ArasClient v1.8.1

ArasClient v1.8.1

Everything below is every change since v1.7.10 — the releases v1.8.0 and
v1.8.1 listed in one place. v1.8.1 on top of v1.8.0 fixes the delay numbers,
and adds the exit node, sing-box imports and the TLS fingerprints.

🛜 AmneziaWG actually works now (the headline of 1.8.0)

AmneziaWG profiles never carried traffic before v1.8.0. Five defects were
stacked to hide it, all fixed:

1. Mimic packets (I1–I5) reach the core. Decoys sent ahead of every
   handshake initiation so the first bytes on the wire belong to another
   protocol (e.g. an "OPTIONS sip:…" line). Configured per profile in the AWG
   editor; a spec the core cannot parse fails validation at edit time instead
   of silently killing the tunnel at connect.
2. Junk params are read from [Interface]. AmneziaVPN writes
   Jc/Jmin/Jmax/S1/S2/H1–H4 as device-level settings; the old parser read
   them in peer context, found nothing, and silently substituted stock values
   — the server dropped every packet. Now [Interface] first, [Peer]
   fallback.
3. .conf detection no longer depends on the exact spelling of Jc.
   Files are classified as Amnezia on the key set, case-insensitively
   (including S3/S4 and I1–I5).
4. The TUN descriptor has one reader. tun2socks used to win the race and
   drain packets into a SOCKS proxy nothing serves in AWG mode.
5. An entry proxy that is Aether/Mieru no longer marks a whole subscription
   −1. The daemons now start when a chain needs them (refcounted), and the
   latency test no longer probes a chained profile's server directly.

Verified end-to-end on an emulator: tunnel up, junk params matching the file,
mimic packets emitted, traffic crossing the tun interface across repeated
on/off cycles.

📶 Ping and delay fixes (the point of 1.8.1)

• Delay numbers read ~5× too high in v1.8.0 — fixed. A v1.8.0 change made
  every measurement a single cold request: it paid the wireguard handshake +
  TCP + TLS (≈4–5 round trips) instead of one round trip on a warm
  connection. A server whose real delay was ~100 ms displayed ~500 ms.
  The measurement is back to the v1.7.x semantics: two samples over the same
  connection, min kept — the first warms the path, the second reads one real
  RTT.
• "Ping all" reports the egress country on cards now. A new core shim
  carries the country/IP back through the same dial path as the delay test,
  so batch results fill the card flags without separate requests.
• Tests start immediately instead of waiting behind a GeoIP pre-warm
  (DNS + batch lookup) that used to run before the first ping was dispatched.
• No more dropped frames during long test runs. Each result patches its
  own card; the whole group is no longer rebuilt (and every profile
  re-decoded) once per result.

📝 Remarks are yours

• Provider flags in remarks are kept on import: nothing rewrites a
  non-empty remark any more; default names only fill an empty one. Cards
  still compose their own flag, so nothing renders twice.

🚪 Exit node (new in 1.8.1)

In the Aether editor you can now pick which config the tunnel dials out
through — the list shows your profiles, the same way a proxy chain does:

• Leave it blank and the tunnel leaves directly (freedom), as always.
• Name a profile and the aether core's own dialer goes through the app's core
  to that profile's outbound — a chain pinned to the exit side.
• A name that no longer matches exactly one profile never breaks the
  connect: it degrades to the direct exit, and the editor shows what it
  picked.
• Latency tests of exit-node profiles serialize, because each owns the loop
  back port while it runs.

🧩 Core updated to patterniha v26.10.13

The bundled Xray core moved to patterniha's v26.10.13 base with our AmneziaWG
patches carried over (+91 upstream commits over v1.8.0's base), notably:

• TUN inbound uses Xray's built-in lightweight TCP/IP stack (gVisor
  removed) with several stability fixes.
• MASQUE: XMUX support, WARP domain-fronting fixes, Chrome User-Agent.
• TLS: Xray's built-in RootCAs by default (defends against a maliciously
  injected system CA), more ECH hardening.
• Lua scripting for dns and routing (power users).
• allowInsecure keeps working on public servers (restored for legacy
  profiles since the 26.x cores removed it).
• The fingerprint picker gains hellochrome_120/131/133,
  hellofirefox_120/148.

🌐 Root mode

• DNS leak fix for LAN-to-ISP resolvers (ported from upstream #6298): DNS
  queries to private/LAN resolvers are DNAT'd to a public IP so they resolve
  through the configured remote DNS instead of leaking back to the LAN/ISP
  resolver — the "some sites work, some don't" symptom.

🪂 Aether core updated to the official v2.3.0

libaether.so (arm64 / armeabi-v7a / x86_64) now carries the official
CluvexStudio Aether v2.3.0 release binaries, checksums verified against the
release's SHA256SUMS.txt. With it, and matching PattNG's editor:

• MASQUE SNI — the name the MASQUE handshakes put in their ClientHello.
• Encrypted Client Hello (ECH) with its lookup resolver (ECH DNS) and
  key domain (ECH domain).
• Four TLS fingerprints — Chrome (default), Firefox, Semi-Python, Go:
  the core offers the captured client's TLS 1.2 suite order and drops GREASE
  where that client sends none.
• WireGuard-over-MASQUE (gool), MASQUE-in-MASQUE (mim), WARP-in-WARP
  (wiw) — two-hop tunnels with outer and inner gateways, as before.
• warp→Psiphon, Psiphon→warp, Psiphon-only — the three carrier modes,
  with Psiphon region support.
• The exit node picker above is an Aether editor feature too.

📥 sing-box subscriptions (.json) now import

An update to a sing-box .json sublink used to import nothing. The
converter reads the dialing outbounds — vless (including REALITY's
public key / short id / fingerprint), vmess, trojan,
shadowsocks, hysteria2 — into the same share links the app has al-
ways read, skips group/meta objects (selector, urltest, direct, block, dns),
and validates the whole list before touching storage. Manual imports and
subscription updates both take it.

🔧 Infrastructure & fixes

• Release signing restored in CI — the workflow step that restores the
  keystore was missing the secrets mapping since the key hardening, so every
  automated build had failed with KEYSTORE_B64: unbound variable. CI now
  builds, signs, and uploads end-to-end (verified green).
• The main menu sheet (the three-line menu) no longer bounces up and down
  when dragged hard; it is pinned to the expanded position with an inner
  scroll.
• Subscription traffic display accepts a used= key, which some panels send
  instead of upload/download.
• This release is signed with the dedicated ArasClient key — the same key
  as v1.7.10 and every release before it that carried it: all five APKs,
  one signer each. Upgrades install without uninstalling.

⚠️ Known limitations

• Profiles imported with a broken older build keep wrong AWG values.
  Config fixes change parsing, not stored data. If AWG still fails after
  updating: delete the profile and re-import the .conf file.
• OpenVPN is not included. The official path is integrating with the
  installed OpenVPN for Android via its intent/AIDL API — planned as its own
  release.
• The bundled Psiphon server list (427 entries) is verified against
  Psiphon's signing key on every use, and the client fetches a fresh list
  itself once it has network. The full Psiphon/Aether/Mieru tunnel path is
  not re-verified on a device for this release's new cores yet (the network
  blocked handshakes during testing; the old and new cores behaved
  identically under the same conditions, so no regression is suspected).
• Release builds log at warning level by default — set the log level to
  Info in Settings before reporting a VPN problem.