Helper process (NodeTester):
- sing-box helper runs at app launch with mixed inbound + Clash API (:9090)
- All nodes configured as urltest group for auto speed testing
- Delay results shown in Nodes tab (green <300ms / orange <600ms / red)
- Queries via Clash REST API GET /proxies
A/B node swap:
- ACTION_SWITCH in SingVpnService: kill old sing-box, start new with same TUN fd
- NodesFragment triggers A/B swap when selecting node while VPN is connected
- ~200ms gap, packets buffered in kernel TUN queue
DNS hijack-dns fix:
- Add route rule {"action": "sniff"} before {"protocol": "dns", "action": "hijack-dns"}
- Required for sing-box 1.13+ where inbound sniff field is deprecated
- Fallback port 53 hijack rule for safety
Other (from previous worker):
- Splash screen, Reality/uTLS support, dual DNS (DoT remote + UDP local)
- 3 default nodes (HK01 VLESS, JMS SS, SOCKS5)
- network_security_config.xml for localhost cleartext HTTP (Clash API)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Patch sing-box source to add `file_descriptor` field to tun inbound config
(2 lines changed in option/tun.go + protocol/tun/inbound.go)
- Rebuild sing-box binary with fd:// support (android/arm64, full tags)
- SingVpnService: single-process architecture (sing-box only, no tun2socks)
- Create TUN first, pass fd to sing-box config, start sing-box with keepFd=tunFd
- SingBoxConfig: switch from mixed inbound to tun inbound with file_descriptor
- Startup time improved: 0.166s vs 0.88s+tun2socks
Architecture: TUN fd → sing-box (tun inbound fd://N → outbound) → upstream
Tested: HTTPS works, exit IP = 156.225.28.220, single process confirmed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
