Release 3.8.2.11: idle rev-cache, port-safe Connect, single-instance tray UX.

Faster unchanged polls; orphan-core cleanup on listen ports; clearer busy-port errors; cores only from binDir; incremental server list; CSP without Google Fonts; single-instance activates existing window; close-to-tray without kill-others or balloon.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/protocols/hysteria2/binary.go

@@ -16,6 +16,7 @@ const githubAPILatest = "https://api.github.com/repos/apernet/hysteria/releases/
 // ResolveBinary finds hysteria client binary.
 func ResolveBinary(binDir string) (string, error) {
 	names := candidateNames()
+	// Only trusted binDir (not beside the app exe) — avoids local binary plant.
 	candidates := []string{}
 	for _, name := range names {
 		candidates = append(candidates,
@@ -24,12 +25,6 @@ func ResolveBinary(binDir string) (string, error) {
 			filepath.Join(binDir, "hysteria", name),
 		)
 	}
-	if exe, err := os.Executable(); err == nil {
-		dir := filepath.Dir(exe)
-		for _, name := range names {
-			candidates = append(candidates, filepath.Join(dir, name), filepath.Join(dir, "bin", name))
-		}
-	}
 	for _, c := range candidates {
 		if st, err := os.Stat(c); err == nil && !st.IsDir() {
 			return c, nil