smc: defer subscription cleanup + strict arg validation across handlers

Six Copilot findings:

1. lantern-core/core.go's listenPeerConnectionEvents subscribed
   to unbounded.ConnectionEvent and started a goroutine waiting
   on ctx.Done to unsubscribe. If client.PeerConnectionEvents
   returned an error while ctx was still live, the function
   returned but the ctx-watcher goroutine + subscription leaked
   for the rest of the process. Replaced with 'defer
   unbSub.Unsubscribe()' so cleanup runs on both exit paths
   (normal ctx cancel + unexpected stream exit).

2. iOS handler comment said the SmC setter helpers use a
   'detached Task' but the implementation uses 'Task {}'. Updated
   the comment to describe the actual choice — plain Task is
   fine for the millisecond-range PatchSettings calls because
   inheriting the current actor's executor is cheap; the
   probeUPnP case is the one exception that uses Task.detached
   because its M-SEARCH wait is multi-second.

3-5. macOS / iOS handlers had unsafe defaults on the SmC setters:
     - setPeerProxyEnabled: defaulted enabled=false on missing arg
       (would silently disable sharing on caller bugs)
     - setPeerManualPort: defaulted port=0 on missing arg (would
       silently clear the user's manual port override, since 0
       has the real semantic of 'no manual port')
     - setUnboundedEnabled: same Bool-defaults-to-false issue
       (Copilot didn't flag this one but it has the identical
       problem)
     All four now route through requireArg, which surfaces a
     FlutterError on missing/invalid argument shape instead of
     defaulting silently.

6. Android setPeerManualPort defaulted port=0 the same way.
   Switched the elvis '?: 0' to '?: error("Missing port")' to
   match the SetPeerProxyEnabled pattern on Android.

Go build clean. The Swift / Kotlin changes are mechanical and
follow patterns already established in the same files
(requireArg / error()-on-missing).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: myleshorton

android/app/src/main/kotlin/org/getlantern/lantern/handler/MethodHandler.kt

@@ -1251,7 +1251,11 @@ class MethodHandler : FlutterPlugin,
 
             Methods.SetPeerManualPort.method -> {
                 scope.handleResult(result, "set_peer_manual_port") {
-                    val port = call.argument<Int>("port") ?: 0
+                    // error() surfaces the failure rather than silently
+                    // defaulting to 0 — which would clear the user's
+                    // manual port override on caller bugs. Matches the
+                    // SetPeerProxyEnabled pattern above.
+                    val port = call.argument<Int>("port") ?: error("Missing port")
                     Mobile.setPeerManualPort(port.toLong())
                 }
             }

ios/Runner/Handlers/MethodHandler.swift

@@ -269,8 +269,10 @@ class MethodHandler {
       // the router. The whole stack is exposed on iOS rather than
       // desktop-only.
       case "setPeerProxyEnabled":
-        let data = call.arguments as? [String: Any]
-        let enabled = data?["enabled"] as? Bool ?? false
+        // requireArg surfaces a FlutterError on missing/invalid
+        // argument shape instead of silently defaulting to false
+        // (which would disable sharing on caller bugs).
+        guard let enabled: Bool = requireArg(call: call, name: "enabled", result: result) else { return }
         self.setPeerProxyEnabled(result: result, enabled: enabled)
 
       case "isPeerProxyEnabled":
@@ -279,8 +281,12 @@ class MethodHandler {
         }
 
       case "setPeerManualPort":
-        let data = call.arguments as? [String: Any]
-        let port = data?["port"] as? Int ?? 0
+        // requireArg surfaces a FlutterError on missing/invalid
+        // argument shape instead of silently defaulting to 0
+        // (which has the real semantic of clearing the manual port
+        // override — caller bugs would silently wipe the user's
+        // setting).
+        guard let port: Int = requireArg(call: call, name: "port", result: result) else { return }
         self.setPeerManualPort(result: result, port: port)
 
       case "getPeerManualPort":
@@ -289,8 +295,7 @@ class MethodHandler {
         }
 
       case "setUnboundedEnabled":
-        let data = call.arguments as? [String: Any]
-        let enabled = data?["enabled"] as? Bool ?? false
+        guard let enabled: Bool = requireArg(call: call, name: "enabled", result: result) else { return }
         self.setUnboundedEnabled(result: result, enabled: enabled)
 
       case "isUnboundedEnabled":
@@ -1173,8 +1178,12 @@ class MethodHandler {
   }
 
   // Share My Connection (samizdat) toggle. Mirrors the macOS handler's
-  // pattern: blocking Mobile call goes onto a detached Task; result
-  // and error delivery hop to MainActor.
+  // pattern: blocking Mobile call goes onto a Task; result and error
+  // delivery hop to MainActor. Plain Task (not Task.detached) is fine
+  // for these PatchSettings calls — they finish in milliseconds, so
+  // inheriting the current actor's executor is cheap. probeUPnP is
+  // the one exception that uses Task.detached because its M-SEARCH
+  // wait is multi-second.
   func setPeerProxyEnabled(result: @escaping FlutterResult, enabled: Bool) {
     Task {
       var error: NSError?

lantern-core/core.go

@@ -425,11 +425,12 @@ func (lc *LanternCore) listenPeerConnectionEvents() {
 	// hit here today. Worth revisiting if Unbounded ever moves out of
 	// process.
 	//
-	// The subscription is tied to ctx via a separate goroutine that
-	// calls Unsubscribe on Done. Without this, a reinitialization of
-	// LanternCore over the process lifetime would leak handlers and
-	// events.Emit would fan out each connection event to N stale
-	// registrations.
+	// defer Unsubscribe so cleanup runs on EITHER path that exits
+	// this function: ctx cancel (normal) OR PeerConnectionEvents
+	// returning an error (unexpected stream exit). The earlier
+	// ctx-watching goroutine missed the error path and leaked both
+	// the goroutine and the subscription whenever the SSE stream
+	// died while ctx was still live.
 	unbSub := events.Subscribe(func(evt unbounded.ConnectionEvent) {
 		jsonBytes, err := json.Marshal(map[string]any{
 			"state":     evt.State,
@@ -442,10 +443,7 @@ func (lc *LanternCore) listenPeerConnectionEvents() {
 		}
 		lc.notifyFlutter(EventTypePeerConnection, string(jsonBytes))
 	})
-	go func() {
-		<-lc.ctx.Done()
-		unbSub.Unsubscribe()
-	}()
+	defer unbSub.Unsubscribe()
 
 	// peer.ConnectionEvent: subscribe via the IPC client's SSE stream.
 	// The events package's globals are process-scoped — events.Emit in

macos/Runner/Handlers/MethodHandler.swift

@@ -251,13 +251,19 @@ class MethodHandler {
         }
 
       case "setPeerProxyEnabled":
-        let data = call.arguments as? [String: Any]
-        let enabled = data?["enabled"] as? Bool ?? false
+        // requireArg surfaces a FlutterError on missing/invalid
+        // argument shape rather than silently defaulting to false
+        // (which would disable sharing on caller bugs).
+        guard let enabled: Bool = requireArg(call: call, name: "enabled", result: result) else { return }
         self.setPeerProxyEnabled(result: result, enabled: enabled)
 
       case "setPeerManualPort":
-        let data = call.arguments as? [String: Any]
-        let port = data?["port"] as? Int ?? 0
+        // requireArg surfaces a FlutterError on missing/invalid
+        // argument shape rather than silently defaulting to 0
+        // (which has the real semantic of clearing the manual port
+        // override — caller bugs would silently wipe the user's
+        // setting).
+        guard let port: Int = requireArg(call: call, name: "port", result: result) else { return }
         self.setPeerManualPort(result: result, port: port)
 
       case "getPeerManualPort":
@@ -266,8 +272,7 @@ class MethodHandler {
         }
 
       case "setUnboundedEnabled":
-        let data = call.arguments as? [String: Any]
-        let enabled = data?["enabled"] as? Bool ?? false
+        guard let enabled: Bool = requireArg(call: call, name: "enabled", result: result) else { return }
         self.setUnboundedEnabled(result: result, enabled: enabled)
 
       case "isUnboundedEnabled":