Add managed Linux TUN and REDIRECT capture with independent DNS interception, protected bootstrap and outbound sockets, best-effort systemd-resolved integration, and retained-ingress reload and recovery. Include configuration documentation, service integration, and kernel coverage.
Add Linux ARMv7 hard-float GNU and static musl binaries so 32-bit ARMv7 systems can use prebuilt Shoes releases. Retain the six existing targets, pin build tooling and cross images, and validate each packaged binary with native or QEMU checks before uploading it. Harden future releases with version and tag validation, SHA-256 checksums, and GitHub build-provenance attestations, and document platform requirements and artifact verification.
Refresh eligible Rust dependencies and build tooling, including notify 8.2.1, Web PKI roots 1.0.11 and the ctutils constant-time fix. Handle macOS watcher restart failures, update Unicode-domain data, and require Rust 1.99.1 while preserving maintained fork pins and protocol baselines. Retain parking_lot 0.12 and the upstream nix pin for Android/iOS compatibility.
Add advisory selector/reload performance reports, optional Linux unit/process coverage with changed-line summaries, and bounded rule-parser property tests to make regressions and verification gaps easier to spot. Reports reject invalid measurements and account for timing noise without introducing hard performance gates; existing tests and production behavior remain unchanged.
Add a non-root Docker image for the Shoes binary and publish native amd64 and arm64 images to GHCR on master pushes and published releases. Reuse commit images by digest, gate branch and release tags on container smoke checks, and guard against stale promotions. Include the full license bundle and document configuration, writable state, and image tags.
* build: remove distributable mobile SDK wrappers
Remove the Android Kotlin/Gradle wrapper, AAR and XCFramework packaging, and mobile SDK release publishing.
Preserve Rust JNI/C embedding and native cross-compilation CI, with checks for library outputs and the generated C header. Document app-owned integration and retain desktop release-notice verification.
* ci: verify mobile header after locked native builds
cbindgen resolves Cargo metadata without --locked and can update Cargo.lock. Run it after the native builds so it cannot hide a stale lockfile from their checks.
* docs: remove obsolete mobile wrapper examples
Remove examples referencing nonexistent JNI wrapper methods and clarify the app-owned callback contract. Keep native mobile support unchanged.
* docs: clarify native mobile CI coverage
Update Rust dependencies for current fixes, including ML-KEM's removal of secret-dependent table lookups, and refresh the BLAKE3 fork while retaining binary-context key derivation. Allow wildcard GotaTun updates with source-notice validation, replace unmaintained test-only PEM parsing, and update Android and CI tooling with current AGP source-set APIs. Preserve Web PKI protections and required fork patches; defer YAML parser migration.
Add named userspace WireGuard endpoints so Shoes can route inbound and outbound traffic through WireGuard without a kernel interface. Includes TCP/UDP forwarding, proxy-chain transports, reload lifecycle management, configuration validation, documentation, and dependency notices for release artifacts.
* Add mobile build artifacts for iOS and Android
- Add GitHub Actions workflow to build XCFramework (iOS) and AAR (Android)
and publish them to GitHub releases on tag pushes
- Add scripts/build-ios.sh and scripts/build-android.sh for local builds
- Add android/ project (Gradle library module with Kotlin JNI wrapper)
- Add include/shoes.h C header for FFI consumers
- Gitignore /output build directory
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* Fix Android JNI build: pin jni to 0.21, use --locked
The committed Cargo.toml had `jni = "*"` which resolved to jni 0.22.4 in
CI. jni 0.22 renamed JNIEnv to EnvUnowned, breaking the Android FFI code
written for the 0.21 API.
- Pin jni to "=0.21" (resolves to 0.21.1 via Cargo.lock)
- Add --locked to cargo ndk to enforce the lock file in CI
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* Migrate Android JNI bindings to jni 0.22
jni 0.22 split JNIEnv into two types:
- EnvUnowned<'local> — FFI-safe type for native method signatures
- Env<'local> — high-level wrapper with get_string, new_string, etc.
Changes:
- Replace JNIEnv with EnvUnowned in all function signatures
- Use EnvUnowned::with_env() to access the Env inside each function
- Use Outcome enum (Ok/Err/Panic) from into_outcome() for error handling
- Replace new_global_ref return type: GlobalRef -> Global<JObject<'static>>
- Replace attach_current_thread() guard pattern with callback closure
- Replace &str method names/sigs with jni_str!/jni_sig! compile-time macros
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* Auto-generate iOS C header with cbindgen
Replace hand-written include/shoes.h with cbindgen-generated output.
The header is now derived from doc comments on extern "C" functions
in src/ffi/ios.rs, keeping it in sync with the Rust source.
- Add cbindgen.toml (exports only ProtectSocketCallback + FFI functions)
- build-ios.sh runs cbindgen before building the XCFramework
- CI installs cbindgen in the iOS job
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix clippy and rustfmt CI failures
- Reorder jni imports in ffi/android.rs to match rustfmt order
- Remove unnecessary `as usize` cast in shadow_tls_server_handler.rs
- Collapse match guard in config/validate.rs (clippy::collapsible_match)
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
cfal
Andrey YastrebovandClaude Sonnet 4.6