- HomeViewModel closes the profile database in finally blocks and relies
on the VPN_PROFILES_CHANGED broadcast instead of reloading twice
- READ_EXTERNAL_STORAGE only up to API 32; drop a dead settings flag
Co-Authored-By: Claude Opus 5.5 <[email protected]>
They can block for 10-30 s on a degraded network and delayed any profile
load (connect, retry, profile switch) queued behind them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- tile: query the configured profile once per listening session instead
of on every state notification
- widget: DISCONNECTING is shown as such, with a Disconnect button
- log viewer: bounded to 5000 lines, tails only while visible, picks up
a log created or restarted after opening, and no longer yanks the user
back to the bottom while they scroll up
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- computeExcludedPackages() (full PackageManager scan) runs on Default,
not Main.immediate, on config changes and package add/remove
- updateConfig() ignores no-op transforms and reconnects when routing is
switched off too (direct apps kept bypassing the tunnel until then)
- config is volatile and read after its version, so an old config can no
longer be cached under a new version
- Direct apps loads the app list once per entry, without GET_META_DATA
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- underlying-network bookkeeping is guarded by one lock and re-applied
after establish(), so a handover racing with it no longer leaves the
tunnel attributed to a lost network
- use the capabilities passed to onCapabilitiesChanged (no IPC per
signal-strength update); mCurrentProfile is volatile
- countdown-only notification re-posts are limited to one per 5 s
- the connected chronometer keeps its start time across re-posts
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- scheduled rechecks are forced: the 15/30 s steps were below FRESH_MS,
so the unforced recheck returned early and the backoff chain died
- signal-strength-only capability changes are no longer network events
(each one reset the backoff and launched a check)
- tunnel state transitions force a new round at most every 15 s
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- traffic (1 s) and probe (10 s) loops run only while the Home screen is
shown and the VPN is connected; no 1 s idle tick otherwise
- the refresh button no longer runs a second exit-IP trace
- the glow pulse is not composed at all while disconnected or with
animations off (it redrew a transparent circle every frame)
- RTT sparkline appends each probe result once (it duplicated stale ones)
- Routing dead-host poll is lifecycle-aware
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- drop the in-process 12 h loop: the VPN keeps the process alive, so it
checked and pre-downloaded on battery, defeating the worker constraint
- the worker now waits for the check and a silent download it starts
- metered is judged by the physical network: the VPN reports itself
unmetered, so pre-downloads ran over cellular while connected
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- WITH_TUNNEL mode pings the server only once the external targets fail
(no ping fork + DNS lookup outside the tunnel on every healthy cycle;
an ICMP-blocking server no longer forces fast polls)
- initial battery-low state from the sticky ACTION_BATTERY_CHANGED
- non-state notifications no longer restart a pending cycle
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- same SHA-256 as the applied list: only bump the timestamp, no parse,
save or tunnel reconnect (it tore a healthy tunnel down daily)
- a failed download is not retried on every cold start (3 h backoff)
- the saved list is read and parsed off the main thread at startup
- switching the split off in system mode reconnects to drop the routes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Retrying, connecting or whitelist-blocked sessions kept the 60 s alarm and
the 10 min Doze wakeup for hours although a live process makes the alarm
useless. They now share the connected backoff (5 min / 60 min).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
After a silent pre-download the state stayed Downloading, so tapping the
"update ready" notification did nothing. It now returns to Available;
an install request without a known update (e.g. after a process restart)
re-checks and installs when found.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- SimpleDateFormat is now used under the lock; rotation counts bytes
- AutoConnectManager.stop() clears pendingEvaluate, whose reset runnable
it removes, so later connects are not silently swallowed
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- remove pending RETRY_MSG on reset/set: a Retry tap during a backoff
started a second countdown chain (double-speed ticks, two reconnects)
- notify listeners over a copy with per-listener error handling
- disconnect() tolerates the VPN service not running
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- DISCONNECT (plain startService) no longer promotes to the foreground,
and startForeground() refusals on Android 12+ are logged, not fatal
- drop the placeholder notification when nothing was running, so the
service does not stay in the foreground with a stale Disabled state
- onDestroy: shutdownNow/await the profile executor before closing the
database; profile loads catch errors instead of killing the process
- unbind by bind result, not by mService (binding leaked if destroyed
before onServiceConnected)
- the connection thread's crash guard can no longer throw itself
Co-Authored-By: Claude Opus 5.5 <[email protected]>
tcpPing never closed its socket: every health/whitelist/home probe leaked
an fd until GC and the peer's later FIN/RST woke the radio again.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
getRoutingStats/getDeadDirectTargets are polled from the UI once a second;
a concurrent disconnect frees the engine under charon_mutex, so reading it
without the lock was a use-after-free.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
AGP 9 strict full-mode keep rules no longer keep no-arg constructors of
-keep'd classes, so WorkManager's reflectively created Room database
lost its constructor and the app crashed in InitializationProvider.
Restore AGP 8 keep-rule semantics and keep RoomDatabase constructors.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Built-in Kotlin (kotlin-android removed), Java 11 compile options (compose 1.12),
proguard-android-optimize.txt (the non-optimize file is rejected by AGP 9),
ExposedDropdownMenu import, minSdk 23 kept via tools:overrideLibrary for
material3 1.5 libs that declare minSdk 24. -PshortNdkCommands for deep worktree paths.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
