ArcadiaPlus

byChar0n · Security & Privacy

Verified safeOpen sourceExclusive

Download APK

—

No reviews reviews

downloads

7.0

android

AI summary

Cross-platform proxy and VPN client for user-supplied Clash-shaped profiles, with rule-set management, DNS options, and per-rule hit counts. Android updates improve VPN recovery, DNS forwarding, TCP handling, and TLS negotiation.

Generated by AI. May contain inaccuracies.

About this app

ArcadiaPlus is a cross-platform proxy client: Flutter owns the interface and the per-platform takeover, and the Rust side is a single FFI bridge — the proxy engine, DNS, the TUN data path, and every protocol come from corduit.

It reads Clash-shaped profiles (proxies, proxy-groups, rules, rule-providers, dns), translates them into the rule table the engine executes, and shows what that engine is doing: the table itself, per-rule hit counts, what conversion dropped, and when each rule set last refreshed. It ships no servers, nodes, or subscriptions — you supply the configuration, and lawful use is on you.

The sections below state what the current build actually does, including the platforms where support cannot yet be claimed.

Implemented Scope Flutter Material Design 3 UI with light/dark themes, dynamic color, Google Fonts, responsive navigation, and component/page motion. A single Rust bridge layer: the proxy engine, DNS, TUN data path, and every proxy protocol come from corduit 0.2.7, and this repository no longer reimplements them. The bridge owns sync/async adaptation, DTO mapping, and platform entry points. Explicit configuration downgrades: a node whose protocol corduit cannot build is dropped and its references fall back to DIRECT, and a rule type corduit has no rule for is skipped — every downgrade is reported through onWarning, never silent. Optional local recursion: with it enabled, RecurseX resolves from the root servers iteratively and corduit's DNS upstreams point at that front-end. Rule sets (rule-providers) are owned by the Dart side: RuleProviderService downloads, validates, normalises, and caches them in the app's private directory, then refreshes each one on the interval the profile declares (86400 seconds by default). The engine only ever receives local file providers, a failed refresh keeps the last good copy, and a rule set that is missing takes its RULE-SET rules out of the profile the way Clash does — with a warning, and without failing the rest of the config. The GeoIP database ships with the installer (assets/Country.mmdb), is unpacked into the app support directory at start-up, and is registered with the engine; a failure to unpack or register is recorded, and GEOIP rules simply do not match while it is missing — never a silent downgrade. Shared Rust TUN packet processing for Android, Windows, and Linux, with platform-owned device lifecycles. Generated app icons for Windows, macOS, Linux, Android, iOS, and HarmonyOS NEXT from assets/arcadiaplus.png.

proxy vpn networking privacy dns open source

What's new

v1.1.0Nov 12, 2026

Give configured DNS forwarding its existing end-to-end query budget instead of splitting a 1.5-second exchange timeout across the entire upstream group. Add a delayed-response regression that fails with the former deadline.
Retain TUN download bytes until cumulatively acknowledged, respect the application's TCP receive window, retry lost segments and probe closed windows. Delay FIN until the response is acknowledged and preserve uploads after a remote half-close. Cover packet loss, zero-window recovery, sequence wrap and half-close with protocol and loopback tests.
Fix companion Courierust TLS negotiation: advertise both enabled versions, enforce RFC 8446 downgrade markers in the correct direction, and complete the advertised X25519 client key exchange for TLS 1.2. Verify TLS 1.2 and TLS 1.3 against OpenSSL with certificate and hostname checks enabled.
Add a reproducible local Android build against sibling engine sources and an independent application-UID VPN probe covering DNS, HTTPS and VPN ownership. No dependency sources are vendored.
Move intercepted TUN DNS queries onto a bounded worker queue so upstream timeouts cannot block TCP packet processing. Discard queued queries and suppress late DNS replies when the tunnel stops; the engine change lives in the Corduit source repository.
Resume a saved Android VPN session when the UI returns after a process exit, provided the user has not stopped the session or revoked VPN consent. Do not rely solely on the device delivering a sticky-service restart.
Add an ADB verification command that installs an ordinary-UID diagnostic application, checks VPN ownership, exercises DNS and verified HTTPS, and returns failure when any check fails. Root-shell network probes are not accepted as evidence of application VPN connectivity.
Restore the Android VPN engine, selector choices, routing mode and local recursive DNS after a sticky service restart. Store restart state atomically in the app's private, backup-excluded directory; explicit disconnects disable recovery before teardown.
Hold a partial wake lock while the VPN is active, keep the service independent of the recent-task entry, and release native resources off the Android main thread. Report actual JNI protection readiness instead of assuming initialization succeeded.
Reconcile the Flutter UI with a VPN restored by Android. Add a real engine restart regression and an opt-in CNAME/dual-stack DNS check for the reported jpushsc.m.jd.com failure.
Companion Corduit source fixes retry interrupted relay I/O and parse SOCKS5 replies without over-reading or length underflow. CI/release builds require published versions containing both the Corduit and Courierust fixes; local validation uses the sibling repositories without vendoring them.