v1.3.0: per-deployment concurrency, ABI-split APKs, ONLY-mode fix

Rolls up the four post-v1.2.14 commits on main into a single tagged
release. Highlights:

- Per-deployment concurrency (#142): each deployment ID gets its own
  30-permit semaphore, so setups with deployments across multiple
  Google accounts get a genuine 30×N throughput ceiling. Single-account
  setups still cap at Google's per-account 30-simultaneous limit —
  docs (EN + FA) updated to call that out.
- Android app-splitting ONLY-mode bug fix (#143): the previous code
  called both addAllowedApplication and addDisallowedApplication,
  which Android documents as mutually exclusive. ONLY mode was
  silently failing establish(). Now fixed.
- Per-ABI Android APKs (#136): ships four split APKs (arm64-v8a ~21 MB,
  armeabi-v7a ~18 MB, x86_64 ~23 MB, x86 ~22 MB) alongside the ~53 MB
  universal. Huge distribution win for users on unreliable
  censorship-tunnel paths — the 21 MB arm64-v8a download succeeds
  where the universal doesn't.
- Honest IP-exposure note in Security Posture (#148): clarified that
  v1.2.9's forwarded-header stripping only covers the client-side leg;
  what Google's own infrastructure may add on the UrlFetchApp.fetch()
  second leg is outside this client's control. Full Tunnel mode is
  the recommendation for threat models where that matters.
- Telegram release-post format: added Persian preambles above both
  links (GitHub repo + full Persian guide; release page + desktop/
  router builds) so channel readers see the intent at a glance.

82 tests pass. Desktop + Android builds both verified clean locally
across the v1.2.15+ commit series.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: therealaleph

.github/scripts/telegram_release_notify.py

@@ -179,10 +179,21 @@ def main() -> int:
 
     ver = args.version
     sha = sha256_of(args.apk)
+    # Caption structure requested by the repo owner:
+    #   1. Title + SHA-256 (as before)
+    #   2. Persian preamble labelling the repo link as
+    #      "GitHub repo + full Persian guide"
+    #   3. Repo URL
+    #   4. Persian preamble labelling the release link as
+    #      "this version's release — desktop/router builds live here"
+    #   5. Release URL
+    # Keeps total well under Telegram's 1024-char caption limit.
     caption = (
         f"<b>mhrv-rs Android v{ver}</b>\n\n"
-        f"SHA-256: <code>{sha}</code>\n"
-        f"https://github.com/{args.repo}\n"
+        f"SHA-256: <code>{sha}</code>\n\n"
+        f"مخزن گیتهاب  + مطالعه راهنمای کامل فارسی:\n"
+        f"https://github.com/{args.repo}\n\n"
+        f"لینک به این نسخه جهت دریافت نسخه های مربوط به مودم و کامپیوتر:\n"
         f"https://github.com/{args.repo}/releases/tag/v{ver}"
     )
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "mhrv-rs"
-version = "1.2.14"
+version = "1.3.0"
 edition = "2021"
 description = "Rust port of MasterHttpRelayVPN -- DPI bypass via Google Apps Script relay with domain fronting"
 license = "MIT"

Cargo.toml

@@ -14,8 +14,8 @@ android {
         applicationId = "com.therealaleph.mhrv"
         minSdk = 24 // Android 7.0 — covers 99%+ of live devices.
         targetSdk = 34
-        versionCode = 134
-        versionName = "1.2.14"
+        versionCode = 135
+        versionName = "1.3.0"
 
         // Ship all four mainstream Android ABIs:
         //   - arm64-v8a      — 95%+ of real-world Android phones since 2019

android/app/build.gradle.kts

@@ -0,0 +1,12 @@
+<!-- see docs/changelog/v1.1.0.md for the file format: Persian, then `---`, then English. -->
+• همزمانی ۳۰ درخواست به ازای هر Deployment در حالت `full` ([#142](https://github.com/therealaleph/MasterHttpRelayVPN-RUST/pull/142)): پیش‌تر سقف pipeline کل = تعداد Deploymentها بود (مثلاً ۳ دیپلوی = ۳ درخواست همزمان). حالا هر Deployment حوضچهٔ همزمانی مخصوص خودش با ۳۰ مجوز داره، مطابق سقف اجرای همزمان ‫Apps Script‬ به ازای هر **حساب**. **توجه مهم:** این ۳۰×N فقط وقتی به طور کامل تحقق پیدا می‌کنه که هر Deployment روی یک حساب گوگل جداگانه باشه. چند Deployment روی یک حساب همچنان در همون سقف ۳۰ هر حساب سهیم‌اند — اگه بیشتر بفرستید، گوگل `Too many simultaneous invocations` برمی‌گردونه. مستندات ‫EN‬ + ‫FA‬ برای این موضوع به‌روز شدن
+• رفع باگ App Splitting حالت ONLY در اندروید ([#143](https://github.com/therealaleph/MasterHttpRelayVPN-RUST/pull/143)): کد قبلی هم `addAllowedApplication` و هم `addDisallowedApplication` رو روی یک Builder صدا می‌زد، که طبق مستندات اندروید mutually exclusive هستن — نتیجه: `establish()` در سکوت fail می‌شد و حالت ONLY عملاً کار نمی‌کرد. حالا self-exclude داخل شاخهٔ `when` منتقل شده و فقط در حالات ALL و EXCEPT اعمال میشه
+• انتشار APKهای جداگانه per-ABI برای اندروید ([#136](https://github.com/therealaleph/MasterHttpRelayVPN-RUST/issues/136)): علاوه بر ‫APK‬ universal ~۵۳ مگابایتی، حالا چهار ‫APK‬ جداگانه هم منتشر میشن: `arm64-v8a` (~۲۱ مگ، اکثر گوشی‌های مدرن)، `armeabi-v7a` (~۱۸ مگ، گوشی‌های قدیمی‌تر)، `x86_64` و `x86` (~۲۲ مگ هر کدام). برای کاربران در شبکه‌های محدود که دانلود ۵۰ مگابایتی قابل اتکا نیست، APK ~۲۱ مگابایتی `arm64-v8a` احتمال موفقیت بسیار بیشتری داره. نام universal عوض نشده، لینک‌های قدیمی کار می‌کنن
+• شفاف‌سازی مدل تهدید `IP` در بخش امنیت README ([#148](https://github.com/therealaleph/MasterHttpRelayVPN-RUST/issues/148)): حذف هدرهای forwarded در نسخهٔ ۱.۲.۹ فقط پایهٔ اول (کلاینت → ‫Apps Script‬) رو پوشش می‌ده. هدرهایی که زیرساخت داخلی گوگل ممکنه روی فراخوانی بعدی `UrlFetchApp.fetch()` اضافه کنه خارج از کنترل این کلاینت هستن. برای مدل‌های تهدیدی که لازمه سرور مقصد تحت هیچ شرایطی ‫IP‬ واقعی کاربر رو نبینه، توصیه میشه از حالت Full Tunnel استفاده بشه که از ‫VPS‬ شخصی خارج میشه
+• قالب‌بندی Telegram release post: متن فارسی توضیحی بالای هر لینک (مخزن گیتهاب + راهنمای کامل، لینک نسخه) اضافه شد تا کاربران فارسی‌زبان بلافاصله بفهمن هر لینک چیه
+---
+• Per-deployment concurrency in `full` mode ([#142](https://github.com/therealaleph/MasterHttpRelayVPN-RUST/pull/142)): previously the pipeline depth was capped at `number_of_deployments` total (e.g. 3 deployments = 3 in-flight batches). Now each deployment ID gets its own concurrency pool of 30 permits, matching the per-Apps-Script-account simultaneous-executions limit. **Important caveat:** the 30×N math only holds if each deployment lives in a separate Google account. Multiple deployments under one account still share that single account's 30-slot bucket; exceeding it returns `Too many simultaneous invocations`. Both EN and FA README sections updated to reflect this
+• Android app-splitting ONLY mode bug fix ([#143](https://github.com/therealaleph/MasterHttpRelayVPN-RUST/pull/143)): the previous code called `addAllowedApplication` and `addDisallowedApplication` on the same `VpnService.Builder` — Android documents these as mutually exclusive, and the result was that `establish()` silently failed in ONLY mode (manifested as "ONLY mode doesn't work, everything still tunnels / nothing tunnels"). The self-exclude is now inside the `when` branch and only fires in ALL / EXCEPT modes
+• Per-ABI Android APKs in addition to the universal ([#136](https://github.com/therealaleph/MasterHttpRelayVPN-RUST/issues/136)): releases now ship four split APKs alongside the ~53 MB universal: `arm64-v8a` (~21 MB, covers 95%+ of modern devices), `armeabi-v7a` (~18 MB, older 32-bit ARM), `x86_64` (~23 MB, emulators / Chromebooks), and `x86` (~22 MB, legacy emulators). Users on unreliable censorship-tunnel paths — where a 50 MB download often fails — now have a 21 MB `arm64-v8a` option that's much more likely to succeed. The universal APK keeps its existing filename so existing download links, Telegram mirrors, and in-app update prompts keep working
+• Honest IP-exposure note added to the Security Posture section ([#148](https://github.com/therealaleph/MasterHttpRelayVPN-RUST/issues/148)): the v1.2.9 forwarded-header stripping only covers the first leg (client → Apps Script). Whatever Google's infrastructure may add on the subsequent `UrlFetchApp.fetch()` to the destination is outside this client's control. For threat models where the destination must not learn the user's IP under any circumstances, the recommendation is Full Tunnel mode (traffic exits via the user's own VPS end-to-end)
+• Telegram release-post format: added Persian preambles above the GitHub repo link ("GitHub repo + full Persian guide") and the release link ("this version's release, with desktop/router builds"), so Persian-speaking channel readers see the intent of each link at a glance