Moves to AGP 9.4.1 and Gradle 9.8.0; Rust 1.98.1 lets macOS 27 load
rust_api. Android 17 treats the tun subnet as local network, so starting
the VPN asks for that permission and falls back to gvisor without it.
Signed release builds upload native symbols to Crashlytics.
Replace window_ext with a first-party tray plugin that loads multi-size
ICO and resolution variants, rework setup, proxy, and wifi_ssid, and add
the Rust API plugin and the desktop Helper service.
The Helper now also serves Linux: setup installs it as a systemd unit on
demand from authorizeCore(), refusing a Helper binary that is not
root-owned or a unit installed for another UID, and it listens on
/run/flclash/helper.sock filtered by SO_PEERCRED against the installing
UID. /start requires the Core address to be a socket owned by the owner
UID, the listener survives accept() errors, and SIGTERM reaches the Core
teardown. Hosts without systemd keep the setuid Core, and an AppImage
reports TUN authorization as unavailable. The Dart-side IPC socket is
bound at 0600 and admits only a peer whose effective uid is the app's
own or root, since the Core connects as root under setuid or the Helper.
Override scripts resolve a main declared with const or let.
rust_api upgrades flutter_rust_bridge to 2.13.0 and builds through
Native Assets: the vendored Cargokit harness and the per-platform FFI
scaffold give way to a Dart build hook on flutter_rust_bridge_hooks, the
crate pins its toolchain and targets in rust-toolchain.toml, and the hook
exports the NDK libclang directory that rquickjs's bindgen needs on
Android, probing lib and lib64 and failing with a clear message when
neither holds it. It also replaces hotkey_manager: the crate wraps the
tauri global-hotkey crate, keys arrive as Flutter USB HID usages,
registration runs on the thread each platform binds it to (a
message-loop thread on Windows, the main queue on macOS), presses stream
back to Dart as action ids, and Linux stays X11 only and reports a
missing DISPLAY instead of registering silently.
setup builds the Go core and the Rust Helper through a Dart build hook in
place of the buildkit glue. Flutter runs the hook before every platform
build and flutter test, once per target architecture; it constructs
CoreBuilder from the setup_hooks package, which turns the hook input into
a BuildRequest, compiles the Core and, on Linux and Windows, the Helper
and manifest, and reports the files it read and the directories it wrote
as hook dependencies. setup_hooks keeps a fingerprint cache under
.dart_tool/setup_build_cache keyed on go list -deps inputs, module files,
build config, harness sources and toolchain versions; builds run in a
staging directory and move into place on success, and everything the
hook prints is mirrored into hook.log, which keeps appending when a
rotation fails. Hook failures reach the runner as BuildError or
InfraError, filesystem errors included.
Changelog: Rework the desktop plugins and add the Helper service and Rust bridge
chen08209