GRoute v2.1.0

GRoute v2.1.0

SSH and SFTP access to your servers, diagnostics that reach past the client into the server and
the panel, and a free config source that tests before it adds.

---

SSH

A new tab between Shop and Home for managing and reaching your servers.

• Hosts — add servers with host, port, username and password. Credentials are encrypted at
  rest with the Android Keystore.
• Routed through the tunnel by default, with a per-host Connect directly option for
  boxes that are themselves VPN nodes. Each card shows which path it will take before you
  connect.
• Shell — an interactive session with scrollback, command history, cursor keys and a working
  Ctrl-C that delivers a real SIGINT over the remote PTY.
• Local terminal — a shell on the device itself, in the app sandbox, for checking routes,
  properties and connectivity without leaving the app.
• SFTP — browse, upload, download, delete and create folders. Transfers go through the system
  file picker, so no storage permission is needed and files land wherever you choose.

Server-side debugging

When an SSH host matches the config you are debugging, the debugger can now run checks on the
server rather than only from the phone.

• Is anything actually listening on the port
• Is a proxy core process running
• Firewall rules covering the port
• The certificate the server presents, and its expiry
• Recent core errors from the journal or log file
• Load average measured against the core count

Panel-side debugging

Point the debugger at a 3x-ui or PasarGuard panel and it walks the chain for that one
config.

Panel type, address and credentials are stored per config, with the password encrypted.

Free Configs

A new entry under Free projects that pulls servers from the @ConfigsHUB Telegram channel,
measures the real latency of each one, and keeps only those that actually connect.

The VPN must be connected for the channel to be reachable. Refresh from the project card or from
the subscription row; each run adds newly working servers and drops ones that stopped answering.

Also new

• Xray log level is selectable in Preferences — none through debug — and applies from the
  next connection.
• Allow insecure TLS now works by pinning the server's certificate rather than disabling
  verification, which is stricter than what it replaced.

---

Fixes

• Smart Connect re-checks every minute and now actually switches. It was measuring correctly
  and then discarding the result.
• IKEv2 server identity is read from subscription links. It previously fell back to the
  address, which produced AUTH_FAILED before EAP started whenever the certificate carried a
  hostname.
• Connection flicker when starting IKEv2 is gone; a stale broadcast from the stopped Xray
  service was clearing the connecting state.