BUG: 在 MIUI 下双开，副 APP 的自定义路由无效或有问题。

[zz5678]

Describe the problem

版本 1.4.2

在 MIUI 下双开某浏览器 APP，其中副 APP 对于 NekoBoxForAndroid 自定义路由设定，显然呈现为失效。

测试步骤如下：
第一，对于测试的浏览器，双开两个 APP
第二，在本软件 NekoBoxForAndroid 中设置自定义路由为，这个浏览器 APP 只走代理。
第三，在本地运行 Python，启动附件的 Python 浏览服务程序。

python serve.py

第四，通过浏览器访问 http://127.0.0.1:8765/

由于 Python 中内置的两个探测资源都是属于国内的资源地址，那么就会出现在主 APP 内显示的 IP 地址是代理地址，而在副 APP 内显示的都是国内上网地址，这显然已经造成了用户上网本地地址的出口的泄露。

推测原因就是副 APP 没有被 NekoBoxForAndroid 的自定义规则、路由规则作用。这就是本 issues 反馈的软件 bug。

附件程序安全、有效，由 AI 编写，可以检查它的安全性后再运行它。

Expected behavior:

Actual behavior:

How to reproduce

Provide helpful screenshots, videos, text descriptions, subscription links, etc.

log

If you have logs, please upload them. Please see the detailed steps for exporting logs in the documentation.

[zz5678]

serve.py

本地运行的浏览服务器程序，在此。

[zz5678]

Issue #1194: MIUI Dual Apps custom route may miss cloned app

Reference issue: #1194

Problem

On MIUI, after enabling Dual Apps for a browser, a custom route configured for that browser only affects the primary app. The cloned app can bypass the expected route and use the local network egress instead of the configured proxy route.

The user report indicates this can leak the user's real local egress IP when the intended rule is "this browser app only uses proxy".

Findings

The current custom route builder converts selected package names into Android UIDs before generating sing-box route rules:

val uidList = rule.packages.map {
    PackageCache[it]?.takeIf { uid -> uid >= 1000 }
}.toHashSet().filterNotNull()

user_id = uidList

This assumes one package name maps to one UID in PackageCache.packageMap.

That assumption is fragile for MIUI Dual Apps / Android multi-user style cloned apps:

• the primary app and cloned app may share the same package name,
• the cloned app can run under a different UID/user range,
• PackageCache.packageMap stores only one packageName -> uid value,
• therefore only one UID can be written to user_id,
• traffic from the cloned app UID may not match the generated custom route.

There is also a related fallback gap in native process lookup:

val packageNames = PackageCache.uidMap[uid]
...
error("unknown uid $uid")

If the cloned app UID is not present in PackageCache.uidMap, package lookup fails instead of asking Android's PackageManager.

Proposed Fix

Use sing-box package_name for custom app route matching instead of eagerly converting package names to user_id.

Reasoning:

• The user-facing route configuration already stores package names.
• package_name preserves the intended rule semantics: "match this app package".
• It avoids losing the cloned app when the same package name can appear under another UID.
• It also keeps the existing storage format unchanged, so old route rules remain compatible.

Additionally, add a fallback in NativeInterface.packageNameByUid():

• first use the existing PackageCache.uidMap,
• if missing, call PackageManager.getPackagesForUid(uid),
• only fail if Android also cannot resolve the UID.

This gives sing-box process/package matching a better chance to resolve cloned-app UIDs.

Patch

diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt b/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt
index 8fe0a29..d07fedc 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt
@@ -25,7 +25,6 @@ import io.nekohasekai.sagernet.fmt.wireguard.WireGuardBean
 import io.nekohasekai.sagernet.fmt.wireguard.buildSingBoxOutboundWireguardBean
 import io.nekohasekai.sagernet.ktx.isIpAddress
 import io.nekohasekai.sagernet.ktx.mkPort
-import io.nekohasekai.sagernet.utils.PackageCache
 import moe.matsuri.nb4a.*
 import moe.matsuri.nb4a.SingBoxOptions.*
 import moe.matsuri.nb4a.plugin.Plugins
@@ -481,25 +480,19 @@ fun buildConfig(
 
         // apply user rules
         for (rule in extraRules) {
-            if (rule.packages.isNotEmpty()) {
-                PackageCache.awaitLoadSync()
+            val packageList = rule.packages.filter { it.isNotBlank() }.toList()
+            if (packageList.isNotEmpty() && !isVPN) {
+                Toast.makeText(
+                    SagerNet.application,
+                    SagerNet.application.getString(R.string.route_need_vpn, rule.displayName()),
+                    Toast.LENGTH_SHORT
+                ).show()
             }
-            val uidList = rule.packages.map {
-                if (!isVPN) {
-                    Toast.makeText(
-                        SagerNet.application,
-                        SagerNet.application.getString(R.string.route_need_vpn, rule.displayName()),
-                        Toast.LENGTH_SHORT
-                    ).show()
-                }
-                PackageCache[it]?.takeIf { uid -> uid >= 1000 }
-            }.toHashSet().filterNotNull()
             val ruleSets = mutableListOf<RuleSet>()
 
             val ruleObj = Rule_DefaultOptions().apply {
-                if (uidList.isNotEmpty()) {
-                    PackageCache.awaitLoadSync()
-                    user_id = uidList
+                if (packageList.isNotEmpty()) {
+                    package_name = packageList
                 }
                 var domainList: List<String>? = null
                 if (rule.domains.isNotBlank()) {
@@ -546,7 +539,7 @@ fun buildConfig(
 
                 fun makeDnsRuleObj(): DNSRule_DefaultOptions {
                     return DNSRule_DefaultOptions().apply {
-                        if (uidList.isNotEmpty()) user_id = uidList
+                        if (packageList.isNotEmpty()) package_name = packageList
                         domainList?.let { makeSingBoxRule(it) }
                     }
                 }
diff --git a/app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt b/app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt
index f06e26d..5e5b5b9 100644
--- a/app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt
+++ b/app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt
@@ -59,6 +59,10 @@ class NativeInterface : BoxPlatformInterface, NB4AInterface {
             return packageName
         }
 
+        SagerNet.application.packageManager.getPackagesForUid(uid)?.firstOrNull()?.let {
+            return it
+        }
+
         error("unknown uid $uid")
     }
 

Expected Result

For a custom route whose app condition contains the browser package name:

• primary browser app traffic should match the route,
• MIUI cloned browser app traffic should also resolve to the same package name and match the route,
• the cloned app should no longer silently miss the proxy-only custom route because of UID mismatch.

Compatibility Notes

• No database/schema change is required.
• Existing route rules still store package names in RuleEntity.packages.
• The generated sing-box config changes from user_id to package_name only for custom app route conditions.
• Global per-app VPN allow/disallow behavior is not changed by this patch.

Verification

Attempted command:

./gradlew :app:compileOssDebugKotlin

The local environment downloaded Gradle successfully but could not compile because Android SDK is not configured:

SDK location not found. Define a valid SDK location with an ANDROID_HOME environment variable
or by setting the sdk.dir path in local.properties.

So this patch still needs maintainer-side build verification in a normal Android development environment.