v1.1.0 - Supercharged Performance, Universal Cross-Platform Hardening & Self-Healing Watchdog

🚀 What's New in v1.1.0

This major release (v1.1.0) brings supercharged kernel & network performance tuning, universal self-healing watchdog automation, v2 multi-part URI configuration sharing, and exhaustive cross-platform hardening across both Linux servers/clients and Windows 10/11 devices. Every subsystem has undergone a 100% line-by-line audit to eliminate race conditions, edge case exceptions, and init system dependencies.

---

✨ High-Octane Performance & Network Supercharging

1. 🏎️ Paqet v1.1.0 KCP Profiles & Dual-Mode TCP Tuning

• 6 Tuned KCP Profiles: Interactive selection across specialized transmission profiles (standard, fast, fast2, fast3, gaming, bulk) directly inside paqctl menu o and Windows setup (Option 3).
• Direct TCP Flag Tuning: Full support for custom TCP local and remote flags (--tcp / tcp_flags), enabling custom flag combinations (AP for ACK+PSH, AS for ACK+SYN) for maximum DPI evasion and packet bypass.
• Smart MTU Auto-Discovery: Automated ICMP path MTU sensing across both Linux (detect_optimal_mtu) and Windows (Find-OptimalMtu) with intelligent fallback (-M do vs -D on ping, plus universal multi-language $LASTEXITCODE parsing on PowerShell).

2. ⚡ Universal Kernel & Open File Limit Expansion

• Automated Open File Expansion: Automatically generates /etc/security/limits.d/99-paqctl.conf and applies ulimit -n 1048576 alongside systemd service definitions (LimitNOFILE=1048576), ensuring maximum connection concurrency and zero Too many open files (EMFILE) bottlenecks across both systemd hosts and minimal containerized kernels (Docker, LXC, OpenVZ).

---

🛡️ Universal Self-Healing & Init System Independence

1. 🩺 Universal Self-Healing Watchdog (paqctl watchdog check)

• Systemd & Non-Systemd Auto-Recovery: Added intelligent init environment sensing (manage_watchdog). On systemd environments, deploys paqctl-watchdog.timer (checked every 60s). On non-systemd environments (Alpine Linux OpenRC, SysVinit, Docker containers), automatically configures /etc/cron.d/paqctl-watchdog (* * * * * root paqctl watchdog check >/dev/null 2>&1) for zero-dependency auto-healing.
• Real-Time Telegram Alerts: Instant notifications dispatched whenever the watchdog detects a service failure and triggers automatic recovery.

2. 🔥 Preemptive Firewall Precedence & Universal Persistence

• Top-Priority Rule Injection (-I 1): All raw (NOTRACK) and mangle (RST DROP) firewall rules across _apply_firewall and install_systemd_service are now inserted at index 1 (-I 1). This guarantees proxy packet interception takes priority over Docker DOCKER-USER chains, UFW, and conntrack rules.
• Universal Multi-Distro Persistence: Consolidated all firewall saving logic into persist_iptables_rules, supporting firewalld, Alpine OpenRC (/etc/init.d/iptables save), nftables (/etc/nftables.conf), netfilter-persistent, and /etc/sysconfig/iptables.

---

🌐 v2 Multi-Part URI Sharing & Copy-Paste Resiliency

1. 🔗 Shareable v2 URI Support (paqet://... & gfk://...)

• Full v2 Format Support: Export and import both 8-part (paqet://ip|port|key|socks|mode|fwd_port|fwd_target|profile) and 9-part (paqet://...|kcp_profile) base64 URI strings across Linux and Windows clients with 100% round-trip variable preservation.
• Automatic Network Sensing on Import: When importing a shareable URI string on a new Linux device (import_config_string), paqctl dynamically detects INTERFACE, LOCAL_IP, and GATEWAY_MAC to generate a production-ready config.yaml without prompt friction.

2. 📋 Copy-Paste & Base64 Sanitization

• URL-Safe Base64 Normalization: Both paqctl.sh and paqet-client.ps1 automatically sanitize pasted base64 strings (- and _ to + and /), auto-append missing = padding, and safely fall back across base64 -D and base64 -d to prevent decoding crashes from truncated or chat-formatted text.

---

🔒 Process Management & Edge Case Hardening

• Multiprocess Exception Safety (quic_client.py & quic_server.py): Replaced unsafe asyncio.create_task(writer.drain()) with exception-safe _safe_writer_drain(writer), cleanly catching ConnectionResetError and BrokenPipeError during high-throughput stream closures.
• SIGINT / SIGTERM Signal Trapping (quic_client.py): Added explicit signal interception (handle_shutdown) to quic_client.py's parent loop, terminating child tunnel processes cleanly when stopped by systemd or orchestrators (mainclient.py). Eliminates infinite while True: respawn loops and orphaned socket binding (EADDRINUSE / WinError 10048).
• Scapy Empty Payload Safety (vio_client.py & vio_server.py): Added strict layer checks (packet.haslayer(Raw) / hasattr(packet[TCP], 'load')) before payload extraction, preventing fatal AttributeError crashes when empty TCP keepalives, window probes, or pure ACKs arrive on raw sockets.
• Windows 11 24H2 & Minimal Linux Compatibility: Upgraded mainclient.py and mainserver.py process cleanup to use PowerShell Get-CimInstance (handling Windows 11 24H2 where wmic is removed by default) and added killall fallback when pkill is absent on lightweight containers.
• Canonical Process & Status Checks (paqctl.sh & paqet-client.ps1): Eliminated function overwriting (is_running) and upgraded get_main_pid() to query /run/paqctl.pid and systemctl show -p MainPID on Linux. On Windows, upgraded Stop-GfkClient and Get-ClientStatus to monitor and cleanly terminate all child GFK Python processes (mainclient, quic_client, vio_client), reporting real-time status and SOCKS5 proxy (127.0.0.1:14000).
• Path Hardening: Added explicit export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH" across all installer headers and embedded wrapper scripts (/usr/local/bin/paqctl), guaranteeing reliable execution inside non-interactive cron jobs and restricted init containers.