AngelaBox v1.0.129-stable

• 1.0.128：

1. 链式代理只带 TCP，UDP 明确失败不再偷跑 (Chained profiles carry TCP only — UDP now fails loudly instead of leaking): 内核的 detour 只作用于 TCP 拨号，落地节点自己建的 UDP 连接不会经过链路，源地址既不是入口也不是落地。以前链式开启时这类流量会照常发出去，出口地址与界面上显示的落地节点不一致。现在链式 outbound 拒绝 UDP，连接直接失败，不会再有任何一条包从你没选的地址出去。默认的「禁用 QUIC」仍会复位 UDP 443，日常浏览无感；游戏、语音、自建 WireGuard 这类 UDP 需要关掉链式才能用。
   The kernel's detour only routes the TCP dial; a UDP socket created by the landing hop never passes through the chain, so its source address was neither the entry nor the landing node. With a chain bound, that traffic used to go out anyway, reporting an exit address that did not match the landing node shown in the UI. The chain outbound now refuses UDP, so the connection fails visibly and no packet can leave from an address you did not pick. QUIC (UDP 443) is still reset by the default overlay, so ordinary browsing is unaffected; UDP traffic such as games, voice calls and self-hosted WireGuard needs the chain turned off.
2. 导入的配置不再把手机变成局域网里的开放代理 (An imported profile can no longer turn the phone into an open proxy for the LAN): 订阅里的 sing-box 配置如果写了 "listen": "0.0.0.0"，内核会照做，同一个 Wi-Fi 下的任何人都能拿你的手机当出口，而界面上看不出任何迹象。现在非回环的入站监听在导入和启动时一律改回 127.0.0.1（unix socket 路径不动），并在提示里点名改了哪一条。
   If a sing-box profile from a subscription contains "listen": "0.0.0.0", the kernel obeys it and anyone on the same Wi-Fi can use the phone as an exit — with nothing in the UI to show for it. Non-loopback inbound listeners are now rebound to 127.0.0.1 at import and start (unix socket paths are left alone), and the notice names each entry that was rewritten.
3. 规则集地址钉到发布版本，不再跟着可变分支漂 (Rule-set URLs are pinned to a release tag instead of a mutable branch): 规则集决定一个域名走代理还是直连，所以它的地址是供应链输入。应用自己写出的规则集地址现在钉在 sing-geosite@20261024005255 与 sing-geoip@20261012，包括默认脚本、广告拦截和 Clash 转换；订阅自带的第三方规则集仍原样保留。任何能把可变分支改回 @rule-set 的改动都会被 CI 拦住。
   A rule set decides whether a domain is proxied or dialled directly, which makes its URL a supply-chain input. The URLs the app writes itself are now pinned to sing-geosite@20261024005255 and sing-geoip@20261012, including the default overlay script, ad blocking and Clash conversion; third-party rule sets that arrive with a subscription are still left exactly as they are. CI now fails if a mutable @rule-set ref comes back.
4. DNS 兜底查到的地址也要过安全策略 (The DNS fallback answer now goes through the same address policy): 隧道开着、绕过隧道的 DNS 又被拦时，应用最后会退回系统解析；这一步以前拿到的地址没有再检查，等于给「返回的地址必须全部合法」这条规则开了个后门。现在假 IP 照常放行（隧道会按名字还原目标），其余地址仍然必须通过同一套检查。
   With the tunnel up and out-of-tunnel DNS blocked, the app falls back to system resolution; the addresses from that last step used to skip the check entirely, which punched a hole in the "every returned address is allowed" rule. Fake-IP answers are still accepted (the tunnel maps them back by name), and everything else still has to pass the same check.
5. 安装包只带 arm64，32 位设备不再装上就闪退 (The APK ships arm64 only, so 32-bit devices no longer install and then crash): 以前安装包声明支持四种架构，实际只有 arm64 带内核库，32 位设备安装后一启动就在加载内核时崩掉。现在明确只发 arm64，不支持的设备会被直接判定为不兼容，安装包也小了约 3 MB。
   The APK used to declare four architectures while only arm64 carried the kernel library, so a 32-bit device installed it and crashed on kernel load at first start. The build is now arm64-only; unsupported devices are reported as incompatible instead, and the APK is about 3 MB smaller.
6. 导入入口收窄 (The import intent filter is narrower): 以前本应用会出现在「用哪个应用打开这个文本文件」的候选里，任何应用都能把自己的一份文本通过 content:// 推进导入流程。现在只保留规则集 .bpf 文件那几条路径匹配，分享菜单和「从文件导入」不受影响。
   The app used to appear as a handler for every text file, and any app could push arbitrary text into the import flow through its own content:// provider. Only the .bpf rule-set path patterns remain; the share menu and "import from file" are unaffected.

本版安装包：AngelaBox-stable-android.apk（arm64）。

Verify:

sha256sum -c AngelaBox-stable-android.apk.sha256

• Product: AngelaBox
• Package: io.chainbox.app
• Kernel branch: chain-dev
• Kernel tag: v1.15.0-chain.8
• Kernel commit: 70f08519fceb81337a00989851454d98c4728194
• Official baseline: SagerNet/sing-box v1.15.0-alpha.10
• Official type-constant check: pass
• Go: go1.25.5