Merge remote-tracking branch 'origin/main' into feature/google-api

# Conflicts:
#	src/bin/ui.rs
#	src/config.rs

Author: dazzling-no-more

.github/scripts/telegram_publish_files.py

@@ -77,18 +77,17 @@ jobs:
           - target: x86_64-pc-windows-gnu
             os: windows-latest
             name: mhrv-rs-windows-amd64
-          - target: i686-pc-windows-msvc
-            os: windows-latest
-            name: mhrv-rs-windows-i686
-            # Pin Rust 1.77.2 specifically for this target. Rust 1.78
-            # (May 2024) raised the Windows MSRV from Win7 to Win10 by
-            # switching std::time to GetSystemTimePreciseAsFileTime, a
-            # kernel32 export that doesn't exist on Win7. The whole
-            # reason this target ships is to support legacy Win7 32-bit
-            # boxes (#272), so a stock-stable build defeats the purpose.
-            # 1.77.2 is the last stable that produces a Win7-loadable
-            # binary; other targets stay on @stable. (Fixes #318.)
-            rust_toolchain: "1.77.2"
+          # i686-pc-windows-msvc target was attempted in v1.7.7-v1.7.10
+          # to support Windows 7 32-bit users (#272, #318). Removed in
+          # v1.7.11 because keeping it on Rust 1.77.2 (last Win7-stable)
+          # is fundamentally fragile: every transitive crate that bumps
+          # its MSRV (e.g. `time` 0.3.47 needs Cargo manifest features
+          # only available in Rust 1.78+) breaks the build, and pinning
+          # transitives is brittle across releases. Win7 users should
+          # self-build per the README; the project no longer ships a
+          # prebuilt i686 Win7 binary. Replaced by the existing
+          # x86_64-pc-windows-gnu (windows-amd64) which covers ~99% of
+          # active Windows installs (incl. all WoA64 emulation).
           - target: x86_64-unknown-linux-musl
             os: [self-hosted, linux, x64, mhrv-build]
             name: mhrv-rs-linux-musl-amd64
@@ -112,12 +111,7 @@ jobs:
     # mipsel-softfloat is best-effort: the Rust tier-3 target occasionally
     # regresses. Letting it fail keeps the main release going so
     # desktop/Android users aren't blocked by MT7621 router support.
-    # i686-pc-windows-msvc is similarly best-effort — pinned to Rust
-    # 1.77.2 for Win7 compat (#318), so a future dep MSRV bump above
-    # 1.77 will fail this one target. Letting it skip keeps the rest
-    # of the release unblocked; we'd then choose between dropping the
-    # target or moving to the tier-3 win7-msvc target with build-std.
-    continue-on-error: ${{ matrix.mipsel_softfloat == true || matrix.target == 'i686-pc-windows-msvc' }}
+    continue-on-error: ${{ matrix.mipsel_softfloat == true }}
 
     steps:
       # Heal any root-owned leftovers from a previous mipsel docker
@@ -165,21 +159,6 @@ jobs:
           toolchain: ${{ matrix.rust_toolchain || 'stable' }}
           targets: ${{ matrix.target }}
 
-      # Cargo.lock from main is generated by stable Rust (1.78+ writes
-      # version=4 lockfiles). Rust 1.77 only understands version=3, so
-      # the i686 build with the pinned 1.77.2 toolchain bails with
-      # "failed to parse lock file at: Cargo.lock" before it ever
-      # touches our code. Drop the committed lockfile only on the pinned
-      # job — cargo will regenerate it with version=3 against the same
-      # Cargo.toml. We don't ship a `Cargo.lock` for binary reproducibility
-      # contracts, so regenerating per-build is safe.
-      - name: Regenerate Cargo.lock for older toolchain (Win7 i686 only)
-        if: matrix.rust_toolchain == '1.77.2'
-        shell: bash
-        run: |
-          rm -f Cargo.lock
-          cargo +${{ matrix.rust_toolchain }} generate-lockfile
-
       # Cache target/ + cargo registry across runs — this is the big
       # self-hosted speedup. Without it, actions/checkout@v4's default
       # `git clean -ffdx` wipes target/ between runs and every build is
@@ -619,10 +598,33 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/download-artifact@v4
-        with:
-          path: dist
-          merge-multiple: true
+      # `actions/download-artifact@v4` has been intermittently flaking on
+      # this workflow with "5 retries exhausted" on a single artifact (~10
+      # of 13). Wrap it in a manual retry — usually the second attempt
+      # succeeds, the third nails any laggards. We use `gh run download`
+      # against the current run so we don't depend on the release page
+      # existing yet (it doesn't until the softprops step below runs).
+      - name: Download all build artifacts (with retries)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mkdir -p dist
+          for attempt in 1 2 3; do
+            if gh run download "${GITHUB_RUN_ID}" --dir dist --repo "${GITHUB_REPOSITORY}"; then
+              echo "downloaded all artifacts on attempt $attempt"
+              # `gh run download` puts each artifact in its own subdir;
+              # flatten so downstream steps that expect dist/<file> work
+              # the same as `merge-multiple: true` did.
+              find dist -type f -mindepth 2 -exec mv -f {} dist/ \;
+              find dist -type d -empty -delete
+              ls -la dist/
+              exit 0
+            fi
+            echo "download attempt $attempt failed; retrying in 30s..."
+            sleep 30
+          done
+          echo "::error::failed to download artifacts after 3 attempts"
+          exit 1
 
       # Compose the GitHub release body from `docs/changelog/v<ver>.md`
       # so the Releases page tells humans what actually changed —
@@ -826,43 +828,58 @@ jobs:
           # isn't gated by the same protection.
           git push origin HEAD:main
 
-  # Notify the Persian-speaking Telegram channel with the CI-built
-  # Android APK + its sha256 + the per-version changelog from
-  # `docs/changelog/v<tag>.md`.
+  # ─────────── LEGACY — DORMANT BY DEFAULT ───────────
   #
-  # Two Telegram API calls:
-  #   1. sendDocument — APK file + a short caption (Telegram caps
-  #      captions at 1024 chars, and we have bigger changelogs than
-  #      that).
-  #   2. sendMessage — full changelog as a reply to #1, Persian
-  #      quote-block first then English, same pattern as the
-  #      previous manual post. No emojis, as the user asked.
+  # Posts the universal APK + per-version changelog to the **main**
+  # Telegram channel as one big sendDocument + sendMessage pair.
   #
-  # Needs two repo secrets:
-  #   TELEGRAM_BOT_TOKEN  — bot the channel admits as poster
-  #   TELEGRAM_CHAT_ID    — numeric chat id (starts with -100...)
-  # Missing either => the whole job is skipped (not failed) so a
-  # forker who hasn't set up a Telegram channel gets a clean release.
+  # Superseded as of v1.8.0+ by `.github/workflows/telegram-publish-files.yml`,
+  # which posts each platform's artifact individually to the **files**
+  # channel (with SHA-256 captions) and then a single cross-link
+  # message to the main channel pointing at the files-channel anchor.
+  #
+  # This job stays in the source tree, dormant, in case we ever want
+  # to revert to the bundled-changelog-on-main-channel pattern (or
+  # use both at once during a transition). To turn it back on:
+  #
+  #     gh variable set TELEGRAM_NOTIFY_ENABLED --body true
+  #
+  # Note: with the new workflow active too, that produces TWO posts
+  # to the main channel per release (the legacy APK+changelog *and*
+  # the new cross-link). Pick one.
+  #
+  # Default state is disabled.
   telegram:
     needs: [android, release]
     runs-on: ubuntu-latest
     # Gated on the repo variable `TELEGRAM_NOTIFY_ENABLED`. Default is
-    # OFF — the job skips silently unless the variable is set to the
-    # literal string "true". Toggle via:
-    #
-    #     gh variable set TELEGRAM_NOTIFY_ENABLED --body true
-    #     gh variable set TELEGRAM_NOTIFY_ENABLED --body false
-    #
-    # Keeping the machinery (script + secrets) in place so flipping
-    # the switch back on is a one-liner, not a workflow edit.
+    # off — the job skips silently unless the variable is set to the
+    # literal string "true".
     if: ${{ vars.TELEGRAM_NOTIFY_ENABLED == 'true' && needs.android.result == 'success' }}
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/download-artifact@v4
-        with:
-          name: mhrv-rs-android-universal
-          path: apk
+      # Same retry pattern as the `release` job above — `actions/download-artifact@v4`
+      # has been flaking on this workflow with 5-retries-exhausted errors.
+      - name: Download universal APK (with retries)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mkdir -p apk
+          for attempt in 1 2 3; do
+            if gh run download "${GITHUB_RUN_ID}" \
+                 --name mhrv-rs-android-universal \
+                 --dir apk \
+                 --repo "${GITHUB_REPOSITORY}"; then
+              echo "downloaded universal APK on attempt $attempt"
+              ls -la apk/
+              exit 0
+            fi
+            echo "download attempt $attempt failed; retrying in 30s..."
+            sleep 30
+          done
+          echo "::error::failed to download universal APK after 3 attempts"
+          exit 1
 
       - name: Post to Telegram
         env:

.github/workflows/release.yml

@@ -0,0 +1,137 @@
+name: Telegram publish release files
+
+# Posts every release artifact (Android APKs, Windows ZIP, macOS, Linux,
+# OpenWRT, Raspbian) to the Telegram channel as individual messages with
+# Persian captions and a #v<MAJOR><MINOR><PATCH> hashtag. Files larger
+# than the bot API's 50 MB ceiling are split into ~45 MB byte chunks
+# server-side and posted as `<name>.part_aa`, `.part_ab`, ... — recipients
+# reassemble with `cat <name>.part_* > <name>`.
+#
+# This workflow is decoupled from `release.yml` so it can be re-triggered
+# for any historical tag (e.g. to re-post v1.8.0 after a Telegram channel
+# wipe) without rebuilding artifacts. It downloads from the GitHub Release
+# page directly via `gh release download`, so the assets must already
+# exist there.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release tag to publish (with or without the v prefix, e.g. 1.8.0 or v1.8.0)'
+        required: true
+        type: string
+  # Auto-trigger after a successful `release` workflow run. Posts files
+  # to Telegram once the release page exists. The `head_branch` of the
+  # triggering run is the tag name (e.g. `v1.8.0`) on tag-pushed releases,
+  # which is what we feed `gh release download`.
+  workflow_run:
+    workflows: [release]
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    # Skip when triggered by a `release` run that didn't succeed — no
+    # point posting half a release. Manual `workflow_dispatch` always
+    # runs (the user explicitly asked for it).
+    if: |
+      github.event_name == 'workflow_dispatch'
+      || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Sparse checkout would be nicer but stock checkout is fast
+          # enough for a 5 MB workflow file + ~200 KB script.
+          fetch-depth: 1
+
+      - name: Resolve version + hashtag
+        id: ver
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -n "${{ inputs.version || '' }}" ]; then
+            VER="${{ inputs.version }}"
+          else
+            # workflow_run path. `head_branch` for a tag-pushed release
+            # workflow is the tag name (e.g. `v1.8.0`).
+            VER="${{ github.event.workflow_run.head_branch || '' }}"
+          fi
+          if [ -z "$VER" ]; then
+            echo "::error::could not determine version from inputs or workflow_run trigger"
+            exit 1
+          fi
+          # Strip the leading `v` if present.
+          VER="${VER#v}"
+          # Hashtag: `#v` + version with dots removed. So 1.8.0 → #v180,
+          # 1.8.10 → #v1810, 2.0.0 → #v200. Predictable across releases.
+          HASHTAG="#v$(echo "$VER" | tr -d '.')"
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          echo "hashtag=$HASHTAG" >> "$GITHUB_OUTPUT"
+          echo "Resolved: version=$VER  hashtag=$HASHTAG"
+
+      - name: Download release assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          mkdir -p assets
+          # Mirror the retry pattern from `release.yml`'s download step —
+          # GitHub's release-asset CDN occasionally times out on cold
+          # tags. Three attempts with 30 s backoff covers most flakes.
+          for attempt in 1 2 3; do
+            if gh release download "v${{ steps.ver.outputs.version }}" \
+                 --dir assets \
+                 --repo "${GITHUB_REPOSITORY}"; then
+              echo "downloaded release assets on attempt $attempt"
+              ls -la assets/
+              exit 0
+            fi
+            echo "attempt $attempt failed; retrying in 30s..."
+            sleep 30
+          done
+          echo "::error::failed to download release assets after 3 attempts"
+          exit 1
+
+      - name: Publish files to Telegram channel
+        env:
+          BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          # The files channel — supergroup-style negative ID, hard-coded
+          # rather than templated as a repo variable because there's only
+          # ever one of these and putting it in source makes the workflow
+          # auditable. The bot token already has post permissions there.
+          CHAT_ID: '-1003966234444'
+          # The main announcement channel. Receives a single cross-link
+          # message per release pointing at the file-channel anchor post,
+          # instead of the previous behaviour of attaching the universal
+          # APK + full changelog. Sourced from the same secret the
+          # legacy `telegram` job in release.yml used.
+          MAIN_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          # Public-username form of the files channel link. Used for
+          # both (a) the post-link in the main-channel cross-post — so
+          # `t.me/<name>/<msg>` works for everyone, not just members
+          # via `t.me/c/<id>/<msg>` — and (b) one of the two
+          # channel-join links rendered at the bottom of the cross-post.
+          # Defaults to `mhrv_rs` (current public username); override via
+          # repo variable if the channel is renamed.
+          FILES_CHANNEL_USERNAME: ${{ vars.FILES_CHANNEL_USERNAME || 'mhrv_rs' }}
+          # `t.me/+<hash>` invite link for the files channel. Rendered
+          # as the second channel-join option in the main-channel
+          # cross-post — the only join path that works for users coming
+          # from outside Telegram search (private/restricted channels)
+          # or whose Telegram client doesn't resolve usernames cleanly.
+          # Override via repo variable if the channel's invite hash is
+          # rotated.
+          FILES_CHANNEL_INVITE: ${{ vars.FILES_CHANNEL_INVITE || 'https://t.me/+R1OyoHX2boA1ZDgx' }}
+        run: |
+          if [ -z "${BOT_TOKEN:-}" ]; then
+            echo "::error::TELEGRAM_BOT_TOKEN not set; can't publish"
+            exit 1
+          fi
+          python3 .github/scripts/telegram_publish_files.py \
+            --assets-dir assets \
+            --version "${{ steps.ver.outputs.version }}" \
+            --hashtag "${{ steps.ver.outputs.hashtag }}"

.github/workflows/telegram-publish-files.yml

@@ -1,6 +1,6 @@
 [package]
 name = "mhrv-rs"
-version = "1.7.10"
+version = "1.8.1"
 edition = "2021"
 description = "Rust port of MasterHttpRelayVPN -- DPI bypass via Google Apps Script relay with domain fronting"
 license = "MIT"

Cargo.lock

@@ -14,8 +14,8 @@ android {
         applicationId = "com.therealaleph.mhrv"
         minSdk = 24 // Android 7.0 — covers 99%+ of live devices.
         targetSdk = 34
-        versionCode = 155
-        versionName = "1.7.10"
+        versionCode = 158
+        versionName = "1.8.1"
 
         // Ship all four mainstream Android ABIs:
         //   - arm64-v8a      — 95%+ of real-world Android phones since 2019