Redesign app UI and streamline VPN connection controls

LICENSE-EXCEPTION

@@ -1,5 +1,5 @@
 OneXray VPN Provider Exception
-Version 1.0
+Version 1.2
 
 1. Scope
 
@@ -13,22 +13,40 @@ Exception. This Exception applies only to those rights.
 
 2. Eligibility and permission
 
-You may rely on this Exception only if both of the following apply:
+You may rely on this Exception only if all of the following apply:
 
   a) You are a VPN service provider.
-  b) You use the Covered Code to create a customized client for your own
-     VPN service.
+  b) You use the Covered Code to create a dedicated, customized client
+     that connects exclusively to your own VPN service.
+  c) The customized client does not include general-purpose
+     custom-configuration or subscription features, including the
+     ability to import or use arbitrary third-party VPN or proxy
+     configurations or subscription URLs.
+  d) Each customized client you distribute under closed-source terms
+     includes a clear, reasonably accessible acknowledgment in its user
+     interface that it is based on the OneXray project, together with a
+     link to https://github.com/YuanDevTeam/OneXray. An About, Credits or
+     Open-source Notices screen may be used for this acknowledgment.
 
-For that purpose, you may use, copy, modify, build and distribute the
-Covered Code and the resulting customized client under terms of your
-choice, including proprietary, closed-source terms. You need not comply
+Configurations and subscriptions that you supply solely for access to
+your own VPN service are permitted. Branding the client for your service,
+distributing it only to your subscribers, or making your service the
+default does not satisfy these conditions if the client can also connect
+to third-party services.
+
+For that purpose and subject to the conditions above, you may use, copy,
+modify, build and distribute the Covered Code and the resulting
+customized client under terms of your choice, including proprietary,
+closed-source terms. You need not comply
 with GPLv3's conditions for the Covered Code in that permitted use,
 including its requirements to license the client or your modifications
 under GPLv3, disclose Corresponding Source or supply Installation
 Information.
 
 This permission does not extend to closed-source clients for VPN services
-provided by others. It does not restrict anyone's rights under GPLv3.
+provided by others, including general-purpose clients that support both
+your own service and third-party services. It does not restrict anyone's
+rights under GPLv3.
 Uses outside this Exception remain subject to GPLv3 or another permission
 from the applicable copyright holders.
 

README.md

@@ -56,7 +56,7 @@
 
 Choose the official store for your device:
 
-- **iPhone / iPad:** [App Store](https://apps.apple.com/us/app/onexray/id6745748773) — iOS / iPadOS 15+.
+- **iPhone / iPad:** [App Store](https://apps.apple.com/us/app/onexray/id6745748773) — iOS / iPadOS 16+.
 - **macOS:** [Mac App Store](https://apps.apple.com/us/app/onexray/id6745748773) — macOS 13+, Apple silicon or Intel.
 - **Android phones / tablets:** [Google Play](https://play.google.com/store/apps/details?id=net.yuandev.onexray) — Android 10+, arm64-v8a or x86_64.
 - **Windows:** [Microsoft Store](https://apps.microsoft.com/detail/9NJ0MVHW215D) — Windows 10 20H2+ (x64) or Windows 11 (ARM64).
@@ -106,7 +106,13 @@ Code, translations and documentation contributions are welcome. Start with the [
 
 OneXray is licensed under the [GNU General Public License v3.0](./LICENSE), with the [OneXray VPN Provider Exception](./LICENSE-EXCEPTION).
 
-VPN service providers may build and distribute customized, closed-source clients for their own VPN services without complying with the repository's GPL requirements for the code covered by the exception. Other uses remain subject to the GPL or another applicable permission.
+VPN service providers may build and distribute dedicated, customized closed-source clients that connect exclusively to their own VPN services without complying with the repository's GPL requirements for the code covered by the exception.
+
+To qualify, the client must not include general-purpose custom-configuration or subscription features, including the ability to import or use arbitrary third-party VPN or proxy configurations or subscription URLs. Configurations and subscriptions supplied by the provider solely for access to its own VPN service are permitted. Branding the client for the provider, distributing it only to the provider's subscribers, or making the provider's service the default is not sufficient if the client can also connect to third-party services.
+
+Each closed-source client distributed under this exception must clearly acknowledge that it is based on the OneXray project and include a link to [OneXray](https://github.com/YuanDevTeam/OneXray) in a reasonably accessible part of its user interface, such as an About, Credits or Open-source Notices screen.
+
+These conditions apply to eligibility for the exception. Other uses remain subject to the GPL or another applicable permission.
 
 Yuan Dev Team guarantees that it will not introduce direct third-party dependencies that require a qualifying customized client as a whole to be GPL-licensed or to disclose its source code under the GPL. Third-party licenses and their component-specific obligations still apply; the exception only covers rights Yuan Dev Team owns or is authorized to license.
 

android/app/src/main/AndroidManifest.xml

@@ -50,6 +50,10 @@
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
+            <intent-filter>
+                <action android:name="android.service.quicksettings.action.QS_TILE_PREFERENCES" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
             <intent-filter>
                 <action android:name="android.intent.action.VIEW" />
                 <category android:name="android.intent.category.DEFAULT" />

android/app/src/main/kotlin/net/yuandev/onexray/pigeon/Messages.g.kt

@@ -682,6 +682,7 @@ private open class MessagesPigeonCodec : StandardMessageCodec() {
   }
 }
 
+
 /** Generated interface from Pigeon that represents a handler of messages from Flutter. */
 interface BridgeHostApi {
   fun getTunFilesDir(callback: (Result<String>) -> Unit)
@@ -1013,6 +1014,11 @@ interface BridgeHostApi {
 interface AppleWidgetHostApi {
   fun takeAction(callback: (Result<String?>) -> Unit)
   fun setLanguage(languageCode: String, callback: (Result<Unit>) -> Unit)
+  fun beginPreparation(callback: (Result<String>) -> Unit)
+  fun finishPreparation(token: String, callback: (Result<Unit>) -> Unit)
+  fun startPreparedVpn(token: String, requestJson: String, callback: (Result<NativeVpnCommandResult>) -> Unit)
+  fun connectedAtMilliseconds(callback: (Result<Long?>) -> Unit)
+  fun setStartBlocked(blocked: Boolean, callback: (Result<Unit>) -> Unit)
 
   companion object {
     /** The codec used by AppleWidgetHostApi. */
@@ -1060,6 +1066,101 @@ interface AppleWidgetHostApi {
           channel.setMessageHandler(null)
         }
       }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.onexray.AppleWidgetHostApi.beginPreparation$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { _, reply ->
+            api.beginPreparation{ result: Result<String> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MessagesPigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(MessagesPigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.onexray.AppleWidgetHostApi.finishPreparation$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { message, reply ->
+            val args = message as List<Any?>
+            val tokenArg = args[0] as String
+            api.finishPreparation(tokenArg) { result: Result<Unit> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MessagesPigeonUtils.wrapError(error))
+              } else {
+                reply.reply(MessagesPigeonUtils.wrapResult(null))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.onexray.AppleWidgetHostApi.startPreparedVpn$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { message, reply ->
+            val args = message as List<Any?>
+            val tokenArg = args[0] as String
+            val requestJsonArg = args[1] as String
+            api.startPreparedVpn(tokenArg, requestJsonArg) { result: Result<NativeVpnCommandResult> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MessagesPigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(MessagesPigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.onexray.AppleWidgetHostApi.connectedAtMilliseconds$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { _, reply ->
+            api.connectedAtMilliseconds{ result: Result<Long?> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MessagesPigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(MessagesPigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.onexray.AppleWidgetHostApi.setStartBlocked$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { message, reply ->
+            val args = message as List<Any?>
+            val blockedArg = args[0] as Boolean
+            api.setStartBlocked(blockedArg) { result: Result<Unit> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MessagesPigeonUtils.wrapError(error))
+              } else {
+                reply.reply(MessagesPigeonUtils.wrapResult(null))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
     }
   }
 }

android/app/src/main/kotlin/net/yuandev/onexray/vpn/OneVpnService.kt

@@ -27,6 +27,9 @@ import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.booleanOrNull
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
 import libXray.DialerController
 import libXray.LibXray
 import net.yuandev.onexray.MainActivity
@@ -41,6 +44,7 @@ import net.yuandev.onexray.pigeon.PerAppVPNMode
 import net.yuandev.onexray.pigeon.StartVpnRequest
 import net.yuandev.onexray.pigeon.TunJson
 import net.yuandev.onexray.pigeon.VpnStatus
+import java.io.File
 import java.util.concurrent.atomic.AtomicBoolean
 import java.util.concurrent.atomic.AtomicInteger
 import java.util.concurrent.atomic.AtomicReference
@@ -68,6 +72,7 @@ class OneVpnService : VpnService() {
         // Core retains protection callbacks for the lifetime of :native.
         private val controller = VPNController()
         private var controllerInit = false
+        private val coreLifecycleLock = Any()
 
         @Synchronized
         private fun initController() {
@@ -510,7 +515,15 @@ class OneVpnService : VpnService() {
                 if (generation != startGeneration.get() || tunnel !== establishedTunnel) {
                     return@launch
                 }
-                val result = LibXray.invoke(patchRuntimeEnv(coreInvokeText, establishedTunnel.fd))
+                val requestJson = patchRuntimeEnv(coreInvokeText, establishedTunnel.fd)
+                val result = synchronized(coreLifecycleLock) {
+                    if (generation != startGeneration.get() || tunnel !== establishedTunnel) {
+                        return@launch
+                    }
+                    check(!isXrayRunning()) { "The previous Xray instance is still running" }
+                    RuntimeLogFiles.clear(File(filesDir, "run"))
+                    LibXray.invoke(requestJson)
+                }
                 validateRunXrayResult(result)
                 if (generation != startGeneration.get() || tunnel !== establishedTunnel) {
                     XLog.d("OneVpnService: stale runXray result ignored")
@@ -547,8 +560,19 @@ class OneVpnService : VpnService() {
     }
 
     private fun stopXray() {
-        val request = LibXrayInvokeRequest(method = LibXrayMethod.STOP_XRAY)
-        LibXray.invoke(JsonTool.json.encodeToString(request))
+        synchronized(coreLifecycleLock) {
+            val request = LibXrayInvokeRequest(method = LibXrayMethod.STOP_XRAY)
+            validateRunXrayResult(LibXray.invoke(JsonTool.json.encodeToString(request)))
+        }
+    }
+
+    private fun isXrayRunning(): Boolean {
+        val request = LibXrayInvokeRequest(method = LibXrayMethod.GET_XRAY_STATE)
+        val result = LibXray.invoke(JsonTool.json.encodeToString(request))
+        validateRunXrayResult(result)
+        return JsonTool.json.parseToJsonElement(result).jsonObject["data"]
+            ?.jsonObject?.get("running")?.jsonPrimitive?.booleanOrNull
+            ?: throw IllegalStateException("Invalid Xray state response")
     }
 
     private fun patchRuntimeEnv(requestJson: String, fd: Int): String {

android/app/src/main/kotlin/net/yuandev/onexray/vpn/RuntimeLogFiles.kt

@@ -0,0 +1,31 @@
+package net.yuandev.onexray.vpn
+
+import java.io.File
+import java.io.IOException
+import java.nio.file.Files
+import java.nio.file.LinkOption
+import java.nio.file.NoSuchFileException
+import java.nio.file.Path
+import java.nio.file.attribute.BasicFileAttributes
+
+/** Called only for an admitted new Core start, after the previous Core has stopped. */
+internal object RuntimeLogFiles {
+    fun clear(directory: File) {
+        val root = directory.toPath()
+        val rootAttributes = attributes(root) ?: return
+        if (!rootAttributes.isDirectory) throw IOException("Invalid runtime log directory: $root")
+        val files = listOf("access.log", "error.log").map { root.resolve(it) }.filter { path ->
+            val attributes = attributes(path) ?: return@filter false
+            if (!attributes.isRegularFile) throw IOException("Invalid runtime log file: $path")
+            true
+        }
+        // Validate both before removing either, without enumerating the directory.
+        files.forEach { Files.delete(it) }
+    }
+
+    private fun attributes(path: Path): BasicFileAttributes? = try {
+        Files.readAttributes(path, BasicFileAttributes::class.java, LinkOption.NOFOLLOW_LINKS)
+    } catch (_: NoSuchFileException) {
+        null
+    }
+}

android/app/src/test/kotlin/net/yuandev/onexray/vpn/RuntimeLogFilesTest.kt

@@ -0,0 +1,58 @@
+package net.yuandev.onexray.vpn
+
+import java.io.File
+import java.io.IOException
+import java.nio.file.Files
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertThrows
+import org.junit.Before
+import org.junit.Test
+
+class RuntimeLogFilesTest {
+    private lateinit var root: File
+
+    @Before fun prepare() {
+        val fixtures = File("../../../references/onexray-tests/android/runtime-logs").absoluteFile
+        check(fixtures.mkdirs() || fixtures.isDirectory)
+        root = Files.createTempDirectory(fixtures.toPath(), "logs-").toFile()
+    }
+
+    @After fun cleanup() { root.deleteRecursively() }
+
+    @Test fun clearsOnlyManagedLogsAndAllowsMissingFiles() {
+        val run = File(root, "run")
+        RuntimeLogFiles.clear(run)
+        check(run.mkdir())
+        for (name in listOf("access.log", "error.log", "start.json", "export.log")) {
+            File(run, name).writeText(name)
+        }
+        RuntimeLogFiles.clear(run)
+        RuntimeLogFiles.clear(run)
+        assertFalse(File(run, "access.log").exists())
+        assertFalse(File(run, "error.log").exists())
+        assertEquals("start.json", File(run, "start.json").readText())
+        assertEquals("export.log", File(run, "export.log").readText())
+    }
+
+    @Test fun rejectsDirectoryLogBeforeClearingEither() {
+        File(root, "access.log").writeText("old access")
+        check(File(root, "error.log").mkdir())
+        assertThrows(IOException::class.java) { RuntimeLogFiles.clear(root) }
+        assertEquals("old access", File(root, "access.log").readText())
+    }
+
+    @Test fun rejectsLinkedLogAndRuntimeDirectory() {
+        val access = File(root, "access.log").apply { writeText("old access") }
+        val outside = File(root, "outside.log").apply { writeText("outside") }
+        Files.createSymbolicLink(File(root, "error.log").toPath(), outside.toPath())
+        assertThrows(IOException::class.java) { RuntimeLogFiles.clear(root) }
+        assertEquals("old access", access.readText())
+        assertEquals("outside", outside.readText())
+        val linkedRun = File(root, "linked-run")
+        Files.createSymbolicLink(linkedRun.toPath(), root.toPath())
+        assertThrows(IOException::class.java) { RuntimeLogFiles.clear(linkedRun) }
+        assertEquals("old access", access.readText())
+    }
+}

android/gradle.properties

@@ -1,6 +1,9 @@
 org.gradle.jvmargs=-Xmx8G -XX:MaxMetaspaceSize=4G -XX:ReservedCodeCacheSize=512m -XX:+HeapDumpOnOutOfMemoryError
 android.useAndroidX=true
 android.enableJetifier=true
+# Avoid cross-drive cache failures when the Windows Pub cache and project
+# are on different drives.
+kotlin.incremental=false
 # Preserve the app-level 64-bit ABI list instead of Flutter's default list.
 disable-abi-filtering=true
 # This builtInKotlin flag was added automatically by Flutter migrator