v3.0.0 - WB Stream + adaptive bypass + glass interface

v3.0.0 (2026-10-04) — WB Stream + adaptive bypass + glass interface

This release brings together the transport, routing and interface changes since
the last public release, v2.0.0.

WB Stream profiles and automatic recovery. Create conference transport
profiles from the managed-server wizard, import WB room links and resume setup
in the background. A completed deployment task alone does not mark a room ready:
live room and publisher state are checked. Transport changes address stalled
transfers, reconnects, owner-session recovery and relay cleanup. Available
bandwidth depends on the conference service and network; parallel transport does
not guarantee 10 MB/s.

Connection state and server selection. Connected status requires a confirmed
exchange through the tunnel. Server selection considers service responses
together with latency, supports cancellation and releases the search indicator
when selection ends. Automatic switching remains conservative to avoid
unnecessary interruption of active sessions. The home screen follows the actual
active server after a switch.

Adaptive routing and bypass diagnostics. AUTO compares direct and VPN paths
as sites are encountered, with a seven-day cache and network context. Apps can
be forced through the VPN. Supported TLS record strategies are tested separately;
probe outcomes and actual application traffic are displayed separately in
diagnostics, with copy/save actions. A successful probe alone is not proof that
an application used the bypass. A direct route exposes your normal public IP;
choose Global proxy when all traffic should use the VPN. HTTP/3, ECH-hidden names
and unrecognized traffic retain the core's routing rules.

Speed testing. Measurements use the active tunnel's authenticated SOCKS
bridge, verified TLS, bounded payloads, cancellation and alternative measurement
services. A partial or unacknowledged transfer is not reported as a completed
result. Measurement-service failures are separate from VPN availability.

Glass interface with preserved themes. Refreshed navigation icons, panels,
typography and connection map; connection state changes the application's accent.
The home screen adapts to the viewport without scrolling. Repeatedly selecting
Settings preserves its position. All six themes remain, including fsociety
terminal styling; the launcher icon can follow the theme.

Sixteen languages. Application-owned screens, dialogs, onboarding,
notifications and diagnostics use localized resources. Service brands, protocol
names and user-created server names are preserved. Third-party web login pages
remain controlled by their provider.

Wi-Fi auto-connect. Network callbacks and delayed checks follow the current
physical Wi-Fi association. An identity hidden by Android is treated as
untrusted after bounded retries, without claiming an Evil Twin attack. Turning
the setting off or losing the association cancels stale start attempts.

Server agent 0.5.14 / revision 15. Existing WB agents qualify for an update
containing the audited fixes. Authenticated binary uploads receive a bounded
four-minute reading deadline; normal API requests retain their shorter limit.
The application has matching upload timeouts, displays server error details and
confirms a new process before reporting update success. Executables are checked
by SHA-256 and a smoke test before replacement, with a backup and serialized
installation. Both amd64 and arm64 installers remain embedded in the APK.

Release hardening. Recovery ownership prevents an old restart from modifying
a replacement tunnel. Relay creation/stop is synchronized. Telemost/VK signaling
verifies TLS certificates and hostnames. SSH setup requires confirmation of a new
server's fingerprint and rejects a changed key; initial agent pairing is pinned
to the public key obtained over SSH. Backup format 3 keeps same-named
subscriptions separate while retaining older import support.

Updated build (2026-10-05): SSH server setup. SSH and agent management use the
running application's VPN proxy, including WB Stream, because the application's
own traffic is excluded from Android's TUN. SSH handshakes have bounded deadlines,
visible attempt numbers and cancellation that closes the underlying sockets.
Proxy transport keeps destination DNS inside the VPN. Fingerprint confirmation
and pinned agent pairing remain required. Background provisioning no longer
delays the successfully added server screen. This replaces the APK in the existing
v3.0.0 release; no separate release is introduced.

Updated build (2026-10-05): UDP transport cleanup. Acknowledged UDP requests
and replies release their transport send state. Delayed SOCKS UDP replies keep
the original destination header when subsequent packets reuse the receive
buffer. Closing a UDP association retires its outstanding requests without
affecting other associations. Lost acknowledgements still trigger reliable
retries without duplicate delivery. Both the Android relay and embedded Linux
server transports include these fixes; update an existing managed server's
agent to revision 15 to install the matching server transport.

Validation

• Updated Android/JVM suite: 238 passed, 13 optional external fixture checks skipped,
  no failures or errors. Full release Lint: zero errors.
• Go release vet passed. Previous build validation included Linux agent
  migration/rollback and a real HTTPS update of the 26,972,320-byte agent in
  43.9 seconds, with a verified certificate, matching installed hash and
  confirmed new process/revision. That upload timing belongs to agent 0.5.13.
• Release preparation covered relay transport, Linux deployment/striping,
  real TUN TCP/UDP IPv4/IPv6 routing, TLS speed transfer/cancellation, server
  selection, notifications, bypass diagnostics, WB recovery, background Wi-Fi
  callbacks, six themes and the 16-language resource audit.
• Final APK signature, ZIP integrity, native payloads and both decoded agent
  installers verified. Previous build upgrade and cold start were checked on an owned API 35 device;
  The previous v3.0.0 APK's Play Protect scan completed without detected threats.
• Previous build SSH fixtures covered all three backends, authenticated VPN SOCKS,
  destination DNS, key rejection/confirmation/change, silent peers and cancellation.
  A physical-phone user also confirmed that DE1 was successfully added after the
  SSH correction. This does not establish reachability of an unavailable VPS.
• UDP cleanup regressions include 2,300 completed request/reply cycles, delayed
  replies to different destinations, association isolation and dropped ACKs.
  The transport suite passed 121 tests with five optional checks skipped.
  Real WB runs between a Windows client and HEL verified complete 12 MiB
  downloads and uploads by byte count and SHA-256. One warmed download reached
  6.78 Mbit/s; this is an observation for that setup, not a guaranteed speed.
• Updated Linux agent suite: 37 tests passed on HEL, including the symlink
  protection check and ELF upgrade from 0.5.13 to 0.5.14 with byte-exact
  backup and rollback. These checks use isolated temporary files and do not
  replace the running production agent.

Physical-phone network changes, carrier-specific bypass, sustained WB throughput
and uninterrupted GPT Remote sessions have not been established by these fixtures.
Play Protect results on one device are not global Google approval.

Installation

Download NetGuard-v3.0.0.apk below. Requires Android 8.0+ / ARM64.
Install over the previous version: package ID and signing certificate are
preserved, including development versions 2.0.34 and 3.0.1. No uninstall is required.

Very old agents can still reject their first slow upload at the former
30-second limit. If this occurs, bootstrap the current agent over SSH first;
increasing the phone's timeout cannot change an already running old server.
New installations and successfully updated agents use the corrected deadline.

versionCode 117, versionName "3.0.0". SHA-256 is supplied in
the accompanying checksum file.
A checksum file and both Linux server-agent binaries are included as assets.