Fix nine reported issues and defects found while auditing around them

[MOMO0302-02]

Updated for the current main. The nine commits merged since this branch opened rewrote the Android service layer, the desktop core transport and the core message layer. Forty files conflicted; rather than replaying the fixes I re-checked each one against the new code and dropped every fix whose defect main has since resolved — see Already fixed on main below. The branch is now 85 files, +1496/−302 against main, down from 107.

This branch collects fixes for reported issues plus a set of defects found while auditing the surrounding code. It is deliberately submitted as one branch so the history stays reviewable; happy to split it into per-issue pull requests on request.

Please read the Verification and Behaviour changes sections before merging.

Already fixed on main — dropped from this branch

These were part of the original submission and are no longer here, because main now fixes the same defect, either independently or by removing the code that carried it. Listed so you do not go looking for them:

• [BUG] 附加规则在UI界面的顺序与配置文件中的顺序完全颠倒 #2256, [BUG] 附加规则应该优先于内置规则之上，不然这个附加规则有什么意义？ #2251, [BUG] 附加规则在UI界面的顺序与配置文件中的顺序完全颠倒 #2255 — queryAddedRules now orders both terms ascending on main.
• [BUG] 运行时间统计最长只能到 99:59:59 #2214, [BUG] 出现时间到99:99:59无法连接的情况 #2191 — the runtime counter now caps at 999:59:59 instead of 99:59:59.
• [BUG] 快捷菜单中图标的状态是反的 #2260 — the whole tile/service layer was rewritten; ServiceState settles the run state from the actual start result, ServiceModules is synchronous, ProxyService.start rethrows, and a denied VPN consent now reports false.
• macOS startup can hang while reading Wi-Fi SSID without location permission #2188 — the macOS SSID read.
• [BUG] 开机自启动直接启动代理,网络实际上未完成代理 #2239 — the _RunRequest model covers the auto-start rollback.
• Also dropped: the getTraffic/getTotalTraffic double free, the stop_ipc_server deadlock (the listener is non-blocking now, so the stop path joins cleanly), CoreLib.withTimeout, the external-provider lock, the DAV ping generation guard, the WebDAV file-name preservation, proxy delay-test batching, the proxies tab index mismatch, the GeoResource config keys, the loading widget, memory-info lifecycle, start-button width measurement, the Android package enumeration race, the uid map, and notification foreground promotion.

Reported issues still addressed here

Issue	Cause
#2241	The export dialog was given the profile label, which never carries an extension.
#2242	flutter_js exports its prebuilt QuickJS bridge under a misspelled variable (flutter_qjs_bundled_libraries), so Flutter's plugin bundling never picks it up. Bundled explicitly in linux/CMakeLists.txt.
#2215 (partial)	The app's geo auto-update setting is still never written into the generated config, so the subscription's value wins. The geox-url key half of this issue is already fixed on main.
#2286	Windows hard-codes checkPermission to "granted" while the WLAN API returns ERROR_ACCESS_DENIED, so exclude-SSID rules are inert with no hint. It also forwards raw 802.11 SSID octets, which the standard codec cannot decode when they are not valid UTF-8.
#2276	Windows sends WM_QUERYENDSESSION/WM_ENDSESSION at shutdown, not WM_CLOSE, so the Dart quit path never runs and the per-user WinINET proxy setting survives the reboot.

Other defects found while auditing

Security

• Backup restore accepts archive entries with ../, an absolute path, or a drive qualifier (zip slip). A crafted or MITM'd backup could write anywhere the user can write, and a drive-qualified entry aborts the whole restore instead of skipping one file.
• badCertificateCallback returns true for every host, so subscription downloads, WebDAV backups and update checks accept any forged certificate. Now restricted to loopback. See Behaviour changes.

Data loss and corruption

• Rule.parse splits on commas with no awareness of logic rules, drops any segment merely containing src/no-resolve, aliases a two-segment rule's payload to its target, and throws a RangeError on single-segment input. Corrupted rules are then persisted by the v1→v2 migration and by quick-fill. Rewritten with a bracket-aware split and exact trailing-parameter matching; test/models/rule_test.dart added.
• Restore with the default compatible strategy hard-replaces scripts, rules, links and proxy groups, silently deleting local entries the backup does not contain. Now merged, with order keys allocated after the existing ones so the two sequences cannot collide.
• SQLite foreign keys are off by default and beforeOpen does not enable them, so the declared cascades never fire; profile dependents are now deleted explicitly.
• excludeSSIDs is a top-level Config field and is dropped on restore.
• Side-loading a provider overwrites the file on disk before the core validates it.
• A new proxy group's generated order key is applied in memory but never persisted, so the row keeps a null order and later reordering computes keys from a null neighbour.

Crashes, hangs, leaks

• A range error in the proxy list view when a search filter is active: the offsets are built from the filtered groups but indexed with a position taken from the unfiltered ones.
• A FormatException in the port dialog after collapsing an emptied field — collapsed fields leave the form, so their validators never run.
• The connections view writes to its ValueNotifier after dispose has released it.
• The JavaScript runtime is never disposed.
• The delete animation in SuperGrid captures a slot index, so a card deleted while the list changes removes the wrong one; and didUpdateWidget resets the controller mid-animation, so onDelete never fires at all.
• eventListener is read from core goroutines while the platform thread replaces and releases it — a data race over a JNI global reference.

UI and logic

• Access-control search is case-sensitive, so typing WeChat matches nothing.
• The custom-rule sheet's delete button is empty and its no-resolve/src switches have no handler.
• Renaming a proxy group to an existing name is accepted, producing duplicates the core rejects.
• Deleting a group matches on the live-edited name, so it deletes nothing — or the wrong group.
• The profile preview encodes an already-encoded YAML document.
• Declining the disclaimer still records it as accepted.
• Dismissing an options dialog writes null back, which resets the app language to "follow system"; the radios are toggleable, so re-tapping the current option does the same.
• New profiles are inserted at the top of the list, then jump to the bottom on the next stream emission.
• The tray "copy environment variable" command is invalid in both cmd and PowerShell.
• An offline update check reports "already up to date".
• A geo update failure announces a successful update first, then the error.
• A desktop core crash leaves the app in the started state, so the system proxy stays pointed at a dead port.
• Quitting skips the debounced config flush that the minimize path performs, losing whatever changed in the last debounce window.

Platform

• The Android build is broken on Windows: run_build_tool.sh writes its own location into the generated runner pubspec, but under Git Bash pwd yields a POSIX path the native Dart SDK cannot resolve, so the build fails with "could not find package build_tool".
• log.Errorln takes a format string, so log.Errorln("TUN:", err) renders the reason through fmt's surplus-operand marker as TUN:%!(EXTRA *fmt.wrapError=...). The reason was always there, just wrapped in that marker — this is a readability and go vet fix, not a functional one, and it resolves no reported TUN failure.
• macOS applicationShouldTerminate always returns .terminateCancel, which aborts system logout and shutdown.
• macOS stopProxy gives up on the first failing networksetup call, leaving the remaining services proxied; the default network service name is truncated at the first space, breaking Thunderbolt Bridge and similar.
• checkIsAdmin shell-escapes an argv element, so any install path containing a space always re-prompts for credentials.
• Linux: g_variant_iter_loop values leak on early exit, and the connman branch uses strings after the iterator has released them.

Verification

Re-run in full after the merge, against Flutter 3.44.9 / Dart 3.12.2:

• flutter analyze — no issues.
• flutter test — 740 of 741 pass. The one failure, task_test's makeRealProfileTask normalizes runtime config and added rules, fails identically on a pristine origin/main worktree under Windows: it asserts a POSIX prefix (/profiles/providers/7/proxies/) against a path built with package:path's platform-aware join. It is untouched by this branch, and it passes on your Linux CI. Happy to make that assertion platform-agnostic in a separate pull request if you want it.
• plugins/proxy and plugins/wifi_ssid analysed and tested separately, since the root analysis_options.yaml excludes plugins/** — clean, 21 and 5 tests respectively.
• go build ./... and go vet ./... pass for the core, both in the default build and cross-compiled for android/arm64 with CGO_ENABLED=1 through the NDK, which is what brings lib.go, bride.go, tun/ and platform/ into analysis at all.

Not compiled: the macOS Swift change needs a macOS host, the Linux C change needs a Linux one, and the Windows C++ changes need MSVC — none of which I have, so all three were reviewed by hand rather than built. build.yaml only triggers on v* tags, so opening this pull request runs no automated build either. Please treat those three with corresponding scepticism, and tell me if you would rather I drop them from this branch.

There are no longer any Kotlin or Rust changes in this branch, so the APK build and cargo check that the earlier revision relied on are no longer load-bearing.

Behaviour changes worth calling out

1. TLS verification. Certificates are now verified for every non-loopback host, so a self-signed or private-CA WebDAV server or subscription URL fails where it previously succeeded. An Allow insecure certificates switch was added under Application settings, off by default, for users who need those servers back — so the default is safe and the escape hatch is explicit. Translations are included for all four bundled locales.
2. Geo auto-update now follows the app setting instead of the subscription's value.
3. Options dialogs deliver their result through a callback instead of the pop value, so a dismissal is no longer indistinguishable from picking null. Tapping the glyph of an already-selected radio now closes without changing anything; picking the null option is still reachable by tapping its row.