Merge branch 'dev' into main for v3.2.0 release

Author: AandStep

.github/workflows/ci.yml

@@ -27,7 +27,18 @@ jobs:
 
       - name: Install Linux build deps
         if: matrix.os == 'ubuntu-latest'
+        env:
+          DEBIAN_FRONTEND: noninteractive
         run: |
+          set -eux
+          sudo find /etc/apt \( -name '*.sources' -o -name '*.list' -o -name '*.sources.list' \) \
+            -type f -exec sed -i 's/azure\.archive\.ubuntu\.com/archive.ubuntu.com/g' {} +
+          sudo tee /etc/apt/apt.conf.d/99-ci-apt >/dev/null <<'EOF'
+          Acquire::Retries "5";
+          Acquire::http::Timeout "120";
+          Acquire::https::Timeout "120";
+          Dpkg::Use-Pty "0";
+          EOF
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             build-essential pkg-config \

.github/workflows/release.yml

@@ -69,19 +69,45 @@ jobs:
           "NSISDIR=$nsisRoot" | Out-File -FilePath $env:GITHUB_ENV -Append
           & $makensis /VERSION
 
+      - name: Stage libcronet.dll (sing-box naive / Cronet)
+        shell: pwsh
+        run: ./scripts/ensure-libcronet-windows.ps1
+
       - name: Build Windows app and installer
         shell: pwsh
         env:
           SUBSCRIPTION_ENCRYPT_KEY: ${{ secrets.SUBSCRIPTION_ENCRYPT_KEY }}
+          # For pre-release tags (containing '-') point the updater at the dev branch
+          # so test builds don't check the production manifest.
+          MANIFEST_URL_OVERRIDE: ${{ contains(github.ref_name, '-') && 'https://raw.githubusercontent.com/AandStep/ResultV/dev/update.json' || '' }}
         run: |
           $key = $env:SUBSCRIPTION_ENCRYPT_KEY
+          $ldflags = ""
           if ($key) {
-            wails build -clean -nsis -platform windows/amd64 -ldflags "-X resultproxy-wails/internal/proxy.subscriptionEncryptKey=$key"
+            $ldflags = "-X resultproxy-wails/internal/proxy.subscriptionEncryptKey=$key"
+          }
+          $manifestOverride = $env:MANIFEST_URL_OVERRIDE
+          if ($manifestOverride) {
+            $ldflags = "$ldflags -X resultproxy-wails/internal/updater.ManifestURLOverride=$manifestOverride".Trim()
+          }
+          if ($ldflags) {
+            wails build -clean -nsis -platform windows/amd64 -ldflags $ldflags
           } else {
-            Write-Warning "Secret SUBSCRIPTION_ENCRYPT_KEY not set — building without decryption key"
             wails build -clean -nsis -platform windows/amd64
           }
 
+      - name: Copy libcronet.dll next to portable exe
+        shell: pwsh
+        run: |
+          $dll = Join-Path (Get-Location) "build/windows/libcronet.dll"
+          if (-not (Test-Path $dll)) { throw "libcronet.dll missing — run scripts/ensure-libcronet-windows.ps1" }
+          $portable = Get-ChildItem -Path "build/bin" -Filter "*.exe" -File |
+            Where-Object { $_.Name -notlike "*-installer.exe" } |
+            Select-Object -First 1
+          if (-not $portable) { throw "Portable exe not found under build/bin" }
+          Copy-Item -LiteralPath $dll -Destination $portable.DirectoryName -Force
+          Write-Host "Copied libcronet.dll beside $($portable.Name)"
+
       - name: Validate Windows artifacts
         shell: pwsh
         run: |
@@ -134,13 +160,19 @@ jobs:
           go install github.com/wailsapp/wails/v2/cmd/wails@latest
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
+      - name: Stage libcronet.dylib (sing-box naive / Cronet)
+        run: |
+          chmod +x scripts/ensure-libcronet-macos.sh
+          ./scripts/ensure-libcronet-macos.sh
+
       - name: Build macOS app and .dmg
         env:
           SUBSCRIPTION_ENCRYPT_KEY: ${{ secrets.SUBSCRIPTION_ENCRYPT_KEY }}
           APPLE_DEVELOPER_ID: ${{ secrets.APPLE_DEVELOPER_ID }}
           APPLE_NOTARY_APPLE_ID: ${{ secrets.APPLE_NOTARY_APPLE_ID }}
           APPLE_NOTARY_TEAM_ID: ${{ secrets.APPLE_NOTARY_TEAM_ID }}
           APPLE_NOTARY_PASSWORD: ${{ secrets.APPLE_NOTARY_PASSWORD }}
+          MANIFEST_URL_OVERRIDE: ${{ contains(github.ref_name, '-') && 'https://raw.githubusercontent.com/AandStep/ResultV/dev/update.json' || '' }}
         run: |
           chmod +x build-macos.sh
           ./build-macos.sh
@@ -154,6 +186,7 @@ jobs:
 
   build-linux:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     permissions:
       contents: read
       actions: write
@@ -173,7 +206,20 @@ jobs:
           node-version: 24
 
       - name: Install Linux build dependencies
+        env:
+          DEBIAN_FRONTEND: noninteractive
         run: |
+          set -eux
+          # azure.archive.ubuntu.com on GitHub-hosted runners sometimes stalls for
+          # many minutes; archive.ubuntu.com is a reliable fallback.
+          sudo find /etc/apt \( -name '*.sources' -o -name '*.list' -o -name '*.sources.list' \) \
+            -type f -exec sed -i 's/azure\.archive\.ubuntu\.com/archive.ubuntu.com/g' {} +
+          sudo tee /etc/apt/apt.conf.d/99-ci-apt >/dev/null <<'EOF'
+          Acquire::Retries "5";
+          Acquire::http::Timeout "120";
+          Acquire::https::Timeout "120";
+          Dpkg::Use-Pty "0";
+          EOF
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             build-essential pkg-config \
@@ -196,9 +242,15 @@ jobs:
             https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
           chmod +x /usr/local/bin/linuxdeploy
 
+      - name: Stage libcronet.so (sing-box naive / Cronet)
+        run: |
+          chmod +x scripts/ensure-libcronet-linux.sh
+          ./scripts/ensure-libcronet-linux.sh
+
       - name: Build Linux artifacts
         env:
           SUBSCRIPTION_ENCRYPT_KEY: ${{ secrets.SUBSCRIPTION_ENCRYPT_KEY }}
+          MANIFEST_URL_OVERRIDE: ${{ contains(github.ref_name, '-') && 'https://raw.githubusercontent.com/AandStep/ResultV/dev/update.json' || '' }}
         run: |
           chmod +x build-linux.sh
           ./build-linux.sh
@@ -285,6 +337,84 @@ jobs:
           body_path: RELEASE_BODY.txt
           files: release-assets/*
           draft: false
-          prerelease: false
+          # Tags with a hyphen (e.g. v3.2.0-dev.1) are pre-releases.
+          # Pre-releases are visible on GitHub but not shown as "Latest release",
+          # so production auto-update is unaffected.
+          prerelease: ${{ contains(github.ref_name, '-') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute sha256 and update update.json platforms
+        run: |
+          cat > update_manifest.cjs <<'NODE_EOF'
+          const fs   = require('fs');
+          const path = require('path');
+          const crypto = require('crypto');
+
+          const tag     = process.env.GITHUB_REF_NAME;          // e.g. "v3.2.0"
+          const version = tag.replace(/^v/, '');
+          const repo    = process.env.GITHUB_REPOSITORY;        // "AandStep/ResultV"
+          const baseURL = `https://github.com/${repo}/releases/download/${tag}`;
+          const dir     = 'release-assets';
+
+          function sha256File(p) {
+            return crypto.createHash('sha256').update(fs.readFileSync(p)).digest('hex');
+          }
+
+          const files = fs.readdirSync(dir);
+
+          const portableFile   = files.find(f => /^ResultV.*\.exe$/i.test(f) && !/installer/i.test(f) && !/setup/i.test(f));
+          const installerFile  = files.find(f => /installer.*\.exe$/i.test(f) || /setup.*\.exe$/i.test(f));
+          const dmgFile        = files.find(f => /\.dmg$/i.test(f));
+          const appimageFile   = files.find(f => /\.AppImage$/i.test(f));
+          const debFile        = files.find(f => /\.deb$/i.test(f));
+
+          const update = JSON.parse(fs.readFileSync('update.json', 'utf8'));
+          update.version   = version;
+          update.platforms = {};
+
+          function addPlatform(key, filename) {
+            if (!filename) return;
+            const p = path.join(dir, filename);
+            if (!fs.existsSync(p)) return;
+            const stat = fs.statSync(p);
+            update.platforms[key] = {
+              url:    `${baseURL}/${filename}`,
+              sha256: sha256File(p),
+              size:   stat.size,
+            };
+            console.log(`[${key}] ${filename} sha256=${update.platforms[key].sha256} size=${stat.size}`);
+          }
+
+          addPlatform('windows-amd64-portable',  portableFile);
+          addPlatform('windows-amd64-installer', installerFile);
+          addPlatform('darwin-universal',         dmgFile);
+          addPlatform('linux-amd64-appimage',     appimageFile);
+          addPlatform('linux-amd64-deb',          debFile);
+
+          fs.writeFileSync('update.json', JSON.stringify(update, null, 2) + '\n');
+          console.log('update.json written with platforms:', Object.keys(update.platforms).join(', ') || '(none)');
+          NODE_EOF
+          node update_manifest.cjs
+
+      # For stable releases (no hyphen): commit update.json to main so all users
+      # receive the update notification. For pre-releases (e.g. v3.2.0-dev.1):
+      # commit to dev branch only — production users are unaffected.
+      - name: Commit updated update.json
+        run: |
+          # Choose target branch based on whether this is a pre-release tag.
+          if [[ "${{ github.ref_name }}" == *"-"* ]]; then
+            TARGET_BRANCH="dev"
+          else
+            TARGET_BRANCH="main"
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git fetch origin "$TARGET_BRANCH"
+          git checkout "$TARGET_BRANCH"
+          git add update.json
+          git diff --cached --quiet || \
+            git commit -m "chore: update update.json platforms for ${{ github.ref_name }} [skip ci]"
+          git push origin "$TARGET_BRANCH"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -36,6 +36,10 @@ build/bin/*.exe
 build/bin/cache.db
 /cache.db
 build/windows/installer/tmp/*
+# Fetched from Go modules via scripts/ensure-libcronet-*.{ps1,sh}
+build/windows/libcronet.dll
+build/darwin/libcronet.dylib
+build/linux/libcronet.so
 *.timestamp-*.mjs
 /tmp.exe
 *~
@@ -51,3 +55,6 @@ build/windows/installer/tmp/*
 tools/encrypt-sub/
 build-release.bat
 build-release.sh
+
+# build
+build/bin/

README.en.md

@@ -10,7 +10,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-3.1.2-blue.svg" alt="Version">
+  <img src="https://img.shields.io/badge/version-3.2.0-blue.svg" alt="Version">
   <img src="https://img.shields.io/badge/desktop-Wails-27272f.svg" alt="Wails">
   <img src="https://img.shields.io/badge/backend-Go-00ADD8.svg" alt="Go">
   <img src="https://img.shields.io/badge/frontend-React_18-61dafb.svg" alt="React">
@@ -33,7 +33,7 @@
 
 ## Overview
 
-ResultV **3.1.2** is a native desktop application built with **[Wails v2](https://wails.io/)**. The UI is **React 18** with **Vite** and **Tailwind CSS**; traffic is handled by a **Go** backend and **[sing-box](https://github.com/SagerNet/sing-box)** (with project-specific build tags in `wails.json`). The interface is localized with **i18next** (English and Russian).
+ResultV **3.2.0** is a native desktop application built with **[Wails v2](https://wails.io/)**. The UI is **React 18** with **Vite** and **Tailwind CSS**; traffic is handled by a **Go** backend and **[sing-box](https://github.com/SagerNet/sing-box)** (with project-specific build tags in `wails.json`). The interface is localized with **i18next** (English and Russian).
 
 **Prebuilt releases:** GitHub Actions publishes **Windows amd64** artifacts (portable `.exe` and NSIS installer), **macOS** (`.dmg`) and **Linux** (`.AppImage`, `.deb`, `.rpm`) when a `v*` tag is pushed.
 
@@ -68,6 +68,8 @@ ResultV **3.1.2** is a native desktop application built with **[Wails v2](https:
 - Subscriptions in **JSON** (Xray format with `outbounds[]` and sing-box format with `type`) are parsed for all key protocols, including `wireguard`/`amneziawg` with an `amnezia` block.
 - **Tunnel** mode on Windows requires **running as Administrator**.
 - **Kill Switch** on Windows may require **administrator privileges** for firewall rules (`internal/system/killswitch_windows.go`).
+- If internet remains blocked after a crash or forced app termination, run in **PowerShell (Administrator)**:
+  `Get-NetFirewallRule -DisplayName 'ResultV_KillSwitch*' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`
 - Some subscription providers enforce **HWID device limits**; the app sends a stable `x-hwid` when fetching subscriptions and shows the reason if the provider returned an empty response due to the limit.
 - **In case of issues**, please contact TG @resultpoint_manager.
 

README.md

@@ -10,7 +10,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-3.1.2-blue.svg" alt="Version">
+  <img src="https://img.shields.io/badge/version-3.2.0-blue.svg" alt="Version">
   <img src="https://img.shields.io/badge/desktop-Wails-27272f.svg" alt="Wails">
   <img src="https://img.shields.io/badge/backend-Go-00ADD8.svg" alt="Go">
   <img src="https://img.shields.io/badge/frontend-React_18-61dafb.svg" alt="React">
@@ -33,7 +33,7 @@
 
 ## О проекте
 
-ResultV **3.1.2** — нативное настольное приложение на **[Wails v2](https://wails.io/)**. Интерфейс: **React 18**, **Vite**, **Tailwind CSS**; трафик обрабатывает бэкенд на **Go** и движок **[sing-box](https://github.com/SagerNet/sing-box)** (теги сборки заданы в `wails.json`). Локализация через **i18next** (русский и английский).
+ResultV **3.2.0** — нативное настольное приложение на **[Wails v2](https://wails.io/)**. Интерфейс: **React 18**, **Vite**, **Tailwind CSS**; трафик обрабатывает бэкенд на **Go** и движок **[sing-box](https://github.com/SagerNet/sing-box)** (теги сборки заданы в `wails.json`). Локализация через **i18next** (русский и английский).
 
 **Готовые сборки:** в GitHub Actions публикуются артефакты **Windows amd64** (portable `.exe` и установщик NSIS), **macOS** (`.dmg`) и **Linux** (`.AppImage`, `.deb`, `.rpm`) при push тега `v`*.
 
@@ -70,6 +70,8 @@ ResultV **3.1.2** — нативное настольное приложение
 - Подписки в **JSON** (Xray-формат с `outbounds[]` и sing-box-формат с `type`) разбираются для всех ключевых протоколов, включая `wireguard`/`amneziawg` с блоком `amnezia`.
 - Режим **Tunnel** в Windows требует **запуска от имени администратора**.
 - **Kill Switch** в Windows может требовать **прав администратора** для правил брандмауэра (`internal/system/killswitch_windows.go`).
+- Если после сбоя/принудительного завершения приложения интернет остается заблокирован, выполните в **PowerShell (Администратор)**:
+  `Get-NetFirewallRule -DisplayName 'ResultV_KillSwitch*' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`
 - Некоторые провайдеры подписок используют **HWID-ограничение устройств**; приложение передает стабильный `x-hwid` при загрузке подписок и показывает причину, если провайдер вернул пустой ответ по лимиту.
 - **При сбоях** просьба писать в ТГ @resultpoint_manager.
 

THIRD_PARTY_LICENSES.md

@@ -0,0 +1,41 @@
+# Third-Party Licenses
+
+ResultV includes the following third-party components. All other code is
+licensed under GPL-3.0 — see [LICENSE](LICENSE).
+
+---
+
+## getlantern/systray
+
+- **Source**: https://github.com/getlantern/systray v1.2.2
+- **Location**: `internal/getlantern_systray/`
+- **License**: Apache-2.0 (see `internal/getlantern_systray/LICENSE`)
+
+The vendored copy has been modified by ResultV. Original package comment:
+> Package systray is a cross-platform Go library to place an icon and menu
+> in the notification area.
+
+---
+
+## Go module dependencies
+
+All other dependencies are consumed as normal Go modules and are not
+vendored into this repository. Their licenses are reproduced in the module
+cache (`go env GOMODCACHE`) and can be audited with:
+
+```
+go-licenses report ./...
+```
+
+Key dependency licenses:
+| Module | License |
+|--------|---------|
+| github.com/sagernet/sing-box | GPL-3.0 |
+| github.com/sagernet/sing | MIT |
+| github.com/sagernet/sing-tun | MIT |
+| github.com/sagernet/sing-quic | MIT |
+| github.com/sagernet/quic-go | MIT |
+| github.com/sagernet/gvisor | Apache-2.0 |
+| github.com/wailsapp/wails | MIT |
+| golang.org/x/sys | BSD-3-Clause |
+| github.com/getlantern/golog | Apache-2.0 |