ArasClient v1.8.2

ArasClient v1.8.2

Two rounds since v1.8.1: the ECH (Encrypted Client Hello) work for the
Xray profiles, and WireGuard/AmneziaWG dialled by the core like every other
protocol. Everything from v1.8.1 and earlier is described in the
v1.8.1 release notes.

🕵️ ECH: the key lookup can now ride through its own outbound

Plain-DNS ECH key lookups are being blocked in some places while ECH itself
still works (cloudflare-ech.com answers). The lookup needs a path of its own,
and the app now has one:

• Two fields on TLS profiles (VMess / VLESS / Shadowsocks / Trojan, and
  Hysteria2): echConfigList — the key source — and echOutbound, the ECH
  outbound as raw JSON. The Aether profiles keep their own ECH fields (ECH DNS
  / ECH domain) from v1.8.1; this one is for the Xray protocols.

• The recipe (from the core's author):

  echConfigList: h2c://1.1.1.1/dns-query

  echOutbound:
  {"tag":"tls-repack-dns","protocol":"freedom","settings":{"redirect":"1.1.1.1:443"},"streamSettings":{"security":"tls","tlsSettings":{"serverName":"www.microsoft.com","verifyPeerCertByName":"fromMitm,www.microsoft.com","alpn":["fromMitm"],"fingerprint":"chrome"}}}

• What the app does with it: the ECH outbound is appended to the generated
  configuration exactly as written, and the profile's TLS settings get
  echSockopt.dialerProxy pointing at it — so the ECH key query leaves
  through that masked outbound (a TLS connection to a public resolver with a
  borrowed SNI and a certificate checked by name) instead of a plain DNS
  query. The profile's own handshake then uses the fetched key, and the real
  server name stays hidden.

• The guards: the ECH outbound must be a JSON object, must come with an
  echConfigList, and needs a tag of its own — not direct, block or
  exit-node, and not starting with proxy (balancers pick their members by
  that prefix). Two different ECH outbounds written under the same tag get
  numbered (tag-2); a tag another outbound already uses is refused; an
  imported ECH outbound that was never checked fails the connection instead of
  letting the query go out in the clear. The ECH outbound is a TLS-only
  setting — a REALITY profile keeps it unused. Same rules as PattNG P67.

• No core rebuild was needed: the bundled Xray core (patterniha v26.10.13)
  already carries the ECH-over-h2c lookup, the echSockopt and the fromMitm
  certificate-by-name support — the app-side plumbing was the missing half.

🔌 WireGuard and AmneziaWG, dialled by the core like every other protocol

• AmneziaWG was bypassing the core. The selected AWG profile took the
  VpnService TUN descriptor for itself, so the tunnel came up carrying nothing:
  no DNS, no routing, no statistics — while the latency test of the same
  profile went through the core. The standalone tunnel is gone: every
  protocol, AmneziaWG included, is dialled by the core now, and the TUN has one
  reader again.
• Plain WireGuard had no keep-alive (the peer's mapping expires after
  minutes) and left noKernelTun unset — in root mode the core then built a
  kernel TUN that fought the app's own interface. Both are filled in now, with
  the allowed IPs and the keep-alive.
• The .conf parsers no longer cut an IPv6 endpoint in half and no longer
  drop PersistentKeepalive.

🔧 In this release

• The bundled core AAR was rebuilt from the same pinned core tag
  (aras-core-26.10.13); the core source itself did not change.
• The five APKs are the same size as v1.8.1's (the ECH work is a few lines of
  code; the rebuilt core library differs by 40 KB).

🔐 Signing

• Signed with the dedicated ArasClient key — the same key as v1.7.10 and
  v1.8.1 (certificate SHA-256 3b2a6fa9…b5ba): all five APKs, one signer
  each. Upgrades install over v1.8.1 without uninstalling.

⚠️ Known limitations

• The ECH outbound is used on TLS profiles only, and the recipe's fromMitm
  certificate check relies on the core's fromMitm support — present in the
  bundled core.
• Profiles imported with a broken older build keep wrong AWG values: config
  fixes change parsing, not stored data. If AWG still fails after updating,
  delete the profile and re-import the .conf file.
• OpenVPN is not included. The official path is integrating with the
  installed OpenVPN for Android via its intent/AIDL API — planned as its own
  release.
• The Psiphon/Aether/Mieru tunnel path is not re-verified on a device for this
  release's cores yet (the network blocked handshakes during testing; the old
  and the new cores behaved identically under the same conditions, so no
  regression is suspected).
• Release builds log at warning level by default — set the log level to Info
  in Settings before reporting a VPN problem.