v0.2.1

RIPDPI v0.2.1

versionCode 14 · 2833 commits since v0.1.4

Main changes: AmneziaWG 3.x profiles (with a breaking bundle format change), importing subscriptions, .conf files and QR codes inside the app, a selector that picks profiles by measured transfer quality, and a rewritten diagnostics pipeline with IPv6/NAT64, HTTP/3 and path-MTU checks. The remaining work is mostly fixes: about 1,570 fix commits, of which roughly 240 touch diagnostics and 125 the UI. Processing stays on-device; there is no account and no application backend.

The v0.2.0 tag exists but was never released: its publish run failed on a workflow permission error. v0.2.1 is the first release of this line. It differs from the v0.2.0 tag only in the version bump, the release-pipeline fixes and their tests.

⚠️ Upgrade notes

• AmneziaWG bundles changed format. Bundles now require schema version 2, a named wire profile, and string headers (commit b3bdf4263). Exports made by older versions do not load and have to be replaced.
• Stored data is migrated. Pending subscription health policies are migrated, and the historical "first group" choice is converted once into an explicitly stored active group; activating a standalone profile clears it.
• Target SDK is now 37.

✨ Highlights

• AmneziaWG 3.1. Named range and signature profiles, a version 2 bundle format, and editor support for the 3.x fields. WARP Amnezia settings and the client accept S3/S4 padding, and the Android arm64 S3/S4 floor is lifted. The evidence for the lifted floor is from emulator interop runs; the shared deployment floor stays guarded (see #687).
• Import without leaving the app. A new "Add subscription" screen takes https:// links and ripdpi/sing-box subscription deep links. An "AmneziaWG from .conf file" entry reads a picked file (64 KiB cap, BOM stripped, binary rejected) and opens the editor prefilled. The QR scanner now also reads subscription links and AmneziaWG .conf codes, and a repeated frame of one code imports it once.
• Selection by measured quality. The selector fetches a configured HTTP URL through a transient relay runtime, rejects incomplete or oversized payloads, and discards evidence that is stale for the group, network, runtime or selection. Profile transfer quality and scoped MTU guidance also appear in diagnostics (#657). Failover uses the same payload check and keeps offline reserves; an unreadable reserve blocks startup instead of letting recovery overwrite saved state.
• Hysteria 2 port hopping. Validated hopping policies pass through import, storage, and direct or chain relay configuration. Protected UDP paths rotate while authenticated TCP and UDP traffic continues (#661).
• Timed connection pauses are persisted: every pause transition is committed before it is published, and AlarmManager owns the wake-up.
• Lua payload strategies without root. Payload-only plans run on an existing protected proxy socket inside an app-private script jail. A partial write is terminal and is never replayed. A pinned zapret2 runtime is also available for rooted devices.

🩺 Diagnostics

• IPv4, IPv6 and NAT64 are probed separately. NAT64 detection reads ipv4only.arpa AAAA data from the network's own resolvers (at most three requests) and follows RFC 6052. An ambiguous embedding does not authorize a TCP probe, and addresses are removed from redacted exports.
• HTTP/3 is tested with a real request: a bounded GET over certificate-verified TLS 1.3 with the h3 protocol. QUIC Initial evidence remains a separate probe, and the report never stores header values or bodies.
• Path MTU is measured with QUIC DPLPMTUD, per address family. The result is an authenticated UDP payload size, not an exact IP path MTU, and the report says so.
• A selective availability matrix shows per-service results, and only a finalized report can support a conclusion; rows saved before network-scope finalization do not.
• Exports are previewed and confirmed before they are written. New export sections: execution plans, strategy attempts, decision trace, resolver trace, protocol milestones, capture manifest, effective-config fingerprint, and VLESS Reality failure stages.
• Classification fixes: a probe handshake timeout counts as unreachable, only real Home stage timeouts are reported as timeouts, and the IP family, HTTP/3 and PMTU plan families are decoded correctly.

📥 Relays & import

• Import is stricter and says why. Plain VLESS links the backend cannot run, and Clash or sing-box nodes with plugins or transports, are rejected. AnyTLS links default to port 443 and refuse insecure. VLESS xHTTP links no longer default to XTLS Vision. Trojan SNI from Clash and Xray JSON is kept. User info in trojan, AnyTLS and Shadowsocks links is percent-encoded and decoded correctly, and share links with unencoded remarks are accepted.
• REALITY and Vision: non-TLS Vision traffic stays inside the REALITY TLS session, and the xHTTP VLESS flow defaults to none.
• Hysteria 2 enforces the pinSHA256 certificate pin end to end.
• AnyTLS and Mieru follow the reference clients more closely: AnyTLS sends FIN on application EOF but not on a write shutdown and draws padding sizes from a CSPRNG; Mieru ends every sub-session on a closeConnRequest. Imported Mieru profiles now activate with their credentials redacted.
• VLESS carriers are capped per exit IP, the NaiveProxy preflight probe is enforced, and an operator-owned Cloudflare Worker can optionally front the Telegram WebSocket tunnel.

🔐 Security & privacy

• Packet-capture exports clear packet content when redaction is on. Xray server names are hidden in privacy-mode exports, and pluggable-transport probes stay blocked once privacy mode is on.
• A failed read of a sealed credential now fails instead of continuing, and the app PIN is kept when the keystore cannot be read. Clearing the backup PIN asks for confirmation.
• TLS spoofing rejects IPv4 shorthand, localhost and NAT64 destinations. WebTunnel honours its certificate, certificate-domain and SNI settings.
• Received file descriptors are closed when an ancillary message is truncated, and the protect-socket connect is bounded.
• Lua assets install atomically, and a torn asset manifest is repaired.

🎛️ App experience

• The home card shows only the mode and exit; a collapsible "Bypass strategy" panel lists the step chain and each setting as a labeled row that TalkBack reads as one item.
• Text and icons are larger, diagnostics tabs follow the system font size, settings are grouped with their current values, and haptic feedback has a preference.
• Brazilian Portuguese (pt-BR) is added. Counts use the digits of the app locale, and each locale uses one glossary term per concept.

🛠️ Performance, build & internal

• Direct-path timeout scans are skipped when none are due, the split DNS policy is shared instead of cloned, the Mozilla CA bundle is parsed once per process, and the log timestamp locale is read once per batch.
• A local release preflight, a reproducible local VPN acceptance lab (#590), and source-owned CI change routing were added. The task portfolio moved to taskctl and OpenSpec.
• Release pipeline fixes shipped in this tag: the candidate-attempt tag ruleset check now accepts a hidden bypass-actor list for the workflow token, and the notes file is built without a write-only API call.

📦 Artifacts

Play AAB, F-Droid and GitHub APKs per ABI plus a universal build, update.json, SHA256SUMS, Android and Rust SBOMs, size reports, the candidate and release manifests, and the provenance attestation receipt. Every file is covered by SHA256SUMS except that file itself.

Full changelog: v0.1.4...v0.2.1