perf + security: hot-path batching, action/source pins, local API token#115

Merged

hawkff merged 26 commits into

mainfrom

feat/pr2-perf-security

Jul 3, 2026

Commits on Jul 3, 2026

fix(bg): unregister DefaultNetworkListener with the service key; use containsKey for callback dedupe
hawkff
committed
fix(bg): null-guard proxy in selector_OnProxySelected (teardown race)
hawkff
committed
fix(db): scope selectedProxy reset to the affected group
hawkff
committed
fix(group): route shadowed duplicate-name rows to delete on subscription update
hawkff
committed
fix(group): return instead of cancel() in executeUpdate; rethrow cancellation
hawkff
committed
fix(group): fall back to default group instead of !! on missing ungrouped group
hawkff
committed
fix(utils): swap PackageCache uidMap by reference; fix awaitLoadSync race
hawkff
committed
fix(bg): assign TrafficLooper synchronously to close the launch/close race
hawkff
committed
fix(group): resume update dialogs safely when the Activity is gone
hawkff
committed
fix(bg): make TestInstance.doTest cancellable and close on cancel
hawkff
committed
fix(bg): address CR — always unlock PackageCache.loaded; rethrow cancellation in group dialogs; ignore .worklog
hawkff
committed
fix(bg): use CancellableContinuation resume (avoid internal tryResume API); drop unused imports
hawkff
committed
style(bg): fix import ordering in TestInstance (ktlint)
hawkff
committed
style(bg): match ktlint import order in TestInstance (kotlin.* last)
hawkff
committed
fix(bg): make TestInstance.close idempotent (avoid double-close on cancel, address review)
hawkff
committed
perf(bg): derive selector group id without building a temp config
hawkff
committed
perf(ui): batch connection-test result writes
hawkff
committed
perf(bg): batch per-tick traffic updates into one callback
hawkff
committed
security(ci): pin third-party GitHub/Depot Actions to commit SHAs
hawkff
committed
security(build): pin gomobile branch and mieru tag to commit SHAs
hawkff
committed
security(plugin): resolve bundled sidecar binaries before external providers
hawkff
committed
security(config): require a per-install token for the Clash API
hawkff
committed
security(build): address CR — fresh gomobile checkout dir and fail-fast on git errors
hawkff
committed
security(config): build dashboard URL via Uri — exact host:port, query before fragment (address review)
hawkff
committed
security(config): use String.toUri KTX extension (lint UseKtx)
hawkff
committed
security(config): omit the local API token from exported configs
hawkff
committed