vpn/docs/upstream-research.md
2026-09-23 01:19:36 +00:00

2.3 KiB

Upstream/API research snapshot

Checked 2026-09-22.

Flet

Current Flet publishing docs describe a generated Flutter shell and support [tool.flet.app] path/module, local developer packages and Flutter user extensions. The bridge uses a Flet Service control and a Dart FletService, then a standard Flutter MethodChannel for the Android plugin. It is intentionally not a Python subprocess bridge.

Android

Current Android docs require VpnService.prepare(), protect() for upstream sockets, Builder.establish(), and a foreground service on API 26+. Android 14+ foreground services require a declared type; this project uses the documented specialUse type and an explanatory property. Android has one active VPN service per user/profile.

Builder.addDisallowedApplication() is valid for DIRECT, but it makes traffic bypass the VPN and therefore cannot implement VOID. VOID needs a UID-aware native packet path and a fail-closed drop policy; the Python model exists now, while enforcement is a device-tested native milestone.

LocalOnlyHotspot is the public API for an app-created local network. Android 13+ requires NEARBY_WIFI_DEVICES; older targets use location permission. The reservation returns SSID/password but the interface address must be discovered at runtime. The implementation does not assume a fixed 192.168.43.1 address and does not enable system tethering.

FreeTurn

The current samosvalishe/free-turn-proxy mobile README documents the gomobile API: Start, StartTunnel, StartDirectTunnel, Restart, Stop, GetState, TunnelStats, ParseTunnelConfig, SetProtect, SetEventSink, ValidateConfig and OnCaptcha. The Android AAR is built with the upstream task build:android target. The Android reference app is GPL-3.0 and is used only as lifecycle/API evidence.

SignBox / sing-box

The exact public name signbox and a public artifact matching the user's VLESS + AmneziaWG 3.1 claim were not found. Upstream sing-box exposes libbox.aar through gomobile, but its package/API and build tags must be checked against the actual SignBox artifact before compiling calls. The repo therefore has a real adapter boundary and a hard UNSUPPORTED result rather than a fabricated success.

Removed scope

iOS and NetworkExtension are not implemented. macOS is omitted from the first build; desktop target is Linux/Windows proxy-only.