/patch_flutter_vless_secure_socks_scope_fix.dart",
-)
-
-val patchFlutterVlessAllowedApps = tasks.register<Exec>("patchFlutterVlessAllowedApps") {
-    group = "build setup"
-    description = "Patch pinned flutter_vless_android 1.1.5 with ReVolt routing/runtime hardening"
-    workingDir(projectRootDir)
-
-    doFirst {
-        if (!dartExecutable.isFile) {
-            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
-        }
-        if (!flutterVlessPatchScript.isFile) {
-            throw GradleException("flutter_vless patch script missing: ${flutterVlessPatchScript.absolutePath}")
-        }
-        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
-            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
-        }
-    }
-
-    commandLine(
-        dartExecutable.absolutePath,
-        "run",
-        flutterVlessPatchScript.absolutePath,
-    )
-}
-
-val patchFlutterVlessSecureSocks = tasks.register<Exec>("patchFlutterVlessSecureSocks") {
-    group = "build setup"
-    description = "Add authenticated ephemeral SOCKS5 and fail-closed process recovery to pinned flutter_vless_android 1.1.5"
-    workingDir(projectRootDir)
-    dependsOn(patchFlutterVlessAllowedApps)
-
-    doFirst {
-        if (!dartExecutable.isFile) {
-            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
-        }
-        if (!flutterVlessSecureSocksPatchScript.isFile) {
-            throw GradleException("secure SOCKS patch script missing: ${flutterVlessSecureSocksPatchScript.absolutePath}")
-        }
-        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
-            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
-        }
-    }
-
-    commandLine(
-        dartExecutable.absolutePath,
-        "run",
-        flutterVlessSecureSocksPatchScript.absolutePath,
-    )
-}
-
-val patchFlutterVlessSecureSocksScopeFix = tasks.register<Exec>("patchFlutterVlessSecureSocksScopeFix") {
-    group = "build setup"
-    description = "Repair the secure Xray process monitor capture without changing stock 1.1.5 runtime sequencing"
-    workingDir(projectRootDir)
-    dependsOn(patchFlutterVlessSecureSocks)
-
-    doFirst {
-        if (!dartExecutable.isFile) {
-            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
-        }
-        if (!flutterVlessSecureSocksScopeFixScript.isFile) {
-            throw GradleException("secure SOCKS scope fix script missing: ${flutterVlessSecureSocksScopeFixScript.absolutePath}")
-        }
-        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
-            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
-        }
-    }
-
-    commandLine(
-        dartExecutable.absolutePath,
-        "run",
-        flutterVlessSecureSocksScopeFixScript.absolutePath,
-    )
-}
-
-// App compilation and the transitive Android plugin compilation must both wait
-// for the pinned runtime patches. Plain `flutter build apk` must behave like CI
-// instead of relying on a hidden manual pre-build step.
-tasks.configureEach {
-    if (name == "preBuild") {
-        dependsOn(patchFlutterVlessSecureSocksScopeFix)
-    }
-}
-
-gradle.projectsEvaluated {
-    rootProject.findProject(":flutter_vless_android")
-        ?.tasks
-        ?.matching { it.name == "preBuild" }
-        ?.configureEach {
-            dependsOn(patchFlutterVlessSecureSocksScopeFix)
-        }
 }
 
 android {
@@ -140,10 +24,6 @@ android {
         targetCompatibility = JavaVersion.VERSION_17
     }
 
-    packaging {
-        resources.excludes.add("META-INF/**")
-    }
-
     val keystorePropertiesFile = rootProject.file("key.properties")
     val keystoreProperties = Properties()
     if (keystorePropertiesFile.exists()) {
@@ -156,6 +36,68 @@ android {
         admobProperties.load(FileInputStream(admobPropertiesFile))
     }
 
+    // Explicit opt-in used only by GitHub Actions to exercise the real
+    // release/R8 graph. Production release signing and config pinning remain
+    // fail-closed outside that CI smoke path.
+    val ciReleaseSmoke =
+        System.getenv("GITHUB_ACTIONS") == "true" &&
+            System.getenv("REVOLT_CI_RELEASE_SMOKE") == "true"
+
+    val appConfigFile = rootProject.file("../lib/logic/app_config.dart")
+    val verifyReleaseAppConfig = tasks.register("verifyReleaseAppConfig") {
+        group = "verification"
+        description = "Verify the production Dart app config against REVOLT_APP_CONFIG_SHA256."
+        doLast {
+            if (ciReleaseSmoke) {
+                logger.lifecycle("Skipping production app-config pin for CI release smoke build")
+                return@doLast
+            }
+
+            val expected = System.getenv("REVOLT_APP_CONFIG_SHA256")?.trim()?.lowercase()
+            if (expected.isNullOrEmpty()) {
+                throw org.gradle.api.GradleException(
+                    "REVOLT_APP_CONFIG_SHA256 is required for production release builds"
+                )
+            }
+            if (!Regex("[0-9a-f]{64}").matches(expected)) {
+                throw org.gradle.api.GradleException(
+                    "REVOLT_APP_CONFIG_SHA256 must be exactly 64 lowercase hexadecimal characters"
+                )
+            }
+            if (!appConfigFile.isFile) {
+                throw org.gradle.api.GradleException(
+                    "Production app config is missing: ${appConfigFile.absolutePath}"
+                )
+            }
+
+            val configText = appConfigFile.readText()
+            val templateMarkers = listOf(
+                "'0.0.0.0'",
+                "YOUR_DOMAIN",
+                "YOUR_GITHUB_USERNAME",
+                "YOUR_REPO_NAME",
+                "ca-app-pub-0000000000000000/0000000000",
+            )
+            val remainingMarker = templateMarkers.firstOrNull(configText::contains)
+            if (remainingMarker != null) {
+                throw org.gradle.api.GradleException(
+                    "Production app config still contains template marker: $remainingMarker"
+                )
+            }
+
+            val actual = sha256Hex(appConfigFile)
+            if (actual != expected) {
+                throw org.gradle.api.GradleException(
+                    "Production app config SHA-256 mismatch: expected $expected, got $actual"
+                )
+            }
+        }
+    }
+
+    tasks.matching { it.name == "preReleaseBuild" }.configureEach {
+        dependsOn(verifyReleaseAppConfig)
+    }
+
     defaultConfig {
         applicationId = "com.paladinvpn.app"
         minSdk = flutter.minSdkVersion
@@ -176,7 +118,11 @@ android {
 
     buildTypes {
         release {
-            signingConfig = signingConfigs.getByName("release")
+            signingConfig = if (ciReleaseSmoke) {
+                signingConfigs.getByName("debug")
+            } else {
+                signingConfigs.getByName("release")
+            }
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(

android/app/proguard-rules.pro

@@ -1,4 +1,4 @@
-# PaladinVPN ProGuard / R8 Rules
+# ReVoltVPN ProGuard / R8 Rules
 # ==============================================================================
 # These rules prevent R8 from stripping classes and methods that are accessed
 # via JNI (Java Native Interface) or reflection, which would cause
@@ -11,9 +11,8 @@
 -keep class xray.** { *; }
 
 # ── Flutter / Platform Channels ───────────────────────────────────────────────
+# io.flutter.** already includes embedding and plugin subpackages.
 -keep class io.flutter.** { *; }
--keep class io.flutter.embedding.** { *; }
--keep class io.flutter.plugin.** { *; }
 
 # ── Google Mobile Ads (AdMob) ─────────────────────────────────────────────────
 -keep class com.google.android.gms.ads.** { *; }

android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt

@@ -3,7 +3,6 @@ package com.paladinvpn.app
 import android.app.Notification
 import android.app.NotificationChannel
 import android.app.NotificationManager
-import android.app.ActivityManager
 import android.app.PendingIntent
 import android.content.Context
 import android.content.Intent
@@ -21,8 +20,7 @@ import android.os.VibratorManager
 import android.provider.Settings
 import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
-import com.github.tfox.flutter_vless.xray.service.XrayVPNService
+import com.github.tfox.flutter_vless.xray.utils.RevoltAlerts
-import com.github.tfox.flutter_vless.xray.utils.AppConfigs
 import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
 import io.flutter.plugin.common.EventChannel
@@ -54,35 +52,42 @@ class MainActivity : FlutterActivity() {
         MethodChannel(flutterEngine.dartExecutor.binaryMessenger, powerChannel)
             .setMethodCallHandler { call, result ->
                 when (call.method) {
-                    // Doze and App Standby stop background services of apps that
-                    // are not exempt. A VPN has to be exempt to survive the screen
-                    // going off, so surface the real state rather than guessing.
                     "isIgnoringBatteryOptimizations" ->
                         result.success(isIgnoringBatteryOptimizations())
                     "requestIgnoreBatteryOptimizations" ->
                         result.success(requestIgnoreBatteryOptimizations())
-                    // Android's own Always-on VPN is the only thing that keeps a
-                    // tunnel up across swipe-from-recents and reboot. It cannot be
-                    // toggled programmatically, so deep-link the user to it.
-                    "openVpnSettings" -> result.success(openVpnSettings())
-                    // Is our VPN runtime actually alive? The service lives in
-                    // :RunSoLibXrayDaemon, a separate process, so its statics are
-                    // NOT visible here -- this is the only honest check.
-                    "isVpnRuntimeAlive" -> result.success(isVpnRuntimeAlive())
                     else -> result.notImplemented()
                 }
             }
 
         MethodChannel(flutterEngine.dartExecutor.binaryMessenger, notificationChannel)
             .setMethodCallHandler { call, result ->
-                if (call.method == "updateNotificationText") {
+                when (call.method) {
-                    val text = call.argument<String>("text") ?: ""
+                    "updateNotificationText" -> {
-                    val title = call.argument<String>("title") ?: "Revolt VPN"
+                        val text = call.argument<String>("text") ?: ""
-                    val action = call.argument<String>("disconnectLabel") ?: "Disconnect"
+                        val title = call.argument<String>("title") ?: "Revolt VPN"
-                    updateVpnNotification(title, text, action)
+                        val action = call.argument<String>("disconnectLabel") ?: "Disconnect"
-                    result.success(null)
+                        updateVpnNotification(title, text, action)
-                } else {
+                        result.success(null)
-                    result.notImplemented()
+                    }
+                    // Session ends only Dart sees; the service posts the rest.
+                    "showDisconnectedAlert" -> {
+                        RevoltAlerts.postDisconnected(this)
+                        result.success(null)
+                    }
+                    // The countdown re-post is ongoing and non-dismissible, so
+                    // whoever posted it last has to take it down. A tick that
+                    // lands after the service cancelled its own foreground
+                    // notification otherwise strands a frozen countdown that
+                    // claims a protected session forever. Harmless while the
+                    // service is still in the foreground - the platform keeps
+                    // its notification regardless.
+                    "cancelNotification" -> {
+                        (getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager)
+                            .cancel(NOTIFICATION_ID)
+                        result.success(null)
+                    }
+                    else -> result.notImplemented()
                 }
             }
 
@@ -115,7 +120,6 @@ class MainActivity : FlutterActivity() {
         super.onDestroy()
     }
 
-    /** True when the OS has exempted us from Doze / App Standby. */
     private fun isIgnoringBatteryOptimizations(): Boolean {
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
         return try {
@@ -126,11 +130,6 @@ class MainActivity : FlutterActivity() {
         }
     }
 
-    /**
-     * Opens the system exemption prompt. Android shows this as a single dialog;
-     * it cannot be granted silently, so the caller must treat a false return as
-     * "ask again later" rather than a denial.
-     */
     private fun requestIgnoreBatteryOptimizations(): Boolean {
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
         if (isIgnoringBatteryOptimizations()) return true
@@ -143,7 +142,6 @@ class MainActivity : FlutterActivity() {
             )
             true
         } catch (_: Exception) {
-            // Some OEM builds hide the direct intent; fall back to the list.
             try {
                 startActivity(Intent(Settings.ACTION_IGNORE_BATTERY_OPTIMIZATION_SETTINGS))
                 true
@@ -153,60 +151,6 @@ class MainActivity : FlutterActivity() {
         }
     }
 
-    /** Deep-links to the OS VPN settings, where Always-on VPN lives. */
-    private fun openVpnSettings(): Boolean {
-        return try {
-            startActivity(
-                Intent(Settings.ACTION_VPN_SETTINGS)
-                    .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK),
-            )
-            true
-        } catch (_: Exception) {
-            false
-        }
-    }
-
-    /**
-     * Whether the VPN runtime is genuinely alive.
-     *
-     * The Xray service runs in :RunSoLibXrayDaemon, a separate process, so its
-     * statics (AppConfigs.V2RAY_CONFIG, V2RAY_STATE) are NOT visible from here --
-     * reading them yields a fresh, empty copy. getRunningAppProcesses still
-     * returns our *own* processes, which makes it the one reliable signal.
-     */
-    private fun isVpnRuntimeAlive(): Map<String, Any> {
-        var processAlive = false
-        try {
-            val am = getSystemService(Context.ACTIVITY_SERVICE) as ActivityManager
-            processAlive = am.runningAppProcesses
-                ?.any { it.processName.endsWith(VPN_PROCESS_SUFFIX) } == true
-        } catch (_: Exception) {
-        }
-
-        var vpnTransport = false
-        try {
-            val cm = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
-            vpnTransport = cm.allNetworks.any { network ->
-                cm.getNetworkCapabilities(network)
-                    ?.hasTransport(NetworkCapabilities.TRANSPORT_VPN) == true
-            }
-        } catch (_: Exception) {
-        }
-
-        return mapOf(
-            "processAlive" to processAlive,
-            "vpnTransport" to vpnTransport,
-        )
-    }
-
-    /** Removes a notification left behind by a runtime that is no longer alive. */
-    private fun cancelVpnNotification() {
-        try {
-            NotificationManagerCompat.from(this).cancel(NOTIFICATION_ID)
-        } catch (_: Exception) {
-        }
-    }
-
     private fun updateVpnNotification(title: String, text: String, actionLabel: String) {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
             checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) !=
@@ -215,15 +159,6 @@ class MainActivity : FlutterActivity() {
             return
         }
 
-        // The foreground notification (id 1) is owned by XrayVPNService via
-        // startForeground. Posting to it from this process while the service is
-        // gone leaves a frozen countdown nothing will ever update again.
-        val alive = isVpnRuntimeAlive()["processAlive"] == true
-        if (!alive) {
-            cancelVpnNotification()
-            return
-        }
-
         ensureNotificationChannel()
 
         val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
@@ -233,28 +168,38 @@ class MainActivity : FlutterActivity() {
         }
 
         val launchIntent = packageManager.getLaunchIntentForPackage(packageName)
-        launchIntent?.action = "FROM_DISCONNECT_BTN"
         launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or
             Intent.FLAG_ACTIVITY_CLEAR_TOP or
             Intent.FLAG_ACTIVITY_NEW_TASK
 
-        val stopIntent = Intent(this, XrayVPNService::class.java)
+        // The VPN service owns the authoritative Disconnect PendingIntent and
-        stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
+        // embeds the current runtime-generation token in it. Never recreate an
-        val stopPendingIntent = PendingIntent.getService(this, 0, stopIntent, flags)
+        // unscoped STOP intent from the UI process: a stale notification could
+        // otherwise stop a newer tunnel. Reuse the live service action when the
+        // platform exposes it; on older Android versions omit the action rather
+        // than weaken generation scoping.
+        val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        val serviceStopAction = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+            manager.activeNotifications
+                .firstOrNull { it.id == NOTIFICATION_ID }
+                ?.notification
+                ?.actions
+                ?.firstOrNull()
+                ?.actionIntent
+        } else {
+            null
+        }
 
-        // Public lock-screen preview: keep the VPN status visible but hide the
-        // session countdown/speed so usage metadata never reaches the lock screen.
         val publicVersion = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
-            .setSmallIcon(R.drawable.notification_status_icon)
+            .setSmallIcon(R.drawable.notification_icon)
             .setContentTitle("Revolt VPN")
             .setContentText("VPN is active")
             .build()
 
         val builder = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
-            .setSmallIcon(R.drawable.notification_status_icon)
+            .setSmallIcon(R.drawable.notification_icon)
             .setContentTitle(title)
             .setContentText(text)
-            .addAction(0, actionLabel, stopPendingIntent)
             .setColorized(true)
             .setColor(0xFF0D1117.toInt())
             .setOngoing(true)
@@ -266,6 +211,10 @@ class MainActivity : FlutterActivity() {
             .setVisibility(NotificationCompat.VISIBILITY_PRIVATE)
             .setPublicVersion(publicVersion)
 
+        if (serviceStopAction != null) {
+            builder.addAction(0, actionLabel, serviceStopAction)
+        }
+
         if (launchIntent != null) {
             builder.setContentIntent(PendingIntent.getActivity(this, 0, launchIntent, flags))
         }
@@ -472,7 +421,6 @@ class MainActivity : FlutterActivity() {
 
     companion object {
         private const val NOTIFICATION_ID = 1
-        private const val VPN_PROCESS_SUFFIX = ":RunSoLibXrayDaemon"
+        private const val NOTIFICATION_CHANNEL_ID = "REVOLT_VPN_SERVICE"
-        private const val NOTIFICATION_CHANNEL_ID = "XRAY_SERVICE_CHANNEL"
     }
 }

android/gradlew

@@ -0,0 +1,251 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH="\\\"\\\""
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"

android/gradlew.bat

@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS=-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

lib/components/connect_button.dart

@@ -19,6 +19,7 @@ class _ConnectButtonState extends State<ConnectButton>
   DateTime _lastTap = DateTime.fromMillisecondsSinceEpoch(0);
   AnimationController? _pulse;
   Animation<double>? _pulseAnim;
+  VpnConnection? _vpn;
 
   double get _pulseValue => _pulseAnim?.value ?? 0.0;
 
@@ -35,20 +36,25 @@ class _ConnectButtonState extends State<ConnectButton>
     );
     WidgetsBinding.instance.addObserver(this);
     WidgetsBinding.instance.addPostFrameCallback((_) {
-      if (mounted) context.read<VpnConnection>().addListener(_onVpnChanged);
+      if (!mounted || _vpn != null) return;
+      final vpn = context.read<VpnConnection>();
+      _vpn = vpn;
+      vpn.addListener(_onVpnChanged);
+      _onVpnChanged();
     });
   }
 
   @override
   void dispose() {
     WidgetsBinding.instance.removeObserver(this);
-    context.read<VpnConnection>().removeListener(_onVpnChanged);
+    _vpn?.removeListener(_onVpnChanged);
     _pulse?.dispose();
     super.dispose();
   }
 
   void _onVpnChanged() {
-    final vpn = context.read<VpnConnection>();
+    final vpn = _vpn;
+    if (vpn == null) return;
     if (vpn.status == VpnStatus.connected) {
       _pulse?.repeat(reverse: true);
     } else {
@@ -60,14 +66,12 @@ class _ConnectButtonState extends State<ConnectButton>
   @override
   void didChangeAppLifecycleState(AppLifecycleState state) {
     if (!mounted) return;
-    if (state == AppLifecycleState.paused ||
+    if (state != AppLifecycleState.resumed) {
-        state == AppLifecycleState.detached) {
       _pulse?.stop();
-    } else if (state == AppLifecycleState.resumed) {
+      return;
-      final vpn = context.read<VpnConnection>();
+    }
-      if (vpn.status == VpnStatus.connected) {
+    if (_vpn?.status == VpnStatus.connected) {
-        _pulse?.repeat(reverse: true);
+      _pulse?.repeat(reverse: true);
-      }
     }
   }
 
@@ -91,10 +95,10 @@ class _ConnectButtonState extends State<ConnectButton>
 
     setState(() => _busy = true);
     try {
-      final adWatched = await ad.showAd('main');
+      final adNonce = await ad.showAd('main');
-      if (!adWatched && AdManager.adsEnabled) return;
+      if (adNonce == null && AdManager.adsEnabled) return;
 
-      final ok = await vpn.connect();
+      final ok = await vpn.connect(adNonce: adNonce);
       if (ok) {
         await timer.start();
         HapticSettings.success();

lib/components/data_disclosure_dialog.dart

@@ -19,23 +19,28 @@ class DataDisclosureDialog {
 
     if (!context.mounted) return;
 
-    await showDialog(
+    final accepted = await showDialog<bool>(
       context: context,
       barrierDismissible: false, // Must tap Continue — no tap-outside dismiss.
-      builder: (_) => _DisclosureDialog(
+      builder: (_) => const _DisclosureDialog(),
-        onContinue: () {
-          prefs.setBool(_key, true);
-          Navigator.of(context).pop(); // Dismiss the dialog.
-        },
-      ),
     );
+    if (accepted != true) return;
+
+    // Persist only after the user action is complete. If storage fails, do not
+    // invent an accepted state; the disclosure will simply reappear later.
+    try {
+      final saved = await prefs.setBool(_key, true);
+      if (!saved) {
+        debugPrint('[Disclosure] Preference write was rejected');
+      }
+    } catch (e) {
+      debugPrint('[Disclosure] Failed to persist acknowledgement: $e');
+    }
   }
 }
 
 class _DisclosureDialog extends StatelessWidget {
-  final VoidCallback onContinue;
+  const _DisclosureDialog();
-
-  const _DisclosureDialog({required this.onContinue});
 
   @override
   Widget build(BuildContext context) {
@@ -49,7 +54,6 @@ class _DisclosureDialog extends StatelessWidget {
           mainAxisSize: MainAxisSize.min,
           crossAxisAlignment: CrossAxisAlignment.start,
           children: [
-            // Title
             const Text(
               'Before you connect',
               style: TextStyle(
@@ -59,8 +63,6 @@ class _DisclosureDialog extends StatelessWidget {
               ),
             ),
             const SizedBox(height: 16),
-
-            // Body
             const Text(
               'Revolt VPN creates a secure VPN tunnel to protect your '
               'traffic. To enforce your data/time quota, we log your '
@@ -76,12 +78,10 @@ class _DisclosureDialog extends StatelessWidget {
               ),
             ),
             const SizedBox(height: 24),
-
-            // Continue button — full-width, accent
             SizedBox(
               width: double.infinity,
               child: ElevatedButton(
-                onPressed: onContinue,
+                onPressed: () => Navigator.of(context).pop(true),
                 style: ElevatedButton.styleFrom(
                   backgroundColor: AppColors.accent,
                   foregroundColor: AppColors.bgDeep,

lib/components/lightning.dart

@@ -182,7 +182,7 @@ class _LightningPainter extends CustomPainter {
 
   @override
   void paint(Canvas canvas, Size size) {
-    final toScreen = (Offset p) => Offset(p.dx * size.width, p.dy * size.height);
+    Offset toScreen(Offset p) => Offset(p.dx * size.width, p.dy * size.height);
     final scaledMain = bolt.mainPath.map(toScreen).toList();
     final scaledBranches = bolt.branches
         .map((b) => b.map(toScreen).toList())

lib/components/sidebar_contents/discord_link_button.dart

@@ -14,8 +14,8 @@ class DiscordLinkButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.discord, color: AppColors.textWhite, size: 28),
+      icon: Icon(Icons.discord, color: AppColors.textWhite, size: 28),
       onPressed: launchDiscord,
       tooltip: 'Join Discord',
       splashRadius: 24,

lib/components/sidebar_contents/gdpr_button.dart

@@ -76,8 +76,8 @@ class GdprButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.admin_panel_settings_outlined,
+      icon: Icon(Icons.admin_panel_settings_outlined,
           color: AppColors.textWhite, size: 28),
       onPressed: showConsentForm,
       tooltip: 'Ad consent & privacy choices',

lib/components/sidebar_contents/info_button.dart

@@ -14,8 +14,8 @@ class InfoButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.help_outline, color: AppColors.textWhite, size: 28),
+      icon: Icon(Icons.help_outline, color: AppColors.textWhite, size: 28),
       onPressed: launchGitHub,
       tooltip: 'About ReVoltVPN',
       splashRadius: 24,

lib/components/sidebar_contents/privacy_policy_button.dart

@@ -14,8 +14,8 @@ class PrivacyPolicyButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28),
+      icon: Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28),
       onPressed: launchPrivacyPolicy,
       tooltip: 'Privacy Policy',
       splashRadius: 24,

lib/components/sidebar_contents/website_button.dart

@@ -14,8 +14,8 @@ class WebsiteButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.language, color: AppColors.textWhite, size: 28),
+      icon: Icon(Icons.language, color: AppColors.textWhite, size: 28),
       onPressed: launchWebsite,
       tooltip: 'Website',
       splashRadius: 24,

lib/components/status_bar.dart

@@ -1,11 +1,44 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
-import 'package:revoltvpn/logic/app_colors.dart';
-import 'package:revoltvpn/logic/vpn_connection.dart';
-import 'package:revoltvpn/logic/session_timer.dart';
-import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/components/online_dot.dart';
-import 'package:revoltvpn/screens/server_selector/selection_screen.dart';
+import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/logic/session_timer.dart';
+import 'package:revoltvpn/logic/vpn_connection.dart';
+
+// The one line worth showing right now, and whether it is a problem.
+class _StatusDetail {
+  const _StatusDetail(this.text, {this.isProblem = false});
+
+  final String text;
+  final bool isProblem;
+}
+
+_StatusDetail? _detail(VpnConnection vpn, SessionTimer timer) {
+  final error = vpn.errorMessage;
+  if (error != null && error.isNotEmpty) {
+    return _StatusDetail(error.replaceAll('\n', ' '), isProblem: true);
+  }
+
+  if (vpn.status == VpnStatus.connecting ||
+      vpn.status == VpnStatus.disconnecting) {
+    return _StatusDetail(vpn.statusMessage);
+  }
+
+  // Control plane only - the tunnel still carries traffic.
+  if (vpn.status == VpnStatus.connected && timer.serverUnreachable) {
+    return const _StatusDetail(
+      'Can\'t reach the server — still connected',
+      isProblem: true,
+    );
+  }
+
+  if (vpn.status != VpnStatus.connected) {
+    final ended = timer.lastEndMessage;
+    if (ended != null) return _StatusDetail(ended, isProblem: true);
+  }
+
+  return null;
+}
 
 class StatusBar extends StatelessWidget {
   const StatusBar({super.key});
@@ -16,76 +49,50 @@ class StatusBar extends StatelessWidget {
       builder: (context, vpn, timer, _) {
         final isConnected = vpn.status == VpnStatus.connected;
         final isConnecting = vpn.status == VpnStatus.connecting;
-        final serverHealthy =
+        // Rule 60: reachability is known only from a session sync that
-            vpn.serverReachable || (isConnected && timer.hasSyncedOnce);
+        // succeeded, never from a probe. While disconnected the app knows
-        final sessionOrTunnelHealthy = timer.hasSyncedOnce || vpn.serverReachable;
+        // nothing about the server, so it claims nothing either way.
+        final serverHealthy = isConnected && timer.hasSyncedOnce;
 
         final statusLabel = isConnected
-            ? (sessionOrTunnelHealthy ? 'Online' : 'Syncing…')
+            ? (timer.hasSyncedOnce ? 'Online' : 'Syncing…')
-            : (isConnecting
+            : (isConnecting ? 'Connecting…' : 'Ready');
-                ? 'Connecting…'
-                : (vpn.serverReachable ? 'Ready' : 'Offline'));
 
-        final server = context.watch<ServerList>().selected;
+        final detail = _detail(vpn, timer);
 
         return Padding(
           padding: const EdgeInsets.symmetric(horizontal: 24),
           child: Column(
             mainAxisSize: MainAxisSize.min,
             children: [
-              GestureDetector(
+              Container(
-                onTap: () {
+                padding:
-                  Navigator.of(context).push(
+                    const EdgeInsets.symmetric(horizontal: 20, vertical: 12),
-                    PageRouteBuilder(
+                decoration: BoxDecoration(
-                      transitionDuration: const Duration(milliseconds: 300),
+                  color: AppColors.bgCard,
-                      pageBuilder: (_, __, ___) => const SelectionScreen(),
+                  borderRadius: BorderRadius.circular(16),
-                      transitionsBuilder: (_, animation, __, child) {
+                  border: Border.all(color: AppColors.slate15),
-                        return SlideTransition(
+                ),
-                          position: Tween<Offset>(
+                child: Row(
-                            begin: const Offset(1.0, 0.0),
+                  children: [
-                            end: Offset.zero,
+                    Image.asset(
-                          ).animate(
+                      'assets/finland_flag_256.png',
-                            CurvedAnimation(
+                      width: 20,
-                              parent: animation,
+                      height: 20,
-                              curve: Curves.easeOut,
-                            ),
-                          ),
-                          child: child,
-                        );
-                      },
                     ),
-                  );
+                    const SizedBox(width: 8),
-                },
+                    const Expanded(
-                child: Container(
+                      child: Text(
-                  padding:
+                        'Helsinki, Finland',
-                      const EdgeInsets.symmetric(horizontal: 20, vertical: 12),
+                        style: TextStyle(
-                  decoration: BoxDecoration(
+                          color: AppColors.accent,
-                    color: AppColors.bgCard,
+                          fontWeight: FontWeight.w600,
-                    borderRadius: BorderRadius.circular(16),
+                          fontSize: 13,
-                    border: Border.all(color: AppColors.slate15),
+                          letterSpacing: 0.5,
-                  ),
-                  child: Row(
-                    children: [
-                      Image.asset(server.flagAsset, width: 20, height: 20),
-                      const SizedBox(width: 8),
-                      Expanded(
-                        child: Text(
-                          server.name,
-                          style: const TextStyle(
-                            color: AppColors.accent,
-                            fontWeight: FontWeight.w600,
-                            fontSize: 13,
-                            letterSpacing: 0.5,
-                          ),
                         ),
                       ),
-                      const Icon(
+                    ),
-                        Icons.chevron_right,
+                  ],
-                        color: AppColors.textDim,
-                        size: 20,
-                      ),
-                    ],
-                  ),
                 ),
               ),
               const SizedBox(height: 8),
@@ -125,6 +132,21 @@ class StatusBar extends StatelessWidget {
                   ],
                 ),
               ),
+              // Errors and session-end reasons used to render nowhere.
+              if (detail != null)
+                Padding(
+                  padding: const EdgeInsets.only(top: 6),
+                  child: Text(
+                    detail.text,
+                    textAlign: TextAlign.center,
+                    style: TextStyle(
+                      color: detail.isProblem
+                          ? AppColors.red
+                          : AppColors.textDim,
+                      fontSize: 11,
+                    ),
+                  ),
+                ),
             ],
           ),
         );

lib/components/support_button.dart

@@ -31,9 +31,10 @@ class _SupportButtonState extends State<SupportButton> {
     setState(() => _busy = true);
 
     try {
-      final rewarded = await ad.showAd('support');
+      final rewarded = await ad.showAd('support') != null;
       if (rewarded) {
         await timer.markSupportRewardClaimed();
+        await timer.syncNow();
       }
     } finally {
       if (mounted) setState(() => _busy = false);

lib/logic/ad_manager.dart

@@ -1,6 +1,5 @@
 import 'dart:async';
 import 'dart:convert';
-import 'dart:math';
 import 'package:flutter/foundation.dart';
 import 'package:google_mobile_ads/google_mobile_ads.dart';
 import 'package:revoltvpn/logic/crypto_service.dart';
@@ -97,13 +96,16 @@ class AdManager extends ChangeNotifier {
 
   // ── Show ad (or debug bypass) ─────────────────────────────────────
 
-  Future<bool> showAd(String adType) async {
+  // Returns the nonce put in the SSV custom_data, null if unrewarded. connect()
-    // Debug bypass: fire fake AdMob callback so support ads work in dev.
+  // must reuse it: minting a second nonce there rejects the ad's own session.
-    // The server's ADMOB_BYPASS must be True for this to succeed.
+  Future<String?> showAd(String adType) async {
-    if (!adsEnabled && kDebugMode) {
+    if (!adsEnabled) {
+      // Main connect fires its own bypass in fetchConfigDirectly (rule 87).
+      if (adType != 'support' || !kDebugMode) return null;
+
+      // Needs ADMOB_BYPASS=True server-side.
       final deviceId = await CryptoService.getDeviceId();
-      final nonce = '${Random().nextInt(0x7FFFFFFF)}-${DateTime.now().millisecondsSinceEpoch}';
+      final nonce = HivemindService.newNonce();
-      HivemindService.setExpectedNonce(nonce);
       try {
         final customData = jsonEncode({
           'device_id': deviceId,
@@ -115,29 +117,24 @@ class AdManager extends ChangeNotifier {
             '?signature=test&key_id=test'
             '&custom_data=${Uri.encodeComponent(customData)}');
         await HivemindService.directGet(fakeUrl, timeout: const Duration(seconds: 8));
-        return true;
+        return nonce;
       } catch (_) {
-        return false;
+        return null;
       }
     }
 
-    if (!adsEnabled) return false;
-
     await ensureSdkInitialized();
 
     if (!_isAdLoaded || _rewardedAd == null) {
       final loaded = await preloadAd();
       if (!loaded || _rewardedAd == null) {
         debugPrint('[AdManager] Cannot show ad, failed to load.');
-        return false;
+        return null;
       }
     }
 
     final deviceId = await CryptoService.getDeviceId();
-
+    final nonce = HivemindService.newNonce();
-    final nonce = '${Random().nextInt(0x7FFFFFFF)}-${DateTime.now().millisecondsSinceEpoch}';
-    HivemindService.setExpectedNonce(nonce);
-    debugPrint('[AdManager] Ad nonce: $nonce');
 
     final ssvOptions = ServerSideVerificationOptions(
       customData: jsonEncode({
@@ -182,7 +179,7 @@ class AdManager extends ChangeNotifier {
       },
     );
 
-    return rewardCompleter.future;
+    return await rewardCompleter.future ? nonce : null;
   }
 
   @override

lib/logic/connection_settings.dart

@@ -1,3 +1,4 @@
+import 'package:flutter/foundation.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 
 enum ConnectionMode { tun, proxy }
@@ -18,23 +19,37 @@ abstract final class ConnectionSettings {
     final prefs = await SharedPreferences.getInstance();
     final storedMode = prefs.getString(_modeKey);
 
-    // Legacy 'ass' was the pre-V3 SOCKS5 label; map it to proxy. Everything
+    // Only the explicit current proxy value restores SOCKS5. Unknown and
-    // else (including the old 'auto') is TUN — there is no runtime auto mode.
+    // obsolete values, including the pre-V3 'auto' label, fail closed to
-    _mode = storedMode == ConnectionMode.proxy.name || storedMode == 'ass'
+    // full-tunnel TUN instead of silently selecting a weaker route.
+    _mode = storedMode == ConnectionMode.proxy.name
         ? ConnectionMode.proxy
         : ConnectionMode.tun;
 
     if (storedMode != _mode.name) {
-      await prefs.setString(_modeKey, _mode.name);
+      // Best-effort. _mode is already the safe TUN default in memory, so a
+      // failed write leaves nothing insecure — it only means the migration
+      // is retried next launch. initialize() runs from main() before
+      // runApp(), with no zone guard, so throwing here would black-screen
+      // the app on the fresh-install path for no security gain.
+      final migrated = await prefs.setString(_modeKey, _mode.name);
+      if (!migrated) {
+        debugPrint('[ConnectionSettings] Could not persist migrated mode.');
+      }
     }
 
     _initialized = true;
   }
 
-  static Future<void> setMode(ConnectionMode mode) async {
+  static Future<bool> setMode(ConnectionMode mode) async {
+    if (_initialized && _mode == mode) return true;
+
+    final prefs = await SharedPreferences.getInstance();
+    final saved = await prefs.setString(_modeKey, mode.name);
+    if (!saved) return false;
+
     _mode = mode;
     _initialized = true;
-    final prefs = await SharedPreferences.getInstance();
+    return true;
-    await prefs.setString(_modeKey, mode.name);
   }
 }

lib/logic/hivemind_service.dart

@@ -13,6 +13,7 @@ class HivemindService {
 
   static const _ua = 'Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 '
       '(KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36';
+  static const int _maxControlResponseBytes = 256 * 1024;
   static const _pollBackoff = <Duration>[
     Duration(seconds: 1),
     Duration(seconds: 2),
@@ -24,35 +25,158 @@ class HivemindService {
     Uri uri, {
     Duration timeout = const Duration(seconds: 5),
   }) {
-    return http.get(uri, headers: {'User-Agent': _ua}).timeout(timeout);
+    return controlGet(uri, timeout: timeout);
   }
 
-  static void cancel() => _currentCallId++;
+  static Future<http.Response> controlGet(
-
+    Uri uri, {
-  static void setExpectedNonce(String nonce) {
+    Duration timeout = const Duration(seconds: 5),
-    _expectedNonce = nonce;
-  }
-
-  static Future<String> fetchConfigDirectly({
-    void Function(int attempt, int total)? onAttempt,
-    bool skipAdBypass = false,
   }) async {
-    final deviceId = await CryptoService.getDeviceId();
+    final client = http.Client();
-    final callId = ++_currentCallId;
+    final request = http.Request('GET', uri)
-    final nonce = _newNonce();
+      ..headers['User-Agent'] = _ua
-    _expectedNonce = nonce;
+      ..followRedirects = false;
 
-    if (!skipAdBypass) {
+    Future<http.Response> read() async {
-      await _runConfiguredBypass(deviceId, nonce);
+      final streamed = await client.send(request);
+      final declaredLength = streamed.contentLength;
+      if (declaredLength != null && declaredLength > _maxControlResponseBytes) {
+        throw const FormatException('Control response is too large.');
+      }
+
+      final bytes = <int>[];
+      await for (final chunk in streamed.stream) {
+        if (bytes.length + chunk.length > _maxControlResponseBytes) {
+          throw const FormatException('Control response is too large.');
+        }
+        bytes.addAll(chunk);
+      }
+
+      return http.Response.bytes(
+        bytes,
+        streamed.statusCode,
+        headers: streamed.headers,
+        isRedirect: streamed.isRedirect,
+        persistentConnection: streamed.persistentConnection,
+        reasonPhrase: streamed.reasonPhrase,
+        request: request,
+      );
     }
 
-    const maxAttempts = 5;
+    try {
+      return await read().timeout(
+        timeout,
+        onTimeout: () {
+          client.close();
+          throw TimeoutException('Control request timed out.', timeout);
+        },
+      );
+    } finally {
+      client.close();
+    }
+  }
+
+  static Future<http.Response> controlPost(
+    Uri uri,
+    Map<String, dynamic> body, {
+    Duration timeout = const Duration(seconds: 5),
+  }) async {
+    final client = http.Client();
+    final request = http.Request('POST', uri)
+      ..headers['User-Agent'] = _ua
+      ..headers['Content-Type'] = 'application/json'
+      ..body = jsonEncode(body)
+      ..followRedirects = false;
+
+    Future<http.Response> send() async {
+      final streamed = await client.send(request);
+      final declaredLength = streamed.contentLength;
+      if (declaredLength != null && declaredLength > _maxControlResponseBytes) {
+        throw const FormatException('Control response is too large.');
+      }
+
+      final bytes = <int>[];
+      await for (final chunk in streamed.stream) {
+        if (bytes.length + chunk.length > _maxControlResponseBytes) {
+          throw const FormatException('Control response is too large.');
+        }
+        bytes.addAll(chunk);
+      }
+
+      return http.Response.bytes(bytes, streamed.statusCode,
+          headers: streamed.headers, request: request);
+    }
+
+    try {
+      return await send().timeout(
+        timeout,
+        onTimeout: () {
+          client.close();
+          throw TimeoutException('Control request timed out.', timeout);
+        },
+      );
+    } finally {
+      client.close();
+    }
+  }
+
+  // Hands the session back so the server can drop the VLESS client instead of
+  // leaving it provisioned until the window runs out.
+  //
+  // Only the user-initiated disconnect calls this. An expiry, a hard cap or a
+  // server-ended session is already gone server-side, and /session/stop takes
+  // nothing but a device_id as proof (hivemind/api.py notes this), so a
+  // transient client error must never be allowed to destroy a live session.
+  // Best effort throughout: the session expires on its own regardless.
+  static Future<void> releaseSession() async {
+    try {
+      final deviceId = await CryptoService.getDeviceId();
+      await controlPost(
+        _publicUrl('/session/stop'),
+        {'device_id': deviceId},
+        timeout: const Duration(seconds: 3),
+      );
+    } catch (_) {
+      // Nothing to recover: the server expires the session anyway.
+    }
+  }
+
+  static void cancel() {
+    _currentCallId++;
+    _expectedNonce = null;
+  }
+
+  // Fetches this device's VLESS URL. Every session starts the same way, so
+  // there is always a nonce to bind it to: either the one the ad minted, or one
+  // we mint here before firing the bypass (rule 87). The re-attach path that
+  // used to accept any nonce is gone - see rule 4.
+  static Future<String> fetchConfigDirectly({
+    void Function(int attempt, int total)? onAttempt,
+    String? adNonce,
+  }) async {
+    // Capture the generation before the first await. Otherwise a disconnect
+    // that lands while secure storage is resolving the device ID can be lost
+    // and the cancelled call can resume network work with a fresh generation.
+    final callId = ++_currentCallId;
+    final deviceId = await CryptoService.getDeviceId();
+    _throwIfCancelled(callId);
+
+    final nonce = adNonce ?? newNonce();
+    _expectedNonce = nonce;
+
+    if (adNonce == null) {
+      await _runConfiguredBypass(deviceId, nonce);
+      _throwIfCancelled(callId);
+    }
+
+    final maxAttempts = adNonce != null ? 10 : 5;
     for (var attempt = 1; attempt <= maxAttempts; attempt++) {
       _throwIfCancelled(callId);
       onAttempt?.call(attempt, maxAttempts);
 
       try {
         final session = await _fetchActiveSession(deviceId, nonce);
+        _throwIfCancelled(callId);
         if (session != null) {
           _expectedNonce = null;
           return session.toVlessUrl();
@@ -63,7 +187,9 @@ class HivemindService {
       }
 
       if (attempt < maxAttempts) {
-        await Future.delayed(_pollBackoff[attempt - 1]);
+        await Future.delayed(
+          _pollBackoff[min(attempt - 1, _pollBackoff.length - 1)],
+        );
         _throwIfCancelled(callId);
       }
     }
@@ -71,19 +197,7 @@ class HivemindService {
     throw Exception('Session not activated. Server callback may have timed out.');
   }
 
-  static Future<bool> checkHealth() async {
+  static String newNonce() {
-    try {
-      final response = await directGet(
-        _publicUrl('/health'),
-        timeout: const Duration(seconds: 3),
-      );
-      return response.statusCode == 200;
-    } catch (_) {
-      return false;
-    }
-  }
-
-  static String _newNonce() {
     final random = Random.secure();
     final high = random.nextInt(0x7FFFFFFF);
     final low = random.nextInt(0x7FFFFFFF);
@@ -109,18 +223,15 @@ class HivemindService {
     final statusUri = _publicUrl('/session/status').replace(
       queryParameters: {'device_id': deviceId},
     );
-    final response = await directGet(statusUri);
+    final response = await controlGet(statusUri);
     if (response.statusCode != 200) return null;
 
     final decoded = jsonDecode(response.body);
     if (decoded is! Map<String, dynamic>) return null;
 
     final serverNonce = decoded['nonce'];
-    if (_expectedNonce != null &&
+    if (_expectedNonce != nonce) return null;
-        serverNonce is String &&
+    if (serverNonce is! String || serverNonce != nonce) return null;
-        serverNonce != nonce) {
-      return null;
-    }
 
     if (decoded['active'] != true || decoded['vless_uuid'] == null) {
       return null;
@@ -141,6 +252,13 @@ class HivemindService {
 }
 
 class _HivemindSessionConfig {
+  static final RegExp _uuidPattern = RegExp(
+    r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$',
+    caseSensitive: false,
+  );
+  static final RegExp _shortIdPattern =
+      RegExp(r'^[0-9a-f]{0,16}$', caseSensitive: false);
+
   final String uuid;
   final String host;
   final int port;
@@ -162,50 +280,174 @@ class _HivemindSessionConfig {
   });
 
   factory _HivemindSessionConfig.fromJson(Map<String, dynamic> json) {
-    final uuid = _requiredString(json, 'vless_uuid');
+    final uuid = _requiredString(json, 'vless_uuid', maxLength: 64);
-    final host = _stringOr(json['vless_ip'], AppConfig.serverIp);
+    if (!_uuidPattern.hasMatch(uuid)) {
-    final port = _portOr(json['vless_port'], 443);
+      throw const FormatException('Invalid VLESS UUID');
-    final sni = _requiredString(json, 'reality_sni');
+    }
+
+    // The API may rotate credentials and Reality parameters, but it must never
+    // choose the tunnel destination. Keep that trust anchor compiled into the
+    // app so an API/domain compromise can cause denial of service, not redirect
+    // VPN traffic to an attacker-controlled server.
+    final pinnedHost = _validatedPublicIp(AppConfig.serverIp, 'serverIp');
+    final advertisedHost = json['vless_ip'];
+    if (advertisedHost != null) {
+      if (advertisedHost is! String || advertisedHost.trim() != pinnedHost) {
+        throw const FormatException(
+          'Session VLESS host does not match compiled server pin',
+        );
+      }
+    }
+    final host = pinnedHost;
+
+    final advertisedPort = json['vless_port'];
+    if (advertisedPort != null &&
+        (advertisedPort is! num || advertisedPort.toInt() != 443)) {
+      throw const FormatException('Session VLESS port does not match compiled pin');
+    }
+    const port = 443;
+    final sni = _validatedHost(
+      _requiredString(json, 'reality_sni', maxLength: 253),
+      'reality_sni',
+    );
+    final publicKey = _requiredString(json, 'reality_pbk', maxLength: 128);
+    final shortId = _stringOr(json['reality_sid'], '').trim();
+    if (!_shortIdPattern.hasMatch(shortId)) {
+      throw const FormatException('Invalid Reality short ID');
+    }
+
+    final fingerprint =
+        _boundedString(json['reality_fp'], AppConfig.realityFp, 32, 'reality_fp');
+    final path =
+        _boundedString(json['xhttp_path'], AppConfig.vlessPath, 2048, 'xhttp_path');
+    if (!path.startsWith('/')) {
+      throw const FormatException('Invalid XHTTP path');
+    }
 
     return _HivemindSessionConfig(
       uuid: uuid,
       host: host,
       port: port,
-      publicKey: _stringOr(json['reality_pbk'], ''),
+      publicKey: publicKey,
-      shortId: _stringOr(json['reality_sid'], ''),
+      shortId: shortId,
       sni: sni,
-      fingerprint: _stringOr(json['reality_fp'], AppConfig.realityFp),
+      fingerprint: fingerprint,
-      path: _stringOr(json['xhttp_path'], AppConfig.vlessPath),
+      path: path,
     );
   }
 
   String toVlessUrl() {
-    return 'vless://$uuid@$host:$port'
+    return Uri(
-        '?security=${AppConfig.vlessSecurity}'
+      scheme: 'vless',
-        '&type=${AppConfig.vlessType}'
+      userInfo: uuid,
-        '&path=$path'
+      host: host,
-        '&pbk=${Uri.encodeComponent(publicKey)}'
+      port: port,
-        '&sni=${Uri.encodeComponent(sni)}'
+      queryParameters: <String, String>{
-        '&sid=${Uri.encodeComponent(shortId)}'
+        'security': AppConfig.vlessSecurity,
-        '&fp=${Uri.encodeComponent(fingerprint)}'
+        'type': AppConfig.vlessType,
-        '#Revolt VPN';
+        'path': path,
+        'pbk': publicKey,
+        'sni': sni,
+        'sid': shortId,
+        'fp': fingerprint,
+      },
+      fragment: 'Revolt VPN',
+    ).toString();
   }
 
-  static String _requiredString(Map<String, dynamic> json, String key) {
+  static String _requiredString(
+    Map<String, dynamic> json,
+    String key, {
+    int maxLength = 4096,
+  }) {
     final value = json[key];
-    if (value is String && value.trim().isNotEmpty) return value.trim();
+    if (value is! String) {
-    throw FormatException('Missing required session field: $key');
+      throw FormatException('Missing required session field: $key');
+    }
+    final trimmed = value.trim();
+    if (trimmed.isEmpty || trimmed.length > maxLength) {
+      throw FormatException('Invalid session field: $key');
+    }
+    return trimmed;
   }
 
   static String _stringOr(Object? value, String fallback) {
-    return value is String && value.isNotEmpty ? value : fallback;
+    return value is String && value.trim().isNotEmpty ? value.trim() : fallback;
   }
 
-  static int _portOr(Object? value, int fallback) {
+  static String _boundedString(
-    final parsed = value is num ? value.toInt() : fallback;
+    Object? value,
-    if (parsed <= 0 || parsed > 65535) {
+    String fallback,
-      throw const FormatException('Invalid VLESS port');
+    int maxLength,
+    String field,
+  ) {
+    final result = _stringOr(value, fallback);
+    if (result.isEmpty || result.length > maxLength) {
+      throw FormatException('Invalid session field: $field');
     }
-    return parsed;
+    return result;
+  }
+
+  static String _validatedHost(String input, String field) {
+    final value = input.trim();
+    if (value.isEmpty ||
+        value.length > 253 ||
+        value.contains(RegExp(r'[\s/@?#]'))) {
+      throw FormatException('Invalid session host: $field');
+    }
+    try {
+      final probe = Uri(scheme: 'https', host: value);
+      if (probe.host.isEmpty) {
+        throw FormatException('Invalid session host: $field');
+      }
+    } on FormatException {
+      throw FormatException('Invalid session host: $field');
+    }
+    return value;
+  }
+
+  static String _validatedPublicIp(String input, String field) {
+    final value = input.trim().toLowerCase();
+    if (_isPublicIpv4(value) || _isPublicIpv6(value)) return value;
+    throw FormatException('Invalid public IP pin: $field');
+  }
+
+  static bool _isPublicIpv4(String value) {
+    final parts = value.split('.');
+    if (parts.length != 4) return false;
+    final octets = <int>[];
+    for (final part in parts) {
+      if (part.isEmpty || (part.length > 1 && part.startsWith('0'))) return false;
+      final parsed = int.tryParse(part);
+      if (parsed == null || parsed < 0 || parsed > 255) return false;
+      octets.add(parsed);
+    }
+    final a = octets[0];
+    final b = octets[1];
+    if (a == 0 || a == 10 || a == 127 || a >= 224) return false;
+    if (a == 100 && b >= 64 && b <= 127) return false;
+    if (a == 169 && b == 254) return false;
+    if (a == 172 && b >= 16 && b <= 31) return false;
+    if (a == 192 && b == 168) return false;
+    if (a == 192 && b == 0 && octets[2] == 2) return false;
+    if (a == 198 && b == 51 && octets[2] == 100) return false;
+    if (a == 203 && b == 0 && octets[2] == 113) return false;
+    return true;
+  }
+
+  static bool _isPublicIpv6(String value) {
+    if (!value.contains(':') || value.contains('.')) return false;
+    try {
+      final parsed = Uri.parse('https://[$value]/');
+      if (parsed.host.isEmpty || !parsed.host.contains(':')) return false;
+    } on FormatException {
+      return false;
+    }
+    if (value == '::' || value == '::1') return false;
+    if (value.startsWith('fc') || value.startsWith('fd')) return false;
+    if (value.startsWith('fe8') || value.startsWith('fe9') || value.startsWith('fea') || value.startsWith('feb')) return false;
+    if (value.startsWith('ff')) return false;
+    if (value.startsWith('2001:db8:') || value == '2001:db8::') return false;
+    return true;
   }
 }

lib/logic/local_socks_tester.dart

@@ -20,13 +20,13 @@ abstract final class LocalSocksTester {
 
   /// Fast local readiness probe used while starting the VPN.
   ///
-  /// This stops after SOCKS5 authentication. Startup must not depend on an
+  /// This stops after authenticated SOCKS5 negotiation. Startup must not depend
-  /// unrelated external host being reachable.
+  /// on an unrelated external host being reachable.
   static Future<LocalSocksTestResult> testListener({
     String host = '127.0.0.1',
-    int port = 10807,
+    required int port,
-    String? username,
+    required String username,
-    String? password,
+    required String password,
   }) async {
     final stopwatch = Stopwatch()..start();
     Socket? socket;
@@ -86,26 +86,47 @@ abstract final class LocalSocksTester {
     }
   }
 
-  /// Full user-facing test: authenticated local SOCKS handshake plus outbound
+  /// Full user-facing test: authenticated local SOCKS handshake, an outbound
-  /// CONNECT. Credentials are optional so the helper remains usable for legacy
+  /// CONNECT through the active ReVolt route, and — critically — a real
-  /// no-auth diagnostic builds.
+  /// request/response exchange over that CONNECT.
+  ///
+  /// The exchange is not optional politeness. Xray answers a SOCKS CONNECT
+  /// before it dials upstream, so the reply code alone says nothing about the
+  /// outbound: it returns success for unroutable addresses and for hostnames
+  /// that can never resolve. Without a round trip this test reports OK while
+  /// the server is down, which is precisely when a user runs it.
   static Future<LocalSocksTestResult> test({
     String host = '127.0.0.1',
-    int port = 10807,
+    required int port,
-    String? username,
+    required String username,
-    String? password,
+    required String password,
-    String targetHost = 'paladinvpn.duckdns.org',
+    String targetHost = 'example.com',
-    int targetPort = 443,
+    int targetPort = 80,
   }) async {
+    const totalTimeout = Duration(seconds: 8);
     final stopwatch = Stopwatch()..start();
     Socket? socket;
     _SocketReader? reader;
 
+    Duration remaining() {
+      final micros = totalTimeout.inMicroseconds - stopwatch.elapsedMicroseconds;
+      if (micros <= 0) throw TimeoutException('SOCKS5 test timed out.', totalTimeout);
+      return Duration(microseconds: micros);
+    }
+
     try {
+      if (targetPort <= 0 || targetPort > 65535) {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message: 'SOCKS5 test target is invalid.',
+        );
+      }
+
       socket = await Socket.connect(
         host,
         port,
-        timeout: const Duration(seconds: 3),
+        timeout: remaining(),
       );
       socket.setOption(SocketOption.tcpNoDelay, true);
       reader = _SocketReader(socket);
@@ -115,6 +136,7 @@ abstract final class LocalSocksTester {
         socket,
         username: username,
         password: password,
+        timeout: remaining(),
       );
       if (!authenticated) {
         return const LocalSocksTestResult(
@@ -145,7 +167,7 @@ abstract final class LocalSocksTester {
       ]);
       await socket.flush();
 
-      final replyHead = await reader.readExactly(4);
+      final replyHead = await reader.readExactly(4, timeout: remaining());
       if (replyHead[0] != 0x05 || replyHead[1] != 0x00) {
         return const LocalSocksTestResult(
           ok: false,
@@ -155,7 +177,44 @@ abstract final class LocalSocksTester {
         );
       }
 
-      await _consumeAddress(reader, replyHead[3]);
+      await _consumeAddress(reader, replyHead[3], timeout: remaining());
+
+      // The CONNECT reply above is not evidence of an outbound. Force a round
+      // trip and require the peer's answer before claiming the route works.
+      socket.add(
+        utf8.encode(
+          'GET / HTTP/1.1\r\nHost: $targetHost\r\nConnection: close\r\n\r\n',
+        ),
+      );
+      await socket.flush();
+
+      List<int> banner;
+      try {
+        banner = await reader.readExactly(5, timeout: remaining());
+      } on TimeoutException {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message: 'Local SOCKS5 is up, but the ReVolt outbound never replied.',
+        );
+      } on SocketException {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message:
+              'Local SOCKS5 is up, but the ReVolt outbound dropped the connection.',
+        );
+      }
+
+      if (String.fromCharCodes(banner) != 'HTTP/') {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message:
+              'Local SOCKS5 is up, but the ReVolt outbound returned unexpected data.',
+        );
+      }
+
       stopwatch.stop();
       return LocalSocksTestResult(
         ok: true,
@@ -189,23 +248,10 @@ abstract final class LocalSocksTester {
   static Future<bool> _authenticate(
     _SocketReader reader,
     Socket socket, {
-    required String? username,
+    required String username,
-    required String? password,
+    required String password,
     Duration timeout = const Duration(seconds: 4),
   }) async {
-    final passwordAuth = username != null && password != null;
-    if ((username == null) != (password == null)) return false;
-
-    socket.add(passwordAuth
-        ? const <int>[0x05, 0x01, 0x02]
-        : const <int>[0x05, 0x01, 0x00]);
-    await socket.flush();
-
-    final greeting = await reader.readExactly(2, timeout: timeout);
-    if (greeting[0] != 0x05) return false;
-    if (!passwordAuth) return greeting[1] == 0x00;
-    if (greeting[1] != 0x02) return false;
-
     final userBytes = utf8.encode(username);
     final passBytes = utf8.encode(password);
     if (userBytes.isEmpty ||
@@ -215,6 +261,15 @@ abstract final class LocalSocksTester {
       return false;
     }
 
+    // ReVolt never accepts unauthenticated local SOCKS. Advertising only RFC
+    // 1929 username/password auth makes a future credential-plumbing regression
+    // fail closed instead of silently falling back to method 0x00.
+    socket.add(const <int>[0x05, 0x01, 0x02]);
+    await socket.flush();
+
+    final greeting = await reader.readExactly(2, timeout: timeout);
+    if (greeting[0] != 0x05 || greeting[1] != 0x02) return false;
+
     socket.add(<int>[
       0x01,
       userBytes.length,
@@ -229,18 +284,24 @@ abstract final class LocalSocksTester {
   }
 
   static Future<void> _consumeAddress(
-      _SocketReader reader, int addressType) async {
+    _SocketReader reader,
+    int addressType, {
+    required Duration timeout,
+  }) async {
     if (addressType == 0x01) {
-      await reader.readExactly(4 + 2);
+      await reader.readExactly(4 + 2, timeout: timeout);
       return;
     }
     if (addressType == 0x04) {
-      await reader.readExactly(16 + 2);
+      await reader.readExactly(16 + 2, timeout: timeout);
       return;
     }
     if (addressType == 0x03) {
-      final length = (await reader.readExactly(1)).first;
+      final length = (await reader.readExactly(1, timeout: timeout)).first;
-      await reader.readExactly(length + 2);
+      if (length == 0) {
+        throw const FormatException('Invalid SOCKS5 domain length');
+      }
+      await reader.readExactly(length + 2, timeout: timeout);
       return;
     }
     throw const FormatException('Unsupported SOCKS5 address type');
@@ -257,8 +318,15 @@ class _SocketReader {
     int count, {
     Duration timeout = const Duration(seconds: 4),
   }) async {
+    final elapsed = Stopwatch()..start();
     while (_buffer.length < count) {
-      final hasNext = await _iterator.moveNext().timeout(timeout);
+      final remainingMicros = timeout.inMicroseconds - elapsed.elapsedMicroseconds;
+      if (remainingMicros <= 0) {
+        throw TimeoutException('Socket read timed out', timeout);
+      }
+      final hasNext = await _iterator.moveNext().timeout(
+            Duration(microseconds: remainingMicros),
+          );
       if (!hasNext) {
         throw const SocketException('Socket closed early');
       }

lib/logic/notification_service.dart

@@ -16,16 +16,41 @@ class NotificationService {
   /// Sets the notification's content text to [text].
   ///
   /// The native side rebuilds the whole notification, so skip the round-trip
-  /// when the text has not changed.
+  /// when the text has not changed. A failed native update is intentionally
+  /// not cached so the next tick can retry it.
   static Future<void> updateTimer(String text) async {
     if (text == _lastText) return;
-    _lastText = text;
     try {
       await _channel.invokeMethod<void>('updateNotificationText', {
         'title': 'Revolt VPN',
         'text': text,
         'disconnectLabel': 'Disconnect',
       });
+      _lastText = text;
+    } catch (_) {
+      // Cosmetic.
+    }
+  }
+
+  // Same id as the service's own alert, so a double post replaces.
+  static Future<void> showDisconnectedAlert() async {
+    try {
+      await _channel.invokeMethod<void>('showDisconnectedAlert');
+    } catch (_) {
+      // Informational only.
+    }
+  }
+
+  /// Takes down the countdown notification.
+  ///
+  /// [updateTimer] re-posts an ongoing, non-dismissible notification, so a tick
+  /// that lands after the VPN service has cancelled its own foreground copy
+  /// leaves a frozen countdown on screen that nobody owns. Call this once the
+  /// tunnel is actually down.
+  static Future<void> cancelTimer() async {
+    _lastText = null;
+    try {
+      await _channel.invokeMethod<void>('cancelNotification');
     } catch (_) {
       // Cosmetic.
     }

lib/logic/power_settings.dart

@@ -5,9 +5,9 @@ import 'package:flutter/services.dart';
 ///
 /// Android stops background services of apps that are not exempt from Doze and
 /// App Standby, and it tears down the whole process group when a task is swiped
-/// away. Those are OS behaviours, not app bugs, and the OS provides exactly two
+/// away. Those are OS behaviours, not app bugs; the battery-optimisation
-/// sanctioned ways around them: a battery-optimisation exemption, and the
+/// exemption is the one sanctioned way an app can ask for around them, and it
-/// system's own Always-on VPN. Both need one user tap; neither can be forced.
+/// still needs one user tap.
 abstract final class PowerSettings {
   PowerSettings._();
 
@@ -41,50 +41,4 @@ abstract final class PowerSettings {
       return false;
     }
   }
-
-  /// Opens the OS VPN settings screen, where Always-on VPN is configured.
-  static Future<bool> openVpnSettings() async {
-    if (kIsWeb) return false;
-    try {
-      return await _channel.invokeMethod<bool>('openVpnSettings') ?? false;
-    } catch (_) {
-      return false;
-    }
-  }
-
-  /// Whether the VPN runtime is genuinely alive.
-  ///
-  /// The Xray service runs in a separate process, so nothing it stores in
-  /// statics is visible to us. This asks the OS instead: is our service process
-  /// running, and (for TUN) is there an active VPN transport?
-  static Future<VpnRuntimeState> runtimeState() async {
-    if (kIsWeb) return const VpnRuntimeState(processAlive: false, vpnTransport: false);
-    try {
-      final result = await _channel.invokeMapMethod<String, dynamic>(
-        'isVpnRuntimeAlive',
-      );
-      return VpnRuntimeState(
-        processAlive: result?['processAlive'] == true,
-        vpnTransport: result?['vpnTransport'] == true,
-      );
-    } catch (_) {
-      return const VpnRuntimeState(processAlive: false, vpnTransport: false);
-    }
-  }
-}
-
-@immutable
-class VpnRuntimeState {
-  final bool processAlive;
-  final bool vpnTransport;
-
-  const VpnRuntimeState({
-    required this.processAlive,
-    required this.vpnTransport,
-  });
-
-  /// TUN needs both a live service and a real VPN interface. Proxy mode has no
-  /// VPN interface at all, so the service process is the whole signal.
-  bool aliveFor({required bool tunMode}) =>
-      processAlive && (!tunMode || vpnTransport);
 }

lib/logic/secure_socks_session.dart

@@ -39,40 +39,29 @@ class SecureSocksSession {
     final username = _token(16);
     final password = _token(32);
 
-    final sourceInbounds = decoded['inbounds'];
+    // ReVolt owns local ingress. Never accept listeners supplied by a remote
-    final inbounds = <dynamic>[];
+    // or imported Xray config; the client exposes exactly one authenticated
-    if (sourceInbounds is List) {
+    // loopback SOCKS5 listener for the current ephemeral session.
-      for (final value in sourceInbounds) {
+    decoded['inbounds'] = <Map<String, dynamic>>[
-        if (value is Map) {
+      <String, dynamic>{
-          final protocol = value['protocol']?.toString().toLowerCase();
+        'tag': inboundTag,
-          // ReVolt owns local proxy ingress on Android. Drop imported SOCKS/HTTP
+        'port': port,
-          // listeners so a stale no-auth proxy cannot remain reachable beside
+        'listen': '127.0.0.1',
-          // the authenticated session listener.
+        'protocol': 'socks',
-          if (protocol == 'socks' || protocol == 'http') continue;
+        'settings': <String, dynamic>{
-        }
+          'auth': 'password',
-        inbounds.add(value);
+          'udp': true,
-      }
+          'ip': '127.0.0.1',
-    }
+          'users': <Map<String, String>>[
-
+            <String, String>{'user': username, 'pass': password},
-    inbounds.add(<String, dynamic>{
+          ],
-      'tag': inboundTag,
+        },
-      'port': port,
+        'sniffing': <String, dynamic>{
-      'listen': '127.0.0.1',
+          'enabled': true,
-      'protocol': 'socks',
+          'destOverride': <String>['http', 'tls'],
-      'settings': <String, dynamic>{
+        },
-        'auth': 'password',
-        'udp': true,
-        'ip': '127.0.0.1',
-        'users': <Map<String, String>>[
-          <String, String>{'user': username, 'pass': password},
-        ],
       },
-      'sniffing': <String, dynamic>{
+    ];
-        'enabled': true,
-        'destOverride': <String>['http', 'tls'],
-      },
-    });
-    decoded['inbounds'] = inbounds;
 
     return SecureSocksSession._(
       port: port,

lib/logic/server_list.dart

@@ -1,69 +0,0 @@
-import 'package:flutter/foundation.dart';
-import 'package:shared_preferences/shared_preferences.dart';
-
-// ── lib/logic/server_list.dart ──────────────────────────────────────────────
-// Server data model and ChangeNotifier — shared by StatusBar (shows current
-// server name/flag) and SelectionScreen (lets user pick a server).
-//
-// Each server is defined by its tunnel IP/port. Reality credentials (public
-// key, shortId) come from /session/status per session; only the transport
-// parameters live in AppConfig.
-//
-// When multi-server ships:
-//   - _all becomes a fetched list (from /api/servers or bundled config)
-//   - SelectionScreen shows multiple rows
-//   - select() triggers a disconnect/reconnect cycle if the tunnel is active
-
-class ServerInfo {
-  final String id;
-  final String name;
-  final String flagAsset;
-  final String ip;
-  final int port;
-
-  const ServerInfo({
-    required this.id,
-    required this.name,
-    required this.flagAsset,
-    required this.ip,
-    required this.port,
-  });
-}
-
-class ServerList extends ChangeNotifier {
-  static const _all = [
-    ServerInfo(
-      id: 'finland',
-      name: 'Helsinki, Finland',
-      flagAsset: 'assets/finland_flag_256.png',
-      ip: '204.168.246.88',
-      port: 443,
-    ),
-  ];
-
-  int _selectedIndex = 0;
-
-  List<ServerInfo> get all => _all;
-  int get selectedIndex => _selectedIndex;
-  ServerInfo get selected => _all[_selectedIndex];
-
-  // Loads persisted selection from SharedPreferences.
-  // Fire-and-forget — UI starts with default, updates when prefs load.
-  Future<void> init() async {
-    final prefs = await SharedPreferences.getInstance();
-    final saved = prefs.getInt('selected_server_index') ?? 0;
-    if (saved >= 0 && saved < _all.length && saved != _selectedIndex) {
-      _selectedIndex = saved;
-      notifyListeners();
-    }
-  }
-
-  // Switches to a different server. Persists the choice.
-  Future<void> select(int index) async {
-    if (index == _selectedIndex || index < 0 || index >= _all.length) return;
-    _selectedIndex = index;
-    notifyListeners();
-    final prefs = await SharedPreferences.getInstance();
-    await prefs.setInt('selected_server_index', index);
-  }
-}

lib/logic/session_timer.dart

@@ -23,7 +23,10 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   bool _hasSyncedOnce = false;
   int _consecutiveFailures = 0;
   bool _isDisconnecting = false;
-  bool _syncInProgress = false;
+  int? _syncEpochInProgress;
+  Completer<void>? _syncCompletion;
+  int _sessionEpoch = 0;
+
   bool _supportRewardClaimed = false;
   bool _supportRewardStateLoaded = false;
   int _supportStateEpoch = 0;
@@ -33,20 +36,26 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   static const FlutterSecureStorage _supportStorage = FlutterSecureStorage();
 
   static const int _maxConsecutiveFailures = 3;
-  static const int _maxOfflineSeconds = 120;
-  int _offlineSeconds = 0;
 
-  static const int _pollIntervalSeconds = 5;
+  static const int _pollIntervalSeconds = 60;
-  static const int _backgroundPollIntervalSeconds = 30;
+  static const int _backgroundPollIntervalSeconds = 60;
 
   int _lastUsedBytes = 0;
-  DateTime? _lastSuccessfulSyncAt;
+  Stopwatch? _sinceLastSuccessfulSync;
+  // Wall clock, because the Stopwatch is CLOCK_MONOTONIC and stops across
+  // device suspend - exactly when the RTC_WAKEUP expiry alarm fires.
+  DateTime? _deadlineAt;
   double _currentSpeedKBps = 0.0;
 
   SessionTimer({required this.vpnConnection}) {
     WidgetsBinding.instance.addObserver(this);
     vpnConnection.addListener(_onVpnConnectionChanged);
     unawaited(_loadSupportRewardState());
+
+    // VpnConnection is eager and can report an already-running native tunnel
+    // before this provider is created. ChangeNotifier listeners do not replay
+    // old events, so always evaluate the current state once after construction.
+    unawaited(Future.microtask(_onVpnConnectionChanged));
   }
 
   int get remaining => _remainingSeconds;
@@ -59,6 +68,13 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   int get usedBytes => _usedBytes;
   double get currentSpeedKBps => _currentSpeedKBps;
 
+  // Display state only - an unreachable API never tears down a live tunnel.
+  bool get serverUnreachable => _consecutiveFailures >= _maxConsecutiveFailures;
+
+  // Why the last session ended, if the user did not end it. Cleared on connect.
+  String? _lastEndMessage;
+  String? get lastEndMessage => _lastEndMessage;
+
   String get formatted {
     final h = (_remainingSeconds ~/ 3600).toString().padLeft(2, '0');
     final m = ((_remainingSeconds % 3600) ~/ 60).toString().padLeft(2, '0');
@@ -102,18 +118,12 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   }
 
   void _onVpnConnectionChanged() {
+    // A live tunnel with a stopped clock is always wrong, whether this process
+    // adopted an existing runtime, attached late, or recovered from a blip.
     if (vpnConnection.status == VpnStatus.connected &&
         !isRunning &&
-        vpnConnection.adoptedRunningRuntime) {
+        !_isDisconnecting) {
-      _resumeTicking();
+      debugPrint('[Timer] Connected with a stopped clock - resuming.');
-      return;
-    }
-
-    if (vpnConnection.status == VpnStatus.connected &&
-        !isRunning &&
-        !_isDisconnecting &&
-        _hasSyncedOnce) {
-      debugPrint('[Timer] VPN reconnected after blip - resuming.');
       _resumeTicking();
       return;
     }
@@ -122,48 +132,51 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
     if (!hadActiveSession || _isDisconnecting) return;
 
     if (vpnConnection.status == VpnStatus.error) {
-      _stopForVpnFailure('VPN entered error state');
+      unawaited(_doDisconnect(
+        'VPN entered error state',
+        endedMessage: 'The tunnel stopped. You are not protected.',
+      ));
       return;
     }
 
     if (vpnConnection.status == VpnStatus.disconnected) {
-      unawaited(_doDisconnect('VPN tunnel dropped'));
+      // The native deadline beats the 1 s tick, so expiry lands here, not in
+      // _tick. postAlert is false: the service already posted, and a
+      // notification-Disconnect tap is the user asking.
+      final deadline = _deadlineAt;
+      final expired = _hasSyncedOnce &&
+          deadline != null &&
+          DateTime.now().isAfter(
+            deadline.subtract(const Duration(seconds: 5)),
+          );
+      unawaited(_doDisconnect(
+        'VPN tunnel dropped',
+        endedMessage:
+            expired ? 'Your session ended. You are not protected.' : null,
+        postAlert: false,
+      ));
     }
   }
 
-  void _stopForVpnFailure(String reason) {
-    if (_isDisconnecting) return;
-    _isDisconnecting = true;
-    debugPrint('[Timer] Stopping after VPN failure: $reason');
-
-    _timer?.cancel();
-    _timer = null;
-    _currentSpeedKBps = 0.0;
-    _remainingSeconds = 0;
-    _remainingAtLastSync = 0;
-    _hasSyncedOnce = false;
-    _lastSuccessfulSyncAt = null;
-    _consecutiveFailures = 0;
-    _offlineSeconds = 0;
-    NotificationService.reset();
-    notifyListeners();
-  }
-
   Future<void> start() async {
+    _sessionEpoch++;
     _remainingSeconds = 0;
     _remainingAtLastSync = 0;
     _usedBytes = 0;
     _lastUsedBytes = 0;
-    _lastSuccessfulSyncAt = null;
+    _sinceLastSuccessfulSync?.stop();
+    _sinceLastSuccessfulSync = null;
+    _deadlineAt = null;
     _currentSpeedKBps = 0.0;
     _tickCount = 0;
     _hasSyncedOnce = false;
     _consecutiveFailures = 0;
-    _offlineSeconds = 0;
     _isDisconnecting = false;
     _appBackgrounded = false;
+    _lastEndMessage = null;
     NotificationService.reset();
 
+    // Every session is new, so the once-per-session top-up resets with it.
     _supportStateEpoch++;
     _supportRewardClaimed = false;
     _supportRewardStateLoaded = true;
@@ -179,20 +192,15 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   void _tick(Timer t) {
     if (_isDisconnecting) return;
 
-    if (_hasSyncedOnce && _consecutiveFailures < _maxConsecutiveFailures) {
+    if (_hasSyncedOnce) {
       _reconcileElapsedTime();
     }
 
-    if (_consecutiveFailures >= _maxConsecutiveFailures) {
-      _offlineSeconds++;
-      if (_offlineSeconds >= _maxOfflineSeconds) {
-        unawaited(_doDisconnect('Server unreachable'));
-        return;
-      }
-    }
-
     if (_hasSyncedOnce && _remainingSeconds <= 0) {
-      unawaited(_doDisconnect('Session expired'));
+      unawaited(_doDisconnect(
+        'Session expired',
+        endedMessage: 'Your session ended. You are not protected.',
+      ));
       return;
     }
 
@@ -211,28 +219,66 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
     }
   }
 
+  /// Force a control-plane refresh after an event that changes the session
+  /// server-side. If a periodic sync is already in flight, wait for it and
+  /// issue a fresh request so the event cannot be hidden behind the busy guard.
+  Future<void> syncNow() async {
+    final requestedEpoch = _sessionEpoch;
+    while (requestedEpoch == _sessionEpoch && !_isDisconnecting) {
+      final active = _syncEpochInProgress == requestedEpoch
+          ? _syncCompletion
+          : null;
+      if (active != null) {
+        await active.future;
+        continue;
+      }
+      await _syncWithHivemind();
+      return;
+    }
+  }
+
   Future<void> disconnect({String reason = 'User requested'}) async {
+    // Only here, not in _doDisconnect: this is the one path the user actually
+    // asked for. Unawaited so a slow or unreachable API never holds up the
+    // teardown.
+    unawaited(HivemindService.releaseSession());
     await _doDisconnect(reason);
   }
 
-  Future<void> _doDisconnect(String reason) async {
+  // endedMessage is what the UI shows; postAlert raises the notification.
+  // A user-requested disconnect passes neither.
+  Future<void> _doDisconnect(
+    String reason, {
+    String? endedMessage,
+    bool postAlert = true,
+  }) async {
     if (_isDisconnecting) return;
     _isDisconnecting = true;
+    _sessionEpoch++;
     debugPrint('[Timer] Disconnecting: $reason');
 
+    _lastEndMessage = endedMessage;
+    _deadlineAt = null;
     _timer?.cancel();
     _timer = null;
     _currentSpeedKBps = 0.0;
     _remainingSeconds = 0;
     _remainingAtLastSync = 0;
     _hasSyncedOnce = false;
-    _lastSuccessfulSyncAt = null;
+    _sinceLastSuccessfulSync?.stop();
+    _sinceLastSuccessfulSync = null;
     NotificationService.reset();
     notifyListeners();
 
     await vpnConnection.disconnect();
+    // After the service is down, so the cancel is not swallowed by a still
+    // foreground notification. Without it a revoke leaves the countdown on
+    // screen, frozen, claiming a session that no longer protects anything.
+    await NotificationService.cancelTimer();
+    if (endedMessage != null && postAlert) {
+      unawaited(NotificationService.showDisconnectedAlert());
+    }
 
-    if (!_isDisconnecting) return;
     _isDisconnecting = false;
     notifyListeners();
   }
@@ -244,20 +290,28 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   }
 
   Future<void> _syncWithHivemind() async {
-    if (_isDisconnecting || _syncInProgress) return;
+    if (_isDisconnecting) return;
-    _syncInProgress = true;
+    final epoch = _sessionEpoch;
+    if (_syncEpochInProgress == epoch) return;
+
+    final completion = Completer<void>();
+    _syncCompletion = completion;
+    _syncEpochInProgress = epoch;
+
     try {
       final deviceId = await CryptoService.getDeviceId();
+      if (epoch != _sessionEpoch || _isDisconnecting) return;
+
       final base = Uri.parse('${AppConfig.hivemindApiPublic}/session/status');
       final url = base.replace(queryParameters: {'device_id': deviceId});
       final response = await HivemindService.directGet(url);
-      if (_isDisconnecting) return;
+      if (epoch != _sessionEpoch || _isDisconnecting) return;
 
       if (response.statusCode == 200) {
         final decoded = jsonDecode(response.body);
         if (decoded is! Map<String, dynamic>) {
           debugPrint('[Timer] Invalid session payload type.');
-          _markSyncFailure();
+          _markSyncFailure(epoch);
           return;
         }
         final data = decoded;
@@ -265,11 +319,15 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
         final activeValue = data['active'];
         if (activeValue is! bool) {
           debugPrint('[Timer] Session payload missing boolean active state.');
-          _markSyncFailure();
+          _markSyncFailure(epoch);
           return;
         }
         if (!activeValue) {
-          await _doDisconnect('Server ended session');
+          await _doDisconnect(
+            'Server ended session',
+            endedMessage:
+                'The server ended your session. You are not protected.',
+          );
           return;
         }
 
@@ -278,53 +336,75 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
             !expiresValue.isFinite ||
             expiresValue < 0) {
           debugPrint('[Timer] Session payload has invalid expiry.');
-          _markSyncFailure();
+          _markSyncFailure(epoch);
           return;
         }
 
+        final elapsedMs = _sinceLastSuccessfulSync?.elapsedMilliseconds;
         _remainingAtLastSync = expiresValue.toInt();
         _remainingSeconds = _remainingAtLastSync;
+        _deadlineAt = DateTime.now().add(
+          Duration(seconds: _remainingAtLastSync),
+        );
         _usedBytes = _readNonNegativeInt(data['used_bytes'], _usedBytes);
 
-        final now = DateTime.now();
-        final previousSyncAt = _lastSuccessfulSyncAt;
         final deltaBytes = _usedBytes - _lastUsedBytes;
-        if (_hasSyncedOnce && previousSyncAt != null) {
+        if (_hasSyncedOnce && elapsedMs != null && elapsedMs > 0) {
-          final elapsedMs = now.difference(previousSyncAt).inMilliseconds;
+          _currentSpeedKBps = deltaBytes > 0
-          if (deltaBytes > 0 && elapsedMs > 0) {
+              ? (deltaBytes / (elapsedMs / 1000.0)) / 1000.0
-            _currentSpeedKBps = (deltaBytes / (elapsedMs / 1000.0)) / 1000.0;
+              : 0.0;
-          } else {
-            _currentSpeedKBps = 0.0;
-          }
         } else {
           _currentSpeedKBps = 0.0;
         }
         _lastUsedBytes = _usedBytes;
-        _lastSuccessfulSyncAt = now;
+        _sinceLastSuccessfulSync?.stop();
+        _sinceLastSuccessfulSync = Stopwatch()..start();
 
         if (data['cap_exhausted'] == true) {
-          await _doDisconnect('Data cap reached');
+          await _doDisconnect(
+            'Data cap reached',
+            endedMessage: 'Data limit reached. You are not protected.',
+          );
           return;
         }
 
+        if (epoch != _sessionEpoch || _isDisconnecting) return;
+        try {
+          await vpnConnection.setNativeSessionDeadline(_remainingAtLastSync);
+        } catch (e) {
+          debugPrint('[Timer] Failed to arm native session deadline: $e');
+          await _doDisconnect(
+            'Native session deadline unavailable',
+            endedMessage:
+                'Could not arm the session timer. You are not protected.',
+          );
+          return;
+        }
+        if (epoch != _sessionEpoch || _isDisconnecting) return;
         _consecutiveFailures = 0;
-        _offlineSeconds = 0;
         _hasSyncedOnce = true;
         notifyListeners();
       } else {
-        _markSyncFailure();
+        _markSyncFailure(epoch);
       }
     } catch (e) {
-      if (!_isDisconnecting) {
+      if (epoch == _sessionEpoch && !_isDisconnecting) {
         debugPrint('Hivemind sync error: $e');
-        _markSyncFailure();
+        _markSyncFailure(epoch);
       }
     } finally {
-      _syncInProgress = false;
+      if (_syncEpochInProgress == epoch) {
+        _syncEpochInProgress = null;
+      }
+      if (identical(_syncCompletion, completion)) {
+        _syncCompletion = null;
+      }
+      if (!completion.isCompleted) completion.complete();
     }
   }
 
-  void _markSyncFailure() {
+  void _markSyncFailure(int epoch) {
+    if (epoch != _sessionEpoch || _isDisconnecting) return;
     _consecutiveFailures++;
     if (_consecutiveFailures >= _maxConsecutiveFailures) {
       notifyListeners();
@@ -332,12 +412,22 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   }
 
   void _reconcileElapsedTime() {
-    final syncedAt = _lastSuccessfulSyncAt;
+    final clock = _sinceLastSuccessfulSync;
-    if (!_hasSyncedOnce || syncedAt == null) return;
+    if (!_hasSyncedOnce || clock == null) return;
 
-    final elapsed = DateTime.now().difference(syncedAt).inSeconds;
+    final elapsed = clock.elapsed.inSeconds;
     _remainingSeconds =
         (_remainingAtLastSync - elapsed).clamp(0, 1 << 31).toInt();
+
+    // The Stopwatch over-reports after device suspend. Take the smaller of
+    // the two, never the wall clock alone - a backward clock must not extend.
+    final deadline = _deadlineAt;
+    if (deadline != null) {
+      final byWallClock = deadline.difference(DateTime.now()).inSeconds;
+      if (byWallClock < _remainingSeconds) {
+        _remainingSeconds = byWallClock.clamp(0, 1 << 31).toInt();
+      }
+    }
   }
 
   @override
@@ -375,9 +465,15 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
 
   @override
   void dispose() {
+    // Invalidate every asynchronous generation before removing listeners so
+    // late storage/network completions cannot notify a disposed notifier.
+    _sessionEpoch++;
+    _supportStateEpoch++;
+    _isDisconnecting = true;
     WidgetsBinding.instance.removeObserver(this);
     vpnConnection.removeListener(_onVpnConnectionChanged);
     _timer?.cancel();
+    _sinceLastSuccessfulSync?.stop();
     super.dispose();
   }
 }

lib/logic/updater.dart

@@ -189,7 +189,7 @@ class Updater {
     }
 
     try {
-      final result = await MethodChannel('com.revoltvpn.app/installer')
+      final result = await const MethodChannel('com.revoltvpn.app/installer')
           .invokeMethod<String>('getInstallerPackage');
       _cachedSource = (result == 'com.android.vending')
           ? InstallSource.playStore

lib/logic/vpn_connection.dart

@@ -1,12 +1,12 @@
 import 'dart:async';
 
 import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
 import 'package:flutter_vless/flutter_vless.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
 import 'package:revoltvpn/logic/local_socks_tester.dart';
 import 'package:revoltvpn/logic/network_monitor.dart';
-import 'package:revoltvpn/logic/power_settings.dart';
 import 'package:revoltvpn/logic/secure_socks_session.dart';
 
 enum VpnStatus {
@@ -18,7 +18,12 @@ enum VpnStatus {
 }
 
 class VpnConnection extends ChangeNotifier {
-  bool _cancelled = false;
+  static const MethodChannel _nativeControl = MethodChannel('flutter_vless');
+
+  int _connectEpoch = 0;
+  bool _suppressNativeConnect = false;
+  bool _disposed = false;
+
   VpnStatus _status = VpnStatus.disconnected;
   VpnStatus get status => _status;
 
@@ -33,9 +38,6 @@ class VpnConnection extends ChangeNotifier {
   bool _adoptedRunningRuntime = false;
   bool get adoptedRunningRuntime => _adoptedRunningRuntime;
 
-  bool _serverReachable = false;
-  bool get serverReachable => _serverReachable;
-
   ConnectionMode _activeMode = ConnectionMode.tun;
   ConnectionMode get activeMode => _activeMode;
 
@@ -45,6 +47,7 @@ class VpnConnection extends ChangeNotifier {
   SecureSocksSession? get activeSocksSession => _lastSecureSocks;
 
   bool get canTestActiveLocalSocks =>
+      !_disposed &&
       _status == VpnStatus.connected &&
       _activeMode == ConnectionMode.proxy &&
       _lastSecureSocks != null;
@@ -67,7 +70,6 @@ class VpnConnection extends ChangeNotifier {
     );
   }
 
-  Timer? _healthTimer;
   StreamSubscription<NetworkSnapshot>? _networkSubscription;
 
   SecureSocksSession? _lastSecureSocks;
@@ -94,9 +96,10 @@ class VpnConnection extends ChangeNotifier {
   }
 
   Future<void> _startEngine() async {
-    if (kIsWeb) return;
+    if (kIsWeb || _disposed) return;
 
     await ConnectionSettings.initialize();
+    if (_disposed) return;
     _activeMode = ConnectionSettings.mode;
 
     _vless = FlutterVless(
@@ -113,15 +116,18 @@ class VpnConnection extends ChangeNotifier {
       await _vless.initializeVless(
         providerBundleIdentifier: 'com.paladinvpn.app',
         notificationIconResourceType: 'drawable',
-        notificationIconResourceName: 'notification_status_icon',
+        notificationIconResourceName: 'notification_icon',
       );
+      if (_disposed) return;
       _initialized = true;
     } catch (e) {
       debugPrint('[VPN] VLESS init error (expected on emulator): $e');
     }
+    if (_disposed) return;
 
     _networkSubscription = NetworkMonitor.changes.listen(
       (snapshot) {
+        if (_disposed) return;
         // ConnectivityManager is informational only. Restarting from every
         // callback caused the old VPN-created-network reconnect loop.
         _networkTransport = snapshot.transport;
@@ -132,39 +138,12 @@ class VpnConnection extends ChangeNotifier {
       },
     );
 
-    unawaited(_checkHealth());
-    _healthTimer = Timer.periodic(const Duration(seconds: 30), (_) {
-      unawaited(_checkHealth());
-    });
-
     try {
       final coreVersion = await _vless.getCoreVersion();
-      debugPrint('[VPN] Xray core version: $coreVersion');
+      if (!_disposed) {
-    } catch (_) {}
+        debugPrint('[VPN] Xray core version: $coreVersion');
-
-    await _adoptRunningRuntime();
-  }
-
-  /// Reflect a tunnel that is already up when the UI starts.
-  ///
-  /// This asks the OS whether our VPN service process is alive, rather than
-  /// probing a local SOCKS port. The old probe called getConnectedServerDelay(),
-  /// which reads AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807 — but
-  /// AppConfigs lives in the VPN's own process, so from here it is always null
-  /// and the port always fell back to 10807. That was correct only while the
-  /// SOCKS port was fixed; per-session ephemeral ports made it permanently
-  /// wrong, so the app reported "connected" against a dead tunnel.
-  Future<void> _adoptRunningRuntime() async {
-    if (kIsWeb) return;
-    try {
-      final state = await PowerSettings.runtimeState();
-      if (state.aliveFor(tunMode: _activeMode == ConnectionMode.tun)) {
-        _adoptedRunningRuntime = true;
-        _setStatus(VpnStatus.connected, _connectedLabel);
       }
-    } catch (e) {
+    } catch (_) {}
-      debugPrint('[VPN] Runtime liveness check failed: $e');
-    }
   }
 
   String get _connectedLabel {
@@ -176,9 +155,15 @@ class VpnConnection extends ChangeNotifier {
     }
   }
 
+  bool _isCurrentConnect(int epoch) =>
+      !_disposed && epoch == _connectEpoch && !_userDisconnecting;
+
   void _mapStatus(VlessStatus status) {
+    if (_disposed) return;
     switch (status.connectionState) {
       case VlessConnectionState.connected:
+        if (_suppressNativeConnect || _userDisconnecting) return;
+        if (_connectEpoch == 0) _adoptedRunningRuntime = true;
         _setStatus(VpnStatus.connected, _connectedLabel);
         break;
 
@@ -188,6 +173,7 @@ class VpnConnection extends ChangeNotifier {
         break;
 
       case VlessConnectionState.connecting:
+        if (_suppressNativeConnect || _userDisconnecting) return;
         _setStatus(VpnStatus.connecting, 'Establishing tunnel…');
         break;
 
@@ -196,6 +182,7 @@ class VpnConnection extends ChangeNotifier {
         break;
 
       case VlessConnectionState.unknown:
+        if (_suppressNativeConnect || _userDisconnecting) return;
         if (_status != VpnStatus.connected &&
             _status != VpnStatus.disconnected) {
           _setStatus(VpnStatus.error, 'Connection failed');
@@ -204,28 +191,46 @@ class VpnConnection extends ChangeNotifier {
     }
   }
 
-  Future<bool> connect({bool skipAdBypass = false}) async {
+  Future<bool> connect({String? adNonce}) async {
-    if (_status == VpnStatus.connected || _status == VpnStatus.connecting) {
+    if (_disposed ||
+        _userDisconnecting ||
+        _status == VpnStatus.connected ||
+        _status == VpnStatus.connecting ||
+        _status == VpnStatus.disconnecting) {
       return false;
     }
 
-    _cancelled = false;
+    final connectEpoch = ++_connectEpoch;
+    _suppressNativeConnect = false;
     _userDisconnecting = false;
 
     await ConnectionSettings.initialize();
+    if (!_isCurrentConnect(connectEpoch)) return false;
     _activeMode = ConnectionSettings.mode;
 
     if (!kIsWeb && !_initialized) {
+      _suppressNativeConnect = true;
       _errorMessage = 'VPN service unavailable.';
       _setStatus(VpnStatus.error, 'Service unavailable');
       return false;
     }
 
-    // TUN needs the Android VPN permission; SOCKS5 proxy mode runs a local
+    // Proxy mode skips requestPermission below (VPN consent it never needs),
-    // authenticated proxy without a VpnService, so no VPN permission is needed.
+    // so it has to ask for POST_NOTIFICATIONS on its own.
+    if (!kIsWeb && _activeMode == ConnectionMode.proxy) {
+      try {
+        await _nativeControl.invokeMethod<void>('requestNotificationPermission');
+      } catch (e) {
+        debugPrint('[VPN] Notification permission request failed: $e');
+      }
+      if (!_isCurrentConnect(connectEpoch)) return false;
+    }
+
     if (!kIsWeb && _activeMode == ConnectionMode.tun) {
       final ok = await _vless.requestPermission();
+      if (!_isCurrentConnect(connectEpoch)) return false;
       if (!ok) {
+        _suppressNativeConnect = true;
         _errorMessage = 'VPN permission denied.';
         _setStatus(VpnStatus.error, 'Permission required');
         return false;
@@ -241,6 +246,7 @@ class VpnConnection extends ChangeNotifier {
 
     if (kIsWeb) {
       await Future.delayed(const Duration(seconds: 1));
+      if (!_isCurrentConnect(connectEpoch)) return false;
       _setStatus(VpnStatus.connected, 'Secured (dev mode)');
       return true;
     }
@@ -250,8 +256,9 @@ class VpnConnection extends ChangeNotifier {
     String realUrl;
     try {
       realUrl = await HivemindService.fetchConfigDirectly(
-        skipAdBypass: skipAdBypass,
+        adNonce: adNonce,
         onAttempt: (attempt, total) {
+          if (!_isCurrentConnect(connectEpoch)) return;
           _setStatus(
             VpnStatus.connecting,
             'Contacting server ($attempt/$total)…',
@@ -259,9 +266,11 @@ class VpnConnection extends ChangeNotifier {
         },
       );
     } catch (e) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
       debugPrint('[VPN] Config fetch error: $e');
       final raw = e.toString().replaceAll('Exception: ', '');
       if (raw.contains('Cancelled')) return false;
+      _suppressNativeConnect = true;
       if (raw.contains('timed out') || raw.contains('Session not activated')) {
         _errorMessage =
             'The server did not respond in time.\nCheck your connection and try again.';
@@ -273,11 +282,7 @@ class VpnConnection extends ChangeNotifier {
       return false;
     }
 
-    if (_cancelled) {
+    if (!_isCurrentConnect(connectEpoch)) return false;
-      _setStatus(VpnStatus.disconnected, 'Tap to connect');
-      return false;
-    }
-
     _setStatus(VpnStatus.connecting, 'Starting secure route…');
 
     try {
@@ -285,6 +290,7 @@ class VpnConnection extends ChangeNotifier {
       final baseConfig = parsed.getFullConfiguration();
       final remark = parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN';
       final secureSocks = await SecureSocksSession.create(baseConfig);
+      if (!_isCurrentConnect(connectEpoch)) return false;
       final verifyLocalSocks = _activeMode == ConnectionMode.proxy;
 
       await _startRuntime(
@@ -292,26 +298,45 @@ class VpnConnection extends ChangeNotifier {
         remark: remark,
         proxyOnly: verifyLocalSocks,
       );
+      if (!_isCurrentConnect(connectEpoch)) return false;
 
       _setStatus(
         VpnStatus.connecting,
-        verifyLocalSocks ? 'Waiting for local SOCKS5…' : 'Waiting for VPN interface…',
+        verifyLocalSocks
+            ? 'Waiting for local SOCKS5…'
+            : 'Waiting for VPN interface…',
       );
-      if (!await _waitForNativeConnected()) {
+      if (!await _waitForNativeConnected(connectEpoch)) {
         throw StateError('VPN runtime did not report CONNECTED');
       }
 
       if (verifyLocalSocks) {
+        if (!_isCurrentConnect(connectEpoch)) return false;
         _setStatus(VpnStatus.connecting, 'Checking Local SOCKS5…');
-        if (!await _waitForLocalSocksListener(secureSocks)) {
+        if (!await _waitForLocalSocksListener(
+          secureSocks,
+          connectEpoch,
+        )) {
           throw StateError('Local SOCKS5 listener did not become ready');
         }
       }
 
+      if (!_isCurrentConnect(connectEpoch)) return false;
       _lastSecureSocks = secureSocks;
     } catch (e) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
       debugPrint('[VPN] Tunnel start error: $e');
-      await _stopRuntime();
+      _suppressNativeConnect = true;
+      try {
+        await _stopRuntime();
+      } catch (stopError) {
+        debugPrint('[VPN] Runtime cleanup failed after start error: $stopError');
+        if (!_isCurrentConnect(connectEpoch)) return false;
+        _errorMessage = 'VPN failed to shut down cleanly.\nPlease restart the app.';
+        _setStatus(VpnStatus.error, 'Shutdown failed');
+        return false;
+      }
+      if (!_isCurrentConnect(connectEpoch)) return false;
       _clearRuntimeSnapshot();
       _errorMessage = _activeMode == ConnectionMode.proxy
           ? 'SOCKS5 gateway failed to start.\nTry reconnecting.'
@@ -320,6 +345,7 @@ class VpnConnection extends ChangeNotifier {
       return false;
     }
 
+    if (!_isCurrentConnect(connectEpoch)) return false;
     _setStatus(VpnStatus.connected, _connectedLabel);
     return true;
   }
@@ -336,22 +362,20 @@ class VpnConnection extends ChangeNotifier {
     );
   }
 
-  Future<bool> _waitForLocalSocksListener([
+  Future<bool> _waitForLocalSocksListener(
-    SecureSocksSession? session,
+    SecureSocksSession session,
-  ]) async {
+    int connectEpoch,
-    final active = session ?? _lastSecureSocks;
+  ) async {
-    if (active == null) return false;
-
     for (var attempt = 0; attempt < 4; attempt++) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
       final result = await LocalSocksTester.testListener(
         host: '127.0.0.1',
-        port: active.port,
+        port: session.port,
-        username: active.username,
+        username: session.username,
-        password: active.password,
+        password: session.password,
       );
-      if (result.ok) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
-        return true;
+      if (result.ok) return true;
-      }
       if (attempt < 3) {
         await Future.delayed(const Duration(milliseconds: 250));
       }
@@ -359,54 +383,59 @@ class VpnConnection extends ChangeNotifier {
     return false;
   }
 
-  Future<bool> _waitForNativeConnected() async {
+  Future<bool> _waitForNativeConnected(int connectEpoch) async {
-    // startVless() queues the Android foreground service. Wait for the native
-    // service/core broadcast rather than treating MethodChannel completion as
-    // proof that a TUN interface was established.
     for (var attempt = 0; attempt < 24; attempt++) {
+      if (!_isCurrentConnect(connectEpoch)) return false;
       if (_status == VpnStatus.connected) return true;
-      if (_status == VpnStatus.error) return false;
+      if (_status == VpnStatus.error || _status == VpnStatus.disconnected) {
-      if (_cancelled || _userDisconnecting) return false;
+        return false;
+      }
       await Future.delayed(const Duration(milliseconds: 250));
     }
-    return _status == VpnStatus.connected;
+    return _isCurrentConnect(connectEpoch) &&
+        _status == VpnStatus.connected;
   }
 
   Future<void> _stopRuntime() async {
-    try {
+    await _vless.stopVless().timeout(const Duration(seconds: 8));
-      await _vless.stopVless().timeout(const Duration(seconds: 5));
+  }
-    } catch (_) {}
+
+  Future<void> setNativeSessionDeadline(int remainingSeconds) async {
+    if (kIsWeb) return;
+    if (_disposed) throw StateError('VPN connection has been disposed');
+    if (!_initialized) throw StateError('VPN native service is not initialized');
+    if (remainingSeconds < 0) {
+      throw ArgumentError.value(remainingSeconds, 'remainingSeconds');
+    }
+    await _nativeControl.invokeMethod<void>(
+      'setSessionDeadline',
+      <String, Object>{'remainingSeconds': remainingSeconds},
+    );
   }
 
   Future<void> disconnect() async {
-    _cancelled = true;
+    if (_disposed || _status == VpnStatus.disconnecting) return;
+
+    _connectEpoch++;
+    _suppressNativeConnect = true;
     _userDisconnecting = true;
     HivemindService.cancel();
 
-    if (_status == VpnStatus.disconnected ||
-        _status == VpnStatus.disconnecting) {
-      _clearRuntimeSnapshot();
-      _userDisconnecting = false;
-      return;
-    }
-
     _setStatus(VpnStatus.disconnecting, 'Tearing down…');
 
     if (kIsWeb) {
       await Future.delayed(const Duration(milliseconds: 500));
+      if (_disposed) return;
       _clearRuntimeSnapshot();
       _setStatus(VpnStatus.disconnected, 'Tap to connect');
       _userDisconnecting = false;
       return;
     }
 
-    bool timedOut = false;
     try {
-      await _vless.stopVless().timeout(
+      await _vless.stopVless().timeout(const Duration(seconds: 8));
-            const Duration(seconds: 5),
-            onTimeout: () => timedOut = true,
-          );
     } catch (e) {
+      if (_disposed) return;
       debugPrint('[VPN] VLESS stop error: $e');
       _errorMessage = 'VPN shutdown error.\nPlease restart the app.';
       _clearRuntimeSnapshot();
@@ -415,15 +444,7 @@ class VpnConnection extends ChangeNotifier {
       return;
     }
 
-    if (timedOut) {
+    if (_disposed) return;
-      debugPrint('[VPN] stopVless() timed out after 5 s.');
-      _errorMessage = 'VPN did not shut down cleanly.\nPlease restart the app.';
-      _clearRuntimeSnapshot();
-      _setStatus(VpnStatus.error, 'Shutdown failed');
-      _userDisconnecting = false;
-      return;
-    }
-
     _errorMessage = null;
     _clearRuntimeSnapshot();
     _setStatus(VpnStatus.disconnected, 'Tap to connect');
@@ -436,22 +457,19 @@ class VpnConnection extends ChangeNotifier {
   }
 
   void _setStatus(VpnStatus status, String message) {
+    if (_disposed) return;
     _status = status;
     _statusMessage = message;
     notifyListeners();
   }
 
-  Future<void> _checkHealth() async {
-    // A live tunnel already proves reachability; only probe while disconnected
-    // so we don't add direct /health traffic while the VPN is active.
-    if (_status == VpnStatus.connected) return;
-    _serverReachable = await HivemindService.checkHealth();
-    notifyListeners();
-  }
-
   @override
   void dispose() {
-    _healthTimer?.cancel();
+    _disposed = true;
+    _connectEpoch++;
+    _suppressNativeConnect = true;
+    _userDisconnecting = true;
+    HivemindService.cancel();
     _networkSubscription?.cancel();
     // Provider/UI disposal is not a user disconnect command. Keeping teardown
     // in disconnect() prevents lifecycle churn from silently dropping the VPN.

lib/main.dart

@@ -7,7 +7,6 @@ import 'package:revoltvpn/logic/ad_manager.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/haptic_settings.dart';
-import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/screens/intro.dart';
@@ -47,16 +46,15 @@ class ReVoltApp extends StatelessWidget {
       providers: [
         ChangeNotifierProvider(create: (_) => VpnConnection(), lazy: false),
         ChangeNotifierProxyProvider<VpnConnection, SessionTimer>(
+          // Eager, like VpnConnection: the timer has to be listening before the
+          // engine reports an already-running tunnel, not after the intro.
+          lazy: false,
           create: (ctx) =>
               SessionTimer(vpnConnection: ctx.read<VpnConnection>()),
           update: (_, vpn, prev) =>
               prev ?? SessionTimer(vpnConnection: vpn),
         ),
         ChangeNotifierProvider(create: (_) => AdManager()),
-        ChangeNotifierProvider(
-          create: (_) => ServerList()..init(),
-          lazy: false,
-        ),
       ],
       child: MaterialApp(
         title: 'ReVolt VPN',

lib/screens/server_selector/selection_screen.dart

@@ -1,63 +0,0 @@
-import 'package:flutter/material.dart';
-import 'package:provider/provider.dart';
-import 'package:revoltvpn/logic/app_colors.dart';
-import 'package:revoltvpn/logic/server_list.dart';
-
-// ── lib/screens/server_selector/selection_screen.dart ──────────────────────
-// Server picker — reads the server list from the ServerList provider.
-// Each row shows a flag + city name.  Tapping a row persists the choice
-// and pops back.  No latency measurement — the app runs inside a Reality
-// tunnel and must not emit separate probe traffic.
-
-class SelectionScreen extends StatelessWidget {
-  const SelectionScreen({super.key});
-
-  @override
-  Widget build(BuildContext context) {
-    final serverList = context.watch<ServerList>();
-
-    return Scaffold(
-      backgroundColor: AppColors.bgDeep,
-      appBar: AppBar(
-        backgroundColor: AppColors.bgSurface,
-        elevation: 0,
-        leading: IconButton(
-          icon: const Icon(Icons.arrow_back, color: AppColors.textWhite),
-          onPressed: () => Navigator.of(context).pop(),
-        ),
-        title: const Text(
-          'Select Server',
-          style: TextStyle(
-            color: AppColors.textWhite,
-            fontWeight: FontWeight.w600,
-          ),
-        ),
-      ),
-      body: ListView.builder(
-        itemCount: serverList.all.length,
-        itemBuilder: (context, index) {
-          final server = serverList.all[index];
-          final isSelected = index == serverList.selectedIndex;
-
-          return ListTile(
-            leading: Image.asset(server.flagAsset, width: 28, height: 28),
-            title: Text(server.name,
-                style: TextStyle(
-                  color: isSelected ? AppColors.accent : AppColors.textWhite,
-                  fontWeight: FontWeight.w600,
-                )),
-            trailing: isSelected
-                ? const Icon(Icons.check, color: AppColors.accent)
-                : null,
-            onTap: () {
-              serverList.select(index);
-              Navigator.of(context).pop();
-            },
-            contentPadding:
-                const EdgeInsets.symmetric(horizontal: 20, vertical: 8),
-          );
-        },
-      ),
-    );
-  }
-}

lib/screens/settings/in_settings/background_reliability.dart

@@ -55,14 +55,6 @@ class _BackgroundReliabilityTileState extends State<BackgroundReliabilityTile>
     );
   }
 
-  Future<void> _openVpnSettings() async {
-    final opened = await PowerSettings.openVpnSettings();
-    if (!mounted || opened) return;
-    ScaffoldMessenger.of(context).showSnackBar(
-      const SnackBar(content: Text('Could not open VPN settings.')),
-    );
-  }
-
   @override
   Widget build(BuildContext context) {
     final exempt = _batteryExempt;
@@ -76,8 +68,8 @@ class _BackgroundReliabilityTileState extends State<BackgroundReliabilityTile>
             style: TextStyle(color: AppColors.textWhite, fontSize: 15),
           ),
           subtitle: Text(
-            'Android stops background apps to save power. These two settings '
+            'Android stops background apps to save power. Disabling battery '
-            'are what keep the VPN running when the app is closed.',
+            'optimisation is what keeps the VPN running when the app is closed.',
             style: TextStyle(color: AppColors.textDim, fontSize: 12),
           ),
         ),
@@ -106,20 +98,6 @@ class _BackgroundReliabilityTileState extends State<BackgroundReliabilityTile>
                   label: const Text('Allow background activity'),
                 ),
               ],
-              const SizedBox(height: 16),
-              const Text(
-                'Always-on VPN keeps the tunnel up even after the app is closed '
-                'or the phone restarts. Turn it on for Revolt VPN in Android\'s '
-                'VPN settings, and enable "Block connections without VPN" if you '
-                'want traffic to stop rather than leak when it drops.',
-                style: TextStyle(color: AppColors.textMuted, fontSize: 12),
-              ),
-              const SizedBox(height: 8),
-              OutlinedButton.icon(
-                onPressed: _openVpnSettings,
-                icon: const Icon(Icons.settings),
-                label: const Text('Open VPN settings'),
-              ),
             ],
           ),
         ),

lib/screens/settings/in_settings/connection_mode.dart

@@ -1,5 +1,6 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
+import 'package:revoltvpn/logic/ad_manager.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/local_socks_tester.dart';
@@ -51,8 +52,14 @@ class _ConnectionModeTileState extends State<ConnectionModeTile> {
       return;
     }
 
-    await ConnectionSettings.setMode(next);
+    final saved = await ConnectionSettings.setMode(next);
     if (!mounted) return;
+    if (!saved) {
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(content: Text('Could not save connection mode.')),
+      );
+      return;
+    }
 
     setState(() {
       _mode = next;
@@ -61,20 +68,25 @@ class _ConnectionModeTileState extends State<ConnectionModeTile> {
     widget.onChanged?.call(next);
   }
 
-  /// Recovers from an orphaned proxy: tear the runtime down and start a fresh
+  // Recovers an orphaned proxy by ending the session and starting a new one,
-  /// session so a readable set of credentials exists again. No rewarded ad —
+  // exactly as the connect button does. Re-attaching to the session already
-  /// the user is repairing a connection they already paid for, not opening a
+  // held was the one place a session began without an ad and without a nonce
-  /// new one.
+  // to bind it to; a fresh one is the same path everywhere and hands back a
+  // full window rather than the remainder of a broken one.
   Future<void> _reconnect() async {
     if (_reconnecting) return;
     final vpn = context.read<VpnConnection>();
     final timer = context.read<SessionTimer>();
+    final ad = context.read<AdManager>();
 
     setState(() => _reconnecting = true);
     try {
       await timer.disconnect();
       if (!mounted) return;
-      if (await vpn.connect()) {
+      final adNonce = await ad.showAd('main');
+      if (adNonce == null && AdManager.adsEnabled) return;
+      if (!mounted) return;
+      if (await vpn.connect(adNonce: adNonce)) {
         if (!mounted) return;
         await timer.start();
       }

local_packages/flutter_vless_android-1.1.5/.metadata

@@ -0,0 +1,30 @@
+# This file tracks properties of this Flutter project.
+# Used by Flutter tool to assess capabilities and perform upgrades etc.
+#
+# This file should be version controlled and should not be manually edited.
+
+version:
+  revision: "adc901062556672b4138e18a4dc62a4be8f4b3c2"
+  channel: "stable"
+
+project_type: plugin
+
+# Tracks metadata for the flutter migrate command
+migration:
+  platforms:
+    - platform: root
+      create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
+      base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
+    - platform: android
+      create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
+      base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
+
+  # User provided section
+
+  # List of Local paths (relative to this file) that should be
+  # ignored by the migrate tool.
+  #
+  # Files that are not part of the templates will be ignored by default.
+  unmanaged_files:
+    - 'lib/main.dart'
+    - 'ios/Runner.xcodeproj/project.pbxproj'

local_packages/flutter_vless_android-1.1.5/CHANGELOG.md

@@ -0,0 +1,49 @@
+## 1.1.5
+
+* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.7.11`.
+* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.7.11`.
+* Fixed Android VPN app routing: all configured blocked apps are now applied to `VpnService.Builder` as disallowed applications and bypass the Xray VPN tunnel.
+
+## 1.1.4
+
+* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.27.1`.
+* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.27`.
+
+## 1.1.3
+
+* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.22`.
+* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.22`.
+
+## 1.1.2
+
+* Clarified that Android device and emulator runtime binaries are delivered through the main Maven `xray-android` AAR.
+* Kept the Android runtime dependency on `dev.tfox.fluttervless:xray-android:26.6.1.1`.
+
+## 1.1.1
+
+* Updated the Android device runtime `libxray.so` binaries to Xray-core `v26.6.1`.
+* Kept Android 15+ 16KB page-size linker alignment for the rebuilt ARM binaries.
+* Moved Android runtime binaries and geodata into the Maven `dev.tfox.fluttervless:xray-android:26.6.1.1` AAR dependency.
+* Included device and emulator ABIs (`armeabi-v7a`, `arm64-v8a`, `x86`, `x86_64`) in the main Maven runtime AAR.
+* Removed raw device `jniLibs` and geodata files from the Pub.dev wrapper package; the wrapper now resolves the runtime from Maven Central.
+
+## 1.1.0
+
+* Replaced Android Dart boilerplate with the shared `VlessMethodChannelAdapter`.
+* Removed template `getPlatformVersion` scaffold files.
+* Moved `flutter_lints` to `dev_dependencies`.
+* Removed publish-time dependency overrides from `pubspec.yaml`.
+
+## 1.0.2
+
+* XRay version up
+
+## 1.0.1
+
+*   XRay version up
+
+## 1.0.0
+
+*   Initial release of the Android implementation for `flutter_vless`.
+*   Supports VLESS/VMESS protocols using Xray core.
+*   Implements `VlessPlatform` interface.

local_packages/flutter_vless_android-1.1.5/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 13FOX Studio / tfox.dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

local_packages/flutter_vless_android-1.1.5/NOTICE

@@ -0,0 +1,13 @@
+flutter_vless_android
+
+Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
+
+This package is the Android implementation of the official flutter_vless
+project maintained by 13FOX Studio.
+
+Official project: https://github.com/XIIIFOX/flutter_vless
+Official publisher: https://pub.dev/publishers/tfox.dev
+Website: https://tfox.dev
+
+Redistributions, forks, and derived packages must preserve the copyright notice
+and MIT license notice where required by the license.

local_packages/flutter_vless_android-1.1.5/README.md

@@ -0,0 +1,14 @@
+# flutter_vless_android
+
+The Android implementation of the `flutter_vless` plugin.
+
+## Runtime
+
+Android runtime binaries and geodata are delivered through the Maven Central AAR dependency `dev.tfox.fluttervless:xray-android:26.7.11`. This keeps the Pub.dev package lightweight while preserving the same packaged Xray files in the final Android app.
+
+Do not add raw `android/src/main/jniLibs` or geodata files back to this package. Rebuild runtime files in `android_runtime/xray_android/src/main`, publish the Maven AAR, then publish this wrapper package.
+
+## Emulator Support
+
+The current Maven runtime AAR includes `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64`.
+This covers both physical Android devices and Android emulators.

local_packages/flutter_vless_android-1.1.5/UPSTREAM

@@ -0,0 +1,4 @@
+Upstream: https://github.com/XIIIFOX/flutter_vless
+Tag: v1.1.5
+Android package: flutter_vless_android 1.1.5
+ReVolt hardening is pre-applied to this vendored package.

local_packages/flutter_vless_android-1.1.5/analysis_options.yaml

@@ -0,0 +1,4 @@
+include: package:flutter_lints/flutter.yaml
+
+# Additional information about this file can be found at
+# https://dart.dev/guides/language/analysis-options

local_packages/flutter_vless_android-1.1.5/android/.gitignore

@@ -0,0 +1,9 @@
+*.iml
+.gradle
+/local.properties
+/.idea/workspace.xml
+/.idea/libraries
+.DS_Store
+/build
+/captures
+.cxx

local_packages/flutter_vless_android-1.1.5/android/XRAY_SETUP.md

@@ -0,0 +1,92 @@
+# Xray & Tun2socks Android Build Guide
+
+This guide explains how to build the native libraries (`libxray.so` and `libtun2socks.so`) for the Flutter Vless plugin.
+
+Android runtime files are stored in `android_runtime/xray_android/src/main` and published as the Maven Central AAR `dev.tfox.fluttervless:xray-android`. They are not stored in the `flutter_vless_android` Pub.dev package.
+
+**Key Features:**
+- ✅ **Android 15+ Support**: Builds with 16KB page size alignment.
+- ✅ **Socket FD Passing**: `tun2socks` is patched to receive the TUN file descriptor via a Unix socket (bypassing Android process restrictions).
+
+## Prerequisites
+
+1. **Go (Golang)**: Version 1.21+ installed.
+2. **Android NDK**: Version r27+ (recommended).
+3. **macOS/Linux**: Build scripts are designed for Unix-like environments.
+
+## 1. Environment Setup
+
+Export the path to your Android NDK.
+
+```bash
+# Example (Adjust path to your NDK installation)
+export ANDROID_NDK_HOME="$HOME/Library/Android/sdk/ndk/27.0.12077973"
+```
+
+## 2. Build Xray (`libxray.so`)
+
+This script builds the Xray core for Android device and emulator architectures (`arm64-v8a`, `armeabi-v7a`, `x86`, `x86_64`) by default and writes them to the Maven runtime module.
+
+```bash
+cd android
+chmod +x build_xray.sh
+./build_xray.sh
+```
+
+## 3. Build Tun2socks (`libtun2socks.so`)
+
+We use a custom Go-based build script (`build_tun2socks.sh`) instead of the old C-based one. This ensures 16KB page alignment and includes the socket-based FD passing logic.
+
+```bash
+cd android
+chmod +x build_tun2socks.sh
+./build_tun2socks.sh
+```
+
+## 4. Verification (16KB Page Size)
+
+To confirm that the libraries are compatible with Android 15+ (16KB page size), check the `LOAD` segment alignment using `llvm-readelf`.
+
+```bash
+# Check alignment (should be 0x4000)
+$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/darwin-x86_64/bin/llvm-readelf -l ../../../android_runtime/xray_android/src/main/jniLibs/arm64-v8a/libtun2socks.so | grep LOAD | head -1
+```
+
+**Expected Output:**
+```
+LOAD           ... 0x4000
+```
+If you see `0x1000`, it is **NOT** compatible with 16KB devices.
+
+## 5. Package The Maven Runtime AAR
+
+The `flutter_vless_android` Pub.dev package consumes the Android device runtime through the Maven artifact:
+
+```text
+dev.tfox.fluttervless:xray-android:26.7.11
+```
+
+After rebuilding `libxray.so`, `libtun2socks.so`, or the geodata files in `android_runtime/xray_android/src/main`, build the local Maven repository from the repository root:
+
+```bash
+tool/build_android_runtime_maven.sh
+```
+
+For local Android wrapper or example builds before Maven Central publication, pass the local repository path:
+
+```bash
+cd example/android
+./gradlew :app:assembleDebug \
+  -PflutterVlessAndroidRuntimeRepo="$PWD/../../android_runtime/xray_android/build/repo"
+```
+
+To upload the signed bundle to Maven Central, configure the Central Portal and signing environment variables documented in `android_runtime/xray_android/README.md`, then run:
+
+```bash
+tool/publish_android_runtime_maven.sh
+```
+
+## 6. Troubleshooting
+
+- **"bad file descriptor"**: This means the socket FD passing failed. Ensure `XrayVPNService.kt` is correctly sending the FD to the socket path specified in `-sock-path`.
+- **"permission denied"**: Ensure the app has permissions to write to the socket file in its private directory.

local_packages/flutter_vless_android-1.1.5/android/build.gradle

@@ -0,0 +1,95 @@
+group 'com.github.tfox.flutter_vless'
+version '1.0'
+
+buildscript {
+    ext.kotlin_version = '2.2.20'
+    repositories {
+        google()
+        mavenCentral()
+    }
+
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.1.0'
+        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
+    }
+}
+
+rootProject.allprojects {
+    repositories {
+        def localRuntimeRepo = findProperty('flutterVlessAndroidRuntimeRepo') ?: System.getenv('FLUTTER_VLESS_ANDROID_RUNTIME_REPO')
+        if (localRuntimeRepo) {
+            maven { url uri(localRuntimeRepo) }
+        }
+        google()
+        mavenCentral()
+    }
+}
+
+apply plugin: 'com.android.library'
+apply plugin: 'kotlin-android'
+
+android {
+    if (project.android.hasProperty("namespace")) {
+        namespace 'com.github.tfox.flutter_vless'
+    }
+
+    compileSdkVersion 34
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_1_8
+        targetCompatibility JavaVersion.VERSION_1_8
+    }
+
+    kotlinOptions {
+        jvmTarget = '1.8'
+    }
+
+    defaultConfig {
+        minSdkVersion 23
+        targetSdkVersion 35
+        
+        // 16KB page size support for Android 15+
+        ndk {
+            abiFilters 'armeabi-v7a', 'arm64-v8a', 'x86', 'x86_64'
+        }
+    }
+    
+    // Configure 16KB page alignment
+    buildFeatures {
+        prefab true
+    }
+
+    dependencies {
+        testImplementation 'junit:junit:4.13.2'
+        testImplementation 'org.mockito:mockito-core:5.0.0'
+        testImplementation 'org.json:json:20240303'
+    }
+
+    testOptions {
+        unitTests.returnDefaultValues = true
+        unitTests.all {
+            testLogging {
+               events "passed", "skipped", "failed", "standardOut", "standardError"
+               outputs.upToDateWhen {false}
+               showStandardStreams = true
+            }
+        }
+    }
+
+    sourceSets {
+        main {
+            java.srcDirs += 'src/main/kotlin'
+        }
+    }
+    packaging {
+        jniLibs {
+            pickFirsts += ['lib/**/libc++_shared.so']
+        }
+    }
+}
+
+dependencies {
+    implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
+    implementation 'androidx.appcompat:appcompat:1.6.1'
+    implementation 'com.google.code.gson:gson:2.10.1'
+    implementation "dev.tfox.fluttervless:xray-android:${findProperty('flutterVlessXrayRuntimeVersion') ?: '26.7.11'}"
+}

local_packages/flutter_vless_android-1.1.5/android/build_tun2socks.sh

@@ -0,0 +1,122 @@
+#!/bin/bash
+set -euo pipefail
+
+# Build script for tun2socks (Go version) with 16KB page size support
+# This is required for Android 15+ compatibility
+
+# Configuration
+TUN2SOCKS_REPO="https://github.com/xjasonlyu/tun2socks"
+TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}"
+NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}"
+
+# Check NDK
+if [ ! -d "$NDK_PATH" ]; then
+    echo "Error: NDK not found at $NDK_PATH"
+    echo "Please export ANDROID_NDK_HOME pointing to your NDK installation."
+    exit 1
+fi
+
+echo "Using NDK at: $NDK_PATH"
+
+case "$(uname -s)" in
+    Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;;
+    Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;;
+    *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;;
+esac
+if [ ! -d "$TOOLCHAIN" ]; then
+    echo "Error: NDK toolchain not found at $TOOLCHAIN"
+    echo "Please check ANDROID_NDK_HOME and host OS."
+    exit 1
+fi
+
+# Clone tun2socks if not exists
+if [ ! -d "tun2socks-go" ]; then
+    echo "Cloning tun2socks (Go version)..."
+    git clone "$TUN2SOCKS_REPO" tun2socks-go
+else
+    echo "tun2socks-go directory exists, pulling latest..."
+    cd tun2socks-go && git pull && cd ..
+fi
+
+# Build Function
+build_tun2socks() {
+    local ARCH_NAME=$1
+    local GO_ARCH=$2
+    local GO_ARM=$3
+    local ANDROID_TARGET=$4
+    local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}"
+
+    echo "Building tun2socks for ${ARCH_NAME}..."
+    
+    mkdir -p "$OUTPUT_DIR"
+
+    export CGO_ENABLED=1
+    export GOOS=android
+    export GOARCH=$GO_ARCH
+    export GOARM=$GO_ARM
+    
+    export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang"
+    export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++"
+    
+    # Verify compiler exists
+    if [ ! -f "$CC" ]; then
+        echo "Error: Compiler not found at $CC"
+        return 1
+    fi
+
+    cd tun2socks-go
+    
+    # Build with 16KB page alignment - same flags as xray
+    go build -v -trimpath -ldflags "-s -w -buildid= -linkmode=external -extldflags '-Wl,-z,max-page-size=16384'" -buildmode=pie -o "../${OUTPUT_DIR}/libtun2socks.so" .
+
+    echo "Success: ${OUTPUT_DIR}/libtun2socks.so created."
+
+    # Verify 16KB alignment
+    if [ -x "${TOOLCHAIN}/bin/llvm-readelf" ]; then
+        echo "Verifying 16KB alignment:"
+        ALIGN=$("${TOOLCHAIN}/bin/llvm-readelf" -l "../${OUTPUT_DIR}/libtun2socks.so" | grep "LOAD" | head -1 | awk '{print $NF}')
+        if [ "$ALIGN" = "0x4000" ]; then
+            echo "Alignment: $ALIGN (16KB) - correct"
+        else
+            echo "Warning: alignment is $ALIGN; expected 0x4000"
+        fi
+    fi
+
+    cd ..
+}
+
+# Build for Architectures
+echo "Building tun2socks (Go version) with 16KB page size support..."
+
+# ARM64
+if [ "${TUN2SOCKS_BUILD_ARM64:-1}" = "1" ]; then
+    build_tun2socks "arm64-v8a" "arm64" "" "aarch64-linux-android21"
+fi
+
+# ARMv7
+if [ "${TUN2SOCKS_BUILD_ARMV7:-1}" = "1" ]; then
+    build_tun2socks "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21"
+fi
+
+# x86 is included in the main runtime AAR.
+if [ "${TUN2SOCKS_BUILD_X86:-1}" = "1" ]; then
+    build_tun2socks "x86" "386" "" "i686-linux-android21"
+fi
+
+# x86_64 is included in the main runtime AAR.
+if [ "${TUN2SOCKS_BUILD_X86_64:-1}" = "1" ]; then
+    build_tun2socks "x86_64" "amd64" "" "x86_64-linux-android21"
+fi
+
+echo ""
+echo "========================================="
+echo "Build process finished!"
+echo "========================================="
+echo ""
+echo "Verification:"
+echo "Run this command to check all libraries:"
+echo ""
+echo "for arch in armeabi-v7a arm64-v8a x86 x86_64; do"
+echo "  echo \"=== \$arch ===\";"
+echo "  ${TOOLCHAIN}/bin/llvm-readelf -l ${TARGET_DIR}/\$arch/libtun2socks.so | grep LOAD | head -1;"
+echo "done"

local_packages/flutter_vless_android-1.1.5/android/build_xray.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+set -euo pipefail
+
+# Configuration
+XRAY_REPO="https://github.com/XTLS/Xray-core"
+XRAY_VERSION="${XRAY_VERSION:-v26.7.11}"
+TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}"
+NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}"
+
+# Check NDK
+if [ ! -d "$NDK_PATH" ]; then
+    echo "Error: NDK not found at $NDK_PATH"
+    echo "Please export ANDROID_NDK_HOME pointing to your NDK installation."
+    exit 1
+fi
+
+echo "Using NDK at: $NDK_PATH"
+
+# MacOS NDK Toolchain path
+case "$(uname -s)" in
+    Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;;
+    Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;;
+    *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;;
+esac
+if [ ! -d "$TOOLCHAIN" ]; then
+    echo "Error: NDK toolchain not found at $TOOLCHAIN"
+    echo "Are you on macOS? If not, please edit the script to match your OS."
+    exit 1
+fi
+
+# Clone Xray if not exists
+if [ ! -d "Xray-core" ]; then
+    echo "Cloning Xray-core..."
+    git clone "$XRAY_REPO"
+else
+    echo "Xray-core directory exists, pulling latest..."
+    cd Xray-core && git fetch --tags && cd ..
+fi
+
+cd Xray-core
+git fetch --tags
+git checkout "$XRAY_VERSION"
+cd ..
+
+# Build Function
+build_xray() {
+    local ARCH_NAME=$1
+    local GO_ARCH=$2
+    local GO_ARM=$3
+    local ANDROID_TARGET=$4
+    local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}"
+
+    echo "Building for ${ARCH_NAME}..."
+    
+    mkdir -p "$OUTPUT_DIR"
+
+    export CGO_ENABLED=1
+    export GOOS=android
+    export GOARCH=$GO_ARCH
+    export GOARM=$GO_ARM
+    
+    export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang"
+    export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++"
+    
+    # 16KB page size support for Android 15+
+    export LDFLAGS="-Wl,-z,max-page-size=16384"
+    
+    # Verify compiler exists
+    if [ ! -f "$CC" ]; then
+        echo "Error: Compiler not found at $CC"
+        # Try older NDK naming convention if new one fails (API 21 is standard)
+        # Some NDKs use specific API levels in clang name
+        return 1
+    fi
+
+    cd Xray-core
+    
+    # Build with 16KB page alignment
+    if go build -v -trimpath -buildvcs=false \
+        -gcflags "all=-l=4" \
+        -ldflags "-X github.com/xtls/xray-core/core.build=${XRAY_VERSION} -s -w -buildid= -checklinkname=0 -linkmode=external -extldflags=${LDFLAGS}" \
+        -buildmode=pie \
+        -o "../${OUTPUT_DIR}/libxray.so" ./main; then
+        echo "Success: ${OUTPUT_DIR}/libxray.so created."
+    else
+        echo "Failed to build for ${ARCH_NAME}"
+        return 1
+    fi
+    
+    cd ..
+}
+
+# Build for Architectures
+# API Level 21 is generally safe for modern Flutter apps (Android 5.0+)
+
+# ARM64
+if [ "${XRAY_BUILD_ARM64:-1}" = "1" ]; then
+    build_xray "arm64-v8a" "arm64" "" "aarch64-linux-android21"
+fi
+
+# ARMv7
+if [ "${XRAY_BUILD_ARMV7:-1}" = "1" ]; then
+    build_xray "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21"
+fi
+
+# x86 is included in the main runtime AAR.
+if [ "${XRAY_BUILD_X86:-1}" = "1" ]; then
+    build_xray "x86" "386" "" "i686-linux-android21"
+fi
+
+# x86_64 is included in the main runtime AAR.
+if [ "${XRAY_BUILD_X86_64:-1}" = "1" ]; then
+    build_xray "x86_64" "amd64" "" "x86_64-linux-android21"
+fi
+
+echo "Build process finished."

local_packages/flutter_vless_android-1.1.5/android/settings.gradle

@@ -0,0 +1 @@
+rootProject.name = 'flutter_vless_android'

local_packages/flutter_vless_android-1.1.5/android/src/main/AndroidManifest.xml

@@ -0,0 +1,31 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.github.tfox.flutter_vless">
+
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission
+        android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"
+        android:minSdkVersion="34" />
+
+    <application>
+        <service
+            android:name="com.github.tfox.flutter_vless.xray.service.XrayVPNService"
+            android:enabled="true"
+            android:exported="false"
+            android:foregroundServiceType="specialUse"
+            android:permission="android.permission.BIND_VPN_SERVICE"
+            android:process=":RunSoLibXrayDaemon">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="vpn" />
+            <intent-filter>
+                <action android:name="android.net.VpnService" />
+            </intent-filter>
+            <meta-data
+                android:name="android.net.VpnService.SUPPORTS_ALWAYS_ON"
+                android:value="false" />
+        </service>
+    </application>
+</manifest>

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/FlutterVlessPlugin.kt

@@ -0,0 +1,424 @@
+// Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
+// SPDX-License-Identifier: MIT
+
+package com.github.tfox.flutter_vless
+
+import android.Manifest
+import android.app.Activity
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.content.pm.PackageManager
+import android.net.VpnService
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.util.Log
+import androidx.core.app.ActivityCompat
+import androidx.core.content.ContextCompat
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import com.github.tfox.flutter_vless.xray.service.XrayVPNService
+import com.github.tfox.flutter_vless.xray.utils.AppConfigs
+import io.flutter.embedding.engine.plugins.FlutterPlugin
+import io.flutter.embedding.engine.plugins.activity.ActivityAware
+import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
+import io.flutter.plugin.common.EventChannel
+import io.flutter.plugin.common.MethodCall
+import io.flutter.plugin.common.MethodChannel
+import io.flutter.plugin.common.PluginRegistry
+import java.io.BufferedReader
+import java.io.File
+import java.io.InputStreamReader
+import java.util.ArrayList
+import java.util.UUID
+import java.util.concurrent.Executors
+
+/**
+ * Main entry point for the Flutter Vless plugin on Android.
+ *
+ * ReVolt keeps this bridge deliberately narrow: start/stop, session deadline,
+ * permission handling, core version and private runtime status only.
+ */
+class FlutterVlessPlugin : FlutterPlugin, ActivityAware, PluginRegistry.ActivityResultListener, MethodChannel.MethodCallHandler {
+
+    private val executor = Executors.newSingleThreadExecutor()
+    private lateinit var vpnControlMethod: MethodChannel
+    private lateinit var vpnStatusEvent: EventChannel
+    private var vpnStatusSink: EventChannel.EventSink? = null
+    private var activity: Activity? = null
+    private var xrayReceiver: BroadcastReceiver? = null
+    private var pendingResult: MethodChannel.Result? = null
+    private lateinit var context: Context
+    private var expectedRuntimeToken: String? = null
+    private var pendingStopResult: MethodChannel.Result? = null
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private val stopTimeoutRunnable = Runnable {
+        val pending = pendingStopResult ?: return@Runnable
+        pendingStopResult = null
+        pending.error("STOP_TIMEOUT", "VPN service did not confirm shutdown", null)
+    }
+
+    companion object {
+        private const val TAG = "FlutterVlessPlugin"
+        private const val REQUEST_CODE_VPN_PERMISSION = 24
+        private const val REQUEST_CODE_POST_NOTIFICATIONS = 1
+    }
+
+    override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+        context = binding.applicationContext
+        vpnControlMethod = MethodChannel(binding.binaryMessenger, "flutter_vless")
+        vpnStatusEvent = EventChannel(binding.binaryMessenger, "flutter_vless/status")
+
+        vpnControlMethod.setMethodCallHandler(this)
+        vpnStatusEvent.setStreamHandler(object : EventChannel.StreamHandler {
+            override fun onListen(arguments: Any?, events: EventChannel.EventSink?) {
+                vpnStatusSink = events
+                registerReceiver()
+            }
+
+            override fun onCancel(arguments: Any?) {
+                vpnStatusSink = null
+                unregisterReceiver()
+            }
+        })
+    }
+
+    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
+        when (call.method) {
+            "startVless" -> {
+                if (pendingStopResult != null) {
+                    result.error("STOP_IN_PROGRESS", "VPN shutdown is still in progress", null)
+                    return
+                }
+
+                val config = XrayConfig()
+                val runtimeToken = UUID.randomUUID().toString()
+                expectedRuntimeToken = runtimeToken
+                config.RUNTIME_TOKEN = runtimeToken
+                config.REMARK = call.argument("remark") ?: ""
+                config.V2RAY_FULL_JSON_CONFIG = call.argument("config") ?: ""
+                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
+                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
+                config.NOTIFICATION_DISCONNECT_BUTTON_NAME = call.argument("notificationDisconnectButtonName") ?: "Disconnect"
+
+                if (AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME.isNotEmpty() && AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE.isNotEmpty()) {
+                    config.NOTIFICATION_ICON_RESOURCE_NAME = AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME
+                    config.NOTIFICATION_ICON_RESOURCE_TYPE = AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE
+                    val resId = context.resources.getIdentifier(
+                        AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME,
+                        AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE,
+                        context.packageName
+                    )
+                    config.APPLICATION_ICON = resId
+                }
+
+                if (call.argument<Boolean>("proxy_only") == true) {
+                    AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.PROXY_ONLY
+                } else {
+                    AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.VPN_TUN
+                }
+
+                try {
+                    val jsonConfig = org.json.JSONObject(config.V2RAY_FULL_JSON_CONFIG)
+                    val outbounds = jsonConfig.optJSONArray("outbounds")
+                    if (outbounds != null && outbounds.length() > 0) {
+                        val firstOutbound = outbounds.getJSONObject(0)
+                        val settings = firstOutbound.optJSONObject("settings")
+                        val vnext = settings?.optJSONArray("vnext")
+                        if (vnext != null && vnext.length() > 0) {
+                            val server = vnext.getJSONObject(0)
+                            config.CONNECTED_V2RAY_SERVER_ADDRESS = server.optString("address", "")
+                            config.CONNECTED_V2RAY_SERVER_PORT = server.optInt("port", 0).toString()
+                        } else if (settings != null) {
+                            config.CONNECTED_V2RAY_SERVER_ADDRESS = settings.optString("address", "")
+                            config.CONNECTED_V2RAY_SERVER_PORT = settings.optInt("port", 0).toString()
+                        }
+                    }
+                } catch (_: Exception) {
+                    // Optional metadata only; runtime config validation happens downstream.
+                }
+
+                val intent = Intent(context, XrayVPNService::class.java)
+                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE)
+                intent.putExtra("V2RAY_CONFIG", config)
+                intent.putExtra("PROXY_ONLY", call.argument<Boolean>("proxy_only") ?: false)
+
+                try {
+                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                        context.startForegroundService(intent)
+                    } else {
+                        context.startService(intent)
+                    }
+                    result.success(null)
+                } catch (e: Exception) {
+                    if (expectedRuntimeToken == runtimeToken) expectedRuntimeToken = null
+                    result.error("START_FAILED", e.message ?: "Could not start VPN service", null)
+                }
+            }
+
+            "stopVless" -> {
+                if (pendingStopResult != null) {
+                    result.error("STOP_IN_PROGRESS", "VPN shutdown is already in progress", null)
+                    return
+                }
+
+                // A STOP without a generation token can kill a newer runtime after
+                // UI/process churn. No token means this bridge owns nothing to stop.
+                val token = expectedRuntimeToken
+                if (token == null) {
+                    result.success(null)
+                    return
+                }
+
+                val intent = Intent(context, XrayVPNService::class.java)
+                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
+                intent.putExtra("RUNTIME_TOKEN", token)
+
+                try {
+                    context.startService(intent)
+                    pendingStopResult = result
+                    mainHandler.removeCallbacks(stopTimeoutRunnable)
+                    mainHandler.postDelayed(stopTimeoutRunnable, 6_000L)
+                } catch (e: Exception) {
+                    pendingStopResult = null
+                    mainHandler.removeCallbacks(stopTimeoutRunnable)
+                    result.error("STOP_FAILED", e.message ?: "Could not stop VPN service", null)
+                }
+            }
+
+            "setSessionDeadline" -> {
+                val token = expectedRuntimeToken
+                val remainingSeconds = call.argument<Number>("remainingSeconds")?.toLong()
+                if (token == null) {
+                    result.error("NO_RUNTIME", "No active runtime token", null)
+                    return
+                }
+                if (remainingSeconds == null || remainingSeconds < 0) {
+                    result.error("INVALID_DEADLINE", "remainingSeconds must be non-negative", null)
+                    return
+                }
+
+                val intent = Intent(context, XrayVPNService::class.java)
+                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE)
+                intent.putExtra("RUNTIME_TOKEN", token)
+                intent.putExtra("REMAINING_SECONDS", remainingSeconds)
+                try {
+                    context.startService(intent)
+                    result.success(null)
+                } catch (e: Exception) {
+                    result.error("DEADLINE_FAILED", e.message ?: "Could not update session deadline", null)
+                }
+            }
+
+            "initializeVless" -> {
+                val iconResourceName = call.argument<String>("notificationIconResourceName")
+                val iconResourceType = call.argument<String>("notificationIconResourceType")
+                if (iconResourceName != null && iconResourceType != null) {
+                    AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME = iconResourceName
+                    AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE = iconResourceType
+                }
+                result.success(null)
+            }
+
+            "getCoreVersion" -> {
+                executor.submit {
+                    try {
+                        val nativeLibraryDir = context.applicationInfo.nativeLibraryDir
+                        val xrayExecutable = File(nativeLibraryDir, "libxray.so")
+                        if (xrayExecutable.exists()) {
+                            val p = Runtime.getRuntime().exec(arrayOf(xrayExecutable.absolutePath, "-version"))
+                            val reader = BufferedReader(InputStreamReader(p.inputStream))
+                            val version = reader.readLine()
+                            result.success(version)
+                        } else {
+                            result.success("Xray not found")
+                        }
+                    } catch (e: Exception) {
+                        result.success("Error: ${e.message}")
+                    }
+                }
+            }
+
+            // POST_NOTIFICATIONS without VpnService.prepare, for proxy mode.
+            "requestNotificationPermission" -> {
+                val currentActivity = activity
+                if (currentActivity == null) {
+                    result.error("NO_ACTIVITY", "Activity is not attached", null)
+                    return
+                }
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
+                    ActivityCompat.checkSelfPermission(
+                        currentActivity,
+                        Manifest.permission.POST_NOTIFICATIONS,
+                    ) != PackageManager.PERMISSION_GRANTED
+                ) {
+                    ActivityCompat.requestPermissions(
+                        currentActivity,
+                        arrayOf(Manifest.permission.POST_NOTIFICATIONS),
+                        REQUEST_CODE_POST_NOTIFICATIONS,
+                    )
+                }
+                result.success(null)
+            }
+
+            "requestPermission" -> {
+                val currentActivity = activity
+                if (currentActivity == null) {
+                    result.error("NO_ACTIVITY", "Activity is not attached", null)
+                    return
+                }
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                    if (ActivityCompat.checkSelfPermission(currentActivity, Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
+                        ActivityCompat.requestPermissions(currentActivity, arrayOf(Manifest.permission.POST_NOTIFICATIONS), REQUEST_CODE_POST_NOTIFICATIONS)
+                    }
+                }
+                val request = VpnService.prepare(currentActivity)
+                if (request != null) {
+                    pendingResult = result
+                    currentActivity.startActivityForResult(request, REQUEST_CODE_VPN_PERMISSION)
+                } else {
+                    result.success(true)
+                }
+            }
+
+            else -> result.notImplemented()
+        }
+    }
+
+    private fun registerReceiver() {
+        if (activity == null) return
+        if (xrayReceiver == null) {
+            xrayReceiver = object : BroadcastReceiver() {
+                override fun onReceive(context: Context?, intent: Intent?) {
+                    if (intent == null || vpnStatusSink == null) return
+                    val state = intent.getSerializableExtra("STATE") as? AppConfigs.V2RAY_STATES
+                    val runtimeToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
+                    val runtimeReady = intent.getBooleanExtra("RUNTIME_READY", false)
+                    val duration = intent.getStringExtra("DURATION")
+                    val uploadSpeed = intent.getLongExtra("UPLOAD_SPEED", 0)
+                    val downloadSpeed = intent.getLongExtra("DOWNLOAD_SPEED", 0)
+                    val uploadTraffic = intent.getLongExtra("UPLOAD_TRAFFIC", 0)
+                    val downloadTraffic = intent.getLongExtra("DOWNLOAD_TRAFFIC", 0)
+
+                    val currentToken = expectedRuntimeToken
+                    if (currentToken == null) {
+                        if (runtimeToken.isNotEmpty() &&
+                            (state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
+                             state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING)
+                        ) {
+                            expectedRuntimeToken = runtimeToken
+                        } else {
+                            return
+                        }
+                    } else if (runtimeToken != currentToken) {
+                        return
+                    }
+
+                    val stateName = when (state) {
+                        AppConfigs.V2RAY_STATES.V2RAY_CONNECTED -> if (runtimeReady) "CONNECTED" else "CONNECTING"
+                        AppConfigs.V2RAY_STATES.V2RAY_CONNECTING -> "CONNECTING"
+                        else -> "DISCONNECTED"
+                    }
+
+                    val data = ArrayList<String>()
+                    data.add(duration ?: "0")
+                    data.add(uploadSpeed.toString())
+                    data.add(downloadSpeed.toString())
+                    data.add(uploadTraffic.toString())
+                    data.add(downloadTraffic.toString())
+                    data.add(stateName)
+
+                    if (state == AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED &&
+                        runtimeToken.isNotEmpty() && runtimeToken == expectedRuntimeToken
+                    ) {
+                        expectedRuntimeToken = null
+                        mainHandler.removeCallbacks(stopTimeoutRunnable)
+                        pendingStopResult?.success(null)
+                        pendingStopResult = null
+                    }
+
+                    vpnStatusSink?.success(data)
+                }
+            }
+        }
+
+        val filter = IntentFilter(AppConfigs.V2RAY_CONNECTION_INFO)
+        val currentActivity = activity ?: return
+        ContextCompat.registerReceiver(
+            currentActivity,
+            xrayReceiver,
+            filter,
+            ContextCompat.RECEIVER_NOT_EXPORTED,
+        )
+    }
+
+    private fun unregisterReceiver() {
+        val currentActivity = activity
+        val receiver = xrayReceiver
+        if (currentActivity != null && receiver != null) {
+            try {
+                currentActivity.unregisterReceiver(receiver)
+            } catch (e: Exception) {
+                Log.w(TAG, "Receiver was already detached during lifecycle cleanup", e)
+            }
+        }
+        xrayReceiver = null
+    }
+
+    private fun failPendingPermission(code: String, message: String) {
+        pendingResult?.error(code, message, null)
+        pendingResult = null
+    }
+
+    override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+        mainHandler.removeCallbacks(stopTimeoutRunnable)
+        pendingStopResult?.error("ENGINE_DETACHED", "Flutter engine detached during VPN shutdown", null)
+        pendingStopResult = null
+        failPendingPermission("ENGINE_DETACHED", "Flutter engine detached during VPN permission request")
+        unregisterReceiver()
+        vpnControlMethod.setMethodCallHandler(null)
+        vpnStatusEvent.setStreamHandler(null)
+        executor.shutdown()
+    }
+
+    override fun onAttachedToActivity(binding: ActivityPluginBinding) {
+        activity = binding.activity
+        binding.addActivityResultListener(this)
+        if (vpnStatusSink != null) {
+            registerReceiver()
+        }
+    }
+
+    override fun onDetachedFromActivityForConfigChanges() {
+        unregisterReceiver()
+        activity = null
+    }
+
+    override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
+        activity = binding.activity
+        binding.addActivityResultListener(this)
+        if (vpnStatusSink != null) {
+            registerReceiver()
+        }
+    }
+
+    override fun onDetachedFromActivity() {
+        failPendingPermission("NO_ACTIVITY", "Activity detached during VPN permission request")
+        unregisterReceiver()
+        activity = null
+    }
+
+    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
+        if (requestCode == REQUEST_CODE_VPN_PERMISSION) {
+            if (resultCode == Activity.RESULT_OK) {
+                pendingResult?.success(true)
+            } else {
+                pendingResult?.success(false)
+            }
+            pendingResult = null
+            return true
+        }
+        return false
+    }
+}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManager.kt

@@ -0,0 +1,700 @@
+package com.github.tfox.flutter_vless.xray.core
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.graphics.Color
+import android.os.Build
+import android.os.CountDownTimer
+import android.os.Handler
+import android.os.Looper
+import android.util.Log
+import androidx.core.app.ActivityCompat
+import androidx.core.app.NotificationCompat
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import com.github.tfox.flutter_vless.xray.service.XrayVPNService
+import com.github.tfox.flutter_vless.xray.utils.AppConfigs
+import com.github.tfox.flutter_vless.xray.utils.Utilities
+import org.json.JSONObject
+import org.json.JSONArray
+import java.io.File
+import java.io.FileOutputStream
+
+/**
+ * Manages the Xray Core process (libxray.so).
+ * 
+ * This singleton object is responsible for:
+ * 1. Generating the final Xray configuration file (config.json).
+ * 2. Injecting necessary inbounds (SOCKS, HTTP, API) into the user-provided config.
+ * 3. Starting and monitoring the Xray process.
+ * 4. Collecting traffic statistics via the Xray API.
+ * 5. Showing the persistent foreground notification.
+ */
+object XrayCoreManager {
+
+    private const val NOTIFICATION_ID = 1
+    private const val TAG = "XrayCoreManager"
+
+    // The core's output is kept only for its first seconds, and only to explain
+    // a non-zero exit. A core that has been up longer than this may be carrying
+    // traffic, and its log can name destinations, which must never reach the
+    // device log (rule 95) - so past the window the buffer is dropped.
+    private const val STARTUP_LOG_WINDOW_MS = 10_000L
+    private const val STARTUP_LOG_MAX_LINES = 40
+    private var xrayProcess: Process? = null
+    private var countDownTimer: CountDownTimer? = null
+    private var seconds = 0
+
+    private fun deleteEphemeralConfigOnFailure(filesDir: File) {
+        try {
+            val config = File(filesDir, "config.json")
+            if (config.exists() && !config.delete()) {
+                Log.w(TAG, "Could not delete failed ephemeral Xray config")
+            }
+        } catch (e: Exception) {
+            Log.w(TAG, "Could not delete failed ephemeral Xray config", e)
+        }
+    }
+
+    private fun nextFreePort(preferredPort: Int, usedPorts: Set<Int>): Int {
+        var port = preferredPort
+        while (usedPorts.contains(port)) {
+            port++
+        }
+        return port
+    }
+
+    private fun uniqueInboundTag(inbounds: JSONArray, preferredTag: String): String {
+        val tags = mutableSetOf<String>()
+        for (i in 0 until inbounds.length()) {
+            val tag = inbounds.optJSONObject(i)?.optString("tag").orEmpty()
+            if (tag.isNotEmpty()) tags.add(tag)
+        }
+
+        if (!tags.contains(preferredTag)) return preferredTag
+
+        var index = 1
+        var candidate = "${preferredTag}_$index"
+        while (tags.contains(candidate)) {
+            index++
+            candidate = "${preferredTag}_$index"
+        }
+        return candidate
+    }
+
+    private fun normalizeRuntimeConfig(value: Any?): Any? {
+        return when (value) {
+            is JSONObject -> {
+                val normalized = JSONObject()
+                val aliases = mapOf(
+                    "xHTTPSettings" to "xhttpSettings",
+                    "httpUpgradeSettings" to "httpupgradeSettings",
+                    "splitHTTPSettings" to "splithttpSettings"
+                )
+                val keys = value.keys()
+                while (keys.hasNext()) {
+                    val key = keys.next()
+                    if (key == "allowInsecure") continue
+
+                    val targetKey = aliases[key] ?: key
+                    if (aliases.containsKey(key) && value.has(targetKey)) continue
+
+                    val normalizedValue = normalizeRuntimeConfig(value.opt(key))
+                    if (targetKey == "network" && normalizedValue is String) {
+                        normalized.put(targetKey, normalizedValue.lowercase())
+                    } else {
+                        normalized.put(targetKey, normalizedValue)
+                    }
+                }
+                normalized
+            }
+            is JSONArray -> {
+                val normalized = JSONArray()
+                for (i in 0 until value.length()) {
+                    normalized.put(normalizeRuntimeConfig(value.opt(i)))
+                }
+                normalized
+            }
+            else -> value
+        }
+    }
+
+    private fun normalizeVlessOutbounds(configJson: JSONObject) {
+        val outbounds = configJson.optJSONArray("outbounds") ?: return
+        for (i in 0 until outbounds.length()) {
+            val outbound = outbounds.optJSONObject(i) ?: continue
+            if (outbound.optString("protocol") != "vless") continue
+
+            val settings = outbound.optJSONObject("settings") ?: continue
+            if (settings.has("vnext")) continue
+
+            val address = settings.optString("address")
+            val id = settings.optString("id")
+            val port = settings.optInt("port", 0)
+            if (address.isEmpty() || id.isEmpty() || port <= 0) continue
+
+            val user = JSONObject()
+            user.put("id", id)
+            user.put("encryption", settings.optString("encryption", "none"))
+            user.put("flow", settings.optString("flow", ""))
+            user.put("level", settings.optInt("level", 8))
+
+            val server = JSONObject()
+            server.put("address", address)
+            server.put("port", port)
+            server.put("users", JSONArray().put(user))
+
+            val normalizedSettings = JSONObject()
+            normalizedSettings.put("vnext", JSONArray().put(server))
+            outbound.put("settings", normalizedSettings)
+            Log.d(TAG, "Normalized flat VLESS outbound settings for $address:$port")
+        }
+    }
+
+    private fun sanitizeLogPaths(configJson: JSONObject, filesDir: File) {
+        val log = configJson.optJSONObject("log") ?: return
+
+        // The VPN client never needs destination/access logs. A server-provided
+        // config must not silently enable browsing metadata collection locally.
+        log.remove("access")
+        try { File(filesDir, "access.log").delete() } catch (_: Exception) {}
+
+        val errorPath = log.optString("error")
+        if (errorPath.isNotEmpty()) {
+            log.put("error", File(filesDir, "error.log").absolutePath)
+        }
+    }
+
+    internal fun buildRuntimeConfigJson(config: XrayConfig, filesDir: File): JSONObject {
+        val configJson = normalizeRuntimeConfig(
+            JSONObject(config.V2RAY_FULL_JSON_CONFIG)
+        ) as JSONObject
+        normalizeVlessOutbounds(configJson)
+        sanitizeLogPaths(configJson, filesDir)
+
+        // ReVolt needs only its authenticated local SOCKS ingress.
+        val inbounds = configJson.optJSONArray("inbounds") ?: JSONArray()
+        var secureSocksEnabled = false
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.optJSONObject(i) ?: continue
+            if (inbound.optString("tag") != "revolt-secure-socks") continue
+
+            val settings = inbound.optJSONObject("settings")
+                ?: throw IllegalStateException("Secure SOCKS5 settings are missing")
+            val users = settings.optJSONArray("users")
+                ?: throw IllegalStateException("Secure SOCKS5 users are missing")
+            val account = users.optJSONObject(0)
+                ?: throw IllegalStateException("Secure SOCKS5 account is missing")
+            val port = inbound.optInt("port", -1)
+
+            if (inbound.optString("protocol") != "socks" ||
+                inbound.optString("listen") != "127.0.0.1" ||
+                port <= 1024 || port > 65535 ||
+                settings.optString("auth") != "password" ||
+                account.optString("user").isEmpty() ||
+                account.optString("pass").isEmpty()
+            ) {
+                throw IllegalStateException("Secure SOCKS5 session is invalid")
+            }
+
+            config.LOCAL_SOCKS5_PORT = port
+            config.LOCAL_HTTP_PORT = 0
+            secureSocksEnabled = true
+            break
+        }
+
+        val usedPorts = mutableSetOf<Int>()
+        var hasSocksOnLocalPort = false
+        var hasHttpOnLocalPort = false
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.getJSONObject(i)
+            val protocol = inbound.optString("protocol")
+            val port = inbound.optInt("port", -1)
+            if (port > 0) usedPorts.add(port)
+            if (protocol == "socks" && port == config.LOCAL_SOCKS5_PORT) hasSocksOnLocalPort = true
+            if (protocol == "http" && port == config.LOCAL_HTTP_PORT) hasHttpOnLocalPort = true
+        }
+
+        if (!hasSocksOnLocalPort) {
+            if (usedPorts.contains(config.LOCAL_SOCKS5_PORT)) {
+                config.LOCAL_SOCKS5_PORT = nextFreePort(config.LOCAL_SOCKS5_PORT, usedPorts)
+            }
+            val socksInbound = JSONObject()
+            socksInbound.put("tag", uniqueInboundTag(inbounds, "socks"))
+            socksInbound.put("port", config.LOCAL_SOCKS5_PORT)
+            socksInbound.put("listen", "127.0.0.1")
+            socksInbound.put("protocol", "socks")
+            socksInbound.put("settings", JSONObject().put("auth", "noauth").put("udp", true))
+            socksInbound.put(
+                "sniffing",
+                JSONObject().put("enabled", true).put("destOverride", JSONArray().put("http").put("tls"))
+            )
+            inbounds.put(socksInbound)
+            usedPorts.add(config.LOCAL_SOCKS5_PORT)
+            Log.d(TAG, "Injected SOCKS inbound on port ${config.LOCAL_SOCKS5_PORT}")
+        }
+
+        if (!secureSocksEnabled && !hasHttpOnLocalPort) {
+            if (usedPorts.contains(config.LOCAL_HTTP_PORT)) {
+                config.LOCAL_HTTP_PORT = nextFreePort(config.LOCAL_HTTP_PORT, usedPorts)
+            }
+            val httpInbound = JSONObject()
+            httpInbound.put("tag", uniqueInboundTag(inbounds, "http"))
+            httpInbound.put("port", config.LOCAL_HTTP_PORT)
+            httpInbound.put("listen", "127.0.0.1")
+            httpInbound.put("protocol", "http")
+            inbounds.put(httpInbound)
+            usedPorts.add(config.LOCAL_HTTP_PORT)
+            Log.d(TAG, "Injected HTTP inbound on port ${config.LOCAL_HTTP_PORT}")
+        }
+
+        return configJson
+    }
+
+    internal fun buildDelayConfigJson(configJson: String, proxyPort: Int, filesDir: File): Pair<JSONObject, Int> {
+        val delayConfig = XrayConfig(
+            V2RAY_FULL_JSON_CONFIG = configJson,
+            LOCAL_SOCKS5_PORT = proxyPort,
+            LOCAL_HTTP_PORT = proxyPort + 1,
+            LOCAL_API_PORT = proxyPort + 2
+        )
+        val runtimeJson = buildRuntimeConfigJson(delayConfig, filesDir)
+        return Pair(runtimeJson, delayConfig.LOCAL_SOCKS5_PORT)
+    }
+
+    /**
+     * Starts the Xray Core process.
+     * 
+     * @param context The service context (needed for file access and notifications).
+     * @param config The configuration object containing the user's settings.
+     * @return true if started successfully, false otherwise.
+     */
+    fun startCore(context: Service, config: XrayConfig): Boolean {
+        AppConfigs.RUNTIME_READY = false
+        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+        AppConfigs.V2RAY_CONFIG = config
+
+        // 1. Prepare the configuration file
+        val configFilesDir = context.filesDir
+        
+        try {
+            val configJson = buildRuntimeConfigJson(config, configFilesDir)
+            val configFile = File(context.filesDir, "config.json")
+            configFile.writeText(configJson.toString())
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to write config file", e)
+            deleteEphemeralConfigOnFailure(configFilesDir)
+            return false
+        }
+
+        // 2. Find Xray executable (libxray.so)
+        val nativeLibraryDir = context.applicationInfo.nativeLibraryDir
+        val xrayExecutable = File(nativeLibraryDir, "libxray.so")
+        if (!xrayExecutable.exists()) {
+            Log.e(TAG, "Xray executable not found at ${xrayExecutable.absolutePath}")
+            deleteEphemeralConfigOnFailure(configFilesDir)
+            return false
+        }
+
+        // 3. Prepare assets (geoip, geosite)
+        try {
+            Utilities.copyAssets(context)
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to prepare Xray assets", e)
+            deleteEphemeralConfigOnFailure(configFilesDir)
+            return false
+        }
+
+        // 4. Run Xray
+        try {
+            val cmd = listOf(
+                xrayExecutable.absolutePath,
+                "-config", File(configFilesDir, "config.json").absolutePath
+            )
+            val pb = ProcessBuilder(cmd)
+            pb.directory(configFilesDir)
+            pb.redirectErrorStream(true)
+            
+            // Set environment variables (XRAY_LOCATION_ASSET is crucial for finding geoip/geosite)
+            val env = pb.environment()
+            env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context)
+
+            xrayProcess = pb.start()
+            Thread.sleep(300)
+            if (xrayProcess?.isAlive != true) {
+                val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()
+                Log.e(TAG, "Xray process exited during startup. Output: $output")
+                xrayProcess = null
+                AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED
+                deleteEphemeralConfigOnFailure(configFilesDir)
+                return false
+            }
+            
+            // config.json contains per-session SOCKS credentials. Xray has
+            // consumed it after the startup liveness check, so remove it now.
+            try {
+                val ephemeralConfig = File(configFilesDir, "config.json")
+                if (ephemeralConfig.exists() && !ephemeralConfig.delete()) {
+                    Log.w(TAG, "Could not delete ephemeral Xray config")
+                }
+            } catch (e: Exception) {
+                Log.w(TAG, "Could not delete ephemeral Xray config", e)
+            }
+
+            AppConfigs.RUNTIME_READY = false
+            AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+            startTimer(context)
+            showNotification(context, config)
+            sendStatusBroadcast(context, config)
+            
+            val process = xrayProcess ?: return false
+            // Monitor process in a separate thread to detect crash
+            Thread {
+                try {
+                    val startedAt = System.currentTimeMillis()
+                    val startupLog = ArrayDeque<String>()
+                    process.inputStream.bufferedReader().use { reader ->
+                        reader.forEachLine { line ->
+                            if (System.currentTimeMillis() - startedAt <= STARTUP_LOG_WINDOW_MS) {
+                                if (startupLog.size >= STARTUP_LOG_MAX_LINES) startupLog.removeFirst()
+                                startupLog.addLast(line)
+                            } else if (startupLog.isNotEmpty()) {
+                                startupLog.clear()
+                            }
+                        }
+                    }
+
+                    val exitCode = process.waitFor()
+                    if (exitCode != 0 && startupLog.isNotEmpty()) {
+                        Log.e(
+                            TAG,
+                            "Xray process exited with code $exitCode; startup output:\n" +
+                                startupLog.joinToString("\n")
+                        )
+                    } else {
+                        Log.e(TAG, "Xray process exited with code $exitCode")
+                    }
+                    if (xrayProcess === process &&
+                        AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN == config.RUNTIME_TOKEN &&
+                        (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
+                         AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING)
+                    ) {
+                        // Hold the Android TUN while the core is recovered. Killing
+                        // the VPN service here would allow direct-network fallback.
+                        xrayProcess = null
+                        AppConfigs.RUNTIME_READY = false
+                        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+                        sendStatusBroadcast(context, config)
+                        if (context is XrayVPNService) {
+                            context.handleXrayCoreExit(config)
+                        } else {
+                            stopCore(context)
+                        }
+                    }
+                } catch (e: java.io.InterruptedIOException) {
+                    // Expected when stopping
+                } catch (e: InterruptedException) {
+                    // Expected when stopping
+                } catch (e: Exception) {
+                    Log.e(TAG, "Error reading xray output", e)
+                }
+            }.start()
+
+            return true
+
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start Xray process", e)
+            // The process may already be running: pb.start() succeeds before
+            // anything below it can throw. Leaving it alive leaked one live
+            // core per recovery attempt. Clear the field BEFORE destroying so
+            // the monitor thread's `xrayProcess === process` guard fails and
+            // recovery is not re-entered for a core we are killing here.
+            val orphan = xrayProcess
+            xrayProcess = null
+            try {
+                orphan?.destroy()
+            } catch (destroyError: Exception) {
+                Log.w(TAG, "Failed to destroy partially started Xray process", destroyError)
+            }
+            deleteEphemeralConfigOnFailure(configFilesDir)
+            return false
+        }
+    }
+
+    /**
+     * Stops the Xray Core process and cleans up notifications.
+     */
+    fun stopCore(context: Service, confirmationToken: String? = AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN) {
+        try {
+            xrayProcess?.destroy()
+            xrayProcess = null
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to destroy Xray process", e)
+        }
+
+        AppConfigs.RUNTIME_READY = false
+        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED
+        stopTimer()
+        val notificationManager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        notificationManager.cancel(NOTIFICATION_ID)
+        sendDisconnectedBroadcast(context, confirmationToken.orEmpty())
+        AppConfigs.V2RAY_CONFIG = null
+    }
+
+    fun markRuntimeConnecting(context: Context, config: XrayConfig) {
+        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return
+        AppConfigs.RUNTIME_READY = false
+        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+        sendStatusBroadcast(context, config)
+    }
+
+    fun markRuntimeReady(context: Service, config: XrayConfig) {
+        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return
+        AppConfigs.RUNTIME_READY = true
+        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED
+        showNotification(context, config)
+        sendStatusBroadcast(context, config)
+    }
+
+    fun isXrayRunning(): Boolean {
+        // Check state instead of process because VPN runs in separate service process
+        return AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
+               AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+    }
+
+    // CountDownTimer builds a Handler, so it only constructs on a looper thread.
+    // Core recovery runs on a bare Thread (XrayVPNService.handleXrayCoreExit),
+    // where this threw "Can't create handler inside thread ... that has not
+    // called Looper.prepare()" and took the whole restart down with it.
+    private val mainHandler = Handler(Looper.getMainLooper())
+
+    private fun runOnMain(block: () -> Unit) {
+        if (Looper.myLooper() == Looper.getMainLooper()) block() else mainHandler.post(block)
+    }
+
+    private fun startTimer(context: Context) {
+        // Captured now: a stop that lands while the post is queued must not
+        // leave a timer ticking for a generation that is already gone.
+        val token = AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN
+        runOnMain { startTimerOnMain(context, token) }
+    }
+
+    private fun startTimerOnMain(context: Context, token: String?) {
+        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != token) return
+        countDownTimer?.cancel()
+        seconds = 0
+        countDownTimer = object : CountDownTimer(Long.MAX_VALUE, 1000) {
+            override fun onTick(millisUntilFinished: Long) {
+                seconds++
+                val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
+                intent.putExtra("STATE", AppConfigs.V2RAY_STATE)
+                intent.putExtra("RUNTIME_TOKEN", AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN.orEmpty())
+                intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY)
+                intent.putExtra("DURATION", seconds.toString())
+                
+                intent.putExtra("UPLOAD_SPEED", 0L)
+                intent.putExtra("DOWNLOAD_SPEED", 0L)
+                intent.putExtra("UPLOAD_TRAFFIC", 0L)
+                intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
+                
+                context.sendBroadcast(intent)
+            }
+
+            override fun onFinish() {}
+        }.start()
+    }
+
+    private fun stopTimer() {
+        runOnMain {
+            countDownTimer?.cancel()
+            countDownTimer = null
+            seconds = 0
+        }
+    }
+
+    fun sendStatusBroadcast(context: Context, config: XrayConfig) {
+        val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
+        intent.putExtra("STATE", AppConfigs.V2RAY_STATE)
+        intent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN)
+        intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY)
+        intent.putExtra("DURATION", seconds.toString())
+        intent.putExtra("UPLOAD_SPEED", 0L)
+        intent.putExtra("DOWNLOAD_SPEED", 0L)
+        intent.putExtra("UPLOAD_TRAFFIC", 0L)
+        intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
+        context.sendBroadcast(intent)
+    }
+
+    private fun sendDisconnectedBroadcast(context: Context, runtimeToken: String) {
+        val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
+        intent.putExtra("STATE", AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED)
+        intent.putExtra("RUNTIME_TOKEN", runtimeToken)
+        intent.putExtra("RUNTIME_READY", false)
+        intent.putExtra("DURATION", "0")
+        intent.putExtra("UPLOAD_SPEED", 0L)
+        intent.putExtra("DOWNLOAD_SPEED", 0L)
+        intent.putExtra("UPLOAD_TRAFFIC", 0L)
+        intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
+        context.sendBroadcast(intent)
+    }
+
+    private fun showNotification(context: Service, config: XrayConfig) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            if (ActivityCompat.checkSelfPermission(context, android.Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
+                return
+            }
+        }
+
+        val channelId = createNotificationChannel(context, config.APPLICATION_NAME)
+        
+        val launchIntent = context.packageManager.getLaunchIntentForPackage(context.packageName)
+        launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_NEW_TASK
+        
+        val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT else PendingIntent.FLAG_UPDATE_CURRENT
+        val contentPendingIntent = PendingIntent.getActivity(context, 0, launchIntent, flags)
+
+        val stopIntent = Intent(context, XrayVPNService::class.java)
+        stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
+        stopIntent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN)
+        val stopPendingIntent = PendingIntent.getService(context, 0, stopIntent, flags)
+        val smallIcon = if (config.APPLICATION_ICON != 0) config.APPLICATION_ICON else android.R.drawable.ic_dialog_info
+
+        val builder = NotificationCompat.Builder(context, channelId)
+            .setSmallIcon(smallIcon)
+            .setContentTitle(config.REMARK)
+            .setContentText(if (AppConfigs.RUNTIME_READY) "Connected" else "Connecting")
+            .addAction(0, config.NOTIFICATION_DISCONNECT_BUTTON_NAME, stopPendingIntent)
+            .setContentIntent(contentPendingIntent)
+            .setPriority(NotificationCompat.PRIORITY_MIN)
+            .setOngoing(true)
+            .setShowWhen(true)
+
+        context.startForeground(NOTIFICATION_ID, builder.build())
+    }
+
+    fun getConnectedV2rayServerDelay(context: Context, url: String): Long {
+        // Use the configured SOCKS port (default 10807)
+        val port = AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807
+        Log.d(TAG, "getConnectedV2rayServerDelay: Testing delay to $url via SOCKS port $port")
+        
+        return try {
+            val start = System.currentTimeMillis()
+            val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", port))
+            val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection
+            connection.connectTimeout = 5000
+            connection.readTimeout = 5000
+            connection.requestMethod = "HEAD"
+            val responseCode = connection.responseCode
+            val end = System.currentTimeMillis()
+            val delay = end - start
+            connection.disconnect()
+            Log.d(TAG, "getConnectedV2rayServerDelay: Success! Response code: $responseCode, Delay: ${delay}ms")
+            delay
+        } catch (e: Exception) {
+            Log.e(TAG, "getConnectedV2rayServerDelay: Failed to measure delay (VPN may not be running)", e)
+            -1L
+        }
+    }
+
+    /**
+     * Measure delay for a server configuration (when not connected).
+     * Temporarily starts Xray with the provided config, measures delay, then stops it.
+     */
+    fun getServerDelay(context: Context, configJson: String, url: String): Long {
+        Log.d(TAG, "getServerDelay: Starting temporary Xray instance")
+        
+        var tempProcess: Process? = null
+        try {
+            // Find a random free port to avoid conflict with running VPN
+            val freePort = try {
+                val socket = java.net.ServerSocket(0)
+                val port = socket.localPort
+                socket.close()
+                port
+            } catch (e: Exception) {
+                10806 // Fallback
+            }
+            
+            val (json, socksPort) = buildDelayConfigJson(configJson, freePort, context.filesDir)
+            Log.d(TAG, "getServerDelay: Using SOCKS port $socksPort")
+            
+            // Write temp config file
+            val tempConfigFile = File(context.filesDir, "temp_delay_config.json")
+            tempConfigFile.writeText(json.toString())
+            
+            // Copy assets
+            Utilities.copyAssets(context)
+            
+            // Start Xray process
+            val xrayExecutable = File(context.applicationInfo.nativeLibraryDir, "libxray.so")
+            if (!xrayExecutable.exists()) {
+                Log.e(TAG, "getServerDelay: Xray executable not found")
+                return -1L
+            }
+            
+            val cmd = listOf(
+                xrayExecutable.absolutePath,
+                "-config", tempConfigFile.absolutePath
+            )
+            
+            val pb = ProcessBuilder(cmd)
+            pb.directory(context.filesDir)
+            val env = pb.environment()
+            env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context)
+            
+            tempProcess = pb.start()
+            
+            // Wait a bit for Xray to start
+            Thread.sleep(1000)
+            
+            // Measure delay
+            val delay = try {
+                val start = System.currentTimeMillis()
+                val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", socksPort))
+                val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection
+                connection.connectTimeout = 5000
+                connection.readTimeout = 5000
+                connection.requestMethod = "HEAD"
+                val responseCode = connection.responseCode
+                val end = System.currentTimeMillis()
+                connection.disconnect()
+                val result = end - start
+                Log.d(TAG, "getServerDelay: Success! Response code: $responseCode, Delay: ${result}ms")
+                result
+            } catch (e: Exception) {
+                Log.e(TAG, "getServerDelay: Failed to measure delay", e)
+                -1L
+            }
+            
+            // Stop temp process
+            tempProcess?.destroy()
+            tempConfigFile.delete()
+            
+            return delay
+            
+        } catch (e: Exception) {
+            Log.e(TAG, "getServerDelay: Error starting temp Xray", e)
+            tempProcess?.destroy()
+            return -1L
+        }
+    }
+
+    private fun createNotificationChannel(context: Context, appName: String): String {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val channelId = "REVOLT_VPN_SERVICE"
+            val channelName = "$appName Background Service"
+            val channel = NotificationChannel(channelId, channelName, NotificationManager.IMPORTANCE_LOW)
+            channel.lightColor = Color.BLUE
+            channel.lockscreenVisibility = Notification.VISIBILITY_PRIVATE
+            val manager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+            manager.createNotificationChannel(channel)
+            return channelId
+        }
+        return ""
+    }
+}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/dto/XrayConfig.kt

@@ -0,0 +1,71 @@
+package com.github.tfox.flutter_vless.xray.dto
+
+import java.io.Serializable
+import java.util.ArrayList
+
+/**
+ * Data class representing the Xray configuration and app settings.
+ * 
+ * This class is passed from Flutter to Android and contains:
+ * 1. The full Xray JSON configuration (V2RAY_FULL_JSON_CONFIG).
+ * 2. App-specific settings like blocked apps, notification text, etc.
+ * 3. Connection parameters (server address, ports).
+ */
+data class XrayConfig(
+    /** The IP address of the connected server (used to exclude it from VPN routing). */
+    var CONNECTED_V2RAY_SERVER_ADDRESS: String = "",
+    
+    /** The port of the connected server. */
+    var CONNECTED_V2RAY_SERVER_PORT: String = "",
+    
+    /** Local port for SOCKS5 proxy (default: 10807). used by tun2socks. */
+    var LOCAL_SOCKS5_PORT: Int = 10807,
+    
+    /** Local port for HTTP proxy (default: 10808). */
+    var LOCAL_HTTP_PORT: Int = 10808,
+    
+    /** Local port for Xray API (stats, etc.) (default: 10809). */
+    var LOCAL_API_PORT: Int = 10809,
+    
+    /** Timeout for connections in milliseconds. */
+    var ALLOWED_TIMEOUT_MS: Int = 0,
+    
+    /** List of subnets to bypass (not routed through VPN). */
+    var BYPASS_SUBNETS: ArrayList<String> = ArrayList(),
+    
+    /** List of app package names to exclude from VPN. */
+    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
+    
+    /** The raw Xray configuration JSON string. */
+    var V2RAY_FULL_JSON_CONFIG: String = "",
+    
+    /** Whether to enable traffic statistics collection. */
+    var ENABLE_TRAFFIC_STATICS: Boolean = false,
+    
+    /** Remark/Name of the server configuration. */
+    var REMARK: String = "",
+    
+    /** Name of the application (displayed in notification). */
+    var APPLICATION_NAME: String = "Flutter Vless",
+    
+    /** Resource ID of the notification icon. */
+    var APPLICATION_ICON: Int = 0,
+    
+    /** Resource name of the notification icon (e.g. "ic_notification"). */
+    var NOTIFICATION_ICON_RESOURCE_NAME: String = "",
+    
+    /** Resource type of the notification icon (e.g. "drawable"). */
+    var NOTIFICATION_ICON_RESOURCE_TYPE: String = "",
+    
+    /** Text for the disconnect button in the notification. */
+    var NOTIFICATION_DISCONNECT_BUTTON_NAME: String = "Disconnect",
+    
+    /** Domain resolution strategy (e.g. "IPIfNonMatch"). */
+    var DOMAIN_STRATEGY: String = "",
+    
+    /** Routing domain strategy. */
+    var ROUTING_DOMAIN_STRATEGY: String = "",
+
+    /** Unique generation token used to reject stale native runtime events. */
+    var RUNTIME_TOKEN: String = ""
+) : Serializable

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/service/XrayVPNService.kt

@@ -0,0 +1,827 @@
+package com.github.tfox.flutter_vless.xray.service
+
+import android.app.AlarmManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.net.LocalSocket
+import android.net.LocalSocketAddress
+import android.net.VpnService
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.os.ParcelFileDescriptor
+import android.os.SystemClock
+import android.util.Log
+import com.github.tfox.flutter_vless.xray.core.XrayCoreManager
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import com.github.tfox.flutter_vless.xray.utils.AppConfigs
+import com.github.tfox.flutter_vless.xray.utils.RevoltAlerts
+import org.json.JSONObject
+import java.io.File
+
+/**
+ * Android VPN Service implementation.
+ *
+ * This service owns the TUN interface and keeps runtime state generation-scoped.
+ * Session deadlines are enforced both by an in-process monotonic timer and by
+ * AlarmManager, while only the non-secret token/deadline pair is persisted.
+ * Per-session VLESS/SOCKS credentials remain memory-only.
+ */
+class XrayVPNService : VpnService() {
+
+    private var mInterface: ParcelFileDescriptor? = null
+    private var tun2socksProcess: Process? = null
+    @Volatile private var isRunning = false
+    @Volatile private var recoveringXray = false
+    @Volatile private var recoveringTun2socks = false
+    private var tun2socksRecoveryAttempt = 0
+    private var currentConfig: XrayConfig? = null
+    private var currentProxyOnly = false
+    private var shuttingDownIntentionally = false
+
+    private val deadlineHandler = Handler(Looper.getMainLooper())
+    private var sessionDeadlineElapsed: Long? = null
+    private var sessionDeadlineToken: String? = null
+    private val sessionDeadlineRunnable = Runnable { enforceSessionDeadline() }
+
+    // The warning's own backstop, mirroring the deadline's. The alarm alone is
+    // not enough: it is inexact on purpose (no SCHEDULE_EXACT_ALARM), and with
+    // the app closed on a dozing device it was measured never arriving at all,
+    // while the deadline's Handler fired within a second of its target.
+    private val sessionWarningRunnable = Runnable {
+        handleSessionWarningAlarm(sessionDeadlineToken.orEmpty())
+    }
+
+    override fun onCreate() {
+        super.onCreate()
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent == null) {
+            if (isRunning && currentConfig != null) return START_REDELIVER_INTENT
+
+            // Session credentials intentionally stay memory-only. If Android
+            // cannot redeliver the original START intent, fail closed instead
+            // of rebuilding a tunnel from sensitive material stored on disk.
+            clearPersistedDeadline()
+            cancelSessionExpiryAlarm()
+            stopSelf()
+            return START_NOT_STICKY
+        }
+
+        if (intent.getBooleanExtra(EXTRA_SESSION_EXPIRED, false)) {
+            enforcePersistedDeadline(intent.getStringExtra("RUNTIME_TOKEN").orEmpty())
+            return START_NOT_STICKY
+        }
+
+        // Must stay above the command dispatch: an intent with no COMMAND
+        // falls through to the final else and stops the tunnel.
+        if (intent.getBooleanExtra(EXTRA_SESSION_WARNING, false)) {
+            handleSessionWarningAlarm(intent.getStringExtra("RUNTIME_TOKEN").orEmpty())
+            return START_NOT_STICKY
+        }
+
+        val command = if (Build.VERSION.SDK_INT >= 33) {
+            intent.getSerializableExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS::class.java)
+        } else {
+            @Suppress("DEPRECATION")
+            intent.getSerializableExtra("COMMAND") as? AppConfigs.V2RAY_SERVICE_COMMANDS
+        }
+
+        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) {
+            val requestedToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
+            val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
+            if (requestedToken.isEmpty() ||
+                (activeToken.isNotEmpty() && requestedToken != activeToken)
+            ) {
+                Log.w(TAG, "Ignoring STOP_SERVICE without matching runtime generation")
+                return START_NOT_STICKY
+            }
+            stopAll(requestedToken, userRequested = true)
+            return START_NOT_STICKY
+        }
+
+        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE) {
+            updateSessionDeadline(intent)
+            return if (isRunning) START_REDELIVER_INTENT else START_NOT_STICKY
+        }
+
+        createNotificationChannel()
+        val notification = createNotification("VPN Service Running")
+        try {
+            if (Build.VERSION.SDK_INT >= 34) {
+                startForeground(1, notification, FOREGROUND_SERVICE_TYPE_SPECIAL_USE)
+            } else {
+                startForeground(1, notification)
+            }
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start foreground", e)
+            clearPersistedDeadline()
+            cancelSessionExpiryAlarm()
+            stopSelf()
+            return START_NOT_STICKY
+        }
+
+        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE) {
+            val config = if (Build.VERSION.SDK_INT >= 33) {
+                intent.getSerializableExtra("V2RAY_CONFIG", XrayConfig::class.java)
+            } else {
+                @Suppress("DEPRECATION")
+                intent.getSerializableExtra("V2RAY_CONFIG") as? XrayConfig
+            }
+
+            if (config != null) {
+                if (XrayCoreManager.isXrayRunning()) {
+                    Log.w(TAG, "Stopping stale Xray core before restart")
+                    XrayCoreManager.stopCore(this)
+                }
+                cleanup(clearDeadline = true)
+                RevoltAlerts.cancelAll(this)
+                shuttingDownIntentionally = false
+                currentConfig = config
+
+                val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false)
+                currentProxyOnly = proxyOnly
+                armSessionDeadline(config, BOOTSTRAP_SESSION_SECONDS)
+                if (shuttingDownIntentionally) return START_NOT_STICKY
+
+                if (XrayCoreManager.startCore(this, config)) {
+                    if (!proxyOnly) {
+                        setupVpn(config)
+                    } else {
+                        isRunning = true
+                        Log.d(TAG, "Starting in PROXY_ONLY mode")
+                        XrayCoreManager.markRuntimeReady(this, config)
+                    }
+                } else {
+                    stopAll(config.RUNTIME_TOKEN)
+                    return START_NOT_STICKY
+                }
+            } else {
+                Log.e(TAG, "START_SERVICE missing V2RAY_CONFIG")
+                stopAll()
+                return START_NOT_STICKY
+            }
+        } else {
+            stopAll()
+            return START_NOT_STICKY
+        }
+
+        return START_REDELIVER_INTENT
+    }
+
+    private fun setupVpn(config: XrayConfig) {
+        try {
+            if (mInterface != null) {
+                mInterface?.close()
+                mInterface = null
+            }
+
+            val builder = Builder()
+            builder.setSession(config.REMARK)
+            builder.setMtu(1500)
+            builder.addAddress("26.26.26.1", 30)
+            builder.addAddress("fd00:26:26::1", 126)
+
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                builder.setMetered(false)
+            }
+
+            if (config.BLOCKED_APPS.isNotEmpty()) {
+                throw IllegalStateException("Per-app VPN bypass is disabled in ReVolt")
+            }
+            try {
+                builder.addDisallowedApplication(packageName)
+            } catch (e: Exception) {
+                throw IllegalStateException("Failed to exclude ReVolt from its own VPN", e)
+            }
+
+            builder.addRoute("0.0.0.0", 0)
+            builder.addRoute("::", 0)
+
+            try {
+                builder.addDnsServer("8.8.8.8")
+                builder.addDnsServer("1.1.1.1")
+            } catch (e: Exception) {
+                throw IllegalStateException("Failed to configure VPN DNS", e)
+            }
+
+            mInterface = builder.establish()
+                ?: throw IllegalStateException("Android refused to establish VPN interface")
+            isRunning = true
+            runTun2socks(config)
+
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to setup VPN", e)
+            stopAll()
+        }
+    }
+
+    private data class SecureSocksCredentials(
+        val port: Int,
+        val username: String,
+        val password: String,
+    )
+
+    private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? {
+        val inbounds = try {
+            JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds")
+        } catch (_: Exception) {
+            null
+        } ?: return null
+
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.optJSONObject(i) ?: continue
+            if (inbound.optString("tag") != "revolt-secure-socks") continue
+            if (inbound.optString("protocol") != "socks" ||
+                inbound.optString("listen") != "127.0.0.1"
+            ) return null
+
+            val settings = inbound.optJSONObject("settings") ?: return null
+            if (settings.optString("auth") != "password") return null
+            val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null
+            val port = inbound.optInt("port", -1)
+            val username = user.optString("user")
+            val password = user.optString("pass")
+            if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) {
+                return null
+            }
+            return SecureSocksCredentials(port, username, password)
+        }
+        return null
+    }
+
+    private fun scheduleTun2socksRecovery(config: XrayConfig, reason: String) {
+        if (!isRunning || currentConfig !== config || recoveringTun2socks) return
+        XrayCoreManager.markRuntimeConnecting(this, config)
+        recoveringTun2socks = true
+        val attempt = ++tun2socksRecoveryAttempt
+        val shift = (attempt - 1).coerceIn(0, 6)
+        val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L)
+        Log.w(TAG, "Scheduling tun2socks recovery attempt $attempt in ${delayMs}ms: $reason")
+
+        Thread {
+            try {
+                Thread.sleep(delayMs)
+            } catch (_: InterruptedException) {
+                recoveringTun2socks = false
+                return@Thread
+            }
+
+            recoveringTun2socks = false
+            if (isRunning && currentConfig === config) {
+                runTun2socks(config)
+            }
+        }.start()
+    }
+
+    private fun runTun2socks(config: XrayConfig) {
+        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
+        val socketFile = File(filesDir, "sock_path")
+        if (socketFile.exists() && !socketFile.delete()) {
+            Log.w(TAG, "Could not delete stale tun2socks socket")
+        }
+        val sockPath = socketFile.absolutePath
+
+        val secure = secureSocksCredentials(config)
+            ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing")
+        config.LOCAL_SOCKS5_PORT = secure.port
+
+        val cmd = arrayListOf(
+            tun2socksPath,
+            "-sock-path", sockPath,
+            "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}",
+            "-mtu", "1500",
+            "-loglevel", "debug"
+        )
+
+        Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")
+
+        try {
+            val pb = ProcessBuilder(cmd)
+            pb.redirectErrorStream(true)
+            pb.directory(filesDir)
+            val process = pb.start()
+            tun2socksProcess = process
+
+            Thread {
+                try {
+                    process.inputStream.bufferedReader().use { reader ->
+                        reader.forEachLine { _ -> }
+                    }
+
+                    process.waitFor()
+                    if (isRunning && tun2socksProcess === process && currentConfig === config) {
+                        Log.e(TAG, "tun2socks exited unexpectedly; keeping TUN fail-closed")
+                        tun2socksProcess = null
+                        scheduleTun2socksRecovery(config, "process exited")
+                    }
+                } catch (_: java.io.InterruptedIOException) {
+                    // Expected when stopping
+                } catch (_: InterruptedException) {
+                    // Expected when stopping
+                } catch (e: Exception) {
+                    Log.e(TAG, "Error reading tun2socks output", e)
+                }
+            }.start()
+
+            sendFd(process, config)
+
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start tun2socks; keeping TUN fail-closed", e)
+            scheduleTun2socksRecovery(config, "start failure")
+        }
+    }
+
+    private fun sendFd(process: Process, config: XrayConfig) {
+        val fd = mInterface?.fileDescriptor ?: return
+        val sockFile = File(filesDir, "sock_path").absolutePath
+
+        Thread {
+            var tries = 0
+            while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) {
+                var localSocket: LocalSocket? = null
+                try {
+                    Thread.sleep(500)
+                    localSocket = LocalSocket()
+                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
+                    val out = localSocket.outputStream
+                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
+                    out.write(32)
+                    out.flush()
+                    localSocket.setFileDescriptorsForSend(null)
+                    localSocket.shutdownOutput()
+                    localSocket.close()
+                    if (isRunning && currentConfig === config && tun2socksProcess === process) {
+                        tun2socksRecoveryAttempt = 0
+                        XrayCoreManager.markRuntimeReady(this, config)
+                    }
+                    return@Thread
+                } catch (_: Exception) {
+                    tries++
+                    try {
+                        localSocket?.close()
+                    } catch (closeError: Exception) {
+                        Log.w(TAG, "Failed to close tun2socks handoff socket", closeError)
+                    }
+                }
+            }
+
+            if (isRunning && tun2socksProcess === process) {
+                Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN")
+                try {
+                    process.destroy()
+                } catch (e: Exception) {
+                    Log.w(TAG, "Failed to recycle tun2socks after FD handoff failure", e)
+                }
+            }
+        }.start()
+    }
+
+    fun handleXrayCoreExit(config: XrayConfig) {
+        if (!isRunning || currentConfig !== config || recoveringXray) return
+        XrayCoreManager.markRuntimeConnecting(this, config)
+        recoveringXray = true
+
+        Thread {
+            var attempt = 0
+            try {
+                while (isRunning && currentConfig === config) {
+                    attempt++
+                    val shift = (attempt - 1).coerceIn(0, 6)
+                    val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L)
+                    Log.w(TAG, "Recovering Xray core attempt $attempt in ${delayMs}ms")
+                    Thread.sleep(delayMs)
+                    if (!isRunning || currentConfig !== config) break
+
+                    if (XrayCoreManager.startCore(this, config)) {
+                        Log.w(TAG, "Xray core recovered without dropping TUN")
+                        if (currentProxyOnly || (mInterface != null && tun2socksProcess?.isAlive == true)) {
+                            XrayCoreManager.markRuntimeReady(this, config)
+                        }
+                        return@Thread
+                    }
+                }
+            } catch (_: InterruptedException) {
+                // Expected when stopping
+            } finally {
+                recoveringXray = false
+            }
+        }.start()
+    }
+
+    private fun cleanup(clearDeadline: Boolean = true) {
+        isRunning = false
+        if (clearDeadline) {
+            clearSessionDeadline()
+        } else {
+            deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
+            sessionDeadlineElapsed = null
+            sessionDeadlineToken = null
+        }
+        recoveringXray = false
+        recoveringTun2socks = false
+        tun2socksRecoveryAttempt = 0
+        currentProxyOnly = false
+        AppConfigs.RUNTIME_READY = false
+        tun2socksProcess?.destroy()
+        tun2socksProcess = null
+        try {
+            mInterface?.close()
+            mInterface = null
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to close VPN interface during cleanup", e)
+        }
+    }
+
+    // Anything that stops a live tunnel unasked must say so. isRunning is read
+    // before cleanup() clears it, which keeps a failed connect silent.
+    private fun stopAll(
+        confirmationToken: String = currentConfig?.RUNTIME_TOKEN.orEmpty(),
+        userRequested: Boolean = false,
+    ) {
+        if (shuttingDownIntentionally) return
+        val alertUser = isRunning && !userRequested
+        shuttingDownIntentionally = true
+        cleanup(clearDeadline = true)
+        currentConfig = null
+        XrayCoreManager.stopCore(this, confirmationToken)
+        stopForeground(true)
+        stopSelf()
+        if (alertUser) RevoltAlerts.postDisconnected(this)
+    }
+
+    private fun armSessionDeadline(config: XrayConfig, remainingSeconds: Long) {
+        val boundedSeconds = remainingSeconds
+            .coerceAtLeast(0L)
+            .coerceAtMost(Long.MAX_VALUE / 1000L)
+        val delayMs = boundedSeconds * 1000L
+        val nowEpochMs = System.currentTimeMillis()
+        val epochDeadline = if (Long.MAX_VALUE - nowEpochMs < delayMs) {
+            Long.MAX_VALUE
+        } else {
+            nowEpochMs + delayMs
+        }
+
+        sessionDeadlineToken = config.RUNTIME_TOKEN
+        sessionDeadlineElapsed = SystemClock.elapsedRealtime() + delayMs
+
+        if (!persistDeadline(config.RUNTIME_TOKEN, epochDeadline) ||
+            !scheduleSessionExpiryAlarm(config.RUNTIME_TOKEN, epochDeadline)
+        ) {
+            Log.e(TAG, "Could not arm OS-level session expiry; stopping fail-closed")
+            stopAll(config.RUNTIME_TOKEN)
+            return
+        }
+
+        armExpiryWarning(config.RUNTIME_TOKEN, epochDeadline)
+
+        deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
+        if (delayMs == 0L) deadlineHandler.post(sessionDeadlineRunnable)
+        else deadlineHandler.postDelayed(sessionDeadlineRunnable, delayMs)
+    }
+
+    // Advisory, unlike the deadline itself: nothing here fails closed. Dart
+    // re-pushes the deadline every sync, so this runs about once a minute.
+    private fun armExpiryWarning(runtimeToken: String, expiresAtEpochMs: Long) {
+        if (runtimeToken.isEmpty()) return
+
+        val warnAt = expiresAtEpochMs - RevoltAlerts.WARNING_LEAD_MS
+        // Inside the window already (or the short bootstrap deadline). Cancel
+        // nothing here: with no dedupe on the re-push, cancelling on this
+        // branch deletes the armed warning and never re-arms it.
+        if (warnAt <= System.currentTimeMillis() + WARNING_REARM_GRACE_MS) return
+
+        cancelSessionWarningAlarm()
+        // A warning on screen now belongs to an older deadline (top-up).
+        RevoltAlerts.cancelExpiryWarning(this)
+
+        try {
+            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
+            val pendingIntent = sessionWarningPendingIntent(runtimeToken)
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                // Inexact on purpose - keeps this off SCHEDULE_EXACT_ALARM.
+                alarmManager.setAndAllowWhileIdle(
+                    AlarmManager.RTC_WAKEUP,
+                    warnAt,
+                    pendingIntent,
+                )
+            } else {
+                alarmManager.set(AlarmManager.RTC_WAKEUP, warnAt, pendingIntent)
+            }
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to schedule session-expiry warning", e)
+        }
+
+        // postDelayed runs on uptimeMillis, so a truly suspended device still
+        // fires this late - handleSessionWarningAlarm then rejects it on the
+        // window check rather than claiming "5 minutes" with seconds left.
+        // Whenever the process is merely backgrounded, which is the common
+        // case, this is what actually delivers the warning.
+        val warnDelay = warnAt - System.currentTimeMillis()
+        deadlineHandler.removeCallbacks(sessionWarningRunnable)
+        if (warnDelay > 0L) {
+            deadlineHandler.postDelayed(sessionWarningRunnable, warnDelay)
+        }
+    }
+
+    private fun handleSessionWarningAlarm(alarmToken: String) {
+        val config = currentConfig
+        if (config == null) {
+            // Woke a process with no live runtime; nothing to warn about.
+            stopSelf()
+            return
+        }
+        if (alarmToken.isEmpty() || alarmToken != config.RUNTIME_TOKEN) {
+            Log.w(TAG, "Ignoring session warning for stale runtime generation")
+            return
+        }
+
+        val deadline = sessionDeadlineElapsed ?: return
+        val remaining = deadline - SystemClock.elapsedRealtime()
+        if (remaining < WARNING_FLOOR_MS ||
+            remaining > RevoltAlerts.WARNING_LEAD_MS + WARNING_SLACK_MS
+        ) {
+            // Too late, or the deadline moved. Saying "5 minutes" with
+            // seconds left is worse than silence.
+            Log.w(TAG, "Ignoring session warning outside the warning window")
+            return
+        }
+
+        RevoltAlerts.postExpiryWarning(this)
+    }
+
+    private fun clearSessionDeadline() {
+        deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
+        sessionDeadlineElapsed = null
+        sessionDeadlineToken = null
+        clearPersistedDeadline()
+        cancelSessionExpiryAlarm()
+        cancelSessionWarningAlarm()
+        RevoltAlerts.cancelExpiryWarning(this)
+    }
+
+    private fun enforceSessionDeadline() {
+        val token = sessionDeadlineToken ?: return
+        val deadline = sessionDeadlineElapsed ?: return
+        val config = currentConfig ?: return
+        if (config.RUNTIME_TOKEN != token) return
+        val remaining = deadline - SystemClock.elapsedRealtime()
+        if (remaining > 0L) {
+            deadlineHandler.postDelayed(sessionDeadlineRunnable, remaining)
+            return
+        }
+        Log.w(TAG, "Native session deadline expired; stopping runtime fail-closed")
+        stopAll(token)
+    }
+
+    private fun updateSessionDeadline(intent: Intent) {
+        val config = currentConfig ?: return
+        val token = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
+        if (token.isEmpty() || token != config.RUNTIME_TOKEN) {
+            Log.w(TAG, "Ignoring session deadline update for stale runtime generation")
+            return
+        }
+        val remainingSeconds = intent.getLongExtra("REMAINING_SECONDS", -1L)
+        if (remainingSeconds < 0L) {
+            Log.w(TAG, "Ignoring invalid negative session deadline")
+            return
+        }
+        armSessionDeadline(config, remainingSeconds)
+    }
+
+    private fun persistDeadline(runtimeToken: String, expiresAtEpochMs: Long): Boolean {
+        return try {
+            getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
+                .edit()
+                .putString(PREF_RUNTIME_TOKEN, runtimeToken)
+                .putLong(PREF_EXPIRES_AT_MS, expiresAtEpochMs)
+                .commit()
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to persist non-secret session deadline", e)
+            false
+        }
+    }
+
+    private fun clearPersistedDeadline() {
+        try {
+            getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
+                .edit()
+                .remove(PREF_RUNTIME_TOKEN)
+                .remove(PREF_EXPIRES_AT_MS)
+                .apply()
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to clear persisted session deadline", e)
+        }
+    }
+
+    private fun enforcePersistedDeadline(alarmToken: String) {
+        val stored = try {
+            val prefs = getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
+            prefs.getString(PREF_RUNTIME_TOKEN, null).orEmpty() to
+                prefs.getLong(PREF_EXPIRES_AT_MS, 0L)
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to read persisted session deadline", e)
+            clearPersistedDeadline()
+            cancelSessionExpiryAlarm()
+            stopSelf()
+            return
+        }
+
+        val storedToken = stored.first
+        val storedDeadline = stored.second
+        if (alarmToken.isEmpty() || storedToken.isEmpty() || alarmToken != storedToken) {
+            Log.w(TAG, "Ignoring stale session-expiry alarm")
+            if (currentConfig == null) stopSelf()
+            return
+        }
+
+        val remaining = storedDeadline - System.currentTimeMillis()
+        if (storedDeadline > 0L && remaining > 0L) {
+            if (!scheduleSessionExpiryAlarm(storedToken, storedDeadline)) {
+                Log.e(TAG, "Failed to re-arm early session-expiry alarm")
+                val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
+                if (activeToken == storedToken) stopAll(storedToken) else stopSelf()
+                return
+            }
+            // An alarm can wake a fresh service process after clock changes.
+            // If there is no live runtime in this process, do not leave a
+            // background service instance hanging around just to hold a timer.
+            if (currentConfig == null) stopSelf()
+            return
+        }
+
+        Log.w(TAG, "OS session-expiry alarm fired; stopping runtime fail-closed")
+        val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
+        if (activeToken.isNotEmpty() && activeToken == storedToken) {
+            stopAll(storedToken)
+        } else {
+            clearPersistedDeadline()
+            cancelSessionExpiryAlarm()
+            cancelSessionWarningAlarm()
+            RevoltAlerts.cancelExpiryWarning(this)
+            stopForeground(true)
+            stopSelf()
+            // This arm does not go through stopAll, so it posts for itself.
+            RevoltAlerts.postDisconnected(this)
+        }
+    }
+
+    private fun scheduleSessionExpiryAlarm(runtimeToken: String, expiresAtEpochMs: Long): Boolean {
+        cancelSessionExpiryAlarm()
+        if (runtimeToken.isEmpty() || expiresAtEpochMs <= 0L) return false
+
+        return try {
+            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
+            val pendingIntent = sessionExpiryPendingIntent(runtimeToken)
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                try {
+                    alarmManager.setExactAndAllowWhileIdle(
+                        AlarmManager.RTC_WAKEUP,
+                        expiresAtEpochMs,
+                        pendingIntent,
+                    )
+                } catch (_: SecurityException) {
+                    Log.w(TAG, "Exact alarm unavailable; using inexact idle-capable expiry alarm")
+                    alarmManager.setAndAllowWhileIdle(
+                        AlarmManager.RTC_WAKEUP,
+                        expiresAtEpochMs,
+                        pendingIntent,
+                    )
+                }
+            } else {
+                alarmManager.setExact(AlarmManager.RTC_WAKEUP, expiresAtEpochMs, pendingIntent)
+            }
+            true
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to schedule OS session-expiry alarm", e)
+            false
+        }
+    }
+
+    private fun cancelSessionExpiryAlarm() {
+        try {
+            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
+            alarmManager.cancel(sessionExpiryPendingIntent(""))
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to cancel session-expiry alarm", e)
+        }
+    }
+
+    private fun cancelSessionWarningAlarm() {
+        deadlineHandler.removeCallbacks(sessionWarningRunnable)
+        try {
+            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
+            // Look it up rather than build it: FLAG_UPDATE_CURRENT would
+            // rewrite the live alarm's RUNTIME_TOKEN to "" before cancelling.
+            existingSessionWarningPendingIntent()?.let { alarmManager.cancel(it) }
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to cancel session-warning alarm", e)
+        }
+    }
+
+    private fun existingSessionWarningPendingIntent(): PendingIntent? {
+        val intent = Intent(this, XrayVPNService::class.java)
+            .putExtra(EXTRA_SESSION_WARNING, true)
+        val flags = PendingIntent.FLAG_NO_CREATE or
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
+        return PendingIntent.getService(this, SESSION_WARNING_REQUEST_CODE, intent, flags)
+    }
+
+    // Identity is component + request code, not extras, so the warning needs
+    // its own code or it clobbers the expiry alarm.
+    private fun sessionWarningPendingIntent(runtimeToken: String): PendingIntent {
+        val intent = Intent(this, XrayVPNService::class.java)
+            .putExtra(EXTRA_SESSION_WARNING, true)
+            .putExtra("RUNTIME_TOKEN", runtimeToken)
+        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
+        return PendingIntent.getService(this, SESSION_WARNING_REQUEST_CODE, intent, flags)
+    }
+
+    private fun sessionExpiryPendingIntent(runtimeToken: String): PendingIntent {
+        val intent = Intent(this, XrayVPNService::class.java)
+            .putExtra(EXTRA_SESSION_EXPIRED, true)
+            .putExtra("RUNTIME_TOKEN", runtimeToken)
+        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
+        return PendingIntent.getService(this, SESSION_EXPIRY_REQUEST_CODE, intent, flags)
+    }
+
+    override fun onDestroy() {
+        if (!shuttingDownIntentionally) {
+            val confirmationToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
+            cleanup(clearDeadline = false)
+            currentConfig = null
+            XrayCoreManager.stopCore(this, confirmationToken)
+            stopForeground(true)
+        }
+        super.onDestroy()
+    }
+
+    override fun onRevoke() {
+        stopAll(userRequested = true)
+        super.onRevoke()
+    }
+
+    private fun createNotificationChannel() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val channelId = "REVOLT_VPN_SERVICE"
+            val channelName = "VPN Service"
+            val channel = android.app.NotificationChannel(
+                channelId,
+                channelName,
+                android.app.NotificationManager.IMPORTANCE_LOW
+            )
+            val manager = getSystemService(android.app.NotificationManager::class.java)
+            manager?.createNotificationChannel(channel)
+        }
+    }
+
+    private fun createNotification(content: String): android.app.Notification {
+        val channelId = "REVOLT_VPN_SERVICE"
+        val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            android.app.Notification.Builder(this, channelId)
+        } else {
+            @Suppress("DEPRECATION")
+            android.app.Notification.Builder(this)
+        }
+
+        val icon = resources.getIdentifier("notification_icon", "drawable", packageName)
+            .takeIf { it != 0 } ?: android.R.drawable.ic_dialog_info
+
+        val notification = builder
+            .setContentTitle("VPN Service")
+            .setContentText(content)
+            .setSmallIcon(icon)
+            .setOngoing(true)
+            .setAutoCancel(false)
+            .setOnlyAlertOnce(true)
+            .build()
+
+        notification.flags = notification.flags or
+            android.app.Notification.FLAG_ONGOING_EVENT or
+            android.app.Notification.FLAG_NO_CLEAR
+        return notification
+    }
+
+    companion object {
+        private const val TAG = "XrayVPNService"
+        private const val FOREGROUND_SERVICE_TYPE_SPECIAL_USE = 0x40000000
+        private const val BOOTSTRAP_SESSION_SECONDS = 120L
+        private const val DEADLINE_PREFS = "revolt_session_deadline"
+        private const val PREF_RUNTIME_TOKEN = "runtime_token"
+        private const val PREF_EXPIRES_AT_MS = "expires_at_ms"
+        private const val EXTRA_SESSION_EXPIRED = "SESSION_EXPIRED"
+        private const val EXTRA_SESSION_WARNING = "SESSION_WARNING"
+        private const val SESSION_EXPIRY_REQUEST_CODE = 1001
+        private const val SESSION_WARNING_REQUEST_CODE = 1002
+        // Drift allowed before a warning is treated as belonging elsewhere.
+        private const val WARNING_SLACK_MS = 60_000L
+        // Don't re-arm for a deadline that moved by round-trip jitter alone.
+        private const val WARNING_REARM_GRACE_MS = 15_000L
+        // Below this the warning has lost its point.
+        private const val WARNING_FLOOR_MS = 60_000L
+    }
+}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/AppConfigs.kt

@@ -0,0 +1,49 @@
+package com.github.tfox.flutter_vless.xray.utils
+
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import java.io.Serializable
+
+/**
+ * Global application configuration and state.
+ *
+ * This object holds:
+ * 1. Constants for Intent actions and Service commands.
+ * 2. Enums for connection states and modes.
+ * 3. Global state variables (current connection state, active config).
+ * 4. Static storage for notification icon resources (passed from Flutter).
+ */
+object AppConfigs {
+    const val V2RAY_CONNECTION_INFO = "com.github.tfox.flutter_vless.xray.V2RAY_CONNECTION_INFO"
+
+    /**
+     * Commands sent to the XrayVPNService via Intent.
+     */
+    enum class V2RAY_SERVICE_COMMANDS : Serializable {
+        START_SERVICE, STOP_SERVICE, RESTART_SERVICE, UPDATE_SESSION_DEADLINE
+    }
+
+    /**
+     * Connection states for the Xray Core.
+     */
+    enum class V2RAY_STATES : Serializable {
+        V2RAY_CONNECTED, V2RAY_DISCONNECTED, V2RAY_CONNECTING
+    }
+
+    /**
+     * Connection modes:
+     * - VPN_TUN: Standard VPN mode using Android VpnService (TUN device).
+     * - PROXY_ONLY: Runs Xray as a local SOCKS/HTTP proxy without establishing a VPN tunnel.
+     */
+    enum class V2RAY_CONNECTION_MODES : Serializable {
+        VPN_TUN, PROXY_ONLY
+    }
+
+    var V2RAY_STATE: V2RAY_STATES = V2RAY_STATES.V2RAY_DISCONNECTED
+    @Volatile var RUNTIME_READY: Boolean = false
+    var V2RAY_CONFIG: XrayConfig? = null
+    var V2RAY_CONNECTION_MODE: V2RAY_CONNECTION_MODES = V2RAY_CONNECTION_MODES.VPN_TUN
+
+    // Stores the resource name and type for the custom notification icon
+    var NOTIFICATION_ICON_RESOURCE_NAME: String = ""
+    var NOTIFICATION_ICON_RESOURCE_TYPE: String = ""
+}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/RevoltAlerts.kt

@@ -0,0 +1,143 @@
+package com.github.tfox.flutter_vless.xray.utils
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Build
+import android.util.Log
+
+// local_packages/.../xray/utils/RevoltAlerts.kt
+//
+// The two session alerts. Both XrayVPNService (:RunSoLibXrayDaemon) and
+// MainActivity post them, sharing ids so a second post replaces. Separate from
+// the foreground-service notification (id 1, IMPORTANCE_LOW): these must be
+// noticed, and must be dismissible.
+object RevoltAlerts {
+
+    const val CHANNEL_ID = "REVOLT_VPN_ALERTS"
+    const val WARNING_NOTIFICATION_ID = 2
+    const val DISCONNECTED_NOTIFICATION_ID = 3
+
+    const val WARNING_LEAD_MS = 5 * 60 * 1000L
+
+    private const val TAG = "RevoltAlerts"
+    private const val LAUNCH_REQUEST_CODE = 2001
+
+    // Neither line names a number or a mechanism, because this notification
+    // cannot honour either. The caller accepts it anywhere from WARNING_FLOOR_MS
+    // to WARNING_LEAD_MS + WARNING_SLACK_MS remaining, so "5 minutes" can be
+    // off by four of them; and "watch an ad" is a dead end in a release build,
+    // where the support bypass is still kDebugMode-gated (rule 87). Put the
+    // number back once the warning is punctual, and the ad back once the
+    // support button works without a debug build.
+    fun postExpiryWarning(context: Context) {
+        post(
+            context,
+            WARNING_NOTIFICATION_ID,
+            "Revolt VPN disconnects soon",
+            "Open the app to extend your session.",
+        )
+    }
+
+    fun postDisconnected(context: Context) {
+        post(
+            context,
+            DISCONNECTED_NOTIFICATION_ID,
+            "Revolt VPN disconnected",
+            "Your traffic is no longer protected. Tap to reconnect.",
+        )
+    }
+
+    fun cancelExpiryWarning(context: Context) = cancel(context, WARNING_NOTIFICATION_ID)
+
+    fun cancelDisconnected(context: Context) = cancel(context, DISCONNECTED_NOTIFICATION_ID)
+
+    fun cancelAll(context: Context) {
+        cancelExpiryWarning(context)
+        cancelDisconnected(context)
+    }
+
+    private fun cancel(context: Context, id: Int) {
+        try {
+            manager(context)?.cancel(id)
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to cancel alert $id", e)
+        }
+    }
+
+    private fun post(context: Context, id: Int, title: String, text: String) {
+        if (!canPost(context)) {
+            Log.w(TAG, "POST_NOTIFICATIONS not granted; dropping alert $id")
+            return
+        }
+
+        try {
+            val manager = manager(context) ?: return
+            ensureChannel(manager)
+
+            val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                Notification.Builder(context, CHANNEL_ID)
+            } else {
+                @Suppress("DEPRECATION")
+                Notification.Builder(context).setPriority(Notification.PRIORITY_HIGH)
+            }
+
+            val icon = context.resources
+                .getIdentifier("notification_icon", "drawable", context.packageName)
+                .takeIf { it != 0 } ?: android.R.drawable.ic_dialog_info
+
+            builder
+                .setContentTitle(title)
+                .setContentText(text)
+                .setStyle(Notification.BigTextStyle().bigText(text))
+                .setSmallIcon(icon)
+                .setAutoCancel(true)
+                .setOngoing(false)
+                // A replacing post must not sound again.
+                .setOnlyAlertOnce(true)
+
+            launchIntent(context)?.let { builder.setContentIntent(it) }
+
+            manager.notify(id, builder.build())
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to post alert $id", e)
+        }
+    }
+
+    private fun canPost(context: Context): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) return true
+        return context.checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) ==
+            PackageManager.PERMISSION_GRANTED
+    }
+
+    private fun manager(context: Context): NotificationManager? =
+        context.getSystemService(Context.NOTIFICATION_SERVICE) as? NotificationManager
+
+    // Importance is fixed at creation, so ask for HIGH up front.
+    private fun ensureChannel(manager: NotificationManager) {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        if (manager.getNotificationChannel(CHANNEL_ID) != null) return
+        val channel = NotificationChannel(
+            CHANNEL_ID,
+            "Session alerts",
+            NotificationManager.IMPORTANCE_HIGH,
+        )
+        channel.description = "Warns before a session ends and when protection stops."
+        manager.createNotificationChannel(channel)
+    }
+
+    private fun launchIntent(context: Context): PendingIntent? {
+        val intent = context.packageManager.getLaunchIntentForPackage(context.packageName)
+            ?: return null
+        intent.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or
+            Intent.FLAG_ACTIVITY_CLEAR_TOP or
+            Intent.FLAG_ACTIVITY_NEW_TASK
+        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
+        return PendingIntent.getActivity(context, LAUNCH_REQUEST_CODE, intent, flags)
+    }
+}

local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/Utilities.kt

@@ -0,0 +1,62 @@
+package com.github.tfox.flutter_vless.xray.utils
+
+import android.content.Context
+import java.io.File
+import java.io.FileOutputStream
+import java.io.IOException
+import java.io.InputStream
+import java.io.OutputStream
+
+object Utilities {
+
+    fun getUserAssetsPath(context: Context): String {
+        val dir = context.filesDir
+        if (!dir.exists()) {
+            dir.mkdirs()
+        }
+        return dir.absolutePath
+    }
+
+    fun copyAssets(context: Context) {
+        val assets = context.assets
+        val files = assets.list("") ?: return
+        for (filename in files) {
+            if (filename == "geoip.dat" || filename == "geosite.dat") {
+                var `in`: InputStream? = null
+                var out: OutputStream? = null
+                try {
+                    `in` = assets.open(filename)
+                    val outFile = File(getUserAssetsPath(context), filename)
+                    out = FileOutputStream(outFile)
+                    copyFile(`in`, out)
+                } catch (e: IOException) {
+                    e.printStackTrace()
+                } finally {
+                    if (`in` != null) {
+                        try {
+                            `in`.close()
+                        } catch (e: IOException) {
+                            e.printStackTrace()
+                        }
+                    }
+                    if (out != null) {
+                        try {
+                            out.close()
+                        } catch (e: IOException) {
+                            e.printStackTrace()
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    @Throws(IOException::class)
+    private fun copyFile(`in`: InputStream, out: OutputStream) {
+        val buffer = ByteArray(1024)
+        var read: Int
+        while (`in`.read(buffer).also { read = it } != -1) {
+            out.write(buffer, 0, read)
+        }
+    }
+}

local_packages/flutter_vless_android-1.1.5/android/src/test/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManagerTest.kt

@@ -0,0 +1,178 @@
+package com.github.tfox.flutter_vless.xray.core
+
+import com.github.tfox.flutter_vless.xray.dto.XrayConfig
+import java.io.File
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Test
+
+class XrayCoreManagerTest {
+    @Test
+    fun buildRuntimeConfigJson_keepsSecureSocksAndSanitizesLogs() {
+        val filesDir = File("build/test-files/runtime-secure")
+        val config = XrayConfig(
+            V2RAY_FULL_JSON_CONFIG = runtimeConfig(
+                extraLog = """
+                    "log": {
+                      "access": "/tmp/access.log",
+                      "error": "/tmp/error.log"
+                    },
+                """.trimIndent(),
+            )
+        )
+
+        val output = XrayCoreManager.buildRuntimeConfigJson(config, filesDir)
+        val log = output.getJSONObject("log")
+        val inbound = output.getJSONArray("inbounds").getJSONObject(0)
+        val user = output
+            .getJSONArray("outbounds")
+            .getJSONObject(0)
+            .getJSONObject("settings")
+            .getJSONArray("vnext")
+            .getJSONObject(0)
+            .getJSONArray("users")
+            .getJSONObject(0)
+
+        assertFalse(log.has("access"))
+        assertEquals(File(filesDir, "error.log").absolutePath, log.getString("error"))
+        assertEquals("revolt-secure-socks", inbound.getString("tag"))
+        assertEquals("password", inbound.getJSONObject("settings").getString("auth"))
+        assertEquals(19080, config.LOCAL_SOCKS5_PORT)
+        assertEquals(0, config.LOCAL_HTTP_PORT)
+        assertEquals(vlessEncryption, user.getString("encryption"))
+        assertEquals("xtls-rprx-vision", user.getString("flow"))
+    }
+
+    @Test
+    fun buildRuntimeConfigJson_rejectsInvalidSecureSocks() {
+        val config = XrayConfig(
+            V2RAY_FULL_JSON_CONFIG = """
+                {
+                  "inbounds": [
+                    {
+                      "tag": "revolt-secure-socks",
+                      "listen": "127.0.0.1",
+                      "port": 19080,
+                      "protocol": "socks",
+                      "settings": { "auth": "noauth", "users": [] }
+                    }
+                  ],
+                  "outbounds": []
+                }
+            """.trimIndent()
+        )
+
+        try {
+            XrayCoreManager.buildRuntimeConfigJson(
+                config,
+                File("build/test-files/runtime-invalid-socks"),
+            )
+            fail("Invalid secure SOCKS5 configuration must fail closed")
+        } catch (expected: IllegalStateException) {
+            assertTrue(expected.message.orEmpty().contains("Secure SOCKS5"))
+        }
+    }
+
+    @Test
+    fun buildRuntimeConfigJson_normalizesXrayRuntimeAliases() {
+        val config = XrayConfig(
+            V2RAY_FULL_JSON_CONFIG = """
+                {
+                  "inbounds": [
+                    {
+                      "tag": "revolt-secure-socks",
+                      "listen": "127.0.0.1",
+                      "port": 19080,
+                      "protocol": "socks",
+                      "settings": {
+                        "auth": "password",
+                        "users": [{"user": "runtime-user", "pass": "runtime-pass"}]
+                      }
+                    }
+                  ],
+                  "outbounds": [
+                    {
+                      "protocol": "vless",
+                      "settings": {
+                        "vnext": [
+                          {
+                            "address": "example.com",
+                            "port": 443,
+                            "users": [{"id": "11111111-1111-4111-8111-111111111111", "encryption": "none"}]
+                          }
+                        ]
+                      },
+                      "streamSettings": {
+                        "network": "XHTTP",
+                        "security": "tls",
+                        "tlsSettings": {"allowInsecure": false, "serverName": "example.com"},
+                        "xHTTPSettings": {"path": "/", "mode": "auto"},
+                        "httpUpgradeSettings": {"path": "/upgrade"},
+                        "splitHTTPSettings": {"path": "/split"}
+                      }
+                    }
+                  ]
+                }
+            """.trimIndent()
+        )
+
+        val output = XrayCoreManager.buildRuntimeConfigJson(
+            config,
+            File("build/test-files/runtime-aliases"),
+        )
+        val stream = output
+            .getJSONArray("outbounds")
+            .getJSONObject(0)
+            .getJSONObject("streamSettings")
+
+        assertEquals("xhttp", stream.getString("network"))
+        assertTrue(stream.has("xhttpSettings"))
+        assertTrue(stream.has("httpupgradeSettings"))
+        assertTrue(stream.has("splithttpSettings"))
+        assertFalse(stream.has("xHTTPSettings"))
+        assertFalse(stream.has("httpUpgradeSettings"))
+        assertFalse(stream.has("splitHTTPSettings"))
+        assertFalse(stream.getJSONObject("tlsSettings").has("allowInsecure"))
+    }
+
+    private fun runtimeConfig(extraLog: String = ""): String = """
+        {
+          $extraLog
+          "inbounds": [
+            {
+              "tag": "revolt-secure-socks",
+              "listen": "127.0.0.1",
+              "port": 19080,
+              "protocol": "socks",
+              "settings": {
+                "auth": "password",
+                "users": [{"user": "runtime-user", "pass": "runtime-pass"}]
+              }
+            }
+          ],
+          "outbounds": [
+            {
+              "tag": "proxy",
+              "protocol": "vless",
+              "settings": {
+                "address": "xhttp.example.com",
+                "port": 443,
+                "id": "b94da146-a56e-49d7-af4c-a68c9065cbfd",
+                "encryption": "$vlessEncryption",
+                "flow": "xtls-rprx-vision",
+                "level": 8
+              },
+              "streamSettings": {"network": "xhttp", "security": "none"}
+            }
+          ]
+        }
+    """.trimIndent()
+
+    private companion object {
+        const val vlessEncryption =
+            "mlkem768x25519plus.native.1rtt.100-500-2000.75-0-100.80-0-5000.gtmOXB2AN_r905czmOIr6dKq_YDdEJB8RWGqfsXurns"
+    }
+}

local_packages/flutter_vless_android-1.1.5/lib/flutter_vless_android.dart

@@ -0,0 +1,13 @@
+// Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
+// SPDX-License-Identifier: MIT
+
+import 'package:flutter_vless_platform_interface/flutter_vless_platform_interface.dart';
+
+/// Android implementation of [VlessPlatform] using MethodChannel.
+class FlutterVlessAndroid extends VlessMethodChannelAdapter {
+  /// Registers this class as the platform implementation.
+  /// This is called automatically by Flutter's plugin registry.
+  static void registerWith() {
+    VlessPlatform.instance = FlutterVlessAndroid();
+  }
+}

local_packages/flutter_vless_android-1.1.5/pubspec.yaml

@@ -0,0 +1,31 @@
+name: flutter_vless_android
+description: Android implementation of the flutter_vless plugin.
+version: 1.1.5
+homepage: https://tfox.dev
+repository: https://github.com/XIIIFOX/flutter_vless
+issue_tracker: https://github.com/XIIIFOX/flutter_vless/issues
+documentation: https://github.com/XIIIFOX/flutter_vless/blob/main/doc/platform/android.md
+funding:
+  - https://tfox.dev
+
+environment:
+  sdk: '>=3.4.0 <4.0.0'
+  flutter: '>=3.3.0'
+
+dependencies:
+  flutter:
+    sdk: flutter
+  flutter_vless_platform_interface: ^1.1.0
+
+dev_dependencies:
+  flutter_test:
+    sdk: flutter
+  flutter_lints: ^6.0.0
+
+flutter:
+  plugin:
+    implements: flutter_vless_platform_interface
+    platforms:
+      android:
+        package: com.github.tfox.flutter_vless
+        pluginClass: FlutterVlessPlugin

pubspec.lock

@@ -65,14 +65,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "3.0.7"
-  cupertino_icons:
-    dependency: "direct main"
-    description:
-      name: cupertino_icons
-      sha256: "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd"
-      url: "https://pub.dev"
-    source: hosted
-    version: "1.0.9"
   fake_async:
     dependency: transitive
     description:
@@ -180,12 +172,11 @@ packages:
     source: hosted
     version: "1.1.5"
   flutter_vless_android:
-    dependency: transitive
+    dependency: "direct overridden"
     description:
-      name: flutter_vless_android
+      path: "local_packages/flutter_vless_android-1.1.5"
-      sha256: "5e6fe73d3606ed8c73e87fac15efa7631e12ce18d39a4bd4e13b6c097c6d52b9"
+      relative: true
-      url: "https://pub.dev"
+    source: path
-    source: hosted
     version: "1.1.5"
   flutter_vless_macos:
     dependency: transitive
@@ -216,14 +207,6 @@ packages:
     description: flutter
     source: sdk
     version: "0.0.0"
-  google_fonts:
-    dependency: "direct main"
-    description:
-      name: google_fonts
-      sha256: ba03d03bcaa2f6cb7bd920e3b5027181db75ab524f8891c8bc3aa603885b8055
-      url: "https://pub.dev"
-    source: hosted
-    version: "6.3.3"
   google_mobile_ads:
     dependency: "direct main"
     description:
@@ -316,10 +299,10 @@ packages:
     dependency: transitive
     description:
       name: matcher
-      sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
+      sha256: "31bd099b47c10cd1aeb55146a2d46ce0277630ecef3f7dae54ad7873f36696cd"
       url: "https://pub.dev"
     source: hosted
-    version: "0.12.19"
+    version: "0.12.20"
   material_color_utilities:
     dependency: transitive
     description:
@@ -332,10 +315,10 @@ packages:
     dependency: transitive
     description:
       name: meta
-      sha256: "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349"
+      sha256: "307249ce4ff29d58a18e97f6345f539382eb9c9c29ecda628900f31de0443dd9"
       url: "https://pub.dev"
     source: hosted
-    version: "1.18.0"
+    version: "1.19.0"
   nested:
     dependency: transitive
     description:
@@ -385,7 +368,7 @@ packages:
     source: hosted
     version: "1.9.1"
   path_provider:
-    dependency: "direct main"
+    dependency: transitive
     description:
       name: path_provider
       sha256: "50c5dd5b6e1aaf6fb3a78b33f6aa3afca52bf903a8a5298f53101fdaee55bbcd"
@@ -577,10 +560,10 @@ packages:
     dependency: transitive
     description:
       name: test_api
-      sha256: "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e"
+      sha256: "2a122cbe059f8b610d3a5415f42e255b6c17b1f21eee1d960f31080237fb4f11"
       url: "https://pub.dev"
     source: hosted
-    version: "0.7.11"
+    version: "0.7.12"
   typed_data:
     dependency: transitive
     description:
@@ -665,10 +648,10 @@ packages:
     dependency: transitive
     description:
       name: vector_math
-      sha256: d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b
+      sha256: f36f9f3be64c6198714492bb455c11056e33e2f85d9a0b676a48301e44fdcf47
       url: "https://pub.dev"
     source: hosted
-    version: "2.2.0"
+    version: "2.4.2"
   vm_service:
     dependency: transitive
     description:
@@ -742,5 +725,5 @@ packages:
     source: hosted
     version: "3.1.3"
 sdks:
-  dart: ">=3.10.3 <4.0.0"
+  dart: ">=3.11.0-0 <4.0.0"
   flutter: ">=3.38.4"

pubspec.yaml

@@ -15,7 +15,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # In iOS, build-name is used as CFBundleShortVersionString while build-number used as CFBundleVersion.
 # Read more about iOS versioning at
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
-version: 3.3.2+28
+version: 3.3.8+34
 
 environment:
   sdk: ">=3.0.0 <4.0.0"
@@ -24,10 +24,6 @@ dependencies:
   flutter:
     sdk: flutter
 
-  # The following adds the Cupertino Icons font to your application.
-  # Use with the CupertinoIcons class for iOS style icons.
-  cupertino_icons: ^1.0.5
-  google_fonts: ^6.1.0
   provider: ^6.1.1
   google_mobile_ads: ^4.0.0
   flutter_vless: 1.1.5
@@ -36,7 +32,6 @@ dependencies:
   url_launcher: ^6.3.2
   flutter_secure_storage: ^10.3.1
   uuid: ^4.5.3
-  path_provider: ^2.1.5
   package_info_plus: ^6.0.0
 
 dev_dependencies:
@@ -83,3 +78,7 @@ flutter:
   #
   # For details regarding fonts from package dependencies,
   # see https://flutter.dev/custom-fonts/#from-packages
+
+dependency_overrides:
+  flutter_vless_android:
+    path: local_packages/flutter_vless_android-1.1.5

test/release_verification_regression_test.dart

@@ -0,0 +1,87 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:revoltvpn/logic/secure_socks_session.dart';
+
+void main() {
+  test('release verification stays fail-closed and reproducible', () {
+    final gradle = File('android/app/build.gradle.kts').readAsStringSync();
+    final workflow = File('.github/workflows/android-ci.yml').readAsStringSync();
+    final lockfile = File('pubspec.lock').readAsStringSync();
+    final wrapper =
+        File('android/gradle/wrapper/gradle-wrapper.properties').readAsStringSync();
+    final verification =
+        File('android/gradle/verification-metadata.xml').readAsStringSync();
+    final proguard = File('android/app/proguard-rules.pro').readAsStringSync();
+
+    expect(
+      wrapper,
+      contains(
+        'distributionSha256Sum='
+        'efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1',
+      ),
+    );
+    expect(wrapper, contains('validateDistributionUrl=true'));
+
+    expect(verification, contains('<verify-metadata>true</verify-metadata>'));
+    expect(verification, contains('<verify-signatures>false</verify-signatures>'));
+    expect(verification, contains('<sha256 value='));
+    expect(
+      verification,
+      contains('a804b261645ef8c13eb3d5c44a5c2fb0340c5539'),
+    );
+
+    expect(gradle, contains('REVOLT_APP_CONFIG_SHA256'));
+    expect(gradle, contains('verifyReleaseAppConfig'));
+    expect(gradle, contains('preReleaseBuild'));
+    expect(gradle, contains('isMinifyEnabled = true'));
+    expect(gradle, contains('isShrinkResources = true'));
+    expect(gradle, contains('REVOLT_CI_RELEASE_SMOKE'));
+    expect(gradle, contains('signingConfigs.getByName("release")'));
+
+    expect(workflow, contains("flutter-version: '3.47.2'"));
+    expect(workflow, contains('Verify Gradle supply chain'));
+    expect(workflow, contains('Verify dependency lock is committed'));
+    expect(workflow, contains('Verify production release config fails closed'));
+    expect(workflow, contains('Cold APK build'));
+    expect(workflow, contains('Warm APK build'));
+    expect(workflow, contains('Release R8 smoke build'));
+    expect(workflow, contains('Verify tracked build inputs stayed immutable'));
+    expect(workflow, contains('REVOLT_CI_RELEASE_SMOKE'));
+    expect(
+      workflow,
+      contains('actions/checkout@11d5960a326750d5838078e36cf38b85af677262'),
+    );
+    expect(
+      workflow,
+      contains('actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961'),
+    );
+    expect(lockfile, contains('dart: ">=3.11.0-0 <4.0.0"'));
+
+    expect(proguard, contains('-keep class io.flutter.** { *; }'));
+    expect(proguard, contains('-keep class xray.** { *; }'));
+  });
+
+  test('runtime keeps authenticated SOCKS on the IPv4 loopback', () async {
+    final session = await SecureSocksSession.create(jsonEncode({
+      'inbounds': <Object?>[],
+      'outbounds': <Object?>[],
+    }));
+    final config = jsonDecode(session.configJson) as Map<String, dynamic>;
+    final inbounds = config['inbounds'] as List<dynamic>;
+    final inbound = inbounds.single as Map<String, dynamic>;
+    final settings = inbound['settings'] as Map<String, dynamic>;
+    final users = settings['users'] as List<dynamic>;
+    final account = users.single as Map<String, dynamic>;
+
+    expect(inbound['tag'], SecureSocksSession.inboundTag);
+    expect(inbound['listen'], '127.0.0.1');
+    expect(inbound['port'], session.port);
+    expect(settings['auth'], 'password');
+    expect(account['user'], session.username);
+    expect(account['pass'], session.password);
+    expect(session.username, isNotEmpty);
+    expect(session.password, isNotEmpty);
+  });
+}

test/session_lifecycle_regression_test.dart

@@ -0,0 +1,187 @@
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+
+// Source assertions, in the style of release_verification_regression_test.dart.
+// The behaviours below were all found broken on a device and fixed on
+// 2026-10-17 (internal/DEVICE_TEST_2026-10-17.md). None of them can be covered
+// by a Dart unit test - they live in the vendored Android runtime, and the one
+// that does not needs a live tunnel - but every one of them regresses silently
+// and looks like tidying when it does. Pin the shape instead of the behaviour.
+
+const _runtime = 'local_packages/flutter_vless_android-1.1.5/android/src/main/'
+    'kotlin/com/github/tfox/flutter_vless/xray';
+
+void main() {
+  test('Xray core recovery survives running off a bare thread', () {
+    final core = File('$_runtime/core/XrayCoreManager.kt').readAsStringSync();
+
+    // startTimer builds a CountDownTimer, which builds a Handler. Recovery runs
+    // on a plain Thread, so constructing it inline threw Looper.prepare() and
+    // killed every restart attempt.
+    expect(core, contains('Handler(Looper.getMainLooper())'));
+    expect(core, contains('runOnMain'));
+    expect(
+      core,
+      contains('runOnMain { startTimerOnMain(context, token) }'),
+      reason: 'startTimer must not construct the CountDownTimer inline',
+    );
+
+    // The post must not outlive the generation that scheduled it.
+    expect(core, contains('if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != token) return'));
+
+    // pb.start() succeeds before the throw, so the catch has to kill the
+    // process or each retry strands another live core.
+    expect(core, contains('val orphan = xrayProcess'));
+    expect(
+      core.indexOf('xrayProcess = null'),
+      lessThan(core.indexOf('orphan?.destroy()')),
+      reason: 'clear the field before destroying, so the monitor thread\'s '
+          'identity guard fails and recovery is not re-entered',
+    );
+  });
+
+  test('a failed Xray core still reports why, without logging destinations', () {
+    final core = File('$_runtime/core/XrayCoreManager.kt').readAsStringSync();
+
+    expect(core, contains('STARTUP_LOG_WINDOW_MS'));
+    expect(core, contains('STARTUP_LOG_MAX_LINES'));
+    expect(
+      core,
+      isNot(contains('reader.forEachLine { _ -> }')),
+      reason: 'discarding the core output leaves exit 23 undiagnosable',
+    );
+    // Rule 95: a core that has been up long enough to carry traffic must not
+    // have its log retained.
+    expect(core, contains('startupLog.clear()'));
+  });
+
+  test('the expiry warning has the same backstop as the deadline', () {
+    final service = File('$_runtime/service/XrayVPNService.kt').readAsStringSync();
+
+    // The alarm alone is inexact on purpose (no SCHEDULE_EXACT_ALARM) and Doze
+    // deferred it past the end of the session it was warning about.
+    expect(service, contains('sessionWarningRunnable'));
+    expect(
+      service,
+      contains('deadlineHandler.postDelayed(sessionWarningRunnable, warnDelay)'),
+      reason: 'without this the warning never arrives when the app is closed',
+    );
+    expect(
+      service,
+      contains('deadlineHandler.removeCallbacks(sessionWarningRunnable)'),
+      reason: 'a cancelled warning must drop its Handler callback too',
+    );
+    expect(service, isNot(contains('SCHEDULE_EXACT_ALARM"')));
+  });
+
+  test('the warning promises neither a number of minutes nor an ad', () {
+    final alerts = File('$_runtime/utils/RevoltAlerts.kt').readAsStringSync();
+
+    // It is accepted anywhere from WARNING_FLOOR_MS to LEAD + SLACK remaining,
+    // so a figure can be off by minutes; and the support bypass is still
+    // kDebugMode-gated (rule 87), so an ad is a dead end in release.
+    expect(alerts, isNot(contains('disconnects in 5 minutes')));
+    expect(alerts, isNot(contains('Watch an ad')));
+    expect(alerts, contains('Revolt VPN disconnects soon'));
+  });
+
+  test('the countdown notification is taken down when the tunnel stops', () {
+    final service = File('lib/logic/notification_service.dart').readAsStringSync();
+    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
+    final activity =
+        File('android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt')
+            .readAsStringSync();
+
+    // updateTimer re-posts an ongoing, non-dismissible notification every tick,
+    // so a tick after the service stops strands a frozen countdown.
+    expect(service, contains('cancelTimer'));
+    expect(activity, contains('"cancelNotification"'));
+    expect(timer, contains('await NotificationService.cancelTimer()'));
+
+    // Must run after the service is down, or the platform swallows the cancel.
+    expect(
+      timer.indexOf('await vpnConnection.disconnect();'),
+      lessThan(timer.indexOf('await NotificationService.cancelTimer()')),
+    );
+  });
+
+  test('only a user-requested disconnect hands the session back', () {
+    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
+    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
+
+    expect(hivemind, contains('releaseSession'));
+    expect(hivemind, contains("_publicUrl('/session/stop')"));
+
+    // /session/stop takes a device_id as its only proof of ownership, so it
+    // must never be reachable from an error path. disconnect() is called only
+    // by the connect button; _doDisconnect is every other ending.
+    final disconnectEntry = timer.indexOf('Future<void> disconnect({');
+    final doDisconnect = timer.indexOf('Future<void> _doDisconnect(');
+    final release = timer.indexOf('HivemindService.releaseSession()');
+    expect(release, greaterThan(disconnectEntry));
+    expect(
+      release,
+      lessThan(doDisconnect),
+      reason: 'releaseSession belongs in disconnect(), not _doDisconnect',
+    );
+    expect(
+      'HivemindService.releaseSession()'.allMatches(timer).length,
+      1,
+      reason: 'exactly one call site',
+    );
+  });
+
+  test('every session starts the same way - no re-attach path', () {
+    final mode =
+        File('lib/screens/settings/in_settings/connection_mode.dart')
+            .readAsStringSync();
+    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
+    final vpn = File('lib/logic/vpn_connection.dart').readAsStringSync();
+    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
+
+    // SOCKS5 Reconnect used to re-attach to the session already held. It was
+    // the only place a session began without an ad and without a nonce binding
+    // it, and it needed three parameters and a carve-out in rule 4 to support.
+    // Reconnect now ends the session and starts a fresh one, like the button.
+    expect(mode, contains("ad.showAd('main')"));
+    expect(mode, contains('vpn.connect(adNonce: adNonce)'));
+    expect(mode, isNot(contains('resume: true')));
+    expect(mode, isNot(contains('release: false')));
+    expect(mode, isNot(contains('resetSupportClaim')));
+
+    // The special cases that only existed for it are gone.
+    expect(hivemind, isNot(contains('bool resume')));
+    expect(vpn, isNot(contains('bool resume')));
+    expect(timer, isNot(contains('bool release')));
+    expect(timer, isNot(contains('resetSupportClaim')));
+
+    // So the nonce is now unconditional: no path accepts whatever the server
+    // happens to hold.
+    expect(
+      hivemind,
+      contains('if (serverNonce is! String || serverNonce != nonce) return null;'),
+      reason: 'the nonce check must not be skippable',
+    );
+  });
+
+  test('nothing probes the control plane while disconnected - rule 60', () {
+    final vpn = File('lib/logic/vpn_connection.dart').readAsStringSync();
+    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
+    final bar = File('lib/components/status_bar.dart').readAsStringSync();
+
+    // The runtime excludes the app from its own tunnel
+    // (XrayVPNService.kt addDisallowedApplication), so a periodic /health probe
+    // was a cleartext-SNI metronome to the API host - which resolves to the
+    // tunnel IP. It fed step 1 of the kill chain in KNOWN_SECURITY_ISSUES #3,
+    // in exchange for a green dot before the user had connected to anything.
+    expect(vpn, isNot(contains('_healthTimer')));
+    expect(vpn, isNot(contains('_checkHealth')));
+    expect(hivemind, isNot(contains('checkHealth')));
+    expect(hivemind, isNot(contains("'/health'")));
+
+    // Reachability is passive now: a session sync that succeeded, nothing else.
+    expect(bar, isNot(contains('serverReachable')));
+    expect(bar, contains('isConnected && timer.hasSyncedOnce'));
+  });
+}

tool/patch_flutter_vless_allowed_apps.dart

@@ -1,293 +0,0 @@
-import 'dart:convert';
-import 'dart:io';
-
-const packageName = 'flutter_vless_android';
-const expectedVersionFragment = 'flutter_vless_android-1.1.5';
-
-Never fail(String message) {
-  stderr.writeln('[flutter_vless patch] $message');
-  exit(1);
-}
-
-Directory packageRoot() {
-  final configFile = File('.dart_tool/package_config.json');
-  if (!configFile.existsSync()) {
-    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
-  }
-
-  final decoded = jsonDecode(configFile.readAsStringSync());
-  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
-    fail('package_config.json is invalid');
-  }
-
-  Map<String, dynamic>? package;
-  for (final item in decoded['packages'] as List) {
-    if (item is Map && item['name'] == packageName) {
-      package = Map<String, dynamic>.from(item);
-      break;
-    }
-  }
-  if (package == null) fail('$packageName was not found');
-
-  final rootUriValue = package['rootUri'];
-  if (rootUriValue is! String || rootUriValue.isEmpty) {
-    fail('$packageName has no rootUri');
-  }
-
-  final rootUri = Uri.parse(rootUriValue);
-  final resolved = rootUri.hasScheme
-      ? rootUri
-      : configFile.parent.absolute.uri.resolveUri(rootUri);
-  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
-
-  final root = Directory.fromUri(resolved);
-  final normalized = root.absolute.path.replaceAll('\\', '/');
-  if (!normalized.contains(expectedVersionFragment)) {
-    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
-  }
-  if (!root.existsSync()) fail('package root does not exist: ${root.path}');
-  return root;
-}
-
-void replaceOnce(
-  File file,
-  String oldValue,
-  String newValue,
-  String marker,
-) {
-  if (!file.existsSync()) fail('missing upstream source: ${file.path}');
-  final text = file.readAsStringSync();
-  if (text.contains(marker)) {
-    stdout.writeln('[flutter_vless patch] already current: ${file.path}');
-    return;
-  }
-  if (!text.contains(oldValue)) {
-    fail('upstream source changed; expected block not found in ${file.path}');
-  }
-  file.writeAsStringSync(text.replaceFirst(oldValue, newValue));
-  stdout.writeln('[flutter_vless patch] patched: ${file.path}');
-}
-
-void replaceOneOf(
-  File file,
-  Map<String, String> replacements,
-  String marker,
-) {
-  if (!file.existsSync()) fail('missing upstream source: ${file.path}');
-  var text = file.readAsStringSync();
-  if (text.contains(marker)) {
-    stdout.writeln('[flutter_vless patch] already current: ${file.path}');
-    return;
-  }
-  for (final entry in replacements.entries) {
-    if (!text.contains(entry.key)) continue;
-    text = text.replaceFirst(entry.key, entry.value);
-    file.writeAsStringSync(text);
-    stdout.writeln('[flutter_vless patch] patched/upgraded: ${file.path}');
-    return;
-  }
-  fail('upstream/legacy patch shape not recognized in ${file.path}');
-}
-
-void main() {
-  final root = packageRoot();
-  final kotlin = Directory(
-    '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless',
-  );
-
-  final configFile = File('${kotlin.path}/xray/dto/XrayConfig.kt');
-  replaceOnce(
-    configFile,
-    '''    /** List of app package names to exclude from VPN. */
-    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
-''',
-    '''    /** List of app package names to exclude from VPN. */
-    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
-
-    /** List of app package names that are exclusively allowed into VPN. */
-    var ALLOWED_APPS: ArrayList<String> = ArrayList(),
-''',
-    'var ALLOWED_APPS:',
-  );
-
-  final pluginFile = File('${kotlin.path}/FlutterVlessPlugin.kt');
-  replaceOnce(
-    pluginFile,
-    '''    private lateinit var context: Context
-''',
-    '''    private lateinit var context: Context
-    private var allowedApps: ArrayList<String> = ArrayList()
-''',
-    'private var allowedApps:',
-  );
-
-  const currentAllowedHandler = '''            "setAllowedApps" -> {
-                val requested = call.argument<ArrayList<String>>("allowed_apps") ?: ArrayList()
-                allowedApps = ArrayList(
-                    requested
-                        .map { it.trim() }
-                        .filter { it.isNotEmpty() && it != context.packageName }
-                        .distinct()
-                        .sorted()
-                )
-                result.success(null)
-            }
-''';
-  const legacyAllowedHandler = '''            "setAllowedApps" -> {
-                val requested = call.argument<ArrayList<String>>("allowed_apps") ?: ArrayList()
-                allowedApps = ArrayList(
-                    requested.map { it.trim() }.filter { it.isNotEmpty() }.distinct()
-                )
-                result.success(null)
-            }
-''';
-  replaceOneOf(
-    pluginFile,
-    <String, String>{
-      legacyAllowedHandler: currentAllowedHandler,
-      '''        when (call.method) {
-            "startVless" -> {
-''': '''        when (call.method) {
-$currentAllowedHandler            "startVless" -> {
-''',
-    },
-    'it.isNotEmpty() && it != context.packageName',
-  );
-
-  replaceOnce(
-    pluginFile,
-    '''                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
-                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
-''',
-    '''                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
-                config.ALLOWED_APPS = ArrayList(allowedApps)
-                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
-''',
-    'config.ALLOWED_APPS = ArrayList(allowedApps)',
-  );
-
-  final serviceFile = File('${kotlin.path}/xray/service/XrayVPNService.kt');
-  replaceOnce(
-    serviceFile,
-    '''            if (config != null) {
-                // Ensure clean state before starting
-                cleanup()
-''',
-    '''            if (config != null) {
-                // A fast reconnect must not leave the previous Xray process
-                // owning the local SOCKS/HTTP ports.
-                if (XrayCoreManager.isXrayRunning()) {
-                    Log.w(TAG, "Stopping stale Xray core before restart")
-                    XrayCoreManager.stopCore(this)
-                }
-                cleanup()
-''',
-    'Stopping stale Xray core before restart',
-  );
-
-  replaceOnce(
-    serviceFile,
-    '''        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
-        val sockPath = File(filesDir, "sock_path").absolutePath
-''',
-    '''        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
-        val socketFile = File(filesDir, "sock_path")
-        if (socketFile.exists() && !socketFile.delete()) {
-            Log.w(TAG, "Could not delete stale tun2socks socket")
-        }
-        val sockPath = socketFile.absolutePath
-''',
-    'Could not delete stale tun2socks socket',
-  );
-
-  final upstreamPolicy = r'''          try {
-    builder.addDisallowedApplication(packageName)
-} catch (e: Exception) {
-    Log.e(TAG, \"Failed to exclude app from VPN\", e)
-}
-
-for (pkg in config.BLOCKED_APPS) {
-    try {
-        builder.addDisallowedApplication(pkg)
-        Log.d(TAG, \"Excluded from VPN: $pkg\")
-    } catch (e: Exception) {
-        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
-    }
-}
-'''.replaceAll(r'\"', '"');
-
-  final legacyPatchedPolicy = r'''            if (config.ALLOWED_APPS.isNotEmpty()) {
-                for (pkg in config.ALLOWED_APPS) {
-                    try {
-                        builder.addAllowedApplication(pkg)
-                        Log.d(TAG, \"Allowed into VPN: $pkg\")
-                    } catch (e: Exception) {
-                        Log.e(TAG, \"Failed to allow $pkg into VPN\", e)
-                    }
-                }
-            } else {
-                try {
-                    builder.addDisallowedApplication(packageName)
-                } catch (e: Exception) {
-                    Log.e(TAG, \"Failed to exclude app from VPN\", e)
-                }
-
-                for (pkg in config.BLOCKED_APPS) {
-                    try {
-                        builder.addDisallowedApplication(pkg)
-                        Log.d(TAG, \"Excluded from VPN: $pkg\")
-                    } catch (e: Exception) {
-                        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
-                    }
-                }
-            }
-'''.replaceAll(r'\"', '"');
-
-  final hardenedPolicy = r'''            if (config.ALLOWED_APPS.isNotEmpty() && config.BLOCKED_APPS.isNotEmpty()) {
-                throw IllegalStateException(\"Allowed and blocked app policies cannot be mixed\")
-            }
-
-            if (config.ALLOWED_APPS.isNotEmpty()) {
-                var allowedCount = 0
-                for (pkg in config.ALLOWED_APPS) {
-                    try {
-                        builder.addAllowedApplication(pkg)
-                        allowedCount++
-                        Log.d(TAG, \"Allowed into VPN: $pkg\")
-                    } catch (e: Exception) {
-                        throw IllegalStateException(\"Failed to allow selected app $pkg\", e)
-                    }
-                }
-                if (allowedCount == 0) {
-                    throw IllegalStateException(\"Selected-only routing has no valid applications\")
-                }
-            } else {
-                try {
-                    builder.addDisallowedApplication(packageName)
-                } catch (e: Exception) {
-                    Log.e(TAG, \"Failed to exclude app from VPN\", e)
-                }
-
-                for (pkg in config.BLOCKED_APPS) {
-                    try {
-                        builder.addDisallowedApplication(pkg)
-                        Log.d(TAG, \"Excluded from VPN: $pkg\")
-                    } catch (e: Exception) {
-                        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
-                    }
-                }
-            }
-'''.replaceAll(r'\"', '"');
-
-  // Support both pristine 1.1.5 and the earlier local allowlist patch.
-  replaceOneOf(
-    serviceFile,
-    <String, String>{
-      legacyPatchedPolicy: hardenedPolicy,
-      upstreamPolicy: hardenedPolicy,
-    },
-    'Allowed and blocked app policies cannot be mixed',
-  );
-
-  stdout.writeln('[flutter_vless patch] allowed-app routing patch is ready');
-}

tool/patch_flutter_vless_secure_socks_scope_fix.dart

@@ -1,154 +0,0 @@
-import 'dart:convert';
-import 'dart:io';
-
-const packageName = 'flutter_vless_android';
-const expectedVersionFragment = 'flutter_vless_android-1.1.5';
-
-Never fail(String message) {
-  stderr.writeln('[secure-socks scope fix] $message');
-  exit(1);
-}
-
-Directory packageRoot() {
-  final configFile = File('.dart_tool/package_config.json');
-  if (!configFile.existsSync()) {
-    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
-  }
-
-  final decoded = jsonDecode(configFile.readAsStringSync());
-  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
-    fail('package_config.json is invalid');
-  }
-
-  Map<String, dynamic>? package;
-  for (final item in decoded['packages'] as List) {
-    if (item is Map && item['name'] == packageName) {
-      package = Map<String, dynamic>.from(item);
-      break;
-    }
-  }
-  if (package == null) fail('$packageName was not found');
-
-  final rootUriValue = package['rootUri'];
-  if (rootUriValue is! String || rootUriValue.isEmpty) {
-    fail('$packageName has no rootUri');
-  }
-
-  final rootUri = Uri.parse(rootUriValue);
-  final resolved = rootUri.hasScheme
-      ? rootUri
-      : configFile.parent.absolute.uri.resolveUri(rootUri);
-  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
-
-  final root = Directory.fromUri(resolved);
-  final normalized = root.absolute.path.replaceAll('\\', '/');
-  if (!normalized.contains(expectedVersionFragment)) {
-    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
-  }
-  return root;
-}
-
-void patchCoreScope(File core) {
-  final before = core.readAsStringSync();
-
-  // The primary secure patcher used a file-wide check for
-  // `val process = pb.start()`. Stock 1.1.5 already contains that exact line
-  // in getV2rayTraffic(), so the startCore() capture could be skipped while
-  // its monitor was still rewritten to use `process`. Capture the active Xray
-  // process immediately before its monitor thread instead. This is deliberately
-  // a scope-only correction and does not alter the stable runtime sequence.
-  const directCapture =
-      '            val process = pb.start()\n            xrayProcess = process\n';
-  const scopedCapture =
-      '            val process = xrayProcess ?: return false\n            // Monitor process in a separate thread to detect crash\n';
-  const monitorMarker =
-      '            // Monitor process in a separate thread to detect crash\n';
-
-  if (before.contains(directCapture) || before.contains(scopedCapture)) {
-    stdout.writeln('[secure-socks scope fix] core already current: ${core.path}');
-    return;
-  }
-
-  if (!before.contains('process.inputStream.bufferedReader().use { reader ->') ||
-      !before.contains('val exitCode = process.waitFor()') ||
-      !before.contains('xrayProcess === process')) {
-    fail('secure Xray monitor patch is not in the expected state');
-  }
-  if (!before.contains('            xrayProcess = pb.start()\n')) {
-    fail('stock Xray start assignment is missing');
-  }
-  if (!before.contains(monitorMarker)) {
-    fail('Xray monitor insertion point is missing');
-  }
-
-  final after = before.replaceFirst(monitorMarker, scopedCapture);
-  core.writeAsStringSync(after);
-  stdout.writeln('[secure-socks scope fix] captured Xray process for monitor scope');
-}
-
-void patchOngoingNotification(File service) {
-  final before = service.readAsStringSync();
-
-  const marker = '.setOngoing(true)';
-  if (before.contains(marker) &&
-      before.contains('Notification.FLAG_NO_CLEAR') &&
-      before.contains('.setAutoCancel(false)')) {
-    stdout.writeln('[secure-socks scope fix] notification already ongoing: ${service.path}');
-    return;
-  }
-
-  const oldBlock = r'''        return builder
-            .setContentTitle("VPN Service")
-            .setContentText(content)
-            .setSmallIcon(icon)
-            .build()
-''';
-
-  const newBlock = r'''        val notification = builder
-            .setContentTitle("VPN Service")
-            .setContentText(content)
-            .setSmallIcon(icon)
-            .setOngoing(true)
-            .setAutoCancel(false)
-            .setOnlyAlertOnce(true)
-            .build()
-
-        // Keep the active VPN notification attached to the foreground service
-        // and resistant to bulk clearing on Android versions that honor these
-        // flags. Android 14+ may still allow an explicit user swipe while the
-        // device is unlocked; apps are not allowed to override that system UI.
-        notification.flags = notification.flags or
-            android.app.Notification.FLAG_ONGOING_EVENT or
-            android.app.Notification.FLAG_NO_CLEAR
-        return notification
-''';
-
-  if (!before.contains(oldBlock)) {
-    fail('VPN notification builder is not in the expected stock 1.1.5 state');
-  }
-
-  final after = before.replaceFirst(oldBlock, newBlock);
-  if (!after.contains(marker) ||
-      !after.contains('Notification.FLAG_NO_CLEAR') ||
-      !after.contains('.setAutoCancel(false)')) {
-    fail('ongoing VPN notification invariant failed');
-  }
-
-  service.writeAsStringSync(after);
-  stdout.writeln('[secure-socks scope fix] VPN notification marked ongoing/no-clear');
-}
-
-void main() {
-  final root = packageRoot();
-  final kotlin =
-      '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless';
-  final core = File('$kotlin/xray/core/XrayCoreManager.kt');
-  final service = File('$kotlin/xray/service/XrayVPNService.kt');
-
-  if (!core.existsSync()) fail('XrayCoreManager.kt is missing');
-  if (!service.existsSync()) fail('XrayVPNService.kt is missing');
-
-  patchCoreScope(core);
-  patchOngoingNotification(service);
-  stdout.writeln('[secure-socks scope fix] scope and notification patch ready');
-}

tool/patch_flutter_vless_secure_socks_v2.dart

@@ -1,546 +0,0 @@
-import 'dart:convert';
-import 'dart:io';
-
-const packageName = 'flutter_vless_android';
-const expectedVersionFragment = 'flutter_vless_android-1.1.5';
-
-Never fail(String message) {
-  stderr.writeln('[secure-socks patch] $message');
-  exit(1);
-}
-
-Directory packageRoot() {
-  final configFile = File('.dart_tool/package_config.json');
-  if (!configFile.existsSync()) {
-    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
-  }
-  final decoded = jsonDecode(configFile.readAsStringSync());
-  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
-    fail('package_config.json is invalid');
-  }
-
-  Map<String, dynamic>? package;
-  for (final item in decoded['packages'] as List) {
-    if (item is Map && item['name'] == packageName) {
-      package = Map<String, dynamic>.from(item);
-      break;
-    }
-  }
-  if (package == null) fail('$packageName was not found');
-
-  final rootUriValue = package['rootUri'];
-  if (rootUriValue is! String || rootUriValue.isEmpty) {
-    fail('$packageName has no rootUri');
-  }
-  final rootUri = Uri.parse(rootUriValue);
-  final resolved = rootUri.hasScheme
-      ? rootUri
-      : configFile.parent.absolute.uri.resolveUri(rootUri);
-  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
-
-  final root = Directory.fromUri(resolved);
-  final normalized = root.absolute.path.replaceAll('\\', '/');
-  if (!normalized.contains(expectedVersionFragment)) {
-    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
-  }
-  return root;
-}
-
-String replaceOnce(
-  String text,
-  String oldValue,
-  String newValue,
-  String label,
-) {
-  if (text.contains(newValue)) return text;
-  if (!text.contains(oldValue)) fail('missing expected source block: $label');
-  return text.replaceFirst(oldValue, newValue);
-}
-
-void writeIfChanged(File file, String before, String after) {
-  if (before == after) {
-    stdout.writeln('[secure-socks patch] already current: ${file.path}');
-    return;
-  }
-  file.writeAsStringSync(after);
-  stdout.writeln('[secure-socks patch] patched: ${file.path}');
-}
-
-void patchCore(File file) {
-  final before = file.readAsStringSync();
-  var text = before;
-
-  const secureValidation = r'''        var secureSocksEnabled = false
-        for (i in 0 until inbounds.length()) {
-            val inbound = inbounds.optJSONObject(i) ?: continue
-            if (inbound.optString("tag") != "revolt-secure-socks") continue
-
-            val settings = inbound.optJSONObject("settings")
-                ?: throw IllegalStateException("Secure SOCKS5 settings are missing")
-            val users = settings.optJSONArray("users")
-                ?: throw IllegalStateException("Secure SOCKS5 users are missing")
-            val account = users.optJSONObject(0)
-                ?: throw IllegalStateException("Secure SOCKS5 account is missing")
-            val port = inbound.optInt("port", -1)
-
-            if (inbound.optString("protocol") != "socks" ||
-                inbound.optString("listen") != "127.0.0.1" ||
-                port <= 1024 || port > 65535 ||
-                settings.optString("auth") != "password" ||
-                account.optString("user").isEmpty() ||
-                account.optString("pass").isEmpty()
-            ) {
-                throw IllegalStateException("Secure SOCKS5 session is invalid")
-            }
-
-            config.LOCAL_SOCKS5_PORT = port
-            config.LOCAL_HTTP_PORT = 0
-            secureSocksEnabled = true
-            break
-        }
-
-''';
-
-  if (!text.contains('var secureSocksEnabled = false')) {
-    text = replaceOnce(
-      text,
-      '        val usedPorts = mutableSetOf<Int>()\n',
-      '$secureValidation        val usedPorts = mutableSetOf<Int>()\n',
-      'secure SOCKS validation insertion',
-    );
-  }
-
-  text = replaceOnce(
-    text,
-    '        if (!hasHttpOnLocalPort) {\n',
-    '        if (!secureSocksEnabled && !hasHttpOnLocalPort) {\n',
-    'disable unauthenticated HTTP proxy in secure mode',
-  );
-
-  if (!text.contains('val process = pb.start()')) {
-    text = replaceOnce(
-      text,
-      '            xrayProcess = pb.start()\n',
-      '            val process = pb.start()\n            xrayProcess = process\n',
-      'capture Xray process identity',
-    );
-    text = replaceOnce(
-      text,
-      '            if (xrayProcess?.isAlive != true) {\n',
-      '            if (!process.isAlive) {\n',
-      'Xray startup liveness',
-    );
-    text = replaceOnce(
-      text,
-      '                val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()\n',
-      '                val output = process.inputStream.bufferedReader().readText()\n',
-      'Xray startup output',
-    );
-  }
-
-  if (!text.contains('Could not delete ephemeral Xray config')) {
-    const connectedLine =
-        '            AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED\n';
-    const deleteConfig = r'''            // config.json contains per-session SOCKS credentials. Xray has
-            // consumed it after the startup liveness check, so remove it now.
-            try {
-                val ephemeralConfig = File(configFilesDir, "config.json")
-                if (ephemeralConfig.exists() && !ephemeralConfig.delete()) {
-                    Log.w(TAG, "Could not delete ephemeral Xray config")
-                }
-            } catch (e: Exception) {
-                Log.w(TAG, "Could not delete ephemeral Xray config", e)
-            }
-
-''';
-    text = replaceOnce(
-      text,
-      connectedLine,
-      '$deleteConfig$connectedLine',
-      'ephemeral config deletion',
-    );
-  }
-
-  if (!text.contains('context.handleXrayCoreExit(config)')) {
-    text = replaceOnce(
-      text,
-      '                    xrayProcess?.inputStream?.bufferedReader()?.use { reader ->\n',
-      '                    process.inputStream.bufferedReader().use { reader ->\n',
-      'Xray monitor process stream',
-    );
-    text = replaceOnce(
-      text,
-      '                    val exitCode = xrayProcess?.waitFor()\n',
-      '                    val exitCode = process.waitFor()\n',
-      'Xray monitor process wait',
-    );
-
-    const oldExit = r'''                    if (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED) {
-                        // Unexpected exit
-                        stopCore(context)
-                    }
-''';
-    const newExit = r'''                    if (xrayProcess === process &&
-                        AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED
-                    ) {
-                        // Hold the Android TUN while the core is recovered. Killing
-                        // the VPN service here would allow direct-network fallback.
-                        xrayProcess = null
-                        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
-                        if (context is XrayVPNService) {
-                            context.handleXrayCoreExit(config)
-                        } else {
-                            stopCore(context)
-                        }
-                    }
-''';
-    text = replaceOnce(text, oldExit, newExit, 'Xray fail-closed recovery');
-  }
-
-  writeIfChanged(file, before, text);
-}
-
-void patchService(File file) {
-  final before = file.readAsStringSync();
-  var text = before;
-
-  if (!text.contains('private var recoveringXray = false')) {
-    text = replaceOnce(
-      text,
-      '    private var isRunning = false\n',
-      '    @Volatile private var isRunning = false\n'
-          '    @Volatile private var recoveringXray = false\n'
-          '    private var currentConfig: XrayConfig? = null\n',
-      'service recovery fields',
-    );
-  }
-
-  const oldNullIntent = r'''        if (intent == null) {
-            stopSelf()
-            return START_NOT_STICKY
-        }
-''';
-  const newNullIntent = r'''        if (intent == null) {
-            if (isRunning && currentConfig != null) return START_REDELIVER_INTENT
-            stopSelf()
-            return START_NOT_STICKY
-        }
-''';
-  text = replaceOnce(
-    text,
-    oldNullIntent,
-    newNullIntent,
-    'null intent lifecycle',
-  );
-
-  if (!text.contains('                currentConfig = config\n')) {
-    text = replaceOnce(
-      text,
-      '                cleanup()\n',
-      '                cleanup()\n                currentConfig = config\n',
-      'runtime config snapshot',
-    );
-  }
-
-  text = replaceOnce(
-    text,
-    '        return START_STICKY\n',
-    '        return START_REDELIVER_INTENT\n',
-    'redeliver START command',
-  );
-
-  if (!text.contains('private data class SecureSocksCredentials(')) {
-    const credentialsHelper = r'''    private data class SecureSocksCredentials(
-        val port: Int,
-        val username: String,
-        val password: String,
-    )
-
-    private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? {
-        val inbounds = try {
-            JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds")
-        } catch (_: Exception) {
-            null
-        } ?: return null
-
-        for (i in 0 until inbounds.length()) {
-            val inbound = inbounds.optJSONObject(i) ?: continue
-            if (inbound.optString("tag") != "revolt-secure-socks") continue
-            if (inbound.optString("protocol") != "socks" ||
-                inbound.optString("listen") != "127.0.0.1"
-            ) return null
-
-            val settings = inbound.optJSONObject("settings") ?: return null
-            if (settings.optString("auth") != "password") return null
-            val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null
-            val port = inbound.optInt("port", -1)
-            val username = user.optString("user")
-            val password = user.optString("pass")
-            if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) {
-                return null
-            }
-            return SecureSocksCredentials(port, username, password)
-        }
-        return null
-    }
-
-''';
-    const runComment = r'''    /**
-     * Starts the tun2socks process and initiates the FD transfer.
-     */
-    private fun runTun2socks(config: XrayConfig) {
-''';
-    text = replaceOnce(
-      text,
-      runComment,
-      '$credentialsHelper$runComment',
-      'secure credentials helper',
-    );
-  }
-
-  if (!text.contains('Authenticated ReVolt SOCKS5 inbound missing')) {
-    const commandComment = r'''        // Command to start tun2socks. 
-        // Note: We pass -sock-path to tell it where to listen for the FD.
-''';
-    const securePrelude = r'''        val secure = secureSocksCredentials(config)
-            ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing")
-        config.LOCAL_SOCKS5_PORT = secure.port
-
-''';
-    text = replaceOnce(
-      text,
-      commandComment,
-      '$securePrelude$commandComment',
-      'secure tun2socks credentials',
-    );
-    text = replaceOnce(
-      text,
-      r'''            "-proxy", "socks5://127.0.0.1:${config.LOCAL_SOCKS5_PORT}",
-''',
-      r'''            "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}",
-''',
-      'authenticated tun2socks URL',
-    );
-    text = replaceOnce(
-      text,
-      r'''        Log.d(TAG, "tun2socks command: ${cmd.joinToString(" ")}")
-''',
-      '        Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")\n',
-      'credential-safe logging',
-    );
-  }
-
-  if (!text.contains('val process = pb.start()\n            tun2socksProcess = process')) {
-    text = replaceOnce(
-      text,
-      '            tun2socksProcess = pb.start()\n',
-      '            val process = pb.start()\n            tun2socksProcess = process\n',
-      'capture tun2socks process identity',
-    );
-    text = replaceOnce(
-      text,
-      '                    tun2socksProcess?.inputStream?.bufferedReader()?.use { reader ->\n',
-      '                    process.inputStream.bufferedReader().use { reader ->\n',
-      'tun2socks monitor stream',
-    );
-    text = replaceOnce(
-      text,
-      '                    tun2socksProcess?.waitFor()\n',
-      '                    process.waitFor()\n',
-      'tun2socks monitor wait',
-    );
-
-    const oldRestart = r'''                    if (isRunning) {
-                        // Restart if crashed and still supposed to be running
-                        Log.e(TAG, "tun2socks exited unexpectedly, restarting...")
-                        runTun2socks(config)
-                    }
-''';
-    const newRestart = r'''                    if (isRunning && tun2socksProcess === process && currentConfig === config) {
-                        Log.e(TAG, "tun2socks exited unexpectedly, recycling without dropping TUN")
-                        Thread.sleep(350)
-                        if (isRunning && currentConfig === config) runTun2socks(config)
-                    }
-''';
-    text = replaceOnce(
-      text,
-      oldRestart,
-      newRestart,
-      'tun2socks crash recovery',
-    );
-    text = replaceOnce(
-      text,
-      '            sendFd()\n',
-      '            sendFd(process)\n',
-      'FD handoff process identity',
-    );
-  }
-
-  const oldStartFailure = r'''        } catch (e: Exception) {
-            Log.e(TAG, "Failed to start tun2socks", e)
-            stopAll()
-        }
-''';
-  const newStartFailure = r'''        } catch (e: Exception) {
-            Log.e(TAG, "Failed to start tun2socks; retrying with TUN held", e)
-            if (isRunning && currentConfig === config) {
-                Thread {
-                    try {
-                        Thread.sleep(600)
-                        if (isRunning && currentConfig === config) runTun2socks(config)
-                    } catch (_: InterruptedException) {}
-                }.start()
-            }
-        }
-''';
-  text = replaceOnce(
-    text,
-    oldStartFailure,
-    newStartFailure,
-    'tun2socks start failure recovery',
-  );
-
-  if (!text.contains('FD handoff failed; recycling tun2socks without dropping TUN')) {
-    const oldSendFd = r'''    private fun sendFd() {
-        val fd = mInterface?.fileDescriptor ?: return
-        val sockFile = File(filesDir, "sock_path").absolutePath
-
-        Thread {
-            var tries = 0
-            while (tries < 10) {
-                try {
-                    Thread.sleep(500)
-                    val localSocket = LocalSocket()
-                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
-                    val out = localSocket.outputStream
-                    // This magic call attaches the FD to the socket message
-                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
-                    out.write(32) // Send a dummy byte to trigger the transfer
-                    localSocket.setFileDescriptorsForSend(null)
-                    localSocket.shutdownOutput()
-                    localSocket.close()
-                    break
-                } catch (e: Exception) {
-                    tries++
-                }
-            }
-        }.start()
-    }
-''';
-    const newSendFd = r'''    private fun sendFd(process: Process) {
-        val fd = mInterface?.fileDescriptor ?: return
-        val sockFile = File(filesDir, "sock_path").absolutePath
-
-        Thread {
-            var tries = 0
-            while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) {
-                var localSocket: LocalSocket? = null
-                try {
-                    Thread.sleep(500)
-                    localSocket = LocalSocket()
-                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
-                    val out = localSocket.outputStream
-                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
-                    out.write(32)
-                    out.flush()
-                    localSocket.setFileDescriptorsForSend(null)
-                    localSocket.shutdownOutput()
-                    localSocket.close()
-                    return@Thread
-                } catch (_: Exception) {
-                    tries++
-                    try { localSocket?.close() } catch (_: Exception) {}
-                }
-            }
-
-            if (isRunning && tun2socksProcess === process) {
-                Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN")
-                try { process.destroy() } catch (_: Exception) {}
-            }
-        }.start()
-    }
-''';
-    text = replaceOnce(text, oldSendFd, newSendFd, 'bounded FD recovery');
-  }
-
-  if (!text.contains('fun handleXrayCoreExit(config: XrayConfig)')) {
-    const cleanupComment = r'''    /**
-     * Cleans up resources (tun2socks process, VPN interface) without stopping the service completely.
-     * Used when restarting or switching configurations.
-     */
-''';
-    const recovery = r'''    fun handleXrayCoreExit(config: XrayConfig) {
-        if (!isRunning || currentConfig !== config || recoveringXray) return
-        recoveringXray = true
-
-        Thread {
-            var attempt = 0
-            try {
-                while (isRunning && currentConfig === config) {
-                    attempt++
-                    Thread.sleep(400L * attempt.coerceAtMost(5))
-                    if (!isRunning || currentConfig !== config) break
-
-                    Log.w(TAG, "Recovering Xray core attempt $attempt")
-                    if (XrayCoreManager.startCore(this, config)) {
-                        Log.w(TAG, "Xray core recovered without dropping TUN")
-                        return@Thread
-                    }
-
-                    if (attempt >= 3) {
-                        attempt = 0
-                        Thread.sleep(3000)
-                    }
-                }
-            } catch (_: InterruptedException) {
-            } finally {
-                recoveringXray = false
-            }
-        }.start()
-    }
-
-''';
-    text = replaceOnce(
-      text,
-      cleanupComment,
-      '$recovery$cleanupComment',
-      'Xray recovery loop',
-    );
-  }
-
-  if (!text.contains('        recoveringXray = false\n        tun2socksProcess?.destroy()')) {
-    text = replaceOnce(
-      text,
-      '        isRunning = false\n        tun2socksProcess?.destroy()\n',
-      '        isRunning = false\n        recoveringXray = false\n        tun2socksProcess?.destroy()\n',
-      'cancel recovery on cleanup',
-    );
-  }
-
-  if (!text.contains('        currentConfig = null\n        XrayCoreManager.stopCore(this)')) {
-    text = replaceOnce(
-      text,
-      '        cleanup()\n        XrayCoreManager.stopCore(this)\n',
-      '        cleanup()\n        currentConfig = null\n        XrayCoreManager.stopCore(this)\n',
-      'clear config on explicit stop',
-    );
-  }
-
-  writeIfChanged(file, before, text);
-}
-
-void main() {
-  final root = packageRoot();
-  final kotlin = Directory(
-    '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless',
-  );
-  final core = File('${kotlin.path}/xray/core/XrayCoreManager.kt');
-  final service = File('${kotlin.path}/xray/service/XrayVPNService.kt');
-  if (!core.existsSync() || !service.existsSync()) {
-    fail('pinned Android runtime sources are missing');
-  }
-
-  patchCore(core);
-  patchService(service);
-  stdout.writeln('[secure-socks patch] stable-core security patch is ready');
-}