Release 3.8.2.11: idle rev-cache, port-safe Connect, single-instance tray UX.

Faster unchanged polls; orphan-core cleanup on listen ports; clearer busy-port errors; cores only from binDir; incremental server list; CSP without Google Fonts; single-instance activates existing window; close-to-tray without kill-others or balloon.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/protocols/naive/binary.go

@@ -21,14 +21,11 @@ func ResolveBinary(binDir string) (string, error) {
 	if runtime.GOOS == "windows" {
 		name = "naive.exe"
 	}
+	// Only trusted binDir (not beside the app exe) — avoids local binary plant.
 	candidates := []string{
 		filepath.Join(binDir, name),
 		filepath.Join(binDir, "naiveproxy", name),
 	}
-	if exe, err := os.Executable(); err == nil {
-		candidates = append(candidates, filepath.Join(filepath.Dir(exe), name))
-		candidates = append(candidates, filepath.Join(filepath.Dir(exe), "bin", name))
-	}
 	for _, c := range candidates {
 		if st, err := os.Stat(c); err == nil && !st.IsDir() {
 			return c, nil

internal/protocols/naive/engine.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"vpnclient/internal/config"
+	"vpnclient/internal/listenutil"
 )
 
 // Engine runs the official Chromium-based naive binary.
@@ -105,7 +106,11 @@ func (e *Engine) Start(ctx context.Context, profile config.Profile, binDir strin
 	var startErr error
 	select {
 	case <-done:
-		startErr = fmt.Errorf("naive: process exited immediately; check proxy URI, credentials, and binary")
+		socks, _ := profile.SOCKSListenHostPort()
+		httpL, _ := profile.HTTPListenHostPort()
+		startErr = listenutil.ClassifyStartFailure("naive",
+			fmt.Errorf("naive: process exited immediately; check proxy URI, credentials, and binary"),
+			socks, httpL)
 	case <-ctx.Done():
 		_ = e.Stop()
 		startErr = ctx.Err()