ShahabSL · tagh6668-dot · Jun 21, 2026 · Jun 21, 2026 · Jun 21, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
         env:
           SKIRK_OAUTH_CLIENT_ID: ${{ secrets.SKIRK_OAUTH_CLIENT_ID }}
           SKIRK_OAUTH_CLIENT_SECRET: ${{ secrets.SKIRK_OAUTH_CLIENT_SECRET }}
-          SKIRK_REQUIRE_BUILTIN_OAUTH: "1"
+          SKIRK_REQUIRE_BUILTIN_OAUTH: "0"
         run: VERSION="${GITHUB_REF_NAME}" scripts/package_release.sh
 
       - uses: actions/upload-artifact@v7
@@ -68,16 +68,19 @@ jobs:
           yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null
           "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "ndk;27.0.12077973"
 
-      - name: Decode Android release keystore
+      - name: Decode or Generate Android release keystore
         env:
           SKIRK_ANDROID_KEYSTORE_BASE64: ${{ secrets.SKIRK_ANDROID_KEYSTORE_BASE64 }}
         run: |
-          if [ -z "${SKIRK_ANDROID_KEYSTORE_BASE64}" ]; then
-            echo "SKIRK_ANDROID_KEYSTORE_BASE64 is required for release APK signing" >&2
-            exit 1
-          fi
           mkdir -p "$RUNNER_TEMP/skirk-android-signing"
-          printf '%s' "$SKIRK_ANDROID_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/skirk-android-signing/release.jks"
+          if [ -n "${SKIRK_ANDROID_KEYSTORE_BASE64}" ]; then
+            printf '%s' "$SKIRK_ANDROID_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/skirk-android-signing/release.jks"
+            echo "USING_CUSTOM_KEYSTORE=1" >> "$GITHUB_ENV"
+          else
+            echo "SKIRK_ANDROID_KEYSTORE_BASE64 is empty. Generating fallback self-signed release keystore..."
+            keytool -genkeypair -v -keystore "$RUNNER_TEMP/skirk-android-signing/release.jks" -alias release -keyalg RSA -keysize 2048 -validity 10000 -storepass fallbackpassword -keypass fallbackpassword -dname "CN=Skirk, O=Skirk, C=US"
+            echo "USING_CUSTOM_KEYSTORE=0" >> "$GITHUB_ENV"
+          fi
 
       - name: Build signed release APK
         working-directory: clients/android
@@ -87,10 +90,17 @@ jobs:
           SKIRK_ANDROID_KEY_ALIAS: ${{ secrets.SKIRK_ANDROID_KEY_ALIAS }}
           SKIRK_ANDROID_KEY_PASSWORD: ${{ secrets.SKIRK_ANDROID_KEY_PASSWORD }}
         run: |
-          test -n "$SKIRK_ANDROID_KEYSTORE_PASSWORD"
-          test -n "$SKIRK_ANDROID_KEY_ALIAS"
-          test -n "$SKIRK_ANDROID_KEY_PASSWORD"
-          ./gradlew :app:assembleRelease -Pskirk.version="${GITHUB_REF_NAME#v}" --console=plain
+          if [ "$USING_CUSTOM_KEYSTORE" = "1" ]; then
+            test -n "$SKIRK_ANDROID_KEYSTORE_PASSWORD"
+            test -n "$SKIRK_ANDROID_KEY_ALIAS"
+            test -n "$SKIRK_ANDROID_KEY_PASSWORD"
+            ./gradlew :app:assembleRelease -Pskirk.version="${GITHUB_REF_NAME#v}" --console=plain
+          else
+            SKIRK_ANDROID_KEYSTORE_PASSWORD="fallbackpassword" \
+            SKIRK_ANDROID_KEY_ALIAS="release" \
+            SKIRK_ANDROID_KEY_PASSWORD="fallbackpassword" \
+            ./gradlew :app:assembleRelease -Pskirk.version="${GITHUB_REF_NAME#v}" --console=plain
+          fi
 
       - name: Verify release APK signature
         run: |
@@ -196,7 +206,7 @@ jobs:
         env:
           SKIRK_OAUTH_CLIENT_ID: ${{ secrets.SKIRK_OAUTH_CLIENT_ID }}
           SKIRK_OAUTH_CLIENT_SECRET: ${{ secrets.SKIRK_OAUTH_CLIENT_SECRET }}
-          SKIRK_REQUIRE_BUILTIN_OAUTH: "1"
+          SKIRK_REQUIRE_BUILTIN_OAUTH: "0"
         run: |
           New-Item -ItemType Directory -Force clients/desktop/src-tauri/resources/sidecars/windows | Out-Null
           $date = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
@@ -317,7 +327,7 @@ jobs:
         env:
           SKIRK_OAUTH_CLIENT_ID: ${{ secrets.SKIRK_OAUTH_CLIENT_ID }}
           SKIRK_OAUTH_CLIENT_SECRET: ${{ secrets.SKIRK_OAUTH_CLIENT_SECRET }}
-          SKIRK_REQUIRE_BUILTIN_OAUTH: "1"
+          SKIRK_REQUIRE_BUILTIN_OAUTH: "0"
         run: clients/desktop/scripts/stage_sidecars.sh
 
       - name: Stage Linux VPN sidecar
@@ -416,7 +426,7 @@ jobs:
         env:
           SKIRK_OAUTH_CLIENT_ID: ${{ secrets.SKIRK_OAUTH_CLIENT_ID }}
           SKIRK_OAUTH_CLIENT_SECRET: ${{ secrets.SKIRK_OAUTH_CLIENT_SECRET }}
-          SKIRK_REQUIRE_BUILTIN_OAUTH: "1"
+          SKIRK_REQUIRE_BUILTIN_OAUTH: "0"
         run: |
           set -euo pipefail
           mkdir -p clients/desktop/src-tauri/resources/sidecars/macos

diff --git a/clients/android/app/src/main/AndroidManifest.xml b/clients/android/app/src/main/AndroidManifest.xml
@@ -4,6 +4,7 @@
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
 
     <application
         android:allowBackup="false"

diff --git a/clients/android/app/src/main/java/app/skirk/client/ClientProfile.kt b/clients/android/app/src/main/java/app/skirk/client/ClientProfile.kt
@@ -16,6 +16,9 @@ data class ClientProfile(
     val driveSpace: String,
     val driveFolderId: String,
     val performance: PerformanceSettings = PerformanceSettings.recommended(),
+    val splitTunnelingEnabled: Boolean = false,
+    val splitTunnelingMode: String = SPLIT_TUNNEL_BYPASS,
+    val splitTunnelingApps: Set<String> = emptySet(),
 ) {
     val socksHost: String
         get() = if (shareLan) "0.0.0.0" else "127.0.0.1"
@@ -45,6 +48,9 @@ data class ClientProfile(
         .put("driveSpace", driveSpace)
         .put("driveFolderId", driveFolderId)
         .put("performance", performance.toJson())
+        .put("splitTunnelingEnabled", splitTunnelingEnabled)
+        .put("splitTunnelingMode", splitTunnelingMode)
+        .put("splitTunnelingApps", org.json.JSONArray(splitTunnelingApps))
 
     companion object {
         fun fromRawConfig(
@@ -91,6 +97,13 @@ data class ClientProfile(
             } else {
                 storedHttpPort
             }
+            val splitAppsArray = json.optJSONArray("splitTunnelingApps")
+            val splitAppsSet = mutableSetOf<String>()
+            if (splitAppsArray != null) {
+                for (i in 0 until splitAppsArray.length()) {
+                    splitAppsSet.add(splitAppsArray.getString(i))
+                }
+            }
             return ClientProfile(
                 id = json.getString("id"),
                 name = json.getString("name"),
@@ -104,11 +117,16 @@ data class ClientProfile(
                 driveSpace = json.optString("driveSpace", json.optString("space")),
                 driveFolderId = json.optString("driveFolderId"),
                 performance = PerformanceSettings.fromJson(json.optJSONObject("performance")),
+                splitTunnelingEnabled = json.optBoolean("splitTunnelingEnabled", false),
+                splitTunnelingMode = json.optString("splitTunnelingMode", SPLIT_TUNNEL_BYPASS),
+                splitTunnelingApps = splitAppsSet,
             )
         }
 
         const val CONNECTION_MODE_PROXY = "proxy"
         const val CONNECTION_MODE_VPN = "vpn"
+        const val SPLIT_TUNNEL_BYPASS = "bypass"
+        const val SPLIT_TUNNEL_PROXY = "proxy"
         const val DEFAULT_SOCKS_PORT = 18080
         const val DEFAULT_HTTP_PORT = 18081
         const val MIN_SOCKS_PORT = 1024