chore: release v0.4.4 on master

A Scheduled Task stores an absolute path. Checking that a task named
"OSTP TUN Helper" exists said nothing about whether its <Command> still points
at the helper we are about to run, and the paths do drift: a dev build
registers target\debug\ostp-tun-helper.exe, an installer registers Program
Files, and moving or reinstalling the app leaves the old path behind.

That failed silently in the worst way. schtasks /Run reports success for
merely ACCEPTING the launch request — a task whose exe no longer exists fails
afterwards, out of band, with nothing returned to us. So launch_as_admin
returned Ok, and the caller then sat in its 60-second connect loop before
reporting "Timeout connecting to helper." On every connect, permanently, with
no way out except deleting the task by hand.

The check now reads the registered <Command> back and compares it to the exe,
re-registering through the existing /F overwrite when they differ: one consent
prompt, once, instead of a permanent silent breakage.

The path is read via /Query /XML rather than /FO LIST /V because the list
format's field labels are localized — "Task To Run" is "Задача для запуска" on
a Russian Windows — while XML tag names are not. schtasks emits UTF-16LE with
a BOM there, which is decoded explicitly, with UTF-8 tolerated as a fallback.
Both paths are canonicalized before comparison so casing, `..` and 8.3 short
names do not read as a mismatch; a path that cannot be canonicalized no longer
exists, which is itself grounds to re-register.

.github/workflows/release.yml

@@ -284,7 +284,15 @@ jobs:
 
       - name: Install cross (if not cached)
         if: ${{ matrix.use_cross && steps.cross-cache.outputs.cache-hit != 'true' }}
-        run: cargo install cross --git https://github.com/cross-rs/cross.git --locked
+        # cross-rs's own source (not ours, not a dependency of ours) uses a
+        # macro-at-end-of-block pattern that trips rustc's
+        # semicolon_in_expressions_from_macros lint on current toolchains -
+        # harmless in cross's actual behavior, but `cargo install` compiles
+        # the installed package as the "local" crate, so dependency lint
+        # capping doesn't shield it. --cap-lints=warn is the standard escape
+        # hatch for building a third-party tool against a newer compiler than
+        # its own lint config assumed; it doesn't touch our own build.
+        run: RUSTFLAGS="--cap-lints=warn" cargo install cross --git https://github.com/cross-rs/cross.git --locked
 
       - name: Build (cross)
         if: ${{ matrix.use_cross }}
@@ -370,7 +378,15 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
+            ostp-gui/src-tauri/target/
           key: cargo-windows-gui-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          # Without a prefix fallback this cache NEVER restored on a release:
+          # cutting a release rewrites every Cargo.lock (version bump), which
+          # changes hashFiles(), which misses the exact key — so each release
+          # rebuilt every dependency from scratch. That is why the GUI jobs ran
+          # 2-4x longer than the plain release targets, which had this all along.
+          restore-keys: |
+            cargo-windows-gui-${{ matrix.target }}-
 
       - name: Download wintun
         shell: pwsh
@@ -452,18 +468,28 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
+            ostp-gui/src-tauri/target/
           key: cargo-linux-gui-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-linux-gui-${{ matrix.target }}-
 
       - name: Build Tauri App
         working-directory: ostp-gui
         run: |
           npm install
+          # TUN mode shells out to this helper, elevated via pkexec. Only the
+          # Windows job used to build it, so the Linux package shipped without
+          # it and TUN could never start.
+          cargo build -p ostp-tun-helper --release --target ${{ matrix.target }} --manifest-path ../Cargo.toml
           npx tauri build --no-bundle --target ${{ matrix.target }}
 
       - name: Package Portable Tarball
         run: |
+          set -euo pipefail
           mkdir ostp-linux-gui-${{ matrix.arch }}
           cp ostp-gui/src-tauri/target/${{ matrix.target }}/release/ostp-gui ostp-linux-gui-${{ matrix.arch }}/
+          # The GUI looks for the helper next to its own executable first.
+          cp target/${{ matrix.target }}/release/ostp-tun-helper ostp-linux-gui-${{ matrix.arch }}/
           tar -czf ostp-linux-gui-${{ matrix.arch }}.tar.gz ostp-linux-gui-${{ matrix.arch }}
 
       - name: Upload to GitHub Release
@@ -514,7 +540,10 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
+            ostp-gui/src-tauri/target/
           key: cargo-macos-gui-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-macos-gui-${{ matrix.target }}-
 
       - name: Build Tauri App
         working-directory: ostp-gui
@@ -579,27 +608,107 @@ jobs:
         with:
           ndk-version: r26b
 
-      - name: Install cargo-ndk
-        run: cargo install cargo-ndk
+      # The Android jobs had no Rust caching at all, so every release recompiled
+      # the whole ostp-jni dependency graph from scratch — the main reason these
+      # were among the slowest jobs in the matrix.
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: cargo-android-${{ matrix.arch }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-android-${{ matrix.arch }}-
+
+      # cargo-ndk was built from source on every run. Cache the binary the same
+      # way the cross-compilation jobs already cache `cross`.
+      - name: Restore cargo-ndk binary cache
+        id: cargo-ndk-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/cargo-ndk
+          key: cargo-ndk-bin-${{ runner.os }}-v1
+
+      - name: Install cargo-ndk (if not cached)
+        if: steps.cargo-ndk-cache.outputs.cache-hit != 'true'
+        run: cargo install cargo-ndk --locked
 
       - name: Build Android APK
         shell: bash
         working-directory: ostp-flutter
+        env:
+          OSTP_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          OSTP_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          OSTP_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          OSTP_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
-          # 1. Compile JNI
+          set -euo pipefail
+
+          # 1. Materialise the upload keystore from secrets. Android keys an app
+          #    by applicationId + signing key and refuses to update across a key
+          #    change, so every published build MUST use this one key. Releases
+          #    used to fall through to the per-machine debug keystore, which on
+          #    ephemeral CI runners meant a different random key every build -
+          #    hence "App not installed" on upgrade.
+          if [ -z "${OSTP_KEYSTORE_B64:-}" ]; then
+            echo "::error::ANDROID_KEYSTORE_BASE64 secret is not set. Refusing to publish a"
+            echo "::error::debug-signed APK: users could not update over it and the key is"
+            echo "::error::not reproducible. See docs for the one-time keystore setup."
+            exit 1
+          fi
+          export OSTP_KEYSTORE_PATH="$RUNNER_TEMP/ostp-upload.jks"
+          # Strip any stray CR/LF before decoding: the secret is pasted from a
+          # shell whose line endings we don't control, and a single trailing \r
+          # is enough to corrupt the decode.
+          printf '%s' "$OSTP_KEYSTORE_B64" | tr -d '\r\n' | base64 -d > "$OSTP_KEYSTORE_PATH"
+
+          # Verify the keystore opens BEFORE spending four minutes on Gradle only
+          # to fail at the packaging step. The size/SHA-256 are safe to print (a
+          # hash reveals nothing) and let the operator compare against the local
+          # file to tell a transport problem apart from a wrong password.
+          echo "keystore: $(stat -c%s "$OSTP_KEYSTORE_PATH") bytes, sha256 $(sha256sum "$OSTP_KEYSTORE_PATH" | cut -d' ' -f1)"
+          if ! keytool -list -keystore "$OSTP_KEYSTORE_PATH" \
+                 -storepass "$OSTP_KEYSTORE_PASSWORD" >/dev/null 2>&1; then
+            echo "::error::The keystore did not open with ANDROID_KEYSTORE_PASSWORD."
+            echo "::error::If the SHA-256 above matches your local ostp-upload.jks, the file"
+            echo "::error::arrived intact and the password secret itself is wrong - note that"
+            echo "::error::PowerShell expands \$ inside double quotes, so a password containing"
+            echo "::error::one gets mangled unless it was set with single quotes."
+            exit 1
+          fi
+          if ! keytool -list -keystore "$OSTP_KEYSTORE_PATH" \
+                 -storepass "$OSTP_KEYSTORE_PASSWORD" -alias "$OSTP_KEY_ALIAS" >/dev/null 2>&1; then
+            echo "::error::Keystore opened, but it has no key under ANDROID_KEY_ALIAS."
+            echo "::error::Aliases present in the keystore:"
+            keytool -list -keystore "$OSTP_KEYSTORE_PATH" -storepass "$OSTP_KEYSTORE_PASSWORD" \
+              | grep -i "PrivateKeyEntry" || true
+            exit 1
+          fi
+
+          # 2. Compile JNI
           mkdir -p android/app/src/main/jniLibs/${{ matrix.arch }}
-          
+
           cd ../ostp-jni
           cargo ndk -t ${{ matrix.arch }} -o "../ostp-flutter/android/app/src/main/jniLibs" build --release
           cd ../ostp-flutter
-          
 
-          
           # 3. Build Flutter APK
           flutter build apk --release --target-platform ${{ matrix.flutter_target }}
-          
-          # 4. Copy to output
-          cp build/app/outputs/flutter-apk/app-release.apk ostp-android-${{ matrix.arch }}.apk
+
+          # 4. Fail loudly if the APK somehow still came out debug-signed, rather
+          #    than shipping another un-updatable build.
+          APK=build/app/outputs/flutter-apk/app-release.apk
+          if "$ANDROID_HOME"/build-tools/*/apksigner verify --print-certs "$APK" 2>/dev/null \
+               | grep -qi "CN=Android Debug"; then
+            echo "::error::APK is signed with the Android debug certificate - aborting."
+            exit 1
+          fi
+
+          # 5. Copy to output
+          cp "$APK" ostp-android-${{ matrix.arch }}.apk
 
       - name: Upload to GitHub Release
         uses: softprops/action-gh-release@v2

.gitignore

@@ -26,6 +26,13 @@ test_route.ps1
 config.json
 wintun.dll
 
+# Android signing keys. The upload keystore is the ONE key every published APK
+# must be signed with (Android refuses to update an app across a key change),
+# so losing or leaking it is unrecoverable — it can never be committed.
+*.jks
+*.keystore
+key.properties
+
 # Server runtime cache (public IP autodetect) — must never be committed,
 # it's regenerated locally and leaks whatever host it ran on last.
 .ostp_public_ip
@@ -39,6 +46,7 @@ turn-harvesting-idea.md
 
 # Private tooling (closed-source)
 ostp-prober/
+ostp-lab/
 
 ostp-brain/
 

.release-state.json

@@ -1,6 +1,6 @@
 {
-  "target_version": "0.4.2",
-  "branch": "beta",
+  "target_version": "0.4.4",
+  "branch": "master",
   "alpha_iteration": 0,
-  "beta_iteration": 2
+  "beta_iteration": 0
 }

Cargo.lock

@@ -1386,7 +1386,7 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "ostp"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "base64",
@@ -1400,6 +1400,7 @@ dependencies = [
  "rlimit",
  "serde",
  "serde_json",
+ "sha2",
  "tokio",
  "tracing",
  "tracing-subscriber",
@@ -1408,7 +1409,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-client"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "base64",
@@ -1439,7 +1440,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-core"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1473,7 +1474,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-server"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "axum",
@@ -1496,6 +1497,7 @@ dependencies = [
  "sha2",
  "simple-dns",
  "socket2",
+ "subtle",
  "tokio",
  "tower-http",
  "tracing",
@@ -1505,7 +1507,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "libc",
@@ -1517,7 +1519,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun-helper"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "chrono",

Cargo.toml

@@ -12,7 +12,7 @@ resolver = "2"
 [workspace.package]
 edition = "2021"
 license = "AGPL-3.0"
-version = "0.4.2"
+version = "0.4.4"
 
 [workspace.dependencies]
 anyhow = "1.0"

docs/relay-config-example.json

@@ -20,9 +20,15 @@
   // Адрес следующего узла в цепочке — UDP
   "upstream_udp": "TARGET_SERVER_IP:50000",
 
-  // URL API конечного (целевого) сервера для синхронизации access_keys
-  // Должен быть доступен с этого relay-сервера (можно через SSH-туннель)
-  "upstream_api_url": "http://TARGET_SERVER_IP:9090",
+  // URL API конечного (целевого) сервера для синхронизации access_keys.
+  // Должен быть доступен с этого relay-сервера (можно через SSH-туннель).
+  //
+  // ВАЖНО: URL обязан включать секретный путь панели (api.webpath целевого
+  // сервера). Management API смонтирован ВНУТРИ этого пути — именно он скрывает
+  // панель от сканеров, — поэтому голый host:port попадает в несуществующий
+  // маршрут, и синхронизация падает с 404 ещё до проверки токена.
+  // Это тот же адрес, по которому вы открываете веб-панель.
+  "upstream_api_url": "http://TARGET_SERVER_IP:9090/TARGET_SERVER_WEBPATH",
 
   // Bearer-токен для доступа к API целевого сервера
   // Должен совпадать с api.token в конфиге target-сервера

ostp-client/src/bridge.rs

@@ -16,6 +16,19 @@ use crate::app::{BridgeCommand, ConnectionStatus, UiEvent};
 use crate::config::ClientConfig;
 use crate::tunnel::{ProxyEvent, ProxyToClientMsg};
 
+/// Per-address ceiling on the UoT/TCP connect attempt. Long enough that a
+/// genuinely slow mobile path still completes its handshake, short enough that
+/// a blackholed address (typically IPv6 advertised without a working route)
+/// costs seconds instead of the kernel's full SYN-retry budget before the next
+/// candidate address is tried.
+const UOT_CONNECT_TIMEOUT: Duration = Duration::from_secs(4);
+
+/// How long to keep retrying a resume-triggered reconnect before handing the
+/// problem back to the ordinary stall path. That path is what releases the
+/// system proxy, so this is really a bound on how long the machine may be left
+/// with no working internet at all after waking.
+const RESUME_RECONNECT_GIVE_UP: Duration = Duration::from_secs(45);
+
 static SOCKET_PROTECTOR: std::sync::OnceLock<Box<dyn Fn(i32) -> bool + Send + Sync>> = std::sync::OnceLock::new();
 
 pub fn set_socket_protector<F>(f: F)
@@ -130,6 +143,21 @@ pub struct Bridge {
     last_rtt_ms: f64,
     last_sample_at: Instant,
     last_valid_recv: Instant,
+    /// Set when a suspend/resume is detected, cleared once a reconnect actually
+    /// succeeds. Waking is precisely when the network is least likely to be
+    /// ready — Wi-Fi has not reassociated yet — so a single attempt fired
+    /// milliseconds after resume usually fails, and a one-shot forced reconnect
+    /// then fell back to the ordinary 25s stall heuristic. That heuristic keys
+    /// off a monotonic clock which does not advance while the machine is
+    /// asleep, so it could take a further 25s of real uptime to fire, or not
+    /// fire at all. Retrying until success removes the dependency on either.
+    forced_reconnect_pending: bool,
+    last_forced_reconnect_try: Instant,
+    /// Wall-clock start of the current resume-reconnect campaign, used to bound
+    /// it. Wall clock rather than Instant because the monotonic clock does not
+    /// advance across suspend on Windows, so it cannot measure anything that
+    /// begins at wake.
+    forced_reconnect_started: Option<SystemTime>,
 }
 
 impl Bridge {
@@ -166,6 +194,9 @@ impl Bridge {
             last_rtt_ms: 0.0,
             last_sample_at: Instant::now(),
             last_valid_recv: Instant::now(),
+            forced_reconnect_pending: false,
+            last_forced_reconnect_try: Instant::now(),
+            forced_reconnect_started: None,
         })
     }
 
@@ -231,7 +262,7 @@ impl Bridge {
                     self.handle_inbound_udp(udp_msg, &mut sessions_opt, &mut udp_rx_opt, &mut proxy_guard, &mut stream_map, &tx, &proxy_tx).await;
                 }
                 cmd = bridge_rx.recv() => {
-                    if !self.handle_bridge_cmd(cmd, &mut sessions_opt, &mut udp_rx_opt, &mut proxy_guard, &mut stream_map, &tx, &proxy_tx).await {
+                    if !self.handle_bridge_cmd(cmd, &mut bridge_rx, &mut sessions_opt, &mut udp_rx_opt, &mut proxy_guard, &mut stream_map, &tx, &proxy_tx).await {
                         break;
                     }
                 }
@@ -248,7 +279,64 @@ impl Bridge {
                         let _ = tx.send(UiEvent::Log(format!(
                             "Resumed after ~{}s suspend — forcing clean reconnect", wall_gap.as_secs()
                         ))).await;
+                        self.forced_reconnect_pending = true;
+                        self.forced_reconnect_started = Some(SystemTime::now());
+                        self.last_forced_reconnect_try = Instant::now() - Duration::from_secs(60);
+                    }
+
+                    // Give up if resume reconnects keep failing. Retrying forever
+                    // looks harmless but is not: the system proxy stays pointed at
+                    // our local listener the whole time, so the machine has NO
+                    // working internet — not merely no tunnel — while the UI sits
+                    // on "connecting". Handing the retry to the ordinary keepalive
+                    // path restores the proxy through its hard-timeout branch,
+                    // which force=true deliberately skips.
+                    //
+                    // Measured on the wall clock: Instant does not advance across
+                    // suspend on Windows (QPC stops), so a monotonic deadline can
+                    // not bound anything that starts at wake.
+                    if self.forced_reconnect_pending {
+                        let pending_for = self
+                            .forced_reconnect_started
+                            .and_then(|t| t.elapsed().ok())
+                            .unwrap_or_default();
+                        if pending_for > RESUME_RECONNECT_GIVE_UP {
+                            self.forced_reconnect_pending = false;
+                            self.forced_reconnect_started = None;
+                            let _ = tx.send(UiEvent::Log(format!(
+                                "Reconnect after suspend failed for {}s — releasing the system \
+                                 proxy so normal traffic works; will keep retrying in the \
+                                 background",
+                                pending_for.as_secs()
+                            ))).await;
+                            // Make the ordinary stall path fire on the next
+                            // keepalive tick: it is the one that tears the proxy
+                            // back down (or, with kill switch on, deliberately
+                            // keeps blocking).
+                            self.last_valid_recv = Instant::now()
+                                .checked_sub(Duration::from_secs(3600))
+                                .unwrap_or_else(Instant::now);
+                        }
+                    }
+
+                    // Keep retrying a resume-triggered reconnect until one lands.
+                    // The first attempt fires within half a second of waking, when
+                    // the NIC is typically still reassociating, so treating it as
+                    // one-shot left the tunnel dead until some other timer noticed.
+                    if self.running
+                        && self.forced_reconnect_pending
+                        && self.last_forced_reconnect_try.elapsed() >= Duration::from_secs(3)
+                    {
+                        self.last_forced_reconnect_try = Instant::now();
                         self.handle_keepalive(true, &mut sessions_opt, &mut udp_rx_opt, &mut proxy_guard, &mut stream_map, &tx, &proxy_tx, &mut proxy_rx).await;
+                        // handle_keepalive refreshes last_valid_recv only when a
+                        // session was actually established, so this is a real
+                        // success check rather than "we tried".
+                        if self.last_valid_recv.elapsed() < Duration::from_secs(3) {
+                            self.forced_reconnect_pending = false;
+                            self.forced_reconnect_started = None;
+                            let _ = tx.send(UiEvent::Log("Reconnected after suspend".into())).await;
+                        }
                     }
                     if self.running {
                         self.emit_metrics(&tx).await;
@@ -265,7 +353,20 @@ impl Bridge {
                     }
                 }
                 proxy_ev = proxy_rx.recv(), if self.running && sessions_opt.as_ref().map(|s| {
-                    s.iter().any(|ses| ses.machine.in_flight_count() < ses.machine.cwnd_packets().clamp(16, 16384))
+                    // Upper bound matches MAX_CWND_PACKETS in ostp-core's congestion
+                    // controller. The old 16384 ceiling let ~20 MB sit in flight,
+                    // which on a mobile uplink is minutes of buffered queue rather
+                    // than throughput — the app kept handing over data long after
+                    // the path had stopped draining it.
+                    // Two independent gates. cwnd bounds how much may be in
+                    // flight; pacing bounds how FAST it is released. Without the
+                    // second, a full window goes out back-to-back and lands in
+                    // the bottleneck's buffer as standing queue rather than
+                    // throughput — the thing that produced multi-second RTT.
+                    s.iter().any(|ses| {
+                        ses.machine.in_flight_count() < ses.machine.cwnd_packets().clamp(16, 1024)
+                            && ses.machine.can_pace_packet()
+                    })
                 }).unwrap_or(true) => {
                     self.handle_proxy_event(proxy_ev, &mut sessions_opt, &mut stream_map, &tx, &proxy_tx).await;
                 }
@@ -288,8 +389,8 @@ impl Bridge {
     ) {
         match udp_msg {
             Some((session_index, inbound)) => {
+                // Raw byte counter — every datagram that reached the socket counts.
                 self.metrics.bytes_recv.fetch_add(inbound.len() as u64, Ordering::Relaxed);
-                self.last_valid_recv = Instant::now();
                 if let Some(sessions) = sessions_opt.as_mut() {
                     if session_index < sessions.len() {
                         let session = &mut sessions[session_index];
@@ -302,6 +403,22 @@ impl Bridge {
                             }
                         };
 
+                        // Only NOW, after the datagram actually authenticated and
+                        // decrypted, does it count as a sign of life. This used to
+                        // be set above, before any validation — so a datagram that
+                        // failed to decrypt still reset the stall detector on its
+                        // way to the `return` above. Anything arriving at this port
+                        // (frames from a session the server already evicted, stale
+                        // retransmits, or plain garbage from an off-path source that
+                        // knows the ip:port) kept the client convinced the tunnel
+                        // was healthy: the 25s background reconnect in
+                        // handle_keepalive never fired and the tunnel sat dead at
+                        // 0 b/s until the user reconnected by hand. It also made
+                        // `is_healthy` (see emit_metrics) lie in the UI, and handed
+                        // any off-path sender a trivial way to pin a client in a
+                        // dead session indefinitely.
+                        self.last_valid_recv = Instant::now();
+
                         let mut actions_queue = std::collections::VecDeque::new();
                         actions_queue.push_back(initial_action);
 
@@ -374,6 +491,7 @@ impl Bridge {
     async fn handle_bridge_cmd(
         &mut self,
         cmd: Option<BridgeCommand>,
+        bridge_rx: &mut mpsc::Receiver<BridgeCommand>,
         sessions_opt: &mut Option<Vec<SessionState>>,
         udp_rx_opt: &mut Option<mpsc::Receiver<(usize, Bytes)>>,
         proxy_guard: &mut Option<crate::sysproxy::SystemProxyGuard>,
@@ -465,6 +583,32 @@ impl Bridge {
                 tx.send(UiEvent::Log(format!("Obfuscation profile switched to {:?}", self.profile))).await.ok();
             }
             Some(BridgeCommand::NetworkChanged) => {
+                // A real network handoff (Wi-Fi <-> cellular) commonly fires
+                // onLost + onAvailable within milliseconds of each other on
+                // Android, queuing several NetworkChanged commands back to
+                // back. Each reconnect below is a full sequential handshake
+                // (up to ~1.2s x 4 attempts x mux_sessions) run synchronously
+                // in this select-loop iteration, so without coalescing, the
+                // first attempt often races the OS's own network switch and
+                // fails on the now-dead interface, then the SECOND queued
+                // NetworkChanged only starts its own full reconnect after
+                // that first one finishes - multiplying a sub-second handoff
+                // into many seconds of extra outage. Drain same-kind repeats
+                // so a burst collapses into one reconnect on the freshest
+                // signal; a different command found while draining is
+                // handled immediately rather than dropped.
+                while let Ok(next) = bridge_rx.try_recv() {
+                    if !matches!(next, BridgeCommand::NetworkChanged) {
+                        let more = Box::pin(self.handle_bridge_cmd(
+                            Some(next), bridge_rx, sessions_opt, udp_rx_opt, proxy_guard, stream_map, tx, proxy_tx,
+                        )).await;
+                        if !more {
+                            return false;
+                        }
+                        break;
+                    }
+                }
+
                 if self.running {
                     let _ = tx.send(UiEvent::Log("Network changed — starting immediate reconnect".to_string())).await;
                     self.metrics.connection_state.store(1, Ordering::Relaxed);
@@ -876,7 +1020,21 @@ impl Bridge {
             Ok(addrs) => addrs.collect(),
             Err(e) => return Err(anyhow::anyhow!("failed to resolve server address {}: {}", self.server_addr, e)),
         };
-        resolved_addrs.sort_by_key(|addr| if addr.is_ipv6() { 0 } else { 1 });
+        // IPv4 first. Addresses are tried strictly in order, each burning its
+        // full retry budget before the next is touched, so this ordering decides
+        // how long a bad family stalls the whole connect. Mobile carriers
+        // routinely hand out IPv6 with no working route and BLACKHOLE it rather
+        // than rejecting, so every IPv6 candidate costs the full timeout budget
+        // — with several AAAA records the working IPv4 address was not reached
+        // for tens of seconds. (The same ordering bug was already fixed on the
+        // server's outbound path and in the UoT connect.)
+        resolved_addrs.sort_by_key(|addr| if addr.is_ipv6() { 1 } else { 0 });
+
+        // NAT64 is a fallback for IPv6-only networks. Retrying it per failing
+        // address multiplied an already-long connect: each attempt re-runs a DNS
+        // lookup and another full round of handshake retries, for a path that
+        // either works for the whole network or for none of it.
+        let mut nat64_attempted = false;
 
         let mut last_err = anyhow::anyhow!("no IP addresses resolved for {}", self.server_addr);
 
@@ -889,7 +1047,8 @@ impl Bridge {
             let socket = match self.try_connect_transport(target_ip, port).await {
                 Ok(sock) => sock,
                 Err(e) => {
-                    if let std::net::IpAddr::V4(ipv4) = target_ip {
+                    if let (std::net::IpAddr::V4(ipv4), false) = (target_ip, nat64_attempted) {
+                        nat64_attempted = true;
                         tx.send(UiEvent::Log(format!("Direct IPv4 connection failed: {}. Trying NAT64 fallback...", e))).await.ok();
                         let nat64_ipv6 = synthesize_nat64(ipv4).await;
                         match self.try_connect_transport(std::net::IpAddr::V6(nat64_ipv6), port).await {
@@ -970,7 +1129,8 @@ impl Bridge {
             let (final_socket, size) = if success {
                 (socket, size)
             } else {
-                if let std::net::IpAddr::V4(ipv4) = target_ip {
+                if let (std::net::IpAddr::V4(ipv4), false) = (target_ip, nat64_attempted) {
+                    nat64_attempted = true;
                     tx.send(UiEvent::Log("Direct IPv4 handshake timed out. Trying NAT64 fallback...".to_string())).await.ok();
                     let nat64_ipv6 = synthesize_nat64(ipv4).await;
                     match self.try_connect_transport(std::net::IpAddr::V6(nat64_ipv6), port).await {
@@ -1057,7 +1217,27 @@ impl Bridge {
     ) -> Result<crate::transport::Transport> {
         let mode = self.transport_mode.to_lowercase();
         if mode == "uot" || mode == "tcp" {
-            let stream = tokio::net::TcpStream::connect((target_ip, port)).await?;
+            // Bound the TCP connect. Without this it inherits the kernel's SYN
+            // retry budget, which is tens of seconds (and can reach ~2 minutes).
+            // That is exactly what made UoT appear to hang on mobile: callers
+            // resolve every address for the server and try IPv6 first (see the
+            // sort in perform_handshake_with_id), and a mobile network that
+            // advertises IPv6 without a working route blackholes the SYN rather
+            // than rejecting it — so the client sat through the full retry
+            // budget before it ever reached the IPv4 address that would have
+            // connected immediately. UDP never showed this because connect() on
+            // a UDP socket only sets the default peer and returns at once.
+            let stream = tokio::time::timeout(
+                UOT_CONNECT_TIMEOUT,
+                tokio::net::TcpStream::connect((target_ip, port)),
+            )
+            .await
+            .map_err(|_| {
+                anyhow::anyhow!(
+                    "TCP connect to {target_ip}:{port} timed out after {:?}",
+                    UOT_CONNECT_TIMEOUT
+                )
+            })??;
             let _ = stream.set_nodelay(true);
             let (mut read_half, mut write_half) = stream.into_split();
 
@@ -1194,8 +1374,19 @@ fn next_profile(current: TrafficProfile) -> TrafficProfile {
 }
 
 async fn synthesize_nat64(ip: std::net::Ipv4Addr) -> std::net::Ipv6Addr {
+    // Well-known prefix (RFC 6052), used if discovery doesn't answer in time.
     let mut prefix = [0x00, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0];
-    if let Ok(addrs) = tokio::net::lookup_host("ipv4only.arpa:80").await {
+    // Bound the discovery lookup. This runs on exactly the networks that are
+    // already misbehaving, where the resolver can hang for tens of seconds
+    // before giving up — unbounded, it was a large part of why connecting over
+    // a broken mobile network took minutes. Falling back to the well-known
+    // prefix is strictly better than waiting.
+    let discovery = tokio::time::timeout(
+        Duration::from_secs(2),
+        tokio::net::lookup_host("ipv4only.arpa:80"),
+    )
+    .await;
+    if let Ok(Ok(addrs)) = discovery {
         for addr in addrs {
             if let std::net::SocketAddr::V6(v6) = addr {
                 let octets = v6.ip().octets();

ostp-client/src/config.rs

@@ -418,19 +418,22 @@ pub struct RelayServerConfig {
     pub upstream_tcp: String,
     /// Upstream address for UDP traffic
     pub upstream_udp: String,
-    /// Target server's API URL, for key sync
+    // ── Deprecated ──────────────────────────────────────────────────────────
+    // The relay used to authenticate clients itself and pulled the access-key
+    // list from the target server's management API to do it. It no longer does:
+    // sessions are authenticated end-to-end by the target server, and a relay
+    // that re-checks credentials only adds a weaker second gate plus a copy of
+    // the key list on a machine that does not need one. These are kept solely
+    // so existing relay configs still parse; they are ignored.
+    #[serde(default)]
     pub upstream_api_url: String,
-    /// Bearer token for the target server's API
     #[serde(default)]
     pub upstream_api_token: String,
-    /// Key sync interval in seconds (default 30)
-    #[serde(default = "default_sync_interval")]
+    #[serde(default)]
     pub sync_interval_secs: u64,
     pub debug: Option<bool>,
 }
 
-fn default_sync_interval() -> u64 { 30 }
-
 /// Supports both a single string "0.0.0.0:50000" and an array
 /// ["0.0.0.0:50000", "[::]:50000"].
 #[derive(Debug, Deserialize, Serialize, Clone)]

ostp-client/src/tunnel/proxy.rs

@@ -361,6 +361,10 @@ async fn handle_udp_associate(
 
     let mut direct_udp_v4: Option<Arc<UdpSocket>> = None;
     let mut direct_udp_v6: Option<Arc<UdpSocket>> = None;
+    // Held only to keep the direct-UDP readers' cancellation senders alive;
+    // dropping this (on every return path from this function) is what tells
+    // spawn_direct_udp_reader's tasks to stop. See its doc comment.
+    let mut direct_udp_cancel_txs: Vec<tokio::sync::oneshot::Sender<()>> = Vec::new();
 
     let mut tcp_buf = [0u8; 1];
     loop {
@@ -432,7 +436,9 @@ async fn handle_udp_associate(
                                     match create_udp_socket_bypassing_tun(true, matcher.physical_if_index, &matcher.physical_if_name).await {
                                         Ok(s) => {
                                             let s_arc = Arc::new(s);
-                                            spawn_direct_udp_reader(s_arc.clone(), sock_tx.clone(), client_udp_addr.clone(), debug);
+                                            let (cancel_tx, cancel_rx) = tokio::sync::oneshot::channel();
+                                            spawn_direct_udp_reader(s_arc.clone(), sock_tx.clone(), client_udp_addr.clone(), debug, cancel_rx);
+                                            direct_udp_cancel_txs.push(cancel_tx);
                                             direct_udp_v6 = Some(s_arc);
                                         }
                                         Err(e) => {
@@ -446,7 +452,9 @@ async fn handle_udp_associate(
                                     match create_udp_socket_bypassing_tun(false, matcher.physical_if_index, &matcher.physical_if_name).await {
                                         Ok(s) => {
                                             let s_arc = Arc::new(s);
-                                            spawn_direct_udp_reader(s_arc.clone(), sock_tx.clone(), client_udp_addr.clone(), debug);
+                                            let (cancel_tx, cancel_rx) = tokio::sync::oneshot::channel();
+                                            spawn_direct_udp_reader(s_arc.clone(), sock_tx.clone(), client_udp_addr.clone(), debug, cancel_rx);
+                                            direct_udp_cancel_txs.push(cancel_tx);
                                             direct_udp_v4 = Some(s_arc);
                                         }
                                         Err(e) => {
@@ -520,11 +528,24 @@ fn spawn_direct_udp_reader(
     sock_tx: Arc<UdpSocket>,
     client_udp_addr: Arc<std::sync::Mutex<Option<std::net::SocketAddr>>>,
     _debug: bool,
+    mut cancel_rx: tokio::sync::oneshot::Receiver<()>,
 ) {
     tokio::spawn(async move {
         let mut buf = vec![0u8; 65536];
         loop {
-            match direct_socket.recv_from(&mut buf).await {
+            let recv_result = tokio::select! {
+                // Fires as soon as the sender half (held by handle_udp_associate
+                // for exactly this reason) is dropped - which happens the
+                // instant that function returns, on every exit path, with no
+                // explicit signaling needed. Without this, a UDP-associate
+                // session that ever bypassed traffic direct (excluded IP/
+                // domain) leaked this socket + task for the rest of the
+                // process's life once the session ended: nothing else ever
+                // stopped this loop.
+                _ = &mut cancel_rx => break,
+                res = direct_socket.recv_from(&mut buf) => res,
+            };
+            match recv_result {
                 Ok((len, target_addr)) => {
                     let client_addr = {
                         let guard = client_udp_addr.lock().unwrap();

ostp-client/src/tunnel/udp_nat.rs

@@ -138,27 +138,34 @@ async fn start_udp_bypass_session(
         let _ = crate::tunnel::proxy::bind_socket_to_interface(&socket, name);
     }
 
-    let socket = Arc::new(socket);
-    let socket_rx = socket.clone();
-
-    // Spawn a task to read from physical socket and send back to smoltcp
-    let tx_clone = smoltcp_tx.clone();
-    tokio::spawn(async move {
-        use futures::SinkExt;
-        let mut buf = [0u8; 65536];
-        loop {
-            match socket_rx.recv_from(&mut buf).await {
-                Ok((n, peer)) => {
-                    let mut lock = tx_clone.lock().await;
-                    let _ = lock.send((buf[..n].to_vec(), peer, client_src)).await;
+    // A single select! loop over both directions, rather than spawning a
+    // separate task for the read side, so the whole session - physical
+    // socket included - is torn down the moment this function returns
+    // (e.g. when session_rx closes). The previous spawned-task version left
+    // that task (and its Arc<UdpSocket> clone, keeping the OS socket fd
+    // alive) running forever after this function returned: nothing ever
+    // cancelled it, so every bypassed UDP flow (any excluded app/IP in TUN
+    // mode) leaked one socket + one task for the lifetime of the process.
+    use futures::SinkExt;
+    let mut buf = [0u8; 65536];
+    loop {
+        tokio::select! {
+            outbound = session_rx.recv() => {
+                match outbound {
+                    Some((payload, dst)) => { socket.send_to(&payload, dst).await?; }
+                    None => break,
+                }
+            }
+            inbound = socket.recv_from(&mut buf) => {
+                match inbound {
+                    Ok((n, peer)) => {
+                        let mut lock = smoltcp_tx.lock().await;
+                        let _ = lock.send((buf[..n].to_vec(), peer, client_src)).await;
+                    }
+                    Err(_) => break,
                 }
-                Err(_) => break,
             }
         }
-    });
-
-    while let Some((payload, dst)) = session_rx.recv().await {
-        socket.send_to(&payload, dst).await?;
     }
 
     Ok(())

ostp-core/src/congestion.rs

@@ -39,10 +39,18 @@ pub struct CongestionController {
     loss_count: u32,
     /// Pacing rate: bytes per second
     pacing_rate: u64,
+    /// Token-bucket allowance for pacing, in bytes.
+    pacing_tokens: f64,
+    pacing_last_refill: Instant,
     /// MTU estimate (used for cwnd → packet count conversion)
     mtu: u64,
     /// Min RTT expiry: re-probe after 10 seconds
     min_rtt_stamp: Instant,
+    /// Loss events counted toward SLOW_START_LOSS_TOLERANCE within the
+    /// current SLOW_START_LOSS_WINDOW (see on_loss's SlowStart arm).
+    slow_start_losses: u32,
+    /// Start of the current loss-tolerance window.
+    slow_start_loss_window_start: Instant,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -60,6 +68,20 @@ const MIN_CWND_PACKETS: u64 = 2;
 /// Min RTT expiry window (after which we re-probe)
 const MIN_RTT_EXPIRY: Duration = Duration::from_secs(10);
 /// Minimum RTO (RFC 6298: 1s in TCP; we use 50ms since we own the protocol)
+/// Absolute ceiling on the congestion window, in packets. At a ~1200-byte MTU
+/// this is roughly 1.2 MB in flight — already far above the bandwidth-delay
+/// product of any link this protocol realistically runs over, so anything
+/// beyond it is standing queue, not throughput. The client previously allowed
+/// up to 16384 packets (~20 MB), which on a mobile uplink is minutes of buffer.
+const MAX_CWND_PACKETS: u64 = 1024;
+/// SRTT/min_rtt ratio at which slow start stops. Doubling is what fills a deep
+/// buffer fastest, so growth must end when the queue starts building rather
+/// than waiting for a loss that a deep buffer may never produce.
+const RTT_INFLATION_EXIT_SLOW_START: f64 = 2.0;
+/// SRTT/min_rtt ratio treated as a standing queue that must be actively drained.
+const RTT_INFLATION_BACKOFF: f64 = 4.0;
+/// How much pacing allowance may accumulate, expressed as time-at-rate.
+const PACING_BURST: Duration = Duration::from_millis(10);
 const RTO_MIN: Duration = Duration::from_millis(50);
 /// Maximum RTO
 const RTO_MAX: Duration = Duration::from_secs(16);
@@ -67,6 +89,24 @@ const RTO_MAX: Duration = Duration::from_secs(16);
 /// Will be replaced by first real measurement within milliseconds.
 const INITIAL_RTT: Duration = Duration::from_millis(30);
 
+/// Isolated packet loss during slow start (a single dropped frame from
+/// wireless noise, a brief LTE handover blip, etc.) is normal on real
+/// mobile/Wi-Fi links and does NOT mean the link is congested. The previous
+/// behavior exited slow start and halved cwnd on the very FIRST loss, which
+/// on any link with a non-zero background loss rate permanently downgrades
+/// the session from exponential growth to linear (+1 MTU/RTT) ProbeBandwidth
+/// growth within the first few RTTs - turning what should be a sub-second
+/// ramp-up into tens of seconds to minutes before throughput opens up
+/// (observed as: a trickle of KB/s, then a sudden jump once cwnd finally
+/// claws back up). Only treat loss as a real congestion signal - and pay
+/// the full slow-start-exit + halving cost - once this many losses land
+/// within SLOW_START_LOSS_WINDOW.
+const SLOW_START_LOSS_TOLERANCE: u32 = 3;
+/// Window within which SLOW_START_LOSS_TOLERANCE losses must land to count
+/// as sustained (rather than isolated) loss. Roughly a few RTTs on a
+/// well-connected link, generous on a slow one.
+const SLOW_START_LOSS_WINDOW: Duration = Duration::from_millis(500);
+
 impl CongestionController {
     pub fn new(mtu: u64) -> Self {
         let now = Instant::now();
@@ -88,9 +128,52 @@ impl CongestionController {
             pacing_rate: initial_pacing,
             mtu,
             min_rtt_stamp: now,
+            slow_start_losses: 0,
+            slow_start_loss_window_start: now,
+            pacing_tokens: (INITIAL_CWND_PACKETS * mtu) as f64,
+            pacing_last_refill: now,
         }
     }
 
+    /// Bytes of pacing allowance available right now, without consuming any.
+    ///
+    /// Read-only so the send path can use it as an admission check before it
+    /// commits to building a datagram.
+    pub fn pacing_available(&self) -> f64 {
+        let elapsed = self.pacing_last_refill.elapsed().as_secs_f64();
+        (self.pacing_tokens + elapsed * self.pacing_rate as f64).min(self.pacing_burst())
+    }
+
+    /// Whether at least one full-size packet may be released right now.
+    pub fn can_pace_packet(&self) -> bool {
+        self.pacing_available() >= self.mtu as f64
+    }
+
+    /// Ceiling on accumulated allowance.
+    ///
+    /// Pacing intervals here are fractions of a millisecond, so releasing
+    /// strictly one packet at a time would need a sub-millisecond timer per
+    /// packet. Instead we allow a short burst — the same trade every real
+    /// pacing implementation makes — sized so the loop's existing ~10ms wakeups
+    /// can still saturate the configured rate, with a small floor so a
+    /// cold/low estimate can never wedge sending entirely.
+    fn pacing_burst(&self) -> f64 {
+        let by_rate = self.pacing_rate as f64 * PACING_BURST.as_secs_f64();
+        by_rate.max((self.mtu * 4) as f64)
+    }
+
+    /// Refill from elapsed time and deduct `bytes`. Called on the real send
+    /// path; allowance is permitted to go negative so an oversized packet still
+    /// pays for itself rather than being released for free.
+    fn consume_pacing(&mut self, bytes: u64) {
+        let now = Instant::now();
+        let elapsed = now.duration_since(self.pacing_last_refill).as_secs_f64();
+        self.pacing_last_refill = now;
+        self.pacing_tokens =
+            (self.pacing_tokens + elapsed * self.pacing_rate as f64).min(self.pacing_burst())
+                - bytes as f64;
+    }
+
     /// Returns the current congestion window in bytes.
     pub fn cwnd(&self) -> u64 {
         self.cwnd
@@ -142,6 +225,11 @@ impl CongestionController {
     /// Record that we sent `bytes` of data.
     pub fn on_send(&mut self, bytes: u64) {
         self.bytes_in_flight = self.bytes_in_flight.saturating_add(bytes);
+        // Charge the pacing bucket here rather than at the admission check, so
+        // every byte that actually reaches the wire is paid for exactly once —
+        // including retransmits, which are precisely what must not be allowed
+        // to bypass the rate limit and pile into an already-full queue.
+        self.consume_pacing(bytes);
     }
 
     /// Record that `bytes` were acknowledged but WITHOUT a usable RTT sample
@@ -173,9 +261,46 @@ impl CongestionController {
 
     /// Congestion-window growth shared by both ACK paths (slow start / probe).
     fn grow_window(&mut self, bytes: u64) {
-        // State machine
+        // ── Delay-based congestion signal ────────────────────────────────────
+        // A loss-only controller is blind on a deeply-buffered path, and mobile
+        // carrier buffers are very deep: they absorb a burst instead of dropping
+        // it, so no loss is ever signalled and cwnd keeps growing. The queue —
+        // not the link — is what grows, and the standing delay it adds shows up
+        // as RTT inflating far above the path's floor. Left unchecked this is a
+        // positive feedback loop: bigger queue -> larger RTT samples -> larger
+        // SRTT -> larger RTO -> retransmits pile on -> bigger queue, which is
+        // how a session ends up reporting multi-second (even multi-minute) RTT
+        // and stalls video until the buffer finally drains or the user
+        // reconnects. Treat sustained RTT inflation as congestion in its own
+        // right, exactly as it is.
+        let inflation = if self.rtt_initialized && !self.min_rtt.is_zero() {
+            self.srtt.as_secs_f64() / self.min_rtt.as_secs_f64()
+        } else {
+            1.0
+        };
+
+        if inflation >= RTT_INFLATION_BACKOFF {
+            // Standing queue is severe — actively drain it.
+            self.cwnd = (self.cwnd / 2).max(MIN_CWND_PACKETS * self.mtu);
+            self.ssthresh = self.cwnd;
+            self.phase = Phase::ProbeBandwidth;
+            tracing::debug!(cwnd = self.cwnd, inflation, "congestion: draining standing queue");
+            self.clamp_cwnd();
+            return;
+        }
+
         match self.phase {
             Phase::SlowStart => {
+                // Exponential doubling is what fills a deep buffer fastest, so
+                // leave slow start as soon as the queue starts to build rather
+                // than waiting for the loss that may never come.
+                if inflation >= RTT_INFLATION_EXIT_SLOW_START {
+                    self.ssthresh = self.cwnd;
+                    self.phase = Phase::ProbeBandwidth;
+                    tracing::debug!(cwnd = self.cwnd, inflation, "congestion: RTT inflation ended slow start");
+                    self.clamp_cwnd();
+                    return;
+                }
                 // Exponential growth: increase cwnd by acked bytes (doubles per RTT)
                 self.cwnd = self.cwnd.saturating_add(bytes);
                 if self.cwnd >= self.ssthresh {
@@ -188,6 +313,21 @@ impl CongestionController {
                 self.cwnd = self.cwnd.saturating_add(bytes * self.mtu / self.cwnd.max(1));
             }
         }
+
+        self.clamp_cwnd();
+    }
+
+    /// Hard ceiling on the congestion window.
+    ///
+    /// Independent of any estimate: no real path this protocol runs over has a
+    /// bandwidth-delay product anywhere near this, so a window above it is
+    /// buffered queue rather than data in transit. Without it, slow start on a
+    /// buffer that never drops could grow the window into the tens of megabytes.
+    fn clamp_cwnd(&mut self) {
+        let ceiling = MAX_CWND_PACKETS.saturating_mul(self.mtu);
+        if self.cwnd > ceiling {
+            self.cwnd = ceiling;
+        }
     }
 
     /// Record a loss event.
@@ -197,11 +337,28 @@ impl CongestionController {
 
         match self.phase {
             Phase::SlowStart => {
-                // Exit slow start, set ssthresh to half of cwnd
-                self.ssthresh = self.cwnd / 2;
-                self.cwnd = self.ssthresh.max(MIN_CWND_PACKETS * self.mtu);
-                self.phase = Phase::ProbeBandwidth;
-                tracing::debug!(cwnd = self.cwnd, ssthresh = self.ssthresh, "congestion: loss during slow start");
+                let now = Instant::now();
+                if now.duration_since(self.slow_start_loss_window_start) > SLOW_START_LOSS_WINDOW {
+                    // Previous window's losses have aged out - this loss starts a fresh count.
+                    self.slow_start_losses = 0;
+                    self.slow_start_loss_window_start = now;
+                }
+                self.slow_start_losses += 1;
+
+                if self.slow_start_losses >= SLOW_START_LOSS_TOLERANCE {
+                    // Sustained loss within the window: treat as real congestion.
+                    // Exit slow start, set ssthresh to half of cwnd.
+                    self.ssthresh = self.cwnd / 2;
+                    self.cwnd = self.ssthresh.max(MIN_CWND_PACKETS * self.mtu);
+                    self.phase = Phase::ProbeBandwidth;
+                    tracing::debug!(cwnd = self.cwnd, ssthresh = self.ssthresh, "congestion: sustained loss during slow start, exiting");
+                } else {
+                    // Isolated loss: likely non-congestive noise. Take a mild,
+                    // temporary haircut but keep exponential growth going -
+                    // don't throw away slow start over a single dropped frame.
+                    self.cwnd = (self.cwnd * 8 / 10).max(MIN_CWND_PACKETS * self.mtu);
+                    tracing::debug!(cwnd = self.cwnd, count = self.slow_start_losses, "congestion: isolated loss during slow start, staying in slow start");
+                }
             }
             Phase::ProbeBandwidth => {
                 // Multiplicative decrease: cwnd *= 0.7 (BBR-style, less aggressive than Cubic's 0.5)
@@ -290,6 +447,138 @@ mod tests {
         assert!(cc.cwnd() < initial);
     }
 
+    /// The bufferbloat case: a deep buffer absorbs everything, so NOTHING is
+    /// ever lost, but the standing queue inflates RTT. A loss-only controller
+    /// grows cwnd forever here — which is how a session ends up reporting
+    /// multi-second RTT and stalling video.
+    #[test]
+    fn test_rtt_inflation_halts_growth_without_any_loss() {
+        let mut cc = CongestionController::new(1200);
+
+        // Establish a low path floor; this becomes min_rtt.
+        for _ in 0..4 {
+            cc.on_send(1200);
+            cc.on_ack(1200, Duration::from_millis(20));
+        }
+        let cwnd_before = cc.cwnd();
+
+        // Queue builds: RTT climbs far above the floor, still zero loss.
+        for _ in 0..20 {
+            cc.on_send(1200);
+            cc.on_ack(1200, Duration::from_millis(400));
+        }
+
+        assert!(
+            cc.cwnd() <= cwnd_before,
+            "cwnd kept growing while the queue was inflating RTT ({} -> {})",
+            cwnd_before,
+            cc.cwnd()
+        );
+    }
+
+    /// Pacing must actually bound the release rate: draining the bucket has to
+    /// deny the next packet. Without this the congestion window alone decides,
+    /// and a whole window leaves back-to-back.
+    #[test]
+    fn test_pacing_bucket_denies_once_drained() {
+        let mut cc = CongestionController::new(1200);
+        assert!(cc.can_pace_packet(), "a fresh controller must allow sending");
+
+        // Spend well beyond one burst allowance.
+        let burst_bytes = cc.pacing_available();
+        let mut spent = 0.0;
+        while spent <= burst_bytes + 1200.0 {
+            cc.on_send(1200);
+            spent += 1200.0;
+        }
+
+        assert!(
+            !cc.can_pace_packet(),
+            "pacing allowed unbounded sending: {} bytes still available after spending {}",
+            cc.pacing_available(),
+            spent
+        );
+    }
+
+    /// The allowance must refill over time, or sending would stall permanently
+    /// once the first burst is spent.
+    #[test]
+    fn test_pacing_bucket_refills_over_time() {
+        let mut cc = CongestionController::new(1200);
+        while cc.can_pace_packet() {
+            cc.on_send(1200);
+        }
+        assert!(!cc.can_pace_packet());
+
+        std::thread::sleep(Duration::from_millis(25));
+        assert!(
+            cc.can_pace_packet(),
+            "pacing bucket never refilled; sending would be stuck forever"
+        );
+    }
+
+    /// cwnd must never exceed the absolute ceiling, however long slow start
+    /// runs unopposed — above it the window is buffered queue, not throughput.
+    #[test]
+    fn test_cwnd_never_exceeds_absolute_ceiling() {
+        let mut cc = CongestionController::new(1200);
+        // Constant RTT: no inflation signal, so only the hard cap can stop this.
+        for _ in 0..5000 {
+            cc.on_send(1200);
+            cc.on_ack(1200, Duration::from_millis(30));
+        }
+        assert!(
+            cc.cwnd() <= MAX_CWND_PACKETS * 1200,
+            "cwnd {} exceeded the {}-packet ceiling",
+            cc.cwnd(),
+            MAX_CWND_PACKETS
+        );
+    }
+
+    #[test]
+    fn test_isolated_slow_start_loss_does_not_exit_slow_start() {
+        // A single dropped packet (wireless noise, a brief handover blip) is
+        // normal on real links and must not permanently downgrade the
+        // session from exponential to linear growth.
+        let mut cc = CongestionController::new(1200);
+        cc.on_loss(1200);
+        assert_eq!(cc.phase, Phase::SlowStart, "one isolated loss must not exit slow start");
+
+        // It should still shrink the window somewhat (not ignored entirely),
+        // just far less punishing than the sustained-congestion case.
+        let after_one = cc.cwnd();
+        assert!(after_one < INITIAL_CWND_PACKETS * 1200);
+    }
+
+    #[test]
+    fn test_sustained_slow_start_loss_exits_slow_start() {
+        // Losses landing close together (within SLOW_START_LOSS_WINDOW) are
+        // a real congestion signal and must still trigger the harsher
+        // exit-slow-start + halve response.
+        let mut cc = CongestionController::new(1200);
+        for _ in 0..SLOW_START_LOSS_TOLERANCE {
+            cc.on_loss(1200);
+        }
+        assert_eq!(cc.phase, Phase::ProbeBandwidth, "sustained loss must exit slow start");
+    }
+
+    #[test]
+    fn test_slow_start_loss_window_resets_after_expiry() {
+        // Two losses far enough apart (window expired between them) must
+        // each be treated as isolated, not accumulated toward the sustained-
+        // loss threshold.
+        let mut cc = CongestionController::new(1200);
+        cc.on_loss(1200);
+        assert_eq!(cc.phase, Phase::SlowStart);
+
+        // Simulate the window having expired by resetting its start
+        // directly (std::thread::sleep in a unit test would be flaky/slow).
+        cc.slow_start_loss_window_start = Instant::now() - SLOW_START_LOSS_WINDOW - Duration::from_millis(1);
+        cc.on_loss(1200);
+        assert_eq!(cc.phase, Phase::SlowStart, "a loss after the window expired must restart the count, not accumulate");
+        assert_eq!(cc.slow_start_losses, 1);
+    }
+
     #[test]
     fn test_can_send_limits() {
         let mut cc = CongestionController::new(1200);

ostp-core/src/protocol.rs

@@ -4,6 +4,11 @@ use thiserror::Error;
 use std::collections::{BTreeMap, VecDeque};
 use std::time::{Duration, Instant};
 
+/// Upper bound on a single frame's retransmit timer, after exponential backoff
+/// is applied to the adaptive RTO. Past this the session is dead from the
+/// user's point of view, and waiting longer only delays recovery.
+const MAX_EFFECTIVE_RTO: Duration = Duration::from_secs(8);
+
 use crate::congestion::CongestionController;
 use crate::crypto::{NoiseRole, NoiseSession, SessionCipher};
 use crate::framing::{AdaptivePadder, FrameHeader, FrameKind, FramedPacket, PaddingStrategy};
@@ -102,6 +107,17 @@ pub struct ProtocolMachine {
     _mtu: usize,
 }
 
+// ── Gap recovery (see `ProtocolMachine::recover_stalled_gap`) ────────────────
+// How long the receive sequence may sit stuck behind a missing frame, with
+// later frames already buffered, before that frame is declared unrecoverable
+// and skipped. Derived from the live RTO so it scales with the path instead of
+// guessing, then clamped: the floor keeps a fast link from discarding a frame
+// that is merely late, the ceiling bounds how long a stall can be visible to
+// the user before the tunnel unblocks itself.
+const GAP_RECOVERY_RTO_MULTIPLIER: u32 = 8;
+const GAP_RECOVERY_MIN: Duration = Duration::from_secs(2);
+const GAP_RECOVERY_MAX: Duration = Duration::from_secs(10);
+
 #[derive(Debug, Clone)]
 struct SentFrame {
     nonce: u64,
@@ -155,10 +171,33 @@ impl ProtocolMachine {
         self.sent_history.iter().filter(|f| f.is_retransmittable).count()
     }
 
+    /// Sum of retry counters across in-flight frames. Test-only: lets a test
+    /// assert the core retransmit invariant (a retry is only ever charged to a
+    /// frame that was actually put on the wire) without needing to advance the
+    /// clock through several seconds of exponential backoff.
+    #[cfg(test)]
+    fn total_retries(&self) -> usize {
+        self.sent_history
+            .iter()
+            .filter(|f| f.is_retransmittable)
+            .map(|f| f.retries as usize)
+            .sum()
+    }
+
     pub fn cwnd_packets(&self) -> usize {
         self.cc.cwnd_packets() as usize
     }
 
+    /// Whether the pacing bucket currently allows releasing another packet.
+    ///
+    /// The congestion window bounds how much may be UNACKNOWLEDGED; it says
+    /// nothing about how fast that window is emptied onto the wire. Sending a
+    /// whole window back-to-back is what drives a deep buffer into standing
+    /// queue, so admission is gated on both.
+    pub fn can_pace_packet(&self) -> bool {
+        self.cc.can_pace_packet()
+    }
+
     pub fn on_send(&mut self, bytes: u64) {
         self.cc.on_send(bytes);
     }
@@ -296,7 +335,107 @@ impl ProtocolMachine {
         Ok(ProtocolAction::HandshakePayload(Bytes::from(extracted_payload), response))
     }
 
+    /// Restores liveness when the receive sequence is stuck behind a frame that
+    /// can never arrive.
+    ///
+    /// Delivery is gated on `expected_recv_nonce`, so a single missing frame
+    /// holds back every later frame. That is correct *while the sender can still
+    /// retransmit* — but the sender drops a frame from `sent_history` once it
+    /// exceeds `max_retries + 2` attempts (see the zombie eviction in
+    /// `handle_tick`). After that the frame is gone for good and the two sides
+    /// deadlock: the receiver buffers forever and NACKs a nonce nobody can
+    /// resend.
+    ///
+    /// That deadlock is invisible to the keepalive watchdog, which is why it
+    /// presented as a hard freeze rather than a reconnect: retransmits, ACKs and
+    /// NACKs keep flowing, so the client's `last_valid_recv` keeps refreshing and
+    /// its stall detector never fires. The RTT readout freezes at its last value
+    /// for the same reason — Pong rides in a Data frame stuck behind the gap.
+    ///
+    /// So: once we have been stuck long enough that retransmission has provably
+    /// given up, skip to the lowest buffered nonce and drain. This drops the
+    /// missing frame's payload (one RelayMessage — a chunk of one stream), which
+    /// is a real cost, but the alternative is a permanently dead tunnel.
+    fn recover_stalled_gap(&mut self) -> Vec<ProtocolAction> {
+        let mut recovered = Vec::new();
+        if self.reorder_buffer.is_empty() {
+            return recovered;
+        }
+
+        // Wait out the sender's full retransmit budget before giving up, so a
+        // frame that is merely late is never discarded. The sender backs off
+        // exponentially, so key this off the live RTO estimate rather than a
+        // flat constant, with a floor that keeps low-RTT links from skipping
+        // too eagerly and a ceiling that bounds the visible freeze.
+        let timeout = self
+            .cc
+            .rto()
+            .saturating_mul(GAP_RECOVERY_RTO_MULTIPLIER)
+            .clamp(GAP_RECOVERY_MIN, GAP_RECOVERY_MAX);
+        if self.last_recv_advance.elapsed() < timeout {
+            return recovered;
+        }
+
+        let Some(&resume_at) = self.reorder_buffer.keys().next() else {
+            return recovered;
+        };
+        let skipped = resume_at.saturating_sub(self.expected_recv_nonce);
+        tracing::warn!(
+            "Gap recovery: no progress for {:?}; skipping {} unrecoverable frame(s) \
+             (nonce {} -> {}) to unblock the session",
+            self.last_recv_advance.elapsed(),
+            skipped,
+            self.expected_recv_nonce,
+            resume_at
+        );
+
+        self.expected_recv_nonce = resume_at;
+        while let Some(buffered) = self.reorder_buffer.remove(&self.expected_recv_nonce) {
+            recovered.push(buffered);
+            match self.expected_recv_nonce.checked_add(1) {
+                Some(next) => self.expected_recv_nonce = next,
+                // u64 nonce space exhausted: stop draining rather than wrap.
+                // The session is finished either way; the caller's next decrypt
+                // will fail and tear it down.
+                None => break,
+            }
+        }
+        self.last_recv_advance = Instant::now();
+        // The peer must learn the sequence moved on, or it will keep
+        // retransmitting into the void.
+        self.ack_pending = true;
+
+        recovered
+    }
+
     fn handle_data_inbound(&mut self, raw_vec: &[u8]) -> Result<ProtocolAction, ProtocolError> {
+        // Check for a stalled gap before classifying this frame, so the rest of
+        // the function sees an already-advanced `expected_recv_nonce`. Runs here
+        // rather than on Tick because both tick handlers discard DeliverApp
+        // actions, and because inbound frames keep arriving throughout the stall
+        // (retransmits/ACKs/NACKs/keepalives) — so this path is reliably reached.
+        let recovered = self.recover_stalled_gap();
+        let result = self.handle_data_inbound_frame(raw_vec)?;
+        if recovered.is_empty() {
+            return Ok(result);
+        }
+
+        // Recovered payloads are older than anything this frame produces, so
+        // they go first to preserve delivery order.
+        let mut all = recovered;
+        match result {
+            ProtocolAction::Noop => {}
+            ProtocolAction::Multiple(list) => all.extend(list),
+            single => all.push(single),
+        }
+        Ok(if all.len() == 1 {
+            all.pop().unwrap()
+        } else {
+            ProtocolAction::Multiple(all)
+        })
+    }
+
+    fn handle_data_inbound_frame(&mut self, raw_vec: &[u8]) -> Result<ProtocolAction, ProtocolError> {
         if raw_vec.len() < 12 {
             return Err(ProtocolError::Framing("data datagram too short".to_string()));
         }
@@ -543,18 +682,39 @@ impl ProtocolMachine {
             if !frame.is_retransmittable {
                 continue;
             }
+            // Out of budget for this tick — stop scanning rather than walking the
+            // rest of the queue. sent_history is in send order, so everything we
+            // skip is strictly newer than what we already handled; deferring it to
+            // the next tick preserves oldest-first retransmit priority.
+            if retransmit_budget == 0 {
+                break;
+            }
 
+            // Exponential backoff, but bounded in absolute terms. base_rto is
+            // itself adaptive and can reach RTO_MAX (16s) on a congested path;
+            // multiplying that by the 64x backoff cap yields a frame that sits
+            // unretransmitted for ~17 MINUTES, long past the point where the
+            // session is simply dead to the user. Cap the product so backoff
+            // stays a backoff rather than an outage.
             let backoff_factor = 1u64 << (frame.retries as u64).min(6);
-            let effective_rto = Duration::from_millis(base_rto_ms.saturating_mul(backoff_factor));
+            let effective_rto = Duration::from_millis(base_rto_ms.saturating_mul(backoff_factor))
+                .min(MAX_EFFECTIVE_RTO);
 
             if now.duration_since(frame.last_sent) >= effective_rto {
+                // Only burn the retry counter and reset the RTO timer when the
+                // frame is ACTUALLY put on the wire. Doing it unconditionally
+                // meant that whenever the per-tick budget ran out — which is
+                // exactly when loss is heavy and retransmits matter most —
+                // frames accumulated "phantom retries" they never actually got,
+                // and the zombie eviction above then silently dropped them after
+                // `grace` such rounds. The peer never received that data and
+                // never would: that stream stalls forever while the session
+                // itself stays healthy, which is precisely the reported "tunnel
+                // frozen at 0 b/s but the session still up" symptom.
                 frame.last_sent = now;
                 frame.retries = frame.retries.saturating_add(1);
-                
-                if retransmit_budget > 0 {
-                    actions.push(ProtocolAction::SendDatagram(frame.bytes.clone()));
-                    retransmit_budget -= 1;
-                }
+                actions.push(ProtocolAction::SendDatagram(frame.bytes.clone()));
+                retransmit_budget -= 1;
             }
         }
 
@@ -971,4 +1131,154 @@ mod tests {
         let _ = client.on_event(OstpEvent::Tick).unwrap();
         let _ = server.on_event(OstpEvent::Tick).unwrap();
     }
+
+    /// A retry may only be charged to a frame that was actually retransmitted.
+    ///
+    /// The retransmit loop is budget-limited per tick. It used to bump
+    /// `retries` and reset `last_sent` for every due frame regardless of
+    /// whether the budget allowed it to actually send — so under heavy loss
+    /// (exactly when the budget runs out) frames racked up retries they never
+    /// received, and the zombie eviction dropped them after `max_retries + 2`
+    /// such rounds. That data was never delivered and never would be: the
+    /// stream stalls permanently while the session itself stays up.
+    #[test]
+    fn test_retransmit_budget_charges_retries_only_for_frames_actually_sent() {
+        let (mut client, _server) = do_handshake();
+
+        // Queue far more in-flight frames than a single tick's budget allows.
+        const FRAMES: usize = 40;
+        for i in 0..FRAMES {
+            let payload = Bytes::from(vec![i as u8; 200]);
+            client.on_event(OstpEvent::Outbound(1, payload)).unwrap();
+        }
+        assert_eq!(client.in_flight_count(), FRAMES);
+        assert_eq!(client.total_retries(), 0, "nothing retransmitted yet");
+
+        // Let every frame's RTO lapse so that on the next tick all FRAMES frames
+        // are due at once and the per-tick budget is guaranteed to run out. The
+        // effective RTO here is max(cc.rto(), config rto_ms) = 100ms at retries=0.
+        std::thread::sleep(Duration::from_millis(150));
+
+        let sent = count_datagrams(&client.on_event(OstpEvent::Tick).unwrap());
+
+        assert!(sent > 0, "expected some retransmits after the RTO lapsed");
+        assert!(
+            sent < FRAMES,
+            "budget should have capped this tick below the {FRAMES} due frames, got {sent}"
+        );
+        assert_eq!(
+            client.total_retries(),
+            sent,
+            "charged {} retries but only put {} frames on the wire — the \
+             difference is phantom retries that will silently evict live data",
+            client.total_retries(),
+            sent
+        );
+        assert_eq!(
+            client.in_flight_count(),
+            FRAMES,
+            "nothing was acked, so no frame may be evicted yet"
+        );
+    }
+
+    /// Count how many datagrams an action tree actually puts on the wire.
+    fn count_datagrams(action: &ProtocolAction) -> usize {
+        match action {
+            ProtocolAction::SendDatagram(_) => 1,
+            ProtocolAction::Multiple(list) => list.iter().map(count_datagrams).sum(),
+            _ => 0,
+        }
+    }
+
+    /// Count how many application payloads an action tree actually delivers.
+    fn delivered_payloads(action: &ProtocolAction) -> Vec<Bytes> {
+        match action {
+            ProtocolAction::DeliverApp(_, data) => vec![data.clone()],
+            ProtocolAction::Multiple(list) => list.iter().flat_map(delivered_payloads).collect(),
+            _ => Vec::new(),
+        }
+    }
+
+    /// Build `count` data frames on `client`, returning them without delivering
+    /// any — lets a test choose which ones to "lose" in transit.
+    fn make_data_frames(client: &mut ProtocolMachine, count: u8) -> Vec<Bytes> {
+        (0..count)
+            .map(|i| {
+                let payload = Bytes::from(vec![i; 32]);
+                match client.on_event(OstpEvent::Outbound(1, payload)).unwrap() {
+                    ProtocolAction::SendDatagram(d) => d,
+                    _ => panic!("expected SendDatagram for frame {i}"),
+                }
+            })
+            .collect()
+    }
+
+    /// The freeze this fixes: a frame is lost, the sender eventually stops
+    /// retransmitting it, and the receiver — which gates delivery on
+    /// `expected_recv_nonce` — waits for it forever. Every later frame piles up
+    /// undelivered while the transport itself stays healthy, so nothing upstream
+    /// notices. Recovery must eventually skip the hole and release the backlog.
+    #[test]
+    fn test_gap_recovery_releases_permanently_stalled_frames() {
+        let (mut client, mut server) = do_handshake();
+        let frames = make_data_frames(&mut client, 4);
+
+        // Frame 0 arrives in order and is delivered straight through.
+        let action = server.on_event(OstpEvent::Inbound(frames[0].clone())).unwrap();
+        assert_eq!(delivered_payloads(&action).len(), 1, "in-order frame should deliver");
+
+        // Frame 1 is lost. 2 and 3 arrive but must be held back — delivering them
+        // now would reorder the stream.
+        for idx in [2usize, 3] {
+            let action = server.on_event(OstpEvent::Inbound(frames[idx].clone())).unwrap();
+            assert!(
+                delivered_payloads(&action).is_empty(),
+                "frame {idx} must stay buffered behind the missing frame"
+            );
+        }
+
+        // Stand in for "the sender exhausted its retries and dropped frame 1":
+        // the sequence has not advanced for longer than the recovery timeout.
+        server.last_recv_advance = Instant::now() - GAP_RECOVERY_MAX - Duration::from_secs(1);
+
+        // The next inbound frame (a retransmitted duplicate, which is exactly what
+        // a real stalled session keeps receiving) must unblock the backlog.
+        let action = server.on_event(OstpEvent::Inbound(frames[0].clone())).unwrap();
+        let delivered = delivered_payloads(&action);
+        assert_eq!(
+            delivered.len(),
+            2,
+            "both buffered frames must be released once the gap is declared unrecoverable"
+        );
+        // ...and in order: frame 2 before frame 3.
+        assert_eq!(delivered[0][0], 2);
+        assert_eq!(delivered[1][0], 3);
+    }
+
+    /// Recovery must not be trigger-happy: a frame that is merely late still has
+    /// to be waited for, or we would discard data the sender is about to resend.
+    #[test]
+    fn test_gap_recovery_does_not_fire_before_timeout() {
+        let (mut client, mut server) = do_handshake();
+        let frames = make_data_frames(&mut client, 3);
+
+        server.on_event(OstpEvent::Inbound(frames[0].clone())).unwrap();
+        let action = server.on_event(OstpEvent::Inbound(frames[2].clone())).unwrap();
+        assert!(delivered_payloads(&action).is_empty());
+
+        // Well inside the timeout — the gap must still be respected.
+        let action = server.on_event(OstpEvent::Inbound(frames[0].clone())).unwrap();
+        assert!(
+            delivered_payloads(&action).is_empty(),
+            "must keep waiting while retransmission is still plausible"
+        );
+
+        // And once the genuinely-late frame shows up, normal in-order delivery
+        // resumes with nothing dropped.
+        let action = server.on_event(OstpEvent::Inbound(frames[1].clone())).unwrap();
+        let delivered = delivered_payloads(&action);
+        assert_eq!(delivered.len(), 2, "late frame plus the buffered one");
+        assert_eq!(delivered[0][0], 1);
+        assert_eq!(delivered[1][0], 2);
+    }
 }

ostp-flutter/android/app/build.gradle.kts

@@ -1,3 +1,6 @@
+import java.io.FileInputStream
+import java.util.Properties
+
 plugins {
     id("com.android.application")
     id("kotlin-android")
@@ -5,6 +8,37 @@ plugins {
     id("dev.flutter.flutter-gradle-plugin")
 }
 
+// ── Release signing material ────────────────────────────────────────────────
+// Supplied out-of-band and never committed: either an `android/key.properties`
+// file (local release builds) or OSTP_KEYSTORE_* environment variables (CI).
+//
+// This exists because the release build used to be signed with the DEBUG
+// keystore (the stock Flutter template TODO). Android identifies an app by
+// applicationId + signing key, and refuses to update across a key change. The
+// debug keystore is auto-generated per machine, and CI runners are ephemeral,
+// so every published build carried a different random key — which is why
+// updating on top of a previous install failed with "App not installed" /
+// "unable to parse the package" and only a full uninstall+reinstall worked.
+val keystoreProperties = Properties().apply {
+    val propsFile = rootProject.file("key.properties")
+    if (propsFile.exists()) {
+        FileInputStream(propsFile).use { load(it) }
+    }
+}
+
+// Blank counts as absent. GitHub Actions substitutes an EMPTY STRING (not an
+// unset variable) for a secret that doesn't exist, so `getenv(...) ?: fallback`
+// silently kept the empty value — the elvis operator only catches null. That is
+// how an unset ANDROID_KEY_PASSWORD ended up being used as the literal key
+// password instead of falling back to the store password, producing Gradle's
+// "Get Key failed: Given final block not properly padded".
+fun signingSetting(propKey: String, envKey: String): String? =
+    (keystoreProperties.getProperty(propKey) ?: System.getenv(envKey))
+        ?.takeIf { it.isNotBlank() }
+
+val releaseStorePath: String? = signingSetting("storeFile", "OSTP_KEYSTORE_PATH")
+val hasReleaseSigning: Boolean = !releaseStorePath.isNullOrBlank()
+
 android {
     namespace = "com.ospab.ostp_client"
     compileSdk = flutter.compileSdkVersion
@@ -34,11 +68,43 @@ android {
         }
     }
 
+    signingConfigs {
+        create("release") {
+            if (hasReleaseSigning) {
+                val store = signingSetting("storePassword", "OSTP_KEYSTORE_PASSWORD")
+                storeFile = file(releaseStorePath!!)
+                storePassword = store
+                keyAlias = signingSetting("keyAlias", "OSTP_KEY_ALIAS")
+                // PKCS12 (the keytool default since Java 9, and what our upload
+                // keystore is) cannot hold a key password that differs from the
+                // store password — the format simply has no place to put one. So
+                // treat a missing key password as "same as the store password"
+                // instead of demanding a secret that, for this keystore, can only
+                // ever be a duplicate. An explicit value still wins, for the older
+                // JKS format where the two genuinely can differ.
+                keyPassword = signingSetting("keyPassword", "OSTP_KEY_PASSWORD") ?: store
+            }
+        }
+    }
+
     buildTypes {
         release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.getByName("debug")
+            // Use the real upload key when one was supplied; otherwise fall back to
+            // the debug keystore so a plain local `flutter build apk --release`
+            // still works for development. Anything PUBLISHED must take the first
+            // branch — a debug-signed build cannot be updated over, and its key is
+            // machine-local, so it also can't be reproduced later.
+            if (hasReleaseSigning) {
+                signingConfig = signingConfigs.getByName("release")
+            } else {
+                logger.warn(
+                    "OSTP: no release keystore configured (android/key.properties or " +
+                    "OSTP_KEYSTORE_PATH) - falling back to the DEBUG keystore. This APK " +
+                    "is for local use only: users cannot update over it, and the key is " +
+                    "not reproducible on another machine."
+                )
+                signingConfig = signingConfigs.getByName("debug")
+            }
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
         }
     }

ostp-flutter/lib/ui/home_screen.dart

@@ -8,6 +8,13 @@ import '../models/connection_state_enum.dart';
 import '../models/ostp_profile.dart';
 import 'settings_screen.dart';
 
+/// Success green for the "connected" state — the button aura/border/icon and
+/// the top-bar status dot. The theme's `secondary` (#AAAAAA) reads as plain
+/// white here, which gave no visual confirmation that the tunnel actually came
+/// up. Reuses the same green already used for a healthy ping value, so
+/// "green = good" stays consistent across the UI.
+const Color kConnectedGreen = Color(0xFF22D3A5);
+
 class HomeScreen extends StatefulWidget {
   final SharedPreferences prefs;
   const HomeScreen({super.key, required this.prefs});
@@ -45,8 +52,7 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
   late AnimationController _pulseController;
   late AnimationController _spinController;
 
-  bool _isCheckingPing = false;
-  String _pingText = 'Target Ping: -- ms';
+  String _pingText = '-- ms';
   Color _pingColor = Colors.white54;
 
   @override
@@ -420,8 +426,8 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
                 _prevBytesSent = bytesSent;
                 _downSpeed = '${_formatBytes(dRecv)}/s';
                 _upSpeed = '${_formatBytes(dSent)}/s';
-                if (rttMs > 0 && !_isCheckingPing) {
-                  _pingText = 'Server Ping: $rttMs ms';
+                if (rttMs > 0) {
+                  _pingText = '$rttMs ms';
                   if (rttMs < 100) {
                     _pingColor = const Color(0xFF22D3A5);
                   } else if (rttMs < 250) {
@@ -447,47 +453,6 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
     return '${(bytes / (1024 * 1024 * 1024)).toStringAsFixed(1)} GB';
   }
 
-  Future<void> _checkConnectionLatency() async {
-    if (_state != ConnectionStateEnum.connected) return;
-
-    setState(() {
-      _isCheckingPing = true;
-      _pingText = 'Updating...';
-      _pingColor = Colors.white70;
-    });
-
-    try {
-      final metricsJson = await platform.invokeMethod('getMetrics');
-      if (metricsJson != null && metricsJson.isNotEmpty) {
-        final Map<String, dynamic> parsed = jsonDecode(metricsJson);
-        final rttMs = parsed['rtt_ms'] as int? ?? 0;
-        if (mounted) {
-          setState(() {
-            if (rttMs > 0) {
-              _pingText = 'Server Ping: $rttMs ms';
-              _pingColor = rttMs < 100
-                  ? const Color(0xFF22D3A5)
-                  : rttMs < 250
-                      ? Colors.amberAccent
-                      : Colors.redAccent;
-            } else {
-              _pingText = 'Server Ping: -- ms';
-              _pingColor = Colors.white54;
-            }
-          });
-        }
-      }
-    } catch (e) {
-      debugPrint("Failed to check latency: $e");
-    }
-
-    if (mounted) {
-      setState(() {
-        _isCheckingPing = false;
-      });
-    }
-  }
-
   void _setDisconnected() {
     if (!mounted) return;
     setState(() {
@@ -498,9 +463,8 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
       _upSpeed = '0 B/s';
       _prevBytesRecv = 0;
       _prevBytesSent = 0;
-      _pingText = 'Target Ping: -- ms';
+      _pingText = '-- ms';
       _pingColor = Colors.white54;
-      _isCheckingPing = false;
     });
     _pulseController.stop();
     _pulseController.value = 0.0;
@@ -578,12 +542,12 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
                 decoration: BoxDecoration(
                   borderRadius: BorderRadius.circular(4),
                   color: _state == ConnectionStateEnum.connected
-                      ? theme.colorScheme.secondary
+                      ? kConnectedGreen
                       : theme.colorScheme.primary,
                   boxShadow: [
                     BoxShadow(
                       color: _state == ConnectionStateEnum.connected
-                          ? theme.colorScheme.secondary.withOpacity(0.5)
+                          ? kConnectedGreen.withOpacity(0.5)
                           : theme.colorScheme.primary.withOpacity(0.5),
                       blurRadius: 10,
                     )
@@ -637,7 +601,7 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
 
   Widget _buildStage(ThemeData theme) {
     Color getAccentColor() {
-      if (_state == ConnectionStateEnum.connected) return theme.colorScheme.secondary;
+      if (_state == ConnectionStateEnum.connected) return kConnectedGreen;
       return theme.colorScheme.primary;
     }
 
@@ -775,67 +739,27 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
           opacity: _state == ConnectionStateEnum.connected ? 1.0 : 0.0,
           duration: const Duration(milliseconds: 300),
           child: Padding(
-            padding: const EdgeInsets.only(top: 16),
+            padding: const EdgeInsets.only(top: 10),
             child: Container(
-              margin: const EdgeInsets.symmetric(horizontal: 16),
-              padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 12),
+              padding: const EdgeInsets.symmetric(horizontal: 12, vertical: 6),
               decoration: BoxDecoration(
                 color: Colors.white.withOpacity(0.03),
-                borderRadius: BorderRadius.circular(20),
+                borderRadius: BorderRadius.circular(12),
                 border: Border.all(color: Colors.white.withOpacity(0.06)),
               ),
               child: Row(
-                mainAxisAlignment: MainAxisAlignment.spaceBetween,
+                mainAxisSize: MainAxisSize.min,
                 children: [
-                  Expanded(
-                    child: Column(
-                      crossAxisAlignment: CrossAxisAlignment.start,
-                      children: [
-                        const Text(
-                          'CONNECTION TEST',
-                          style: TextStyle(
-                            fontSize: 10,
-                            fontWeight: FontWeight.bold,
-                            color: Colors.white38,
-                            letterSpacing: 0.8,
-                          ),
-                        ),
-                        const SizedBox(height: 4),
-                        Text(
-                          _pingText,
-                          overflow: TextOverflow.ellipsis,
-                          style: TextStyle(
-                            fontSize: 15,
-                            fontWeight: FontWeight.bold,
-                            color: _pingColor,
-                          ),
-                        ),
-                      ],
+                  Icon(Icons.speed_rounded, size: 13, color: _pingColor),
+                  const SizedBox(width: 6),
+                  Text(
+                    _pingText,
+                    style: TextStyle(
+                      fontSize: 13,
+                      fontWeight: FontWeight.bold,
+                      color: _pingColor,
                     ),
                   ),
-                  const SizedBox(width: 8),
-                  _isCheckingPing
-                      ? const SizedBox(
-                          width: 20, height: 20,
-                          child: CircularProgressIndicator(strokeWidth: 2, color: Colors.white70),
-                        )
-                      : TextButton.icon(
-                          onPressed: _checkConnectionLatency,
-                          icon: Icon(Icons.speed_rounded, size: 16, color: theme.colorScheme.primary),
-                          label: Text(
-                            'Test Ping',
-                            style: TextStyle(
-                              fontWeight: FontWeight.bold,
-                              fontSize: 13,
-                              color: theme.colorScheme.primary,
-                            ),
-                          ),
-                          style: TextButton.styleFrom(
-                            padding: const EdgeInsets.symmetric(horizontal: 12, vertical: 8),
-                            backgroundColor: theme.colorScheme.primary.withOpacity(0.1),
-                            shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(12)),
-                          ),
-                        ),
                 ],
               ),
             ),

ostp-flutter/pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 0.4.2+21
+version: 0.4.4+31
 
 environment:
   sdk: ^3.11.4

ostp-gui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ostp-gui",
   "private": true,
-  "version": "0.4.2",
+  "version": "0.4.4",
   "type": "module",
   "scripts": {
     "tauri": "tauri",

ostp-gui/src-tauri/Cargo.lock

@@ -2665,7 +2665,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-client"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -2696,7 +2696,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-core"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "bytes",
@@ -2713,7 +2713,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-gui"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "json_comments",
@@ -2733,7 +2733,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "libc",

ostp-gui/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ostp-gui"
-version = "0.4.2"
+version = "0.4.4"
 description = "OSTP desktop GUI"
 authors = ["ospab"]
 edition = "2021"

ostp-gui/src-tauri/src/lib.rs

@@ -204,19 +204,34 @@ fn get_wintun_install_path() -> String {
     String::new()
 }
 
+/// A `Command` for a console program, with the console window suppressed.
+///
+/// The GUI is a windowed-subsystem binary, so every console child it spawns
+/// pops up a console window for as long as that child runs. With `reg`,
+/// `tasklist` and `schtasks` all being invoked from here, that surfaced as
+/// windows flashing on screen — worst while polling for the scheduled task,
+/// which could spawn twenty of them in a row.
+#[cfg(target_os = "windows")]
+fn quiet_command(program: &str) -> std::process::Command {
+    use std::os::windows::process::CommandExt;
+    const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+    let mut cmd = std::process::Command::new(program);
+    cmd.creation_flags(CREATE_NO_WINDOW);
+    cmd
+}
+
 /// Sets or removes the app from Windows startup (HKCU\...\Run).
 #[tauri::command]
 fn set_autostart(enable: bool) -> Result<(), String> {
     #[cfg(target_os = "windows")]
     {
-        use std::process::Command;
         let key = r"HKCU\Software\Microsoft\Windows\CurrentVersion\Run";
         let app_name = "OSTP";
         if enable {
             let exe = std::env::current_exe()
                 .map_err(|e| format!("Cannot get exe path: {}", e))?;
             let exe_str = format!("\"{}\"", exe.to_string_lossy());
-            let out = Command::new("reg")
+            let out = quiet_command("reg")
                 .args(["add", key, "/v", app_name, "/t", "REG_SZ", "/d", &exe_str, "/f"])
                 .output()
                 .map_err(|e| format!("reg add failed: {}", e))?;
@@ -224,28 +239,71 @@ fn set_autostart(enable: bool) -> Result<(), String> {
                 return Err(String::from_utf8_lossy(&out.stderr).to_string());
             }
         } else {
-            let _ = Command::new("reg")
+            let _ = quiet_command("reg")
                 .args(["delete", key, "/v", app_name, "/f"])
                 .output();
         }
     }
+    #[cfg(target_os = "linux")]
+    {
+        // XDG autostart: desktop environments launch every .desktop file in
+        // ~/.config/autostart on login. This is the portable equivalent of the
+        // HKCU Run key above and needs no elevation.
+        let path = linux_autostart_path().ok_or("Cannot determine the autostart directory")?;
+        if enable {
+            let exe = std::env::current_exe().map_err(|e| format!("Cannot get exe path: {}", e))?;
+            if let Some(dir) = path.parent() {
+                std::fs::create_dir_all(dir)
+                    .map_err(|e| format!("Cannot create {}: {}", dir.display(), e))?;
+            }
+            let entry = format!(
+                "[Desktop Entry]\n\
+                 Type=Application\n\
+                 Name=OSTP\n\
+                 Exec=\"{}\"\n\
+                 Terminal=false\n\
+                 X-GNOME-Autostart-enabled=true\n",
+                exe.display()
+            );
+            std::fs::write(&path, entry)
+                .map_err(|e| format!("Cannot write {}: {}", path.display(), e))?;
+        } else if path.exists() {
+            std::fs::remove_file(&path)
+                .map_err(|e| format!("Cannot remove {}: {}", path.display(), e))?;
+        }
+    }
     Ok(())
 }
 
+/// Path of the XDG autostart entry, honouring XDG_CONFIG_HOME.
+#[cfg(target_os = "linux")]
+fn linux_autostart_path() -> Option<PathBuf> {
+    let base = std::env::var_os("XDG_CONFIG_HOME")
+        .map(PathBuf::from)
+        .filter(|p| !p.as_os_str().is_empty())
+        .or_else(|| std::env::var_os("HOME").map(|h| PathBuf::from(h).join(".config")))?;
+    Some(base.join("autostart").join("ostp.desktop"))
+}
+
 /// Checks if the app is currently in Windows startup.
 #[tauri::command]
 fn get_autostart() -> bool {
     #[cfg(target_os = "windows")]
     {
-        use std::process::Command;
         let key = r"HKCU\Software\Microsoft\Windows\CurrentVersion\Run";
-        let out = Command::new("reg")
+        let out = quiet_command("reg")
             .args(["query", key, "/v", "OSTP"])
             .output();
         if let Ok(o) = out {
             return o.status.success();
         }
     }
+    #[cfg(target_os = "linux")]
+    {
+        if let Some(path) = linux_autostart_path() {
+            return path.exists();
+        }
+    }
     false
 }
 
@@ -254,8 +312,7 @@ fn get_autostart() -> bool {
 fn list_running_processes() -> Vec<String> {
     #[cfg(target_os = "windows")]
     {
-        use std::process::Command;
-        if let Ok(out) = Command::new("tasklist")
+        if let Ok(out) = quiet_command("tasklist")
             .args(["/FO", "CSV", "/NH"])
             .output()
         {
@@ -625,13 +682,18 @@ async fn start_tun_via_helper(
     raw: &ClientConfigRaw,
     app: tauri::AppHandle,
 ) -> Result<bool, String> {
+    // TUN goes through a privileged helper. Elevation is implemented for
+    // Windows (UAC) and Linux (polkit/pkexec); anywhere else launch_as_admin
+    // reports that plainly rather than letting this fail later as a confusing
+    // missing-file error.
     let port = {
         let listener = std::net::TcpListener::bind("127.0.0.1:0").map_err(|e| format!("Bind error: {}", e))?;
         listener.local_addr().unwrap().port()
     };
 
     let auth_token = rand::random::<u64>().to_string();
-    let helper_exe = find_helper_exe().ok_or_else(|| "ostp-tun-helper.exe not found.".to_string())?;
+    let helper_exe = find_helper_exe()
+        .ok_or_else(|| format!("{HELPER_EXE_NAME} not found next to the app or in target/."))?;
     launch_as_admin(&helper_exe, &auth_token, port).map_err(|e| format!("Failed to launch helper: {}", e))?;
     tokio::time::sleep(std::time::Duration::from_millis(1500)).await;
 
@@ -705,21 +767,32 @@ struct HelperPipeState {
     error_msg: Option<String>,
 }
 
+/// Executable name of the TUN helper for the current platform.
+///
+/// The ".exe" suffix was hardcoded, so on Linux every lookup below searched for
+/// a file that cannot exist and the GUI reported the helper as missing on a
+/// platform where it ships without an extension.
+const HELPER_EXE_NAME: &str = if cfg!(windows) {
+    "ostp-tun-helper.exe"
+} else {
+    "ostp-tun-helper"
+};
+
 fn find_helper_exe() -> Option<PathBuf> {
     if let Ok(exe) = std::env::current_exe() {
         if let Some(dir) = exe.parent() {
             // 1. Release/Production adjacent
-            let candidate = dir.join("ostp-tun-helper.exe");
+            let candidate = dir.join(HELPER_EXE_NAME);
             if candidate.exists() { return Some(candidate); }
-            
+
             // 2. Tauri target directory fallback
             // e.g. from ostp-gui/src-tauri/target/debug/deps/
             let mut parent = dir;
             while let Some(p) = parent.parent() {
                 if p.file_name().map(|n| n == "target").unwrap_or(false) {
-                    let deb = p.join("debug").join("ostp-tun-helper.exe");
+                    let deb = p.join("debug").join(HELPER_EXE_NAME);
                     if deb.exists() { return Some(deb); }
-                    let rel = p.join("release").join("ostp-tun-helper.exe");
+                    let rel = p.join("release").join(HELPER_EXE_NAME);
                     if rel.exists() { return Some(rel); }
                 }
                 parent = p;
@@ -729,13 +802,13 @@ fn find_helper_exe() -> Option<PathBuf> {
     // 3. Current working directory target fallback
     let cwd = std::env::current_dir().unwrap_or_default();
     let candidates = [
-        cwd.join("ostp-tun-helper.exe"),
-        cwd.join("target").join("debug").join("ostp-tun-helper.exe"),
-        cwd.join("target").join("release").join("ostp-tun-helper.exe"),
-        cwd.join("..").join("target").join("debug").join("ostp-tun-helper.exe"),
-        cwd.join("..").join("target").join("release").join("ostp-tun-helper.exe"),
-        cwd.join("..").join("..").join("target").join("debug").join("ostp-tun-helper.exe"),
-        cwd.join("..").join("..").join("target").join("release").join("ostp-tun-helper.exe"),
+        cwd.join(HELPER_EXE_NAME),
+        cwd.join("target").join("debug").join(HELPER_EXE_NAME),
+        cwd.join("target").join("release").join(HELPER_EXE_NAME),
+        cwd.join("..").join("target").join("debug").join(HELPER_EXE_NAME),
+        cwd.join("..").join("target").join("release").join(HELPER_EXE_NAME),
+        cwd.join("..").join("..").join("target").join("debug").join(HELPER_EXE_NAME),
+        cwd.join("..").join("..").join("target").join("release").join(HELPER_EXE_NAME),
     ];
     for path in &candidates {
         if path.exists() { return Some(path.clone()); }
@@ -743,8 +816,272 @@ fn find_helper_exe() -> Option<PathBuf> {
     None
 }
 
+/// Name of the Scheduled Task that runs the helper elevated without a prompt.
+#[cfg(target_os = "windows")]
+const HELPER_TASK_NAME: &str = "OSTP TUN Helper";
+
+/// Fixed path the GUI writes launch parameters to, and the task's command line
+/// reads them from.
+///
+/// A Scheduled Task stores a FIXED command line, so the per-launch port and
+/// token cannot travel as arguments. The file lives under the user's own
+/// LOCALAPPDATA: the helper runs elevated but as the SAME user, so this keeps
+/// the token inside the trust boundary it already had — no other user can read
+/// it, which would not be true of a shared location.
+#[cfg(target_os = "windows")]
+fn helper_args_file() -> PathBuf {
+    let base = std::env::var_os("LOCALAPPDATA")
+        .map(PathBuf::from)
+        .unwrap_or_else(std::env::temp_dir);
+    base.join("OSTP").join("helper-args.json")
+}
+
+/// Minimal XML text escaping for the values interpolated into the task
+/// definition. Paths and usernames are attacker-irrelevant here but can easily
+/// contain `&`, which would otherwise produce invalid XML and a confusing
+/// schtasks parse failure.
+#[cfg(target_os = "windows")]
+fn xml_escape(s: &str) -> String {
+    s.replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+        .replace('\'', "&apos;")
+}
+
+/// Reverse of [`xml_escape`]. `&amp;` must be undone last or `&amp;lt;` would
+/// come back as `<`.
+#[cfg(target_os = "windows")]
+fn xml_unescape(s: &str) -> String {
+    s.replace("&quot;", "\"")
+        .replace("&apos;", "'")
+        .replace("&lt;", "<")
+        .replace("&gt;", ">")
+        .replace("&amp;", "&")
+}
+
+/// The exe path currently baked into the registered task, if any.
+///
+/// Queried as XML rather than `/FO LIST /V`: the list format's field labels are
+/// localized (on a Russian Windows "Task To Run" is "Задача для запуска"),
+/// whereas XML tag names are fixed. schtasks writes UTF-16LE with a BOM here,
+/// but tolerate UTF-8 in case that ever changes.
+#[cfg(target_os = "windows")]
+fn helper_task_command() -> Option<String> {
+    let out = quiet_command("schtasks")
+        .args(["/Query", "/TN", HELPER_TASK_NAME, "/XML"])
+        .output()
+        .ok()?;
+    if !out.status.success() {
+        return None;
+    }
+
+    let text = if out.stdout.starts_with(&[0xFF, 0xFE]) {
+        let units: Vec<u16> = out.stdout[2..]
+            .chunks_exact(2)
+            .map(|c| u16::from_le_bytes([c[0], c[1]]))
+            .collect();
+        String::from_utf16_lossy(&units)
+    } else {
+        String::from_utf8_lossy(&out.stdout).into_owned()
+    };
+
+    let start = text.find("<Command>")? + "<Command>".len();
+    let end = text[start..].find("</Command>")? + start;
+    Some(xml_unescape(text[start..end].trim()))
+}
+
+/// Whether a task is registered AND still points at the exe we are about to run.
+///
+/// The path matters as much as the name. A task registered by a dev build (or
+/// by an install that has since moved) keeps its original `<Command>`, and
+/// `schtasks /Run` reports success merely for *accepting* the request — a task
+/// whose exe no longer exists fails asynchronously and silently. Trusting the
+/// name alone therefore bought a 60-second "Timeout connecting to helper" on
+/// every single connect, permanently, until the task was deleted by hand.
+/// Re-registering costs one consent prompt and fixes it for good.
+#[cfg(target_os = "windows")]
+fn helper_task_matches(exe: &std::path::Path) -> bool {
+    let Some(registered) = helper_task_command() else {
+        return false;
+    };
+    let registered = registered.trim().trim_matches('"');
+
+    // Canonicalize both sides when possible so `..`, short 8.3 names and
+    // casing differences do not read as a mismatch. A missing file cannot be
+    // canonicalized — which is itself a mismatch worth re-registering over.
+    match (
+        std::fs::canonicalize(registered),
+        std::fs::canonicalize(exe),
+    ) {
+        (Ok(a), Ok(b)) => a == b,
+        _ => registered.eq_ignore_ascii_case(&exe.display().to_string()),
+    }
+}
+
+/// Register the Scheduled Task. This is the ONLY step that needs elevation, and
+/// it happens once per machine; every later tunnel start reuses the task.
+///
+/// RunLevel=HIGHEST makes the task run elevated, and because a task launch is
+/// not an elevation request, Windows shows no consent dialog for it.
+#[cfg(target_os = "windows")]
+fn install_helper_task(exe: &std::path::Path) -> anyhow::Result<()> {
+    let args_file = helper_args_file();
+    if let Some(dir) = args_file.parent() {
+        std::fs::create_dir_all(dir)?;
+    }
+
+    // Register from an XML definition rather than /TR. The command line would
+    // otherwise need the exe path and the args path quoted INSIDE an already
+    // quoted /TR value, escaped again through ShellExecuteW — a notoriously
+    // brittle chain when either path contains a space, which both of these do
+    // by default (Program Files, and usernames with spaces). XML also lets the
+    // battery and time-limit settings below be stated explicitly.
+    let user = format!(
+        "{}\\{}",
+        std::env::var("USERDOMAIN").unwrap_or_else(|_| "%COMPUTERNAME%".into()),
+        std::env::var("USERNAME").unwrap_or_default()
+    );
+    let xml = format!(
+        r#"<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>Runs the OSTP TUN helper elevated so enabling the tunnel does not prompt for consent every time.</Description>
+  </RegistrationInfo>
+  <Principals>
+    <Principal id="Author">
+      <UserId>{user}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>HighestAvailable</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <StartWhenAvailable>false</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Enabled>true</Enabled>
+    <Hidden>false</Hidden>
+    <AllowHardTerminate>true</AllowHardTerminate>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>{exe}</Command>
+      <Arguments>--args-file "{args}"</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+"#,
+        user = xml_escape(&user),
+        exe = xml_escape(&exe.display().to_string()),
+        args = xml_escape(&args_file.display().to_string()),
+    );
+
+    // schtasks /Create /XML expects UTF-16LE with a BOM.
+    let xml_path = std::env::temp_dir().join(format!("ostp_task_{}.xml", rand::random::<u32>()));
+    let mut utf16: Vec<u8> = vec![0xFF, 0xFE];
+    for unit in xml.encode_utf16() {
+        utf16.extend_from_slice(&unit.to_le_bytes());
+    }
+    std::fs::write(&xml_path, &utf16)?;
+
+    // Registering a HighestAvailable task is itself privileged: this is the one
+    // prompt, and it happens once per machine.
+    //
+    // Elevate through PowerShell's Start-Process -Wait rather than
+    // ShellExecuteW. ShellExecuteW returns as soon as the elevated process is
+    // LAUNCHED, so the XML below was being deleted while schtasks was still
+    // starting up — registration then failed, leaving the user with a consent
+    // prompt that accomplished nothing, followed by a second prompt from the
+    // fallback path. -Wait makes the deletion safe and lets the exit code be
+    // checked instead of guessed at by polling.
+    //
+    // ArgumentList takes an array, so the task name and XML path never need
+    // quoting or escaping through a command line, only PowerShell's own
+    // single-quote doubling.
+    let ps = format!(
+        "$p = Start-Process -FilePath 'schtasks.exe' -Verb RunAs -Wait -PassThru \
+         -WindowStyle Hidden -ArgumentList @('/Create','/TN','{}','/XML','{}','/F'); \
+         exit $p.ExitCode",
+        ps_quote(HELPER_TASK_NAME),
+        ps_quote(&xml_path.display().to_string()),
+    );
+
+    let status = quiet_command("powershell")
+        .args(["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", &ps])
+        .status();
+
+    // schtasks has exited by now, so this is safe.
+    let _ = std::fs::remove_file(&xml_path);
+
+    match status {
+        Ok(s) if s.success() => {}
+        Ok(s) => anyhow::bail!(
+            "registering the scheduled task failed (exit code {:?}). A declined consent prompt \
+             reports 1223.",
+            s.code()
+        ),
+        Err(e) => anyhow::bail!("could not run powershell to register the task: {e}"),
+    }
+
+    if helper_task_matches(exe) {
+        Ok(())
+    } else {
+        anyhow::bail!("schtasks reported success but the task does not point at {}", exe.display())
+    }
+}
+
+/// Escape a value for embedding in a PowerShell single-quoted string.
+#[cfg(target_os = "windows")]
+fn ps_quote(s: &str) -> String {
+    s.replace('\'', "''")
+}
+
 #[cfg(target_os = "windows")]
 fn launch_as_admin(exe: &std::path::PathBuf, token: &str, port: u16) -> anyhow::Result<()> {
+    // Preferred path: hand the parameters over in a file and trigger the
+    // pre-registered task, which runs elevated with no prompt. Falls back to a
+    // direct elevated launch when the task is absent (first ever run, or the
+    // user removed it) — and that first run is also where the task gets created,
+    // so the prompt appears once rather than on every connect.
+    let args_file = helper_args_file();
+    if let Some(dir) = args_file.parent() {
+        let _ = std::fs::create_dir_all(dir);
+    }
+    let payload = serde_json::json!({ "port": port, "token": token });
+    let wrote_args = std::fs::write(&args_file, payload.to_string()).is_ok();
+
+    if wrote_args {
+        if !helper_task_matches(exe) {
+            if let Err(e) = install_helper_task(exe) {
+                eprintln!("[OSTP] could not register the helper task ({e}); falling back to a direct elevated launch");
+            }
+        }
+        if helper_task_matches(exe) {
+            let run = quiet_command("schtasks")
+                .args(["/Run", "/TN", HELPER_TASK_NAME])
+                .output();
+            match run {
+                Ok(o) if o.status.success() => return Ok(()),
+                Ok(o) => eprintln!(
+                    "[OSTP] schtasks /Run failed: {}",
+                    String::from_utf8_lossy(&o.stderr).trim()
+                ),
+                Err(e) => eprintln!("[OSTP] schtasks /Run could not start: {e}"),
+            }
+        }
+        // Falling through: remove the file so a stale token is not left behind.
+        let _ = std::fs::remove_file(&args_file);
+    }
+
+    launch_as_admin_direct(exe, token, port)
+}
+
+/// The original one-prompt-per-launch path, kept as the fallback.
+#[cfg(target_os = "windows")]
+fn launch_as_admin_direct(exe: &std::path::PathBuf, token: &str, port: u16) -> anyhow::Result<()> {
     use std::ffi::OsStr;
     use std::os::windows::ffi::OsStrExt;
     use std::ptr::null_mut;
@@ -797,8 +1134,50 @@ fn launch_as_admin(exe: &std::path::PathBuf, token: &str, port: u16) -> anyhow::
     Ok(())
 }
 
-#[cfg(not(target_os = "windows"))]
-fn launch_as_admin(_exe: &PathBuf, _token: &str, _port: u16) -> Result<()> { anyhow::bail!("Windows only."); }
+#[cfg(target_os = "linux")]
+fn launch_as_admin(exe: &PathBuf, token: &str, port: u16) -> Result<()> {
+    use std::os::unix::fs::PermissionsExt;
+    use std::process::Command;
+
+    // Same shape as the Windows path: the token goes through a file rather than
+    // argv, so it never shows up in the process list.
+    let token_file = std::env::temp_dir().join(format!("ostp_auth_{}.tmp", rand::random::<u32>()));
+    std::fs::write(&token_file, token)?;
+    // Unlike Windows, /tmp is world-readable here, and this token authenticates
+    // control of the privileged tunnel helper — restrict it to the owner.
+    let _ = std::fs::set_permissions(&token_file, std::fs::Permissions::from_mode(0o600));
+
+    // pkexec is polkit's front-end: in a desktop session it raises a graphical
+    // authentication dialog. sudo is not an option from a GUI process, which has
+    // no terminal to prompt on.
+    match Command::new("pkexec")
+        .arg(exe)
+        .arg("--port")
+        .arg(port.to_string())
+        .arg("--token-file")
+        .arg(&token_file)
+        .spawn()
+    {
+        Ok(_) => Ok(()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+            let _ = std::fs::remove_file(&token_file);
+            anyhow::bail!(
+                "pkexec was not found, so the TUN helper cannot be granted the privileges it \
+                 needs. Install polkit (package \"policykit-1\" on Debian/Ubuntu, \"polkit\" on \
+                 Fedora/Arch), or use proxy mode, which needs no elevation."
+            )
+        }
+        Err(e) => {
+            let _ = std::fs::remove_file(&token_file);
+            Err(e.into())
+        }
+    }
+}
+
+#[cfg(not(any(target_os = "windows", target_os = "linux")))]
+fn launch_as_admin(_exe: &PathBuf, _token: &str, _port: u16) -> Result<()> {
+    anyhow::bail!("TUN mode needs a privileged helper, which is implemented on Windows and Linux only. Use proxy mode on this platform.");
+}
 
 #[cfg(target_os = "windows")]
 fn show_error_dialog(msg: &str) {

ostp-gui/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ostp-gui",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "identifier": "com.ospab.ostp",
   "build": {
     "frontendDist": "../src"
@@ -11,9 +11,11 @@
     "windows": [
       {
         "title": "OSTP",
-        "width": 360,
-        "height": 680,
-        "resizable": false
+        "width": 400,
+        "height": 720,
+        "minWidth": 360,
+        "minHeight": 560,
+        "resizable": true
       }
     ],
     "security": {

ostp-gui/src/main.js

@@ -660,6 +660,13 @@ function loadSettingsIntoForm() {
   updateClientVisibility();
 }
 
+// Last values actually pushed to the OS / backend, so repeated saves that did
+// not change them stay free. Undefined until the first save, which is correct:
+// the first one should apply.
+let lastAppliedAutostart;
+let lastAppliedTunnelConfig;
+let hotReloadTimer;
+
 function collectAndSaveSettings() {
   const s = {
     tun:          inTun.checked,
@@ -686,19 +693,41 @@ function collectAndSaveSettings() {
     fragChunk:    parseInt(inFragChunk.value) || 2,
     fragSleep:    !isNaN(parseInt(inFragSleep.value)) ? parseInt(inFragSleep.value) : 2,
   };
+  // Cheap and local: safe to run on every debounced keystroke.
   saveClientSettings(s);
   updateClientVisibility();
 
-  // Set autostart
-  invoke('set_autostart', { enable: s.launchStartup }).catch(() => {});
+  // Everything below talks to the OS or restarts the tunnel. Running it per
+  // keystroke is what made typing in the exclusion fields lag by seconds: the
+  // 400ms debounce fires during natural pauses in typing, and each firing hit
+  // the Windows registry and then tore down and rebuilt the tunnel.
 
-  // Hot-reload exclusions if connected
+  // Only touch autostart when it actually changed — this is a registry write.
+  if (s.launchStartup !== lastAppliedAutostart) {
+    lastAppliedAutostart = s.launchStartup;
+    invoke('set_autostart', { enable: s.launchStartup }).catch(() => {});
+  }
+
+  // Hot-reload the tunnel only when something it actually reads has changed,
+  // and on a much longer debounce: a reload is disruptive, so it should land
+  // once the user has stopped editing rather than between keystrokes.
   if (appState === 'connected') {
-    const cfg = buildConfig();
-    if (cfg) {
-      invoke('save_config', { jsonContent: JSON.stringify(cfg, null, 2) })
-        .then(() => invoke('reload_tunnel'))
-        .catch(() => {});
+    const tunnelRelevant = JSON.stringify([
+      s.tun, s.killSwitch, s.mux, s.muxSessions, s.mtu, s.dns, s.socks,
+      s.exDomains, s.exIps, s.exProcs, s.junkEnabled, s.junkPcMin, s.junkPcMax,
+      s.junkPsMin, s.junkPsMax, s.tcpFrag, s.fragChunk, s.fragSleep,
+    ]);
+    if (tunnelRelevant !== lastAppliedTunnelConfig) {
+      clearTimeout(hotReloadTimer);
+      hotReloadTimer = setTimeout(() => {
+        lastAppliedTunnelConfig = tunnelRelevant;
+        const cfg = buildConfig();
+        if (cfg) {
+          invoke('save_config', { jsonContent: JSON.stringify(cfg, null, 2) })
+            .then(() => invoke('reload_tunnel'))
+            .catch(() => {});
+        }
+      }, 1500);
     }
   }
 }

ostp-gui/src/styles.css

@@ -17,10 +17,12 @@
   --c-accent-dim:  rgba(var(--c-fg-rgb),0.08);
   --c-accent-glow: rgba(var(--c-fg-rgb),0.18);
 
-  /* Green only for "connected" state */
-  --c-green:       #e8e8e8;
-  --c-green-glow:  rgba(232,232,232,0.25);
-  --c-green-dim:   rgba(232,232,232,0.07);
+  /* Green only for "connected" state — the one deliberate break from the
+     monochrome palette, so a successful connection reads at a glance. */
+  --c-green-rgb:   46, 230, 109;
+  --c-green:       #2ee66d;
+  --c-green-glow:  rgba(var(--c-green-rgb),0.28);
+  --c-green-dim:   rgba(var(--c-green-rgb),0.09);
 
   --c-red:         #ff5f5f;
   --c-amber:       #f0b840;
@@ -55,9 +57,11 @@
   --c-accent:      #18181b;
   --c-accent-dim:  rgba(0,0,0,0.08);
   --c-accent-glow: rgba(0,0,0,0.14);
-  --c-green:       #18181b;
-  --c-green-glow:  rgba(0,0,0,0.16);
-  --c-green-dim:   rgba(0,0,0,0.05);
+  /* Deeper green so it stays legible against the light background. */
+  --c-green-rgb:   22, 163, 74;
+  --c-green:       #16a34a;
+  --c-green-glow:  rgba(var(--c-green-rgb),0.22);
+  --c-green-dim:   rgba(var(--c-green-rgb),0.08);
   --c-red:         #dc2626;
   --c-amber:       #d97706;
   --c-txt-1:       #18181b;
@@ -95,6 +99,13 @@ a { text-decoration: none; }
 .app-root {
   position: relative;
   width: 100%;
+  /* The window is resizable so users on desktops where the toolkit does not
+     apply our DPI scaling (WebKitGTK on HiDPI Linux renders the configured
+     size as raw pixels, giving a postage-stamp window) can size it themselves.
+     Capping and centring the column keeps the intended narrow layout instead of
+     stretching controls across a wide window. */
+  max-width: 460px;
+  margin: 0 auto;
   height: 100%;
   display: flex;
   flex-direction: column;
@@ -155,7 +166,7 @@ a { text-decoration: none; }
   transition: background var(--t-med), box-shadow var(--t-med);
 }
 .brand-dot.connecting { animation: dot-blink 1.4s infinite ease-in-out; background: var(--c-accent); }
-.brand-dot.connected  { background: var(--c-accent); box-shadow: 0 0 10px var(--c-accent-glow); }
+.brand-dot.connected  { background: var(--c-green); box-shadow: 0 0 10px var(--c-green-glow); }
 
 @keyframes dot-blink {
   0%,100% { opacity: 1; }
@@ -233,11 +244,11 @@ a { text-decoration: none; }
 
 .orbit-wrap.connected .orbit {
   animation: orbit-spin 4s linear infinite;
-  border-color: rgba(var(--c-fg-rgb),0.14);
+  border-color: rgba(var(--c-green-rgb),0.30);
   opacity: 1;
 }
-.orbit-wrap.connected .orbit-2 { animation-duration: 6s; animation-direction: reverse; border-color: rgba(var(--c-fg-rgb),0.08); }
-.orbit-wrap.connected .orbit-3 { animation-duration: 9s; border-color: rgba(var(--c-fg-rgb),0.04); }
+.orbit-wrap.connected .orbit-2 { animation-duration: 6s; animation-direction: reverse; border-color: rgba(var(--c-green-rgb),0.18); }
+.orbit-wrap.connected .orbit-3 { animation-duration: 9s; border-color: rgba(var(--c-green-rgb),0.10); }
 
 @keyframes orbit-spin {
   from { transform: rotate(0deg); }
@@ -270,9 +281,9 @@ a { text-decoration: none; }
   animation: btn-breathe 2s infinite ease-in-out;
 }
 .power-btn.connected {
-  border-color: rgba(var(--c-fg-rgb),0.8);
-  color: var(--c-txt-1);
-  box-shadow: 0 0 0 8px rgba(var(--c-fg-rgb),0.04), 0 0 50px rgba(var(--c-fg-rgb),0.12), 0 8px 32px rgba(0,0,0,0.5);
+  border-color: var(--c-green);
+  color: var(--c-green);
+  box-shadow: 0 0 0 8px var(--c-green-dim), 0 0 50px var(--c-green-glow), 0 8px 32px rgba(0,0,0,0.5);
 }
 .power-btn.error {
   border-color: var(--c-red);

ostp-server/Cargo.toml

@@ -31,3 +31,4 @@ hex = "0.4.3"
 chacha20poly1305.workspace = true
 x25519-dalek = { version = "2.0.1", features = ["static_secrets"] }
 chrono = "0.4.44"
+subtle = "2.6"

ostp-server/src/api.rs

@@ -318,6 +318,18 @@ pub async fn start_api_server(
 
 // ── Middleware: token check ──────────────────────────────────────────────────
 
+/// Constant-time string equality for secrets (tokens, password hashes).
+/// Plain `==` short-circuits on the first differing byte, which leaks how
+/// many leading bytes an attacker's guess got right through response
+/// timing - a classic remote timing side-channel against exactly the kind
+/// of long-lived bearer/session secrets compared here. `subtle` is already
+/// pulled in transitively (chacha20poly1305 etc.); pinning it as a direct
+/// dependency here makes that guarantee explicit for this call site.
+fn secure_eq(a: &str, b: &str) -> bool {
+    use subtle::ConstantTimeEq;
+    a.as_bytes().ct_eq(b.as_bytes()).into()
+}
+
 fn check_token(state: &ApiState, headers: &axum::http::HeaderMap) -> bool {
     // Both session token (for web UI) and static API token (for relays) are checked
     let mut allowed = false;
@@ -332,19 +344,19 @@ fn check_token(state: &ApiState, headers: &axum::http::HeaderMap) -> bool {
             if let Some(token) = val.strip_prefix("Bearer ") {
                 let current_session = state.session_token.read().unwrap_or_else(|e| e.into_inner()).clone();
                 if let Some(session) = current_session {
-                    if token == session {
+                    if secure_eq(token, &session) {
                         allowed = true;
                     }
                 }
-                
+
                 if let Some(ref api_tok) = state.api_token {
-                    if token == api_tok {
+                    if secure_eq(token, api_tok) {
                         allowed = true;
                     }
                 }
             } else {
                 if let Some(ref api_tok) = state.api_token {
-                    if val == api_tok {
+                    if secure_eq(val, api_tok) {
                         allowed = true;
                     }
                 }
@@ -371,7 +383,7 @@ async fn handle_login(
     let hash = sha2::Sha256::digest(password.as_bytes());
     let hash_hex = format!("{:x}", hash);
 
-    if hash_hex == state.password_hash {
+    if secure_eq(&hash_hex, &state.password_hash) {
         let token = uuid::Uuid::new_v4().to_string();
         *state.session_token.write().unwrap_or_else(|e| e.into_inner()) = Some(token.clone());
         (StatusCode::OK, ApiResponse::success(LoginResponse { token }))
@@ -881,15 +893,91 @@ mod tests {
         let state = make_test_state("");
         let _router = create_api_router(state);
     }
+
+    #[test]
+    fn test_secure_eq_matches_and_rejects() {
+        assert!(secure_eq("same-secret", "same-secret"));
+        assert!(!secure_eq("same-secret", "different"));
+        assert!(!secure_eq("short", "much-longer-value"));
+        assert!(secure_eq("", ""));
+    }
+
+    fn headers_with_bearer(token: &str) -> axum::http::HeaderMap {
+        let mut h = axum::http::HeaderMap::new();
+        h.insert("authorization", format!("Bearer {token}").parse().unwrap());
+        h
+    }
+
+    // These pin down check_token's behavior directly: it's the single gate
+    // every mutating/sensitive handler (including the audit-log ones - see
+    // the missing-auth fix) relies on, so its logic must be independently
+    // verified rather than only exercised incidentally through handlers.
+    #[test]
+    fn test_check_token_rejects_missing_header_when_configured() {
+        let state = make_test_state("panel");
+        assert!(!check_token(&state, &axum::http::HeaderMap::new()));
+    }
+
+    #[test]
+    fn test_check_token_accepts_matching_api_token_as_bearer() {
+        let state = make_test_state("panel");
+        assert!(check_token(&state, &headers_with_bearer("test-token")));
+    }
+
+    #[test]
+    fn test_check_token_accepts_matching_api_token_raw() {
+        let state = make_test_state("panel");
+        let mut h = axum::http::HeaderMap::new();
+        h.insert("authorization", "test-token".parse().unwrap());
+        assert!(check_token(&state, &h));
+    }
+
+    #[test]
+    fn test_check_token_rejects_wrong_token() {
+        let state = make_test_state("panel");
+        assert!(!check_token(&state, &headers_with_bearer("wrong-token")));
+    }
+
+    #[test]
+    fn test_check_token_accepts_matching_session_token() {
+        let state = make_test_state("panel");
+        *state.session_token.write().unwrap() = Some("live-session".to_string());
+        assert!(check_token(&state, &headers_with_bearer("live-session")));
+    }
+
+    #[test]
+    fn test_check_token_open_when_no_credentials_configured() {
+        let mut state = make_test_state("panel");
+        state.api_token = None;
+        state.username.clear();
+        state.password_hash.clear();
+        // Documented "unsafe but possible" open-panel mode: no credentials
+        // configured at all means every request passes, including with no
+        // Authorization header.
+        assert!(check_token(&state, &axum::http::HeaderMap::new()));
+    }
 }
 
-async fn handle_get_audit(State(state): State<ApiState>) -> impl IntoResponse {
-    let logs = state.audit_logs.read().unwrap();
-    ApiResponse::success(logs.clone())
+async fn handle_get_audit(
+    State(state): State<ApiState>,
+    headers: axum::http::HeaderMap,
+) -> impl IntoResponse {
+    if !check_token(&state, &headers) {
+        return api_unauthorized::<Vec<AuditLogEntry>>();
+    }
+    let logs = state.audit_logs.read().unwrap_or_else(|e| e.into_inner());
+    (StatusCode::OK, ApiResponse::success(logs.clone()))
 }
 
-async fn handle_create_audit(State(state): State<ApiState>, Json(req): Json<CreateAuditLogRequest>) -> impl IntoResponse {
-    let mut logs = state.audit_logs.write().unwrap();
+async fn handle_create_audit(
+    State(state): State<ApiState>,
+    headers: axum::http::HeaderMap,
+    Json(req): Json<CreateAuditLogRequest>,
+) -> impl IntoResponse {
+    if !check_token(&state, &headers) {
+        return api_unauthorized::<bool>();
+    }
+    let mut logs = state.audit_logs.write().unwrap_or_else(|e| e.into_inner());
     let id = format!("{:x}", rand::random::<u64>());
     let now = chrono::Local::now();
     let entry = AuditLogEntry {
@@ -904,7 +992,7 @@ async fn handle_create_audit(State(state): State<ApiState>, Json(req): Json<Crea
         logs.truncate(100);
     }
 
-    ApiResponse::success(true)
+    (StatusCode::OK, ApiResponse::success(true))
 }
 
 // ── Bulk keys & Router Rules ─────────────────────────────────────────────────
@@ -1006,10 +1094,16 @@ async fn handle_put_rules(
     (StatusCode::OK, ApiResponse::success(true))
 }
 
-async fn handle_clear_audit(State(state): State<ApiState>) -> impl IntoResponse {
-    let mut logs = state.audit_logs.write().unwrap();
+async fn handle_clear_audit(
+    State(state): State<ApiState>,
+    headers: axum::http::HeaderMap,
+) -> impl IntoResponse {
+    if !check_token(&state, &headers) {
+        return api_unauthorized::<()>();
+    }
+    let mut logs = state.audit_logs.write().unwrap_or_else(|e| e.into_inner());
     logs.clear();
-    ApiResponse::success(())
+    (StatusCode::OK, ApiResponse::success(()))
 }
 
 

ostp-server/src/dispatcher.rs

@@ -263,8 +263,19 @@ impl Dispatcher {
         self.peer_machines
             .iter()
             .map(|(&sid, ps)| {
-                let cwnd = (ps.machine.cwnd_packets() as i64).clamp(16, 16384);
+                // Ceiling matches MAX_CWND_PACKETS in ostp-core. The old 16384
+                // allowed ~20 MB outstanding toward one client — on a mobile
+                // downlink that is standing queue, not throughput, and it is the
+                // download direction that carries video.
+                let cwnd = (ps.machine.cwnd_packets() as i64).clamp(16, 1024);
                 let in_flight = ps.machine.in_flight_count() as i64;
+                // Pacing gates the RATE, cwnd only the outstanding amount. With
+                // the pacing bucket empty, report no headroom so the relay
+                // reader pauses instead of handing over another chunk that would
+                // leave back-to-back.
+                if !ps.machine.can_pace_packet() {
+                    return (sid, 0);
+                }
                 (sid, cwnd - in_flight)
             })
             .collect()

ostp-server/src/dns.rs

@@ -276,6 +276,18 @@ impl DnsServer {
     ///
     /// Клиент может явно указать `<server_ip>:<local_port>` как DNS-сервер
     /// в настройках — тогда все DNS-запросы туннелируются и резолвятся здесь.
+    ///
+    /// SECURITY: this socket is bound on 0.0.0.0, reachable directly from the
+    /// public internet with no authentication (unlike the main OSTP port,
+    /// there is no Noise handshake gating it). Answering every UDP datagram
+    /// by resolving and replying to its (unverified, spoofable) source
+    /// address is a textbook DNS reflection/amplification primitive: an
+    /// attacker spoofing a victim's IP as the query source turns this server
+    /// into a free amplifier against that victim. There is currently no
+    /// caller for this function anywhere in the codebase, but the rate
+    /// limiter below exists so that connecting it later doesn't silently
+    /// reintroduce that risk - it bounds how much amplification bandwidth
+    /// this listener can ever contribute, regardless of query volume.
     pub async fn run_local_udp_listener(self: Arc<Self>) {
         let port = self.config.read().await.local_port;
         let bind_addr = format!("0.0.0.0:{port}");
@@ -289,10 +301,30 @@ impl DnsServer {
         };
         tracing::info!("Built-in DNS server listening on UDP {bind_addr}");
 
+        // Global token bucket capping total replies/sec this listener will
+        // ever send. Deliberately global (not per-source-IP): per-IP limiting
+        // does nothing against a reflection attack, since the attacker never
+        // sees the responses and can spread queries across arbitrarily many
+        // spoofed sources anyway. A global cap bounds this server's total
+        // contribution to any attack regardless of how the queries are
+        // distributed.
+        const MAX_REPLIES_PER_SEC: f64 = 100.0;
+        let mut tokens: f64 = MAX_REPLIES_PER_SEC;
+        let mut last_refill = tokio::time::Instant::now();
+
         let mut buf = vec![0u8; 4096];
         loop {
             match socket.recv_from(&mut buf).await {
                 Ok((n, peer)) => {
+                    let now = tokio::time::Instant::now();
+                    tokens = (tokens + now.duration_since(last_refill).as_secs_f64() * MAX_REPLIES_PER_SEC)
+                        .min(MAX_REPLIES_PER_SEC);
+                    last_refill = now;
+                    if tokens < 1.0 {
+                        continue; // over budget: drop silently, no reply sent
+                    }
+                    tokens -= 1.0;
+
                     let query = buf[..n].to_vec();
                     let srv = self.clone();
                     let sock = socket.clone();

ostp-server/src/outbound.rs

@@ -48,10 +48,23 @@ pub async fn connect_target(
             }
             if action == OutboundAction::Proxy {
                 let proxy_addr = format!("{}:{}", outbound.address, outbound.port);
-                return match outbound.protocol.as_str() {
+                // Case-insensitive: a config saying "SOCKS5" means the same thing
+                // as "socks5", and silently treating it as unknown is a trap.
+                return match outbound.protocol.to_ascii_lowercase().as_str() {
                     "socks5" => connect_via_socks5(&proxy_addr, target).await,
                     "http" => connect_via_http(&proxy_addr, target).await,
-                    _ => connect_direct(target, connect_timeout).await,
+                    // FAIL CLOSED. This used to fall through to a direct
+                    // connection, so any unrecognised protocol string — a typo,
+                    // a case difference, an empty value — silently sent ALL TCP
+                    // straight out of the server while the operator believed it
+                    // was proxied. Combined with the same bug on the UDP path,
+                    // that is how one session ends up presenting two different
+                    // exit addresses to the remote site.
+                    other => Err(anyhow::anyhow!(
+                        "outbound.protocol is \"{other}\", which is not a supported proxy type \
+                         (expected \"socks5\" or \"http\"); refusing to connect to {target} \
+                         directly, because the rules asked for the proxy"
+                    )),
                 };
             }
         }
@@ -370,10 +383,22 @@ pub async fn connect_udp_target(
             }
             if action == OutboundAction::Proxy {
                 let proxy_addr = format!("{}:{}", outbound.address, outbound.port);
-                if outbound.protocol == "socks5" {
+                if outbound.protocol.eq_ignore_ascii_case("socks5") {
                     return connect_udp_via_socks5(&proxy_addr, server_udp).await;
                 }
-                // HTTP CONNECT does not support UDP. Fallback to direct.
+                // FAIL CLOSED. HTTP CONNECT genuinely cannot carry UDP — but the
+                // answer to that is not to send the datagrams in the clear. The
+                // previous "fallback to direct" honoured a Proxy rule by
+                // egressing from the server's own address, so with an HTTP
+                // upstream every UDP flow (QUIC, DNS) leaked while TCP stayed
+                // proxied, presenting two exit IPs to the same remote site.
+                return Err(anyhow::anyhow!(
+                    "outbound rules route UDP to {target} through the proxy, but the upstream \
+                     protocol is \"{}\", which cannot carry UDP. Refusing to send directly. \
+                     Use a socks5 upstream, or add an explicit udp rule with action \"direct\" \
+                     or \"block\" so the intent is recorded in the config.",
+                    outbound.protocol
+                ));
             }
         }
     }

ostp-server/src/relay_node.rs

@@ -1,403 +1,460 @@
-//! Authenticated Relay Node
+//! Transparent relay node.
 //!
-//! Принимает входящие UDP/TCP (UoT) соединения от клиентов,
-//! валидирует HMAC-подпись клиента, используя ключи синхронизированные с upstream-сервера,
-//! и слепо пробрасывает авторизованный трафик к целевому upstream-серверу.
+//! Forwards traffic to a fixed upstream OSTP server:
 //!
-//! Архитектура цепочек:
-//!   Клиент -> [Relay 1] -> [Relay 2] -> ... -> [Target Server]
-//! Каждый Relay скачивает access_keys напрямую с Target Server API.
+//!   Client -> [Relay] -> [Target server]
+//!
+//! ## Why this performs no authentication of its own
+//!
+//! The previous design had the relay authenticate clients itself, with an
+//! HMAC handshake and a background job that pulled the access-key list from the
+//! target server's management API. That was wrong on two counts.
+//!
+//! It did not work: no OSTP client has ever produced those credentials. The TCP
+//! path expected an HTTP request (`GET /stream` with an `Authorization: Bearer`
+//! header) and the UDP path expected a `timestamp || HMAC` preamble, while the
+//! client sends junk frames followed by length-prefixed OSTP frames, and an
+//! obfuscated Noise handshake, respectively. Every connection was rejected.
+//!
+//! It was also weak where it did apply: the HMAC covered only an 8-byte
+//! timestamp, so a captured signature was a bearer token that anyone could
+//! replay from any address for the length of the clock-skew window. And the
+//! HTTP handshake was a plaintext `GET /stream` on the wire, a greppable
+//! signature in a protocol whose entire premise is that no byte is
+//! recognisable.
+//!
+//! Authentication belongs where it is cryptographically meaningful: the target
+//! server already authenticates every session end-to-end via Noise with a PSK
+//! derived from the access key, and silently drops anything that fails. A relay
+//! that re-checks credentials adds a second, weaker gate and a copy of the key
+//! list on a machine that has no need for it. So this relay makes no security
+//! decisions at all — it is a pipe, and says so.
+//!
+//! What it does need is protection against being used as a resource sink, which
+//! is what the session cap and admission rate limit below are for. It forwards
+//! only to one fixed upstream and returns replies only to the sender, so it is
+//! not a reflector: the amplification factor is one.
 
-use anyhow::Result;
-use bytes::Bytes;
-use hmac::{Hmac, Mac};
-use sha2::Sha256;
+use anyhow::{Context, Result};
 use std::collections::HashMap;
 use std::net::SocketAddr;
-use std::sync::{Arc, RwLock};
-use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
 use tokio::net::{TcpListener, TcpStream, UdpSocket};
 use tokio::sync::Mutex;
 
-/// Конфигурация Relay-узла.
+/// Configuration for a relay node.
 #[derive(Debug, Clone)]
 pub struct RelayConfig {
-    /// Адрес(а) для прослушивания входящих соединений (UDP + TCP).
+    /// Address(es) to accept client traffic on (UDP and TCP both bind here).
     pub listen_addrs: Vec<String>,
-    /// Адрес upstream TCP для пересылки (обычно тот же порт, что и у target-сервера).
+    /// Upstream target for TCP (UoT) traffic.
     pub upstream_tcp: String,
-    /// Адрес upstream UDP.
+    /// Upstream target for UDP traffic.
     pub upstream_udp: String,
-    /// URL API target-сервера для получения access_keys.
-    /// Пример: "http://127.0.0.1:9090"
-    pub upstream_api_url: String,
-    /// Bearer-токен для аутентификации на API target-сервера.
-    pub upstream_api_token: String,
-    /// Интервал синхронизации ключей (секунды).
-    pub sync_interval_secs: u64,
 }
 
-type SharedKeys = Arc<RwLock<Vec<String>>>;
+/// Maximum concurrent UDP client sessions. Each holds one upstream socket and
+/// one reader task, so this bounds both file descriptors and tasks.
+const MAX_UDP_SESSIONS: usize = 4096;
+/// A UDP session with no traffic for this long is reclaimed. Mobile NAT
+/// bindings are typically shorter-lived than this, so it is generous enough not
+/// to break roaming clients.
+const UDP_SESSION_IDLE: Duration = Duration::from_secs(120);
+/// Maximum concurrent relayed TCP connections.
+const MAX_TCP_CONNECTIONS: usize = 4096;
+/// Sustained rate (and burst ceiling) for admitting NEW sessions, per second.
+/// Established sessions are never rate limited; this only bounds how fast an
+/// unknown source can cause state to be allocated.
+const NEW_SESSION_RATE: f64 = 200.0;
+/// How long to wait for the upstream TCP connection before giving up.
+const UPSTREAM_CONNECT_TIMEOUT: Duration = Duration::from_secs(8);
 
-/// Точка входа Relay-узла.
-pub async fn run_relay_node(cfg: RelayConfig) -> Result<()> {
-    let shared_keys: SharedKeys = Arc::new(RwLock::new(Vec::new()));
+/// Token bucket bounding how fast new sessions may be created.
+struct AdmissionLimiter {
+    tokens: f64,
+    last_refill: Instant,
+}
 
-    // Первоначальная синхронизация ключей
-    if let Err(e) = sync_keys(&cfg, &shared_keys).await {
-        tracing::warn!("Relay: initial key sync failed: {}. Will retry.", e);
-    } else {
-        let count = shared_keys.read().unwrap_or_else(|e| e.into_inner()).len();
-        tracing::info!("Relay: synced {} access key(s) from upstream API", count);
+impl AdmissionLimiter {
+    fn new() -> Self {
+        Self { tokens: NEW_SESSION_RATE, last_refill: Instant::now() }
     }
 
-    // Фоновый синхронизатор ключей
-    let cfg_clone = cfg.clone();
-    let keys_clone = shared_keys.clone();
+    /// Consume one admission slot, or report that the caller should drop.
+    fn try_admit(&mut self) -> bool {
+        let now = Instant::now();
+        let elapsed = now.duration_since(self.last_refill).as_secs_f64();
+        self.last_refill = now;
+        self.tokens = (self.tokens + elapsed * NEW_SESSION_RATE).min(NEW_SESSION_RATE);
+        if self.tokens >= 1.0 {
+            self.tokens -= 1.0;
+            true
+        } else {
+            false
+        }
+    }
+}
+
+/// Entry point.
+pub async fn run_relay_node(cfg: RelayConfig) -> Result<()> {
+    let udp_cfg = cfg.clone();
     tokio::spawn(async move {
-        loop {
-            tokio::time::sleep(Duration::from_secs(cfg_clone.sync_interval_secs)).await;
-            match sync_keys(&cfg_clone, &keys_clone).await {
-                Ok(count) => tracing::debug!("Relay: refreshed {} access key(s)", count),
-                Err(e) => tracing::warn!("Relay: key sync error: {}", e),
-            }
+        if let Err(e) = run_udp_relay(udp_cfg).await {
+            tracing::error!("Relay UDP loop error: {e}");
         }
     });
 
-    // Запуск UDP relay
-    {
-        let cfg_udp = cfg.clone();
-        let keys_udp = shared_keys.clone();
-        tokio::spawn(async move {
-            if let Err(e) = run_udp_relay(cfg_udp, keys_udp).await {
-                tracing::error!("Relay UDP loop error: {}", e);
-            }
-        });
-    }
-
-    // Запуск TCP (UoT) relay
-    run_tcp_relay(cfg, shared_keys).await
+    run_tcp_relay(cfg).await
 }
 
-/// Синхронизация access_keys с upstream API.
-async fn sync_keys(cfg: &RelayConfig, shared_keys: &SharedKeys) -> Result<usize> {
-    let url = format!("{}/api/users", cfg.upstream_api_url.trim_end_matches('/'));
+// ── UDP ──────────────────────────────────────────────────────────────────────
 
-    let client = reqwest::Client::builder()
-        .timeout(Duration::from_secs(10))
-        .build()?;
-
-    let mut req = client.get(&url);
-    if !cfg.upstream_api_token.is_empty() {
-        req = req.header("Authorization", format!("Bearer {}", cfg.upstream_api_token));
-    }
-
-    let resp = req.send().await?;
-    if !resp.status().is_success() {
-        anyhow::bail!("API returned HTTP {}", resp.status());
-    }
-
-    #[derive(serde::Deserialize)]
-    struct UserStatsSnapshot {
-        access_key: String,
-    }
-
-    #[derive(serde::Deserialize)]
-    struct ApiResponse {
-        ok: bool,
-        data: Option<Vec<UserStatsSnapshot>>,
-    }
-
-    let body: ApiResponse = resp.json().await?;
-    if !body.ok {
-        anyhow::bail!("API returned error ok=false");
-    }
-
-    let keys: Vec<String> = body.data.unwrap_or_default().into_iter().map(|u| u.access_key).collect();
-    let count = keys.len();
-    {
-        let mut lock = shared_keys.write().unwrap();
-        *lock = keys;
-    }
-    Ok(count)
+struct UdpSession {
+    upstream: Arc<UdpSocket>,
+    last_seen: Instant,
 }
 
-/// Проверяет HMAC-подпись клиента по набору ключей.
-/// Возвращает true если хотя бы один ключ подходит.
-fn verify_hmac(ts_bytes: &[u8; 8], provided_mac: &[u8], keys: &[String]) -> bool {
-    let client_ts = u64::from_be_bytes(*ts_bytes);
-    let now = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap()
-        .as_secs();
-
-    // Защита от replay: ±60 секунд
-    if client_ts > now + 30 || client_ts < now.saturating_sub(60) {
-        return false;
-    }
-
-    for key in keys {
-        if let Ok(mut mac) = Hmac::<Sha256>::new_from_slice(key.as_bytes()) {
-            mac.update(ts_bytes);
-            if mac.verify_slice(provided_mac).is_ok() {
-                return true;
-            }
-        }
-    }
-    false
-}
-
-// ── UDP Relay ────────────────────────────────────────────────────────────────
-
-async fn run_udp_relay(cfg: RelayConfig, shared_keys: SharedKeys) -> Result<()> {
-    // NAT-таблица: client_addr -> (upstream_socket, last_seen)
-    let nat_table: Arc<Mutex<HashMap<SocketAddr, (Arc<UdpSocket>, Instant)>>> =
+async fn run_udp_relay(cfg: RelayConfig) -> Result<()> {
+    // client address -> the upstream socket carrying that client's flow
+    let sessions: Arc<Mutex<HashMap<SocketAddr, UdpSession>>> =
         Arc::new(Mutex::new(HashMap::new()));
+    let limiter = Arc::new(Mutex::new(AdmissionLimiter::new()));
 
     for bind_addr in &cfg.listen_addrs {
-        let sock = UdpSocket::bind(bind_addr).await?;
-        tracing::info!("Relay UDP listening on {}", bind_addr);
-        let sock = Arc::new(sock);
-        let upstream_udp = cfg.upstream_udp.clone();
-        let keys = shared_keys.clone();
-        let nat = nat_table.clone();
+        let sock = Arc::new(
+            UdpSocket::bind(bind_addr)
+                .await
+                .with_context(|| format!("relay: failed to bind UDP on {bind_addr}"))?,
+        );
+        tracing::info!("Relay UDP listening on {bind_addr} -> {}", cfg.upstream_udp);
+
+        let upstream_addr = cfg.upstream_udp.clone();
+        let sessions = sessions.clone();
+        let limiter = limiter.clone();
 
         tokio::spawn(async move {
             let mut buf = vec![0u8; 65535];
             loop {
-                let (n, peer) = match sock.recv_from(&mut buf).await {
-                    Ok(v) => v,
-                    Err(_) => continue,
-                };
-
-                let packet = Bytes::copy_from_slice(&buf[..n]);
-
-                // Быстрая проверка: первый UDP-пакет от нового клиента содержит Noise handshake.
-                // Мы берём из него первые 8 байт как timestamp + 32 байта MAC.
-                // Если пакет достаточно длинный, проверяем подпись.
-                // Для уже авторизованных клиентов (есть в NAT) — пропускаем проверку.
-                {
-                    let nat_lock = nat.lock().await;
-                    if !nat_lock.contains_key(&peer) {
-                        drop(nat_lock);
-
-                        // Пакет должен быть >= 40 байт (8 ts + 32 hmac) для первичной проверки
-                        if packet.len() < 40 {
-                            tracing::debug!("Relay UDP: dropping short packet from {}", peer);
-                            continue;
-                        }
-
-                        let ts_bytes: [u8; 8] = packet[0..8].try_into().unwrap();
-                        let provided_mac = &packet[8..40];
-                        let keys_guard = keys.read().unwrap_or_else(|e| e.into_inner());
-
-                        if !verify_hmac(&ts_bytes, provided_mac, &keys_guard) {
-                            tracing::debug!("Relay UDP: unauthorized probe from {}, dropped", peer);
-                            continue;
-                        }
-                        tracing::debug!("Relay UDP: authorized new client {}", peer);
-                    }
-                }
-
-                // Находим или создаём upstream socket для этого клиента
-                let upstream_sock = {
-                    let mut nat_lock = nat.lock().await;
-                    if let Some(entry) = nat_lock.get_mut(&peer) {
-                        entry.1 = Instant::now();
-                        entry.0.clone()
-                    } else {
-                        // Новый upstream socket для этого клиента
-                        let usock = match UdpSocket::bind("0.0.0.0:0").await {
-                            Ok(s) => Arc::new(s),
-                            Err(e) => {
-                                tracing::warn!("Relay UDP: failed to bind upstream socket: {}", e);
-                                continue;
-                            }
-                        };
-                        if usock.connect(&upstream_udp).await.is_err() {
-                            tracing::warn!("Relay UDP: failed to connect to upstream {}", upstream_udp);
-                            continue;
-                        }
-
-                        nat_lock.insert(peer, (usock.clone(), Instant::now()));
-
-                        // Задача: читаем ответы от upstream и отправляем клиенту
-                        let usock_rx = usock.clone();
-                        let client_sock = sock.clone();
-                        let peer_addr = peer;
-                        tokio::spawn(async move {
-                            let mut rbuf = vec![0u8; 65535];
-                            loop {
-                                match usock_rx.recv(&mut rbuf).await {
-                                    Ok(n) => {
-                                        let _ = client_sock.send_to(&rbuf[..n], peer_addr).await;
-                                    }
-                                    Err(_) => break,
-                                }
-                            }
-                        });
-
-                        usock
-                    }
-                };
-
-                // Пересылаем пакет в upstream
-                let _ = upstream_sock.send(&packet).await;
-            }
-        });
-    }
-
-    // Периодически чистим устаревшие NAT записи (timeout 120 сек)
-    loop {
-        tokio::time::sleep(Duration::from_secs(30)).await;
-        let mut nat_lock = nat_table.lock().await;
-        let now = Instant::now();
-        nat_lock.retain(|_, (_, last)| now.duration_since(*last) < Duration::from_secs(120));
-    }
-}
-
-// ── TCP (UoT) Relay ──────────────────────────────────────────────────────────
-
-async fn run_tcp_relay(cfg: RelayConfig, shared_keys: SharedKeys) -> Result<()> {
-    for bind_addr in &cfg.listen_addrs {
-        let listener = TcpListener::bind(bind_addr).await?;
-        tracing::info!("Relay TCP (UoT) listening on {}", bind_addr);
-
-        let upstream_tcp = cfg.upstream_tcp.clone();
-        let keys = shared_keys.clone();
-
-        tokio::spawn(async move {
-            loop {
-                let (stream, peer_addr) = match listener.accept().await {
+                let (len, peer) = match sock.recv_from(&mut buf).await {
                     Ok(v) => v,
                     Err(e) => {
-                        tracing::warn!("Relay TCP accept error: {}", e);
+                        tracing::warn!("Relay UDP recv error: {e}");
                         continue;
                     }
                 };
 
-                let upstream = upstream_tcp.clone();
-                let keys_clone = keys.clone();
-
-                tokio::spawn(async move {
-                    if let Err(e) = handle_tcp_client(stream, peer_addr, upstream, keys_clone).await {
-                        tracing::debug!("Relay TCP client {} closed: {}", peer_addr, e);
+                // Fast path: an established session just forwards.
+                {
+                    let mut map = sessions.lock().await;
+                    if let Some(session) = map.get_mut(&peer) {
+                        session.last_seen = Instant::now();
+                        let upstream = session.upstream.clone();
+                        drop(map);
+                        let _ = upstream.send(&buf[..len]).await;
+                        continue;
                     }
+                }
+
+                // New client: bounded by both a hard cap and an admission rate,
+                // so a flood of spoofed sources cannot exhaust sockets or tasks.
+                {
+                    let map = sessions.lock().await;
+                    if map.len() >= MAX_UDP_SESSIONS {
+                        continue;
+                    }
+                }
+                if !limiter.lock().await.try_admit() {
+                    continue;
+                }
+
+                let upstream = match new_upstream_socket(&upstream_addr).await {
+                    Ok(s) => s,
+                    Err(e) => {
+                        tracing::warn!("Relay UDP: cannot reach upstream {upstream_addr}: {e}");
+                        continue;
+                    }
+                };
+
+                sessions.lock().await.insert(
+                    peer,
+                    UdpSession { upstream: upstream.clone(), last_seen: Instant::now() },
+                );
+
+                // Reverse direction for this client.
+                let back_sock = sock.clone();
+                let sessions_rx = sessions.clone();
+                tokio::spawn(async move {
+                    let mut rbuf = vec![0u8; 65535];
+                    loop {
+                        match upstream.recv(&mut rbuf).await {
+                            Ok(n) => {
+                                if back_sock.send_to(&rbuf[..n], peer).await.is_err() {
+                                    break;
+                                }
+                                if let Some(s) = sessions_rx.lock().await.get_mut(&peer) {
+                                    s.last_seen = Instant::now();
+                                }
+                            }
+                            Err(_) => break,
+                        }
+                    }
+                    sessions_rx.lock().await.remove(&peer);
+                });
+
+                let _ = sessions
+                    .lock()
+                    .await
+                    .get(&peer)
+                    .map(|s| s.upstream.clone())
+                    .unwrap()
+                    .send(&buf[..len])
+                    .await;
+            }
+        });
+    }
+
+    // Reclaim idle sessions. Dropping the entry closes the upstream socket,
+    // which ends that session's reader task.
+    loop {
+        tokio::time::sleep(Duration::from_secs(30)).await;
+        let now = Instant::now();
+        let mut map = sessions.lock().await;
+        let before = map.len();
+        map.retain(|_, s| now.duration_since(s.last_seen) < UDP_SESSION_IDLE);
+        let reclaimed = before - map.len();
+        if reclaimed > 0 {
+            tracing::debug!("Relay UDP: reclaimed {reclaimed} idle session(s), {} active", map.len());
+        }
+    }
+}
+
+/// One upstream socket per client, `connect`ed so replies can be read with
+/// `recv` and cannot come from anywhere else.
+async fn new_upstream_socket(upstream: &str) -> Result<Arc<UdpSocket>> {
+    // Resolve first, then bind the SAME address family. Binding "[::]:0" and
+    // connecting to an IPv4 upstream fails anywhere IPV6_V6ONLY defaults on
+    // (Windows, and many Linux configurations) — which is every deployment with
+    // an IPv4 target server, i.e. the common case.
+    let addr: SocketAddr = tokio::net::lookup_host(upstream)
+        .await
+        .with_context(|| format!("resolve upstream {upstream}"))?
+        .next()
+        .ok_or_else(|| anyhow::anyhow!("upstream {upstream} resolved to no addresses"))?;
+
+    let bind: SocketAddr = if addr.is_ipv6() {
+        "[::]:0".parse().expect("valid literal")
+    } else {
+        "0.0.0.0:0".parse().expect("valid literal")
+    };
+
+    let sock = UdpSocket::bind(bind).await?;
+    sock.connect(addr)
+        .await
+        .with_context(|| format!("connect to upstream {addr}"))?;
+    Ok(Arc::new(sock))
+}
+
+// ── TCP (UoT) ────────────────────────────────────────────────────────────────
+
+async fn run_tcp_relay(cfg: RelayConfig) -> Result<()> {
+    let live = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+
+    for bind_addr in &cfg.listen_addrs {
+        let listener = TcpListener::bind(bind_addr)
+            .await
+            .with_context(|| format!("relay: failed to bind TCP on {bind_addr}"))?;
+        tracing::info!("Relay TCP (UoT) listening on {bind_addr} -> {}", cfg.upstream_tcp);
+
+        let upstream = cfg.upstream_tcp.clone();
+        let live = live.clone();
+
+        tokio::spawn(async move {
+            loop {
+                let (client, peer) = match listener.accept().await {
+                    Ok(v) => v,
+                    Err(e) => {
+                        tracing::warn!("Relay TCP accept error: {e}");
+                        continue;
+                    }
+                };
+
+                use std::sync::atomic::Ordering;
+                if live.load(Ordering::Relaxed) >= MAX_TCP_CONNECTIONS {
+                    // Close immediately rather than queueing unbounded work.
+                    drop(client);
+                    continue;
+                }
+                live.fetch_add(1, Ordering::Relaxed);
+
+                let upstream = upstream.clone();
+                let live = live.clone();
+                tokio::spawn(async move {
+                    if let Err(e) = splice_tcp(client, &upstream).await {
+                        tracing::debug!("Relay TCP {peer} closed: {e}");
+                    }
+                    live.fetch_sub(1, Ordering::Relaxed);
                 });
             }
         });
     }
 
-    // Держим поток живым
     futures_util::future::pending::<()>().await;
     Ok(())
 }
 
-/// Обработка одного TCP (UoT) соединения.
+/// Splice a client connection to the upstream, byte for byte.
 ///
-/// Алгоритм:
-/// 1. Читаем HTTP-заголовки (фейковый WebSocket upgrade).
-/// 2. Извлекаем HMAC-подпись из Authorization: Bearer.
-/// 3. Проверяем подпись по синхронизированным ключам.
-/// 4. Если авторизован — открываем соединение к upstream и пайпим потоки.
-async fn handle_tcp_client(
-    mut client: TcpStream,
-    peer_addr: SocketAddr,
-    upstream_addr: String,
-    shared_keys: SharedKeys,
-) -> Result<()> {
-    // Читаем HTTP-заголовки (до \r\n\r\n)
-    let mut header_buf = vec![0u8; 4096];
-    let mut header_len = 0usize;
-
-    loop {
-        let n = client.read(&mut header_buf[header_len..]).await?;
-        if n == 0 {
-            anyhow::bail!("connection closed before handshake");
-        }
-        header_len += n;
-        if header_buf[..header_len].windows(4).any(|w| w == b"\r\n\r\n") {
-            break;
-        }
-        if header_len >= header_buf.len() {
-            anyhow::bail!("headers too large");
-        }
-    }
-
-    let headers_str = String::from_utf8_lossy(&header_buf[..header_len]);
-
-    // Быстрая проверка: должен быть GET /stream
-    if !headers_str.starts_with("GET /stream HTTP/1.1\r\n") {
-        // Возвращаем 404 как обычный сервер (anti-scan)
-        let _ = client.write_all(b"HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nConnection: close\r\n\r\nNot Found").await;
-        anyhow::bail!("invalid request from {}", peer_addr);
-    }
-
-    // Извлекаем HMAC-подпись
-    let mut sig_b64 = None;
-    for line in headers_str.lines() {
-        let lower = line.to_ascii_lowercase();
-        if lower.starts_with("authorization: bearer ") {
-            sig_b64 = Some(line[22..].trim().to_string());
-        } else if lower.starts_with("cookie: ostp_token=") {
-            sig_b64 = Some(line[19..].trim().to_string());
-        }
-    }
-
-    let sig_b64 = match sig_b64 {
-        Some(s) => s,
-        None => {
-            let _ = client.write_all(b"HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nConnection: close\r\n\r\nNot Found").await;
-            anyhow::bail!("missing authorization from {}", peer_addr);
-        }
-    };
-
-    let sig_bytes = base64::Engine::decode(
-        &base64::engine::general_purpose::STANDARD_NO_PAD,
-        &sig_b64,
+/// Nothing is parsed or rewritten: the relay must stay agnostic to the payload,
+/// both because the payload is an opaque encrypted stream and because any
+/// parsing would be a place for the relay to disagree with the endpoints.
+async fn splice_tcp(mut client: TcpStream, upstream_addr: &str) -> Result<()> {
+    let mut upstream = tokio::time::timeout(
+        UPSTREAM_CONNECT_TIMEOUT,
+        TcpStream::connect(upstream_addr),
     )
-    .map_err(|_| anyhow::anyhow!("invalid base64 from {}", peer_addr))?;
+    .await
+    .map_err(|_| anyhow::anyhow!("upstream {upstream_addr} connect timed out"))?
+    .with_context(|| format!("connect to upstream {upstream_addr}"))?;
 
-    if sig_bytes.len() < 40 {
-        let _ = client.write_all(b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 12\r\nConnection: close\r\n\r\nUnauthorized").await;
-        anyhow::bail!("signature too short from {}", peer_addr);
-    }
+    // Both sides carry latency-sensitive framed traffic; Nagle would add delay
+    // for no benefit on an already-batched stream.
+    let _ = client.set_nodelay(true);
+    let _ = upstream.set_nodelay(true);
 
-    let ts_bytes: [u8; 8] = sig_bytes[0..8].try_into().unwrap();
-    let provided_mac = &sig_bytes[8..];
-
-    // Проверяем по синхронизированным ключам
-    let authorized = {
-        let keys = shared_keys.read().unwrap_or_else(|e| e.into_inner());
-        verify_hmac(&ts_bytes, provided_mac, &keys)
-    };
-
-    if !authorized {
-        let _ = client.write_all(b"HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nConnection: close\r\n\r\nNot Found").await;
-        anyhow::bail!("unauthorized client {}", peer_addr);
-    }
-
-    tracing::info!("Relay TCP: authorized client {}, forwarding to {}", peer_addr, upstream_addr);
-
-    // Подключаемся к upstream
-    let mut upstream = TcpStream::connect(&upstream_addr).await
-        .map_err(|e| anyhow::anyhow!("failed to connect to upstream {}: {}", upstream_addr, e))?;
-
-    // Пересылаем upstream заголовки AS-IS (он сам проверит подпись)
-    upstream.write_all(&header_buf[..header_len]).await?;
-
-    // Пайпим оба потока: client <-> upstream
-    let (mut cr, mut cw) = client.into_split();
-    let (mut ur, mut uw) = upstream.into_split();
-
-    let c2u = tokio::spawn(async move {
-        let _ = tokio::io::copy(&mut cr, &mut uw).await;
-    });
-    let u2c = tokio::spawn(async move {
-        let _ = tokio::io::copy(&mut ur, &mut cw).await;
-    });
-
-    let _ = tokio::join!(c2u, u2c);
+    tokio::io::copy_bidirectional(&mut client, &mut upstream).await?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The admission limiter is what replaced per-client authentication as the
+    /// defence against resource abuse, so it has to actually stop admitting.
+    #[test]
+    fn admission_limiter_stops_at_the_burst_ceiling() {
+        let mut limiter = AdmissionLimiter::new();
+        let mut admitted = 0usize;
+        // Ask for far more than one burst without letting time pass.
+        for _ in 0..(NEW_SESSION_RATE as usize * 3) {
+            if limiter.try_admit() {
+                admitted += 1;
+            }
+        }
+        assert!(
+            admitted <= NEW_SESSION_RATE as usize + 1,
+            "admitted {admitted} sessions in one instant, ceiling is {NEW_SESSION_RATE}"
+        );
+        assert!(admitted > 0, "limiter admitted nothing at all");
+    }
+
+    /// It must also refill, or the relay would accept a burst once and then
+    /// refuse every client forever.
+    #[test]
+    fn admission_limiter_refills_over_time() {
+        let mut limiter = AdmissionLimiter::new();
+        while limiter.try_admit() {}
+        assert!(!limiter.try_admit(), "bucket should be empty");
+
+        std::thread::sleep(Duration::from_millis(50));
+        assert!(
+            limiter.try_admit(),
+            "limiter never refilled; the relay would stop accepting new clients"
+        );
+    }
+
+    /// End-to-end through the real UDP path: a client datagram reaches the
+    /// upstream and the reply comes back to that same client. This is the whole
+    /// job of the relay, and it is what the previous implementation could not do
+    /// with a real client, because it demanded credentials no client sends.
+    #[tokio::test]
+    async fn udp_relay_forwards_both_directions() {
+        // Stand-in upstream that echoes with a marker.
+        let upstream = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let upstream_addr = upstream.local_addr().unwrap();
+        tokio::spawn(async move {
+            let mut buf = [0u8; 1500];
+            while let Ok((n, from)) = upstream.recv_from(&mut buf).await {
+                let mut reply = b"echo:".to_vec();
+                reply.extend_from_slice(&buf[..n]);
+                let _ = upstream.send_to(&reply, from).await;
+            }
+        });
+
+        let relay_listen = {
+            let probe = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+            let a = probe.local_addr().unwrap();
+            drop(probe);
+            a
+        };
+
+        tokio::spawn(run_udp_relay(RelayConfig {
+            listen_addrs: vec![relay_listen.to_string()],
+            upstream_tcp: upstream_addr.to_string(),
+            upstream_udp: upstream_addr.to_string(),
+        }));
+        tokio::time::sleep(Duration::from_millis(150)).await;
+
+        // A plain OSTP-looking datagram: no credentials, no preamble.
+        let client = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        client.send_to(b"opaque-payload", relay_listen).await.unwrap();
+
+        let mut buf = [0u8; 1500];
+        let (n, _) = tokio::time::timeout(Duration::from_secs(3), client.recv_from(&mut buf))
+            .await
+            .expect("relay did not deliver a reply within 3s")
+            .unwrap();
+
+        assert_eq!(
+            &buf[..n],
+            b"echo:opaque-payload",
+            "relay did not forward the payload verbatim in both directions"
+        );
+    }
+
+    /// Same for TCP: bytes must cross unmodified in both directions, with no
+    /// handshake demanded of the client.
+    #[tokio::test]
+    async fn tcp_relay_splices_both_directions() {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+        let upstream = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let upstream_addr = upstream.local_addr().unwrap();
+        tokio::spawn(async move {
+            if let Ok((mut sock, _)) = upstream.accept().await {
+                let mut buf = [0u8; 128];
+                if let Ok(n) = sock.read(&mut buf).await {
+                    let mut reply = b"echo:".to_vec();
+                    reply.extend_from_slice(&buf[..n]);
+                    let _ = sock.write_all(&reply).await;
+                }
+            }
+        });
+
+        let relay_listen = {
+            let probe = TcpListener::bind("127.0.0.1:0").await.unwrap();
+            let a = probe.local_addr().unwrap();
+            drop(probe);
+            a
+        };
+
+        tokio::spawn(run_tcp_relay(RelayConfig {
+            listen_addrs: vec![relay_listen.to_string()],
+            upstream_tcp: upstream_addr.to_string(),
+            upstream_udp: upstream_addr.to_string(),
+        }));
+        tokio::time::sleep(Duration::from_millis(150)).await;
+
+        let mut client = TcpStream::connect(relay_listen).await.unwrap();
+        client.write_all(b"opaque-stream").await.unwrap();
+
+        let mut buf = [0u8; 128];
+        let n = tokio::time::timeout(Duration::from_secs(3), client.read(&mut buf))
+            .await
+            .expect("relay did not deliver a reply within 3s")
+            .unwrap();
+
+        assert_eq!(&buf[..n], b"echo:opaque-stream");
+    }
+}

ostp-server/src/router.rs

@@ -47,12 +47,29 @@ impl Router {
         
         let mut proxy = None;
         if let Some(ref c) = cfg {
-            if c.enabled && c.protocol == "socks5" {
-                let proxy_addr = format!("{}:{}", c.address, c.port);
-                if let Ok(p) = crate::outbound::connect_udp_via_socks5(&proxy_addr, server_udp.clone()).await {
-                    proxy = Some(Arc::new(p));
-                } else if self.debug {
-                    tracing::warn!("Failed to establish SOCKS5 UDP Associate");
+            if c.enabled {
+                if c.protocol == "socks5" {
+                    let proxy_addr = format!("{}:{}", c.address, c.port);
+                    match crate::outbound::connect_udp_via_socks5(&proxy_addr, server_udp.clone()).await {
+                        Ok(p) => proxy = Some(Arc::new(p)),
+                        // Warn unconditionally, not only under `debug`. Every UDP
+                        // flow the rules want proxied is now dropped instead of
+                        // sent, so an operator who cannot see this has a session
+                        // where TCP works and UDP silently does not.
+                        Err(e) => tracing::warn!(
+                            "SOCKS5 UDP ASSOCIATE to {proxy_addr} failed: {e}. UDP that the \
+                             outbound rules route through the proxy will be DROPPED (it is not \
+                             sent directly, which would expose this server's address)."
+                        ),
+                    }
+                } else {
+                    tracing::warn!(
+                        "Upstream proxy protocol is '{}', which cannot carry UDP. UDP matching \
+                         a Proxy rule will be DROPPED. Use a socks5 upstream for UDP, or add an \
+                         explicit udp rule with action \"direct\" or \"block\" to make the \
+                         intent explicit.",
+                        c.protocol
+                    );
                 }
             }
         }
@@ -87,9 +104,28 @@ impl UdpSessionRouter {
                     return Err(anyhow::anyhow!("blocked by outbound udp rule: {}", target));
                 }
                 if action == crate::outbound::OutboundAction::Proxy {
-                    if let Some(p) = &self.proxy {
-                        return p.send_to(data, target).await;
-                    }
+                    return match &self.proxy {
+                        Some(p) => p.send_to(data, target).await,
+                        // FAIL CLOSED. This used to fall through to the direct
+                        // socket, so whenever the UDP proxy was unavailable —
+                        // the SOCKS5 UDP ASSOCIATE failed, or the upstream is an
+                        // HTTP proxy, which cannot carry UDP at all — every UDP
+                        // datagram silently egressed from the server's own
+                        // address while TCP still went through the proxy. The
+                        // session then had two different exit IPs, which is what
+                        // Google flags and why YouTube (QUIC, i.e. UDP/443)
+                        // geolocated to the server instead of the proxy exit.
+                        //
+                        // A rule that says "proxy" must never be satisfied by
+                        // sending in the clear: a dropped datagram is visible and
+                        // debuggable, a deanonymising leak is neither.
+                        None => Err(anyhow::anyhow!(
+                            "outbound rule requires the proxy for UDP to {target}, but no UDP \
+                             proxy is available (SOCKS5 UDP ASSOCIATE failed, or the upstream \
+                             is an HTTP proxy, which cannot carry UDP) - dropping rather than \
+                             leaking the server's own address"
+                        )),
+                    };
                 }
             }
         }

ostp-tun-helper/build.rs

@@ -4,6 +4,21 @@
 // or launched via ShellExecuteW("runas").
 
 fn main() {
+    // Key off the TARGET, not the host. In a build script `cfg(windows)`
+    // describes the machine doing the building, so cross-compiling the helper
+    // from Windows to Linux took this branch and failed with "Can only compile
+    // resource file when target_env is gnu or msvc". CARGO_CFG_TARGET_OS is the
+    // target being built for, which is what actually decides whether a Windows
+    // manifest belongs in the binary.
+    let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    if target_os != "windows" {
+        return;
+    }
+    // Second gate, on the HOST: winres is declared under
+    // [target.'cfg(windows)'.build-dependencies], and build-dependencies are
+    // resolved against the host triple, so the crate simply does not exist when
+    // building on Linux. Referencing it unconditionally would fail to compile
+    // there even though the target check above already passed.
     #[cfg(windows)]
     {
         let mut res = winres::WindowsResource::new();

ostp-tun-helper/src/main.rs

@@ -24,6 +24,14 @@ fn log_to_file(msg: &str) {
 
 
 
+/// Launch parameters handed over in a file rather than on the command line.
+/// See the `--args-file` handling in `main` for why.
+#[derive(Deserialize)]
+struct HelperArgs {
+    port: u16,
+    token: String,
+}
+
 #[derive(Deserialize)]
 #[serde(tag = "cmd", rename_all = "lowercase")]
 enum GuiCmd {
@@ -76,6 +84,28 @@ async fn main() -> Result<()> {
                 let _ = std::fs::remove_file(path); // securely delete after reading
             }
         }
+        // Both port and token from one file. A Scheduled Task stores a FIXED
+        // command line, so anything that varies per launch cannot be passed as
+        // an argument — the GUI writes this file immediately before triggering
+        // the task instead. That indirection is what lets the task be created
+        // once (a single UAC prompt) and reused for every later connect without
+        // prompting again.
+        if args[i] == "--args-file" && i + 1 < args.len() {
+            let path = &args[i + 1];
+            match std::fs::read_to_string(path) {
+                Ok(content) => {
+                    let _ = std::fs::remove_file(path); // single use
+                    match serde_json::from_str::<HelperArgs>(&content) {
+                        Ok(parsed) => {
+                            port = parsed.port;
+                            expected_token = parsed.token;
+                        }
+                        Err(e) => log_to_file(&format!("Failed to parse --args-file: {e}")),
+                    }
+                }
+                Err(e) => log_to_file(&format!("Failed to read --args-file {path}: {e}")),
+            }
+        }
     }
 
     log_to_file("Helper started (TCP mode)");

ostp/Cargo.toml

@@ -21,3 +21,4 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 ostp-core = { path = "../ostp-core" }
 colored = "2.1"
 rlimit = "0.11.0"
+sha2.workspace = true

ostp/src/main.rs

@@ -28,6 +28,12 @@ enum Commands {
     Init {
         mode: String,
     },
+    /// Hash a password for the web panel's `api.password_hash` config field
+    #[command(name = "hash-password", alias = "hp")]
+    HashPassword {
+        /// The password to hash. Omit to be prompted (keeps it out of shell history).
+        password: Option<String>,
+    },
     /// Generate a new secure access key
     #[command(name = "gk", alias = "generate-key")]
     GenerateKey {
@@ -720,24 +726,18 @@ fn run_setup_wizard(config_path: &std::path::Path) -> Result<()> {
                 }) as char
             }).collect();
             let password  = wizard_prompt("Admin password (blank for random)", &rand_pass);
-            let pass_hash = {
-                use std::fmt::Write as _;
-                let mut hash = String::new();
-                let digest: [u8; 32] = {
-                    use std::collections::hash_map::DefaultHasher;
-                    use std::hash::{Hash, Hasher};
-                    // Panel password hashing. sha2 is not a direct dep of ostp/Cargo.toml,
-                    // so we use std's hasher as a placeholder digest here.
-                    let mut h = DefaultHasher::new();
-                    password.hash(&mut h);
-                    let v = h.finish();
-                    let mut out = [0u8; 32];
-                    out[..8].copy_from_slice(&v.to_be_bytes());
-                    out
-                };
-                for b in digest { let _ = write!(hash, "{:02x}", b); }
-                hash
-            };
+            // Must match api.rs's handle_login exactly (format!("{:x}", Sha256::digest(..))) -
+            // this used to be a DefaultHasher (SipHash) placeholder that produced a
+            // differently-shaped digest, so a password set up through this wizard could
+            // never actually log into the panel it just configured.
+            // Trait-qualified so this compiles whether or not `sha2::Digest` happens
+            // to be in scope: `digest` is a trait method, and relying on the import
+            // alone broke the CI build once (v0.4.2-beta.3) while resolving fine
+            // locally.
+            let pass_hash = format!(
+                "{:x}",
+                <sha2::Sha256 as sha2::Digest>::digest(password.as_bytes())
+            );
 
             wizard_step(4, TOTAL, "Saving configuration");
             let panel_bind = format!("0.0.0.0:{}", panel_port);
@@ -799,18 +799,16 @@ fn run_setup_wizard(config_path: &std::path::Path) -> Result<()> {
             let listen   = wizard_prompt("Listen address (host:port)", "0.0.0.0:50000");
             let upstream = wizard_prompt("Upstream server address (host:port)", "");
             if upstream.is_empty() { anyhow::bail!("Upstream address cannot be empty."); }
-            let api_url  = wizard_prompt("Upstream server API URL (e.g. http://1.2.3.4:9090)", "");
-            let api_token = wizard_prompt("Upstream API token (leave blank if none)", "");
 
             wizard_step(2, TOTAL, "Saving configuration");
+            // No credentials are collected: the relay forwards transparently and
+            // authenticates nothing, so it needs neither the target's API nor a
+            // copy of the access keys.
             let relay_json = serde_json::json!({
                 "mode": "relay",
                 "listen": listen,
                 "upstream_tcp": upstream,
                 "upstream_udp": upstream,
-                "upstream_api_url": api_url,
-                "upstream_api_token": api_token,
-                "sync_interval_secs": 30,
                 "debug": false
             });
 
@@ -926,6 +924,38 @@ async fn run_app() -> Result<()> {
         match cmd {
             Commands::Setup { init } => { args.setup = true; args.init = init; }
             Commands::Init { mode } => { args.init = Some(mode); }
+            Commands::HashPassword { password } => {
+                // The panel stores only a hash, and until now nothing in the CLI
+                // could produce one: `ostp init server` writes password_hash: ""
+                // and the only generator lived inside the Unix-only Server+Panel
+                // wizard branch, leaving no supported way to set up API auth on a
+                // plain server.
+                let password = match password {
+                    Some(p) => p,
+                    None => {
+                        print!("Password: ");
+                        use std::io::Write as _;
+                        std::io::stdout().flush().ok();
+                        let mut buf = String::new();
+                        std::io::stdin().read_line(&mut buf)?;
+                        buf.trim_end_matches(['\r', '\n']).to_string()
+                    }
+                };
+                if password.is_empty() {
+                    anyhow::bail!("password must not be empty");
+                }
+                // Must match api.rs's handle_login byte for byte.
+                let hash = format!(
+                    "{:x}",
+                    <sha2::Sha256 as sha2::Digest>::digest(password.as_bytes())
+                );
+                println!();
+                println!("Add this to the \"api\" section of your config:");
+                println!();
+                println!("  \"password_hash\": \"{hash}\"");
+                println!();
+                return Ok(());
+            }
             Commands::GenerateKey { format, count } => { args.generate_key = true; args.format = format; args.count = count; }
             Commands::Links => { args.links = true; }
             Commands::Check => { args.check = true; }
@@ -1105,7 +1135,9 @@ async fn run_app() -> Result<()> {
                         println!("  Listen: {:?}", r.listen.primary().cyan());
                         println!("  Upstream TCP: {}", r.upstream_tcp.cyan());
                         println!("  Upstream UDP: {}", r.upstream_udp.cyan());
-                        println!("  API sync: {}", r.upstream_api_url.yellow());
+                        if !r.upstream_api_url.is_empty() {
+                            println!("  {}", "upstream_api_url is set but no longer used - safe to remove".yellow());
+                        }
                     }
                 }
             }
@@ -1181,9 +1213,9 @@ async fn run_app() -> Result<()> {
   "listen": "0.0.0.0:50000",
   "upstream_tcp": "TARGET_SERVER_IP:50000",
   "upstream_udp": "TARGET_SERVER_IP:50000",
-  "upstream_api_url": "http://TARGET_SERVER_IP:9090",
-  "upstream_api_token": "YOUR_API_TOKEN_HERE",
-  "sync_interval_secs": 30,
+  // The relay forwards transparently and holds no keys: sessions are
+  // authenticated end-to-end by the target server, which drops anything that
+  // fails. Nothing else needs configuring here.
   "debug": false
 }"#.to_string()
         } else {
@@ -1382,14 +1414,18 @@ async fn run_app() -> Result<()> {
             println!("{} Starting relay node on {:?}", "[ostp]".cyan().bold(), listen_addrs);
             println!("{} Upstream TCP: {}", "[ostp]".cyan().bold(), relay_cfg.upstream_tcp);
             println!("{} Upstream UDP: {}", "[ostp]".cyan().bold(), relay_cfg.upstream_udp);
-            println!("{} Key sync API: {}", "[ostp]".cyan().bold(), relay_cfg.upstream_api_url);
+            if !relay_cfg.upstream_api_url.is_empty() {
+                println!(
+                    "{} Note: upstream_api_url is no longer used and can be removed. The relay \
+                     forwards transparently; sessions are authenticated end-to-end by the target \
+                     server.",
+                    "[ostp]".yellow().bold()
+                );
+            }
             let relay_config = ostp_server::RelayConfig {
                 listen_addrs,
                 upstream_tcp: relay_cfg.upstream_tcp,
                 upstream_udp: relay_cfg.upstream_udp,
-                upstream_api_url: relay_cfg.upstream_api_url,
-                upstream_api_token: relay_cfg.upstream_api_token,
-                sync_interval_secs: relay_cfg.sync_interval_secs,
             };
             ostp_server::relay_node::run_relay_node(relay_config).await?;
         }

scripts/install.sh

@@ -115,12 +115,18 @@ if [ -n "$TARGET_VERSION" ]; then
     fi
     echo "Fetching requested release $LATEST_RELEASE..."
 else
-    if [ "$TARGET_BRANCH" == "alpha" ]; then
-        echo "Fetching alpha release..."
-        LATEST_RELEASE="alpha"
-    elif [ "$TARGET_BRANCH" == "beta" ]; then
-        echo "Fetching beta release..."
-        LATEST_RELEASE="beta"
+    if [ "$TARGET_BRANCH" == "alpha" ] || [ "$TARGET_BRANCH" == "beta" ]; then
+        # There is no floating "alpha"/"beta" GitHub Release - gha.ps1 cuts a
+        # fresh versioned tag every time (v0.4.2-beta.4, v0.4.2-alpha.7, ...).
+        # /releases/latest only ever returns the newest NON-prerelease
+        # (stable) tag, so it can't find these. Query the full releases list
+        # (newest first) and take the first tag_name containing "-$TARGET_BRANCH".
+        echo "Fetching latest ${TARGET_BRANCH} release..."
+        LATEST_RELEASE=$(curl -s "https://api.github.com/repos/${GITHUB_REPO}/releases" \
+            | grep '"tag_name":' \
+            | grep -- "-${TARGET_BRANCH}" \
+            | head -1 \
+            | sed -E 's/.*"tag_name": *"([^"]+)".*/\1/')
     else
         echo "Fetching latest stable release..."
         LATEST_RELEASE=$(curl -s "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')