fix: bind desktop DNS and process bypass to physical egress

.github/actions/checkout-ipstack/action.yml

@@ -0,0 +1,9 @@
+name: Checkout sibling IP stack
+description: Fetch the exact fork revision required by the path dependency
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        git clone --no-checkout https://github.com/acking-you/ipstack.git ../ipstack
+        git -C ../ipstack checkout 99ea5315aff12d632523f8e32d3fa1ea8cab5081

.github/workflows/rust.yml

@@ -25,8 +25,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+    - uses: ./.github/actions/checkout-ipstack
     - uses: dtolnay/rust-toolchain@stable
       with:
+        toolchain: nightly-2026-01-26
         components: clippy, rustfmt
 
     - name: rustfmt
@@ -35,18 +37,21 @@ jobs:
 
     - name: check
       if: ${{ !cancelled() }}
-      run: cargo check --verbose
+      run: cargo check --verbose --locked
 
     - name: clippy
       if: ${{ !cancelled() }}
-      run: cargo clippy --all-targets --all-features -- -D warnings
+      run: cargo clippy --locked --all-targets --all-features -- -D warnings
 
     - name: Build
       if: ${{ !cancelled() }}
       run: |
-        cargo build --verbose --tests --all-features
+        cargo build --locked --verbose --tests --all-features
         cargo clean
-        cargo build --verbose
+        cargo build --locked --verbose
+
+    - name: Test
+      run: cargo test --locked --all-features
 
     - name: Abort on error
       if: ${{ failure() }}
@@ -59,21 +64,23 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+    - uses: ./.github/actions/checkout-ipstack
     - uses: dtolnay/rust-toolchain@stable
       with:
+        toolchain: nightly-2026-01-26
         components: clippy, rustfmt
     - name: Install cargo ndk and rust compiler for android target
       if: ${{ !cancelled() }}
       run: |
-        cargo install --locked cargo-ndk
+        cargo +stable install --locked cargo-ndk
         rustup target add x86_64-linux-android
     - name: clippy
       if: ${{ !cancelled() }}
-      run: cargo ndk -t x86_64 clippy --all-features -- -D warnings
+      run: cargo ndk -t x86_64 clippy --locked --all-features -- -D warnings
     - name: Build
       if: ${{ !cancelled() }}
       run: |
-        cargo ndk -t x86_64 rustc --verbose --all-features --lib --crate-type=cdylib
+        cargo ndk -t x86_64 rustc --locked --verbose --all-features --lib --crate-type=cdylib
     - name: Abort on error
       if: ${{ failure() }}
       run: echo "Android build job failed" && false
@@ -85,21 +92,23 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+    - uses: ./.github/actions/checkout-ipstack
     - uses: dtolnay/rust-toolchain@stable
       with:
+        toolchain: nightly-2026-01-26
         components: clippy, rustfmt
-    - name: Install cargo lipo and rust compiler for ios target
+    - name: Install rust compiler for iOS targets
       if: ${{ !cancelled() }}
       run: |
-        cargo install --locked cargo-lipo
         rustup target add x86_64-apple-ios aarch64-apple-ios
     - name: clippy
       if: ${{ !cancelled() }}
-      run: cargo clippy --target x86_64-apple-ios --all-features -- -D warnings
+      run: cargo clippy --locked --target x86_64-apple-ios --all-features -- -D warnings
     - name: Build
       if: ${{ !cancelled() }}
       run: |
-        cargo lipo --verbose --all-features
+        cargo build --locked --target aarch64-apple-ios --lib --all-features
+        cargo build --locked --target x86_64-apple-ios --lib --all-features
     - name: Abort on error
       if: ${{ failure() }}
       run: echo "iOS build job failed" && false
@@ -113,6 +122,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/checkout-ipstack
       - uses: dtolnay/rust-toolchain@stable
       - name: Check semver
         if: ${{ !cancelled() }}

.github/workflows/tests.yml

@@ -16,7 +16,10 @@ jobs:
     if: github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request_target' && !github.event.pull_request.head.repo.fork && contains(github.event.pull_request.labels.*.name, 'safe to test')))
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/checkout-ipstack
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: nightly-2026-01-26
       - name: Populate .env
         env:
           DOTENV: ${{ secrets.DOTENV }}
@@ -38,7 +41,7 @@ jobs:
           pip install -r tests/requirements.txt
 
       - name: Build project
-        run: cargo build --release
+        run: cargo build --release --locked
 
       - name: Run tests
         run: |

.gitignore

@@ -9,6 +9,5 @@ xcuserdata/
 .VSCodeCounter/
 build/
 tmp/
-Cargo.lock
 target/
 .idea/