Release 3.8.2.11: idle rev-cache, port-safe Connect, single-instance tray UX.

Faster unchanged polls; orphan-core cleanup on listen ports; clearer busy-port errors; cores only from binDir; incremental server list; CSP without Google Fonts; single-instance activates existing window; close-to-tray without kill-others or balloon.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/protocols/hysteria2/binary.go

@@ -16,6 +16,7 @@ const githubAPILatest = "https://api.github.com/repos/apernet/hysteria/releases/
 // ResolveBinary finds hysteria client binary.
 func ResolveBinary(binDir string) (string, error) {
 	names := candidateNames()
+	// Only trusted binDir (not beside the app exe) — avoids local binary plant.
 	candidates := []string{}
 	for _, name := range names {
 		candidates = append(candidates,
@@ -24,12 +25,6 @@ func ResolveBinary(binDir string) (string, error) {
 			filepath.Join(binDir, "hysteria", name),
 		)
 	}
-	if exe, err := os.Executable(); err == nil {
-		dir := filepath.Dir(exe)
-		for _, name := range names {
-			candidates = append(candidates, filepath.Join(dir, name), filepath.Join(dir, "bin", name))
-		}
-	}
 	for _, c := range candidates {
 		if st, err := os.Stat(c); err == nil && !st.IsDir() {
 			return c, nil

internal/protocols/hysteria2/engine.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"vpnclient/internal/config"
+	"vpnclient/internal/listenutil"
 )
 
 // Engine runs the official apernet/hysteria client (Hysteria 2).
@@ -102,7 +103,11 @@ func (e *Engine) Start(ctx context.Context, profile config.Profile, binDir strin
 	var startErr error
 	select {
 	case <-done:
-		startErr = fmt.Errorf("hysteria2: process exited immediately; check URI/password and binary")
+		socks, _ := profile.SOCKSListenHostPort()
+		httpL, _ := profile.HTTPListenHostPort()
+		startErr = listenutil.ClassifyStartFailure("hysteria2",
+			fmt.Errorf("hysteria2: process exited immediately; check URI/password and binary"),
+			socks, httpL)
 	case <-ctx.Done():
 		_ = e.Stop()
 		startErr = ctx.Err()