update ci

.github/workflows/build.yml

@@ -33,6 +33,10 @@ jobs:
           distribution: 'temurin'
           java-version: '17'
 
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.x'
+
       - name: Determine build type
         id: build-type
         run: |
@@ -55,6 +59,18 @@ jobs:
         with:
           node-version: 20
 
+      - name: Cache Go build dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+            ~/go/bin/gomobile
+            ~/go/bin/gobind
+          key: ${{ runner.os }}-go-runtime-${{ hashFiles('native/go_mobile_runtime/pins.env') }}
+          restore-keys: |
+            ${{ runner.os }}-go-runtime-
+
       - name: Download bundle dependencies
         if: steps.build-type.outputs.is_prerelease == 'false'
         run: |
@@ -71,13 +87,13 @@ jobs:
       - uses: subosito/flutter-action@v2
         with:
           channel: stable
-          flutter-version: 3.41.6
+          flutter-version: 3.44.0
           cache: true
 
       - name: Setup Flutter dependencies
         run: |
           dart pub global activate melos
-          melos bootstrap
+          melos bootstrap --no-select
 
       - name: Update external assets
         run: melos run update-assets --no-select
@@ -85,6 +101,26 @@ jobs:
       - name: Build components
         run: melos run build-components --no-select
 
+      - name: Checkout native runtime sources
+        run: |
+          set -euo pipefail
+          source native/go_mobile_runtime/pins.env
+
+          git clone https://github.com/SagerNet/sing-box.git "$RUNNER_TEMP/sing-box"
+          git -C "$RUNNER_TEMP/sing-box" checkout "$SING_BOX_TAG"
+          test "$(git -C "$RUNNER_TEMP/sing-box" rev-parse HEAD)" = "$SING_BOX_COMMIT"
+
+          git clone https://github.com/tladesignz/IPtProxy.git "$RUNNER_TEMP/IPtProxy"
+          git -C "$RUNNER_TEMP/IPtProxy" checkout "$IPTPROXY_TAG"
+          test "$(git -C "$RUNNER_TEMP/IPtProxy" rev-parse HEAD)" = "$IPTPROXY_COMMIT"
+          git -C "$RUNNER_TEMP/IPtProxy" submodule update --init dnstt
+
+      - name: Build native gomobile runtime
+        env:
+          SING_BOX_SOURCE: ${{ runner.temp }}/sing-box
+          IPTPROXY_SOURCE: ${{ runner.temp }}/IPtProxy
+        run: melos run build-go-runtime --no-select
+
       - name: Build APK (Alpha)
         if: steps.build-type.outputs.is_prerelease == 'true'
         run: melos run build-browser-alpha --no-select

native/go_mobile_runtime/README.md

@@ -16,7 +16,7 @@ Pinned inputs are defined in `pins.env`:
 Build locally from the repository root:
 
 ```sh
-native/go_mobile_runtime/scripts/build-android.sh
+melos run build-go-runtime --no-select
 ```
 
 The default source locations are sibling checkouts of this repository:
@@ -36,3 +36,6 @@ native/go_mobile_runtime/scripts/build-android.sh \
 ```
 
 The output AAR is written to `native/go_mobile_runtime/build/weblibre-go.aar`.
+
+GitHub release builds clone the pinned sources from `pins.env` and run the same
+Melos command before building the Flutter APK/AAB artifacts.

packages/flutter_singbox_proxy/README.md

@@ -13,23 +13,22 @@ Current state:
 - Returns runtime endpoint metadata for Gecko container proxy integration.
 - Exposes status/log callbacks.
 - Starts libbox via reflection against the `io.nekohasekai.libbox.*` classes
-  shipped in the AAR — if the AAR is missing, the plugin still compiles but
-  `start` reports an `IllegalStateException` at runtime.
+  shipped in the combined WebLibre gomobile AAR.
 
-## Building official sing-box libbox
+## Building the Android gomobile runtime
 
-The plugin does not commit binary AARs. Build them from the official sing-box
-checkout before release/F-Droid builds:
+The app uses one combined gomobile AAR for sing-box `libbox` and IPtProxy,
+because multiple gomobile AARs in one Android app collide on generated runtime
+symbols. Build it from the repository root before release/F-Droid builds:
 
 ```sh
-packages/flutter_singbox_proxy/scripts/build-libbox-android.sh \
-  --source /path/to/sing-box
+melos run build-go-runtime --no-select
 ```
 
-By default the script looks for `../../../sing-box` relative to this package,
-which matches the local workspace layout used during development. It copies
-`libbox.aar` into `android/libs/`; Gradle consumes that AAR automatically when
-present.
+By default the script looks for sibling `../sing-box` and `../IPtProxy`
+checkouts relative to this repository. It writes
+`native/go_mobile_runtime/build/weblibre-go.aar`; Gradle requires that AAR
+before compiling this plugin.
 
 For F-Droid metadata, call the package-local prebuild script:
 
@@ -45,15 +44,16 @@ official SagerNet gomobile tools with `go install`.
 
 ### Version compatibility
 
-The script pins `github.com/sagernet/gomobile/cmd/gomobile@v0.1.12` and
-`gobind@v0.1.12`. The sing-box source itself is whatever you point `--source`
-at; the runtime accesses `io.nekohasekai.libbox.*` via reflection, so API drift
-across sing-box releases surfaces as a `NoSuchMethodException` at start time
-rather than a build failure. When bumping sing-box:
+The combined runtime pins sing-box, IPtProxy, dnstt, and gomobile in
+`native/go_mobile_runtime/pins.env`. The runtime accesses
+`io.nekohasekai.libbox.*` via reflection, so API drift across sing-box releases
+surfaces as a `NoSuchMethodException` at start time rather than a build failure.
+When bumping sing-box:
 
-1. Rebuild the AAR with the new tag.
-2. Smoke-test `start`/`stop` on a profile to catch missing/renamed setup
+1. Update `native/go_mobile_runtime/pins.env`.
+2. Rebuild the AAR with the new tag.
+3. Smoke-test `start`/`stop` on a profile to catch missing/renamed setup
    methods (notably `SetupOptions.setOomKillerDisabled` /
-   `setOomKillerEnabled` — `LibboxRuntime` falls back between the two).
-3. Update this README with the verified sing-box tag if relying on it for a
+   `setOomKillerEnabled` - `LibboxRuntime` falls back between the two).
+4. Update this README with the verified sing-box tag if relying on it for a
    release.

pubspec.yaml

@@ -82,6 +82,9 @@ melos:
     build-singbox-libbox:
       description: Build official sing-box Android libbox AAR for flutter_singbox_proxy
       run: packages/flutter_singbox_proxy/scripts/build-libbox-android.sh
+    build-go-runtime:
+      description: Build combined Android gomobile runtime AAR for proxy plugins
+      run: native/go_mobile_runtime/scripts/build-android.sh
     build-browser:
       description: Build stable release APK split per ABI
       run: |