fix(android): secure local proxy entry and CI delivery

.gitattributes

@@ -0,0 +1,2 @@
+# Stored Git patches contain source-context whitespace by design.
+tool/patches/*.patch text eol=lf whitespace=-trailing-space,-space-before-tab

.github/workflows/build.yaml

@@ -28,6 +28,9 @@ jobs:
       - name: Install dependencies
         run: flutter pub get
 
+      - name: Apply Clash.Meta patches
+        run: dart tool/apply_clash_meta_patches.dart
+
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
@@ -46,6 +49,10 @@ jobs:
           CGO_ENABLED: '0'
         run: go test .
 
+      - name: Test Android local proxy UDP security
+        working-directory: core/Clash.Meta
+        run: go test ./listener -run '^TestShouldDisableDefaultUDP$' -count=1
+
       - name: Verify delay test concurrency alignment
         run: ruby tool/verify_delay_test_concurrency.rb
 

.github/workflows/pull-request-validation.yaml

@@ -86,6 +86,16 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Setup Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          cache: true
+
+      - name: Apply Clash.Meta patches
+        run: dart tool/apply_clash_meta_patches.dart
+
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
@@ -98,6 +108,10 @@ jobs:
           CGO_ENABLED: '0'
         run: go test .
 
+      - name: Test Android local proxy UDP security
+        working-directory: core/Clash.Meta
+        run: go test ./listener -run '^TestShouldDisableDefaultUDP$' -count=1
+
   go-vet:
     name: Go vet
     runs-on: ubuntu-latest
@@ -529,6 +543,10 @@ jobs:
             script: tool/verify_android_tile_background_toggle.rb
           - id: android-vpn-stop-cleanup
             script: tool/verify_android_proxy_stop.rb
+          - id: android-local-proxy-security
+            script: tool/verify_android_local_proxy_security.rb
+          - id: clash-meta-patch-delivery
+            script: tool/verify_clash_meta_patch_delivery.rb
           - id: android-service-lifecycle
             script: tool/verify_android_service_lifecycle.rb
           - id: linux-x11-thread

.gitignore

@@ -46,6 +46,7 @@ app.*.map.json
 
 # Documentation (generated/planning artifacts)
 docs/
+/.worktrees/
 
 
 # Android Studio will place build artifacts here
@@ -74,4 +75,4 @@ devtools_options.yaml
 
 # FVM Version Cache
 .fvm/
-.fvmrc
+.fvmrc

android/service/src/main/java/com/follow/clash/service/VpnService.kt

@@ -2,7 +2,6 @@ package com.follow.clash.service
 
 import android.content.Intent
 import android.net.ConnectivityManager
-import android.net.ProxyInfo
 import android.os.Binder
 import android.os.Build
 import android.os.IBinder
@@ -219,14 +218,6 @@ class VpnService : SystemVpnService(), IBaseService,
             if (options.allowBypass) {
                 allowBypass()
             }
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q && options.systemProxy) {
-                GlobalState.log("Open http proxy")
-                setHttpProxy(
-                    ProxyInfo.buildDirectProxy(
-                        "127.0.0.1", options.port, options.bypassDomain
-                    )
-                )
-            }
             establish()?.detachFd()
                 ?: throw NullPointerException("Establish VPN rejected by system")
         }