add: Tor anti-censorship with failsafe, obfs4 bridges, and advanced UI

Always-on failsafe: when Tor is enabled but inactive (mid-bootstrap, mid-toggle,
post-failure), all relay and HTTP traffic routes to a blackhole proxy instead
of leaking to clearnet. Cache flip happens after stop, never before.

Per-account lifecycle: TorService stops on logout, account switch, and account
create, then restarts with the new account's preference. SOCKS task drains via
JoinSet so state-dir locks release deterministically before runtime drop.

Bridges with obfs4: vanilla and obfs4 supported via arti's pluggable transport
layer. Bridge reconfigure uses arti's Reconfigure::AllOrNothing then re-bootstraps
in place (no stop+start lock contention). System-installed obfs4proxy with inline
detection banner and per-OS install hints. Auto-disables bridges when obfs4 lines
exist but obfs4proxy is missing, falling back to direct Tor.

Compile-time leak prevention: clippy disallowed_methods lint blocks raw reqwest
client construction in first-party code, forcing all HTTP through the canonical
build_http_client path that respects transport state.

Per-stream isolation: each relay socket and HTTP request gets a fresh
IsolationToken. Token rotates on circuit rebuild and bridge reconfigure so
post-cycle traffic doesn't share circuits with pre-cycle.

Advanced UI: live circuit display with rail and traveling pulse, hop position
labels, fingerprint hex with hover-to-full, rebuild button, bridges section
with horizontal-scroll textarea and apply-on-diff. Login lockscreen shows
"Bootstrapping Tor NN%" while the first connection establishes.

Android background sync: Tor lifecycle integrated. After client.disconnect,
stop_and_join_if_running awaits SOCKS drain before the transient runtime drops.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: JSKitty

crates/Cargo.lock

@@ -0,0 +1,9 @@
+# Forbid raw reqwest::Client construction outside the canonical entry point.
+# `vector_core::net::build_http_client` honors the Tor failsafe (proxy when
+# Tor is up, blackhole when Tor is enabled-but-bootstrapping). Bypassing it
+# can leak clearnet traffic when the user has Tor enabled.
+disallowed-methods = [
+    { path = "reqwest::Client::new", reason = "Use vector_core::net::build_http_client so the Tor failsafe applies (or annotate this call site with #[allow(clippy::disallowed_methods)] if you genuinely need a raw client and have audited why it's safe)." },
+    { path = "reqwest::Client::builder", reason = "Use vector_core::net::build_http_client so the Tor failsafe applies." },
+    { path = "reqwest::ClientBuilder::new", reason = "Use vector_core::net::build_http_client so the Tor failsafe applies." },
+]

crates/clippy.toml

@@ -65,8 +65,15 @@ rustls = { version = "0.23", default-features = false, features = ["ring", "logg
 # workspace resolves through one consistent source — patching only tor-dirmgr
 # while siblings come from crates.io creates a tor_protover type-identity
 # split that breaks the build with 150+ trait-mismatch errors.
-arti-client = { git = "https://github.com/VectorPrivacy/arti.git", branch = "vector/rusqlite-0.32", default-features = false, features = ["tokio", "rustls"], optional = true }
+arti-client = { git = "https://github.com/VectorPrivacy/arti.git", branch = "vector/rusqlite-0.32", default-features = false, features = ["tokio", "rustls", "experimental-api", "bridge-client", "pt-client"], optional = true }
 tor-rtcompat = { git = "https://github.com/VectorPrivacy/arti.git", branch = "vector/rusqlite-0.32", default-features = false, features = ["tokio", "rustls"], optional = true }
+# For circuit introspection (the "Advanced" panel showing live hops). Direct git
+# deps from the same fork so type identities line up with arti-client's transitive
+# tree — see the note above on type-identity splits.
+tor-circmgr = { git = "https://github.com/VectorPrivacy/arti.git", branch = "vector/rusqlite-0.32", default-features = false, optional = true }
+tor-dirmgr = { git = "https://github.com/VectorPrivacy/arti.git", branch = "vector/rusqlite-0.32", default-features = false, optional = true }
+tor-linkspec = { git = "https://github.com/VectorPrivacy/arti.git", branch = "vector/rusqlite-0.32", default-features = false, optional = true }
+tor-guardmgr = { git = "https://github.com/VectorPrivacy/arti.git", branch = "vector/rusqlite-0.32", default-features = false, features = ["bridge-client", "pt-client"], optional = true }
 # tokio_util::compat bridges arti's futures::io::AsyncRead to tokio::io::AsyncRead so
 # we can splice Arti's DataStream into a tokio TcpStream for the SOCKS5 bridge.
 tokio-util = { version = "0.7", features = ["compat"], optional = true }
@@ -79,7 +86,7 @@ default = []
 # Enables embedded Tor (Arti) — bootstraps Arti, runs a localhost SOCKS5 listener
 # bridging into the Tor network. Consumers (HTTP / Nostr) opt into the proxy via
 # `tor::proxy_url()` returning `Some(socks5://127.0.0.1:<port>)` when active.
-tor = ["dep:arti-client", "dep:tor-rtcompat", "dep:tokio-util"]
+tor = ["dep:arti-client", "dep:tor-rtcompat", "dep:tokio-util", "dep:tor-circmgr", "dep:tor-dirmgr", "dep:tor-linkspec", "dep:tor-guardmgr"]
 
 [dev-dependencies]
 tempfile = "3"

crates/vector-core/Cargo.toml

@@ -247,6 +247,30 @@ pub fn init_database(npub: &str) -> Result<(), String> {
     let write_conn = create_connection(&db_path)?;
     *DB_WRITE_CONN.lock().unwrap() = Some(write_conn);
 
+    // Hydrate Tor's hot-path settings cache from the new account's DB.
+    // Use a direct rusqlite query against `db_path` rather than the global
+    // `get_sql_setting()` helper — that helper resolves through the read
+    // pool + `get_current_account()`, both of which may not yet reflect THIS
+    // account at the moment we run (switch_account calls init_database
+    // BEFORE set_current_account). Reading the path directly removes the
+    // race entirely.
+    #[cfg(feature = "tor")]
+    {
+        let enabled = create_connection(&db_path)
+            .ok()
+            .and_then(|c| {
+                c.query_row(
+                    "SELECT value FROM settings WHERE key = 'tor_enabled'",
+                    [],
+                    |row| row.get::<_, String>(0),
+                )
+                .ok()
+            })
+            .map(|v| v == "1" || v == "true")
+            .unwrap_or(false);
+        crate::tor::set_tor_enabled_pref(enabled);
+    }
+
     Ok(())
 }
 

crates/vector-core/src/db/mod.rs

@@ -76,9 +76,18 @@ pub fn nostr_client_options() -> nostr_sdk::ClientOptions {
     let opts = nostr_sdk::ClientOptions::new();
     #[cfg(all(feature = "tor", not(target_arch = "wasm32")))]
     {
-        if let Some(addr) = tor::socks_addr() {
-            let conn = nostr_sdk::client::Connection::new().proxy(addr);
-            return opts.connection(conn);
+        match tor::transport_state() {
+            tor::TorTransportState::Active(addr) => {
+                return opts.connection(nostr_sdk::client::Connection::new().proxy(addr));
+            }
+            tor::TorTransportState::RequiredButInactive => {
+                // Tor failsafe: route to a blackhole so the relay socket can't
+                // accidentally come up direct while Tor is mid-bootstrap.
+                return opts.connection(
+                    nostr_sdk::client::Connection::new().proxy(tor::blackhole_proxy_addr()),
+                );
+            }
+            tor::TorTransportState::Disabled => {}
         }
     }
     opts
@@ -96,8 +105,18 @@ pub fn nostr_client_options() -> nostr_sdk::ClientOptions {
 pub fn tor_aware_relay_options(opts: nostr_sdk::RelayOptions) -> nostr_sdk::RelayOptions {
     #[cfg(all(feature = "tor", not(target_arch = "wasm32")))]
     {
-        if let Some(addr) = tor::socks_addr() {
-            return opts.connection_mode(nostr_sdk::pool::ConnectionMode::proxy(addr));
+        match tor::transport_state() {
+            tor::TorTransportState::Active(addr) => {
+                return opts.connection_mode(nostr_sdk::pool::ConnectionMode::proxy(addr));
+            }
+            tor::TorTransportState::RequiredButInactive => {
+                // Tor failsafe: pin to blackhole so this relay can never come
+                // up direct while Tor isn't running.
+                return opts.connection_mode(
+                    nostr_sdk::pool::ConnectionMode::proxy(tor::blackhole_proxy_addr()),
+                );
+            }
+            tor::TorTransportState::Disabled => {}
         }
     }
     opts

crates/vector-core/src/lib.rs

@@ -49,21 +49,42 @@ fn is_ipv6_private(ip: &std::net::Ipv6Addr) -> bool {
 
 /// Build an HTTP client with the given timeout.
 ///
-/// When the `tor` feature is enabled and `tor::TorService` is currently active,
-/// the returned client routes all requests through Tor's local SOCKS5 proxy.
-/// When Tor is disabled or the feature is off, this is the identity client.
+/// Honors the Tor failsafe: when the user has Tor enabled, every connection
+/// goes through Tor — period. If Tor is enabled but not currently running
+/// (bootstrap in flight, mid-restart, service crashed), the returned client
+/// is wired to a blackhole SOCKS proxy so requests fail at the TCP layer
+/// without any chance of leaking clearnet traffic. Direct connections are
+/// only ever issued when the user has explicitly disabled Tor.
 ///
 /// Callers should use this rather than `reqwest::Client::builder()` directly
-/// so the Tor toggle automatically covers their traffic.
+/// so the failsafe automatically covers their traffic. The `disallowed_methods`
+/// clippy lint enforces this everywhere except this one canonical call site.
+#[allow(clippy::disallowed_methods)]
 pub fn build_http_client(timeout: std::time::Duration) -> Result<reqwest::Client, String> {
     let mut builder = reqwest::Client::builder().timeout(timeout);
 
     #[cfg(feature = "tor")]
     {
-        if let Some(url) = crate::tor::proxy_url() {
-            let proxy = reqwest::Proxy::all(&url)
-                .map_err(|e| format!("Tor proxy URL ({url}) invalid: {e}"))?;
-            builder = builder.proxy(proxy);
+        match crate::tor::transport_state() {
+            crate::tor::TorTransportState::Active(addr) => {
+                // Use the addr from the variant directly — re-querying via
+                // proxy_url() races against TorService::stop() and can panic.
+                let url = format!("socks5h://{addr}");
+                let proxy = reqwest::Proxy::all(&url)
+                    .map_err(|e| format!("Tor proxy URL ({url}) invalid: {e}"))?;
+                builder = builder.proxy(proxy);
+            }
+            crate::tor::TorTransportState::RequiredButInactive => {
+                // Tor failsafe: route to a blackhole so connections fail safe
+                // instead of leaking direct.
+                let url = format!("socks5h://{}", crate::tor::blackhole_proxy_addr());
+                let proxy = reqwest::Proxy::all(&url)
+                    .map_err(|e| format!("blackhole proxy invalid: {e}"))?;
+                builder = builder.proxy(proxy);
+            }
+            crate::tor::TorTransportState::Disabled => {
+                // No proxy — user has Tor off.
+            }
         }
     }