v4.3.0: Notification pause/resume, CNAME cloak badge, source health alerts

- VPN notification: "Pause 5m" action pauses blocking, shows "Resume" when paused
- ACTION_PAUSE intent with pause_minutes extra (0 = resume immediately)
- isPaused flag bypasses isDomainBlocked — all queries pass through while paused
- Log detail sheet: red "CNAME CLOAK" badge when blocked entry has CNAME chain
- Upstream server labels prettified (DoH:CLOUDFLARE -> DoH: Cloudflare)
- SourceHealthWorker: push notification when sources transition to DEAD status
- Alert notification channel (ALERT_CHANNEL_ID) for non-VPN alerts

Author: SysAdminDoc

CLAUDE.md

@@ -1,7 +1,7 @@
 # HostShield
 
 ## Overview
-Modern, AMOLED-dark hosts-based ad blocker app for Android. Inspired by AdAway. v4.2.0.
+Modern, AMOLED-dark hosts-based ad blocker app for Android. Inspired by AdAway. v4.3.0.
 
 ## Tech Stack
 - Kotlin, Jetpack Compose, Material 3
@@ -70,6 +70,7 @@ cd app
 - Secrets configured: `KEYSTORE_BASE64`, `KEY_ALIAS`, `KEY_PASSWORD`, `STORE_PASSWORD`
 
 ## Version History
+- v4.3.0: Notification pause/resume action (5-min pause from notification), CNAME CLOAK badge in log detail sheet, pretty upstream server labels (DoH:Cloudflare), source health DEAD notifications (push alert), alerts notification channel, pause state bypasses blocking
 - v4.2.0: Fix DNS log data starvation (CNAME chains, resolved IPs, latency, upstream server now written to DB), CNAME-blocked domains now logged, fd error tracking + auto-restart on TUN error, IPv6 DoH support (honours useDoH flag), IPv6 DNS cache lookup, DohBypassUpdater uses shared OkHttpClient, app context threaded through all forward methods
 - v4.1.0: Custom upstream DNS UI in Settings, firewall rule export/import (JSON), automation audit log viewer screen, query rate anomaly detection (3x baseline warning on Home), dropped queries banner, cache hit rate on Home
 - v4.0.0: Automation API rate limiting + audit logging, GeoIP rate limit backoff, shared OkHttpClient pooling, tracker scanner Room caching, VPN stability metrics (uptime/rebuilds/errors/drops), DNS cache stats in Stats screen, VPN Health card, log buffer overflow detection, DB v9
@@ -111,3 +112,7 @@ cd app
 - processIpv6Dns now has DoH + cache lookup (was plaintext-only before v4.2.0)
 - forwardDoH is dual-mode: `wrapV6=true` wraps response as IPv6 packet instead of IPv4
 - packetLoop auto-restarts VPN on unexpected exit (fd error) while `isRunning=true`
+- ACTION_PAUSE with `pause_minutes` extra; 0 = resume immediately
+- isPaused flag checked in isDomainBlocked — all queries allowed while paused
+- SourceHealthWorker tracks newly-DEAD sources and posts notification via ALERT_CHANNEL_ID
+- ALERT_CHANNEL_ID created alongside VPN channel in createNotificationChannel()

app/app/build.gradle.kts

@@ -1,4 +1,4 @@
-// HostShield v4.2.0
+// HostShield v4.3.0
 plugins {
     id("com.android.application")
     id("org.jetbrains.kotlin.android")
@@ -15,8 +15,8 @@ android {
         applicationId = "com.hostshield"
         minSdk = 26
         targetSdk = 35
-        versionCode = 42
-        versionName = "4.2.0"
+        versionCode = 43
+        versionName = "4.3.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 

app/app/src/main/java/com/hostshield/service/DnsVpnService.kt

@@ -83,8 +83,10 @@ class DnsVpnService : VpnService() {
     companion object {
         const val ACTION_START = "com.hostshield.VPN_START"
         const val ACTION_STOP = "com.hostshield.VPN_STOP"
+        const val ACTION_PAUSE = "com.hostshield.VPN_PAUSE"
         const val ACTION_WATCHDOG = "com.hostshield.VPN_WATCHDOG"
         const val CHANNEL_ID = "hostshield_vpn"
+        const val ALERT_CHANNEL_ID = "hostshield_alerts"
         const val NOTIFICATION_ID = 1
         private const val TAG = "HostShield"
         private const val WATCHDOG_INTERVAL_MS = 600_000L  // 10 minutes
@@ -259,6 +261,10 @@ class DnsVpnService : VpnService() {
     private var vpnStartTime = 0L
     @Volatile private var stabilityFlushJob: Job? = null
 
+    // Pause state: when paused, all queries are allowed (no blocking)
+    @Volatile private var isPaused = false
+    private var pauseResumeJob: Job? = null
+
     override fun onCreate() {
         super.onCreate()
         createNotificationChannel()
@@ -267,6 +273,19 @@ class DnsVpnService : VpnService() {
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
         when (intent?.action) {
             ACTION_STOP -> { stopVpn(); return START_NOT_STICKY }
+            ACTION_PAUSE -> {
+                val mins = intent.getIntExtra("pause_minutes", 5)
+                if (mins <= 0) {
+                    // Resume immediately
+                    isPaused = false
+                    pauseResumeJob?.cancel(); pauseResumeJob = null
+                    Log.i(TAG, "Blocking resumed (manual)")
+                    updateNotification(blockedCount)
+                } else {
+                    pauseBlocking(mins)
+                }
+                return START_STICKY
+            }
             ACTION_WATCHDOG -> {
                 // OEM battery managers (Samsung, Xiaomi, Huawei) kill VPN services.
                 // This alarm fires every 10 min to detect and recover.
@@ -1042,7 +1061,10 @@ class DnsVpnService : VpnService() {
      * Handles exact match, www. prefix, wildcard allow/block.
      * Replaces the old linear Set.contains() + wildcard scan.
      */
-    private fun isDomainBlocked(domain: String): Boolean = blocklist.isBlocked(domain)
+    private fun isDomainBlocked(domain: String): Boolean {
+        if (isPaused) return false
+        return blocklist.isBlocked(domain)
+    }
 
     // ── Packet Parsing ───────────────────────────────────────
 
@@ -1920,10 +1942,29 @@ class DnsVpnService : VpnService() {
 
     // ── Notifications ────────────────────────────────────────
 
+    /** Pause DNS blocking for a specified number of minutes. */
+    private fun pauseBlocking(minutes: Int) {
+        isPaused = true
+        pauseResumeJob?.cancel()
+        pauseResumeJob = serviceScope.launch {
+            Log.i(TAG, "Blocking paused for ${minutes} minutes")
+            updateNotification(blockedCount)
+            delay(minutes * 60_000L)
+            isPaused = false
+            pauseResumeJob = null
+            Log.i(TAG, "Blocking resumed after ${minutes}-minute pause")
+            updateNotification(blockedCount)
+        }
+    }
+
     private fun createNotificationChannel() {
+        val nm = getSystemService(NotificationManager::class.java)
         NotificationChannel(CHANNEL_ID, "HostShield VPN", NotificationManager.IMPORTANCE_LOW).apply {
             description = "VPN blocking status"; setShowBadge(false)
-        }.let { getSystemService(NotificationManager::class.java).createNotificationChannel(it) }
+        }.let { nm.createNotificationChannel(it) }
+        NotificationChannel(ALERT_CHANNEL_ID, "HostShield Alerts", NotificationManager.IMPORTANCE_DEFAULT).apply {
+            description = "Source health and system alerts"
+        }.let { nm.createNotificationChannel(it) }
     }
 
     private fun buildNotification(blocked: Int): Notification {
@@ -1932,18 +1973,42 @@ class DnsVpnService : VpnService() {
         val si = PendingIntent.getService(this, 1,
             Intent(this, DnsVpnService::class.java).apply { action = ACTION_STOP },
             PendingIntent.FLAG_IMMUTABLE)
+        val pauseIntent = PendingIntent.getService(this, 2,
+            Intent(this, DnsVpnService::class.java).apply {
+                action = ACTION_PAUSE; putExtra("pause_minutes", 5)
+            },
+            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
+
+        val title = if (isPaused) "HostShield Paused" else "HostShield Active"
         val sub = buildString {
-            append(if (blocked > 0) "$blocked blocked" else "DNS filtering active")
-            if (useDoH) append(" | DoH")
-            if (dnsTrapEnabled) append(" | Trap")
+            if (isPaused) append("Blocking paused")
+            else {
+                append(if (blocked > 0) "$blocked blocked" else "DNS filtering active")
+                if (useDoH) append(" | DoH")
+                if (dnsTrapEnabled) append(" | Trap")
+            }
         }
-        return NotificationCompat.Builder(this, CHANNEL_ID)
-            .setContentTitle("HostShield Active").setContentText(sub)
+        val builder = NotificationCompat.Builder(this, CHANNEL_ID)
+            .setContentTitle(title).setContentText(sub)
             .setSmallIcon(android.R.drawable.ic_lock_lock).setOngoing(true)
             .setContentIntent(ci)
-            .addAction(android.R.drawable.ic_menu_close_clear_cancel, "Stop", si)
             .setCategory(NotificationCompat.CATEGORY_SERVICE)
-            .setPriority(NotificationCompat.PRIORITY_LOW).build()
+            .setPriority(NotificationCompat.PRIORITY_LOW)
+
+        if (isPaused) {
+            // Show resume action when paused
+            val resumeIntent = PendingIntent.getService(this, 3,
+                Intent(this, DnsVpnService::class.java).apply {
+                    action = ACTION_PAUSE; putExtra("pause_minutes", 0)
+                },
+                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
+            builder.addAction(android.R.drawable.ic_media_play, "Resume", resumeIntent)
+        } else {
+            builder.addAction(android.R.drawable.ic_media_pause, "Pause 5m", pauseIntent)
+        }
+        builder.addAction(android.R.drawable.ic_menu_close_clear_cancel, "Stop", si)
+
+        return builder.build()
     }
 
     private fun updateNotification(blocked: Int) {

app/app/src/main/java/com/hostshield/service/SourceHealthWorker.kt

@@ -1,6 +1,8 @@
 package com.hostshield.service
 
+import android.app.NotificationManager
 import android.content.Context
+import androidx.core.app.NotificationCompat
 import androidx.hilt.work.HiltWorker
 import androidx.work.*
 import com.hostshield.data.database.HostSourceDao
@@ -10,7 +12,7 @@ import dagger.assisted.Assisted
 import dagger.assisted.AssistedInject
 import java.util.concurrent.TimeUnit
 
-// HostShield v1.6.0 - Source Health Monitor
+// HostShield v4.3.0 - Source Health Monitor with notifications
 
 @HiltWorker
 class SourceHealthWorker @AssistedInject constructor(
@@ -24,6 +26,7 @@ class SourceHealthWorker @AssistedInject constructor(
         const val WORK_NAME = "hostshield_health_check"
         private const val STALE_THRESHOLD_MS = 7L * 24 * 60 * 60 * 1000 // 7 days
         private const val DEAD_FAILURE_THRESHOLD = 5
+        private const val NOTIFICATION_ID_HEALTH = 200
 
         fun schedule(context: Context) {
             val request = PeriodicWorkRequestBuilder<SourceHealthWorker>(
@@ -59,8 +62,10 @@ class SourceHealthWorker @AssistedInject constructor(
     override suspend fun doWork(): Result {
         return try {
             val sources = sourceDao.getAllSourcesList()
+            val newlyDead = mutableListOf<String>()
 
             for (source in sources) {
+                val wasDead = source.health == SourceHealth.DEAD
                 val validationResult = downloader.validate(source.url)
 
                 validationResult.onSuccess { lineCount ->
@@ -89,12 +94,44 @@ class SourceHealthWorker @AssistedInject constructor(
                         error = err.message ?: "Unknown error",
                         failures = failures
                     )
+
+                    // Track sources that just transitioned to DEAD
+                    if (!wasDead && health == SourceHealth.DEAD) {
+                        newlyDead.add(source.label)
+                    }
                 }
             }
 
+            // Notify user about newly dead sources
+            if (newlyDead.isNotEmpty()) {
+                notifyDeadSources(newlyDead)
+            }
+
             Result.success()
         } catch (e: Exception) {
             if (runAttemptCount < 2) Result.retry() else Result.failure()
         }
     }
+
+    private fun notifyDeadSources(labels: List<String>) {
+        try {
+            val nm = applicationContext.getSystemService(NotificationManager::class.java) ?: return
+            val text = if (labels.size == 1) {
+                "${labels[0]} is unreachable after $DEAD_FAILURE_THRESHOLD failures"
+            } else {
+                "${labels.size} sources unreachable: ${labels.joinToString(", ")}"
+            }
+
+            val notification = NotificationCompat.Builder(applicationContext, DnsVpnService.ALERT_CHANNEL_ID)
+                .setContentTitle("Source Health Alert")
+                .setContentText(text)
+                .setStyle(NotificationCompat.BigTextStyle().bigText(text))
+                .setSmallIcon(android.R.drawable.ic_dialog_alert)
+                .setAutoCancel(true)
+                .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+                .build()
+
+            nm.notify(NOTIFICATION_ID_HEALTH, notification)
+        } catch (_: Exception) { }
+    }
 }

app/app/src/main/java/com/hostshield/ui/screens/logs/LogsScreen.kt

@@ -733,11 +733,38 @@ private fun QueryDetailSheet(entry: DedupedLogEntry, onDismiss: () -> Unit, isPi
             DetailRow("Response Time", "${entry.responseTimeMs} ms")
         }
         if (entry.upstreamServer.isNotEmpty()) {
-            DetailRow("Upstream Server", entry.upstreamServer)
+            // Pretty-print upstream server label
+            val serverLabel = when {
+                entry.upstreamServer.startsWith("DoH:") -> {
+                    val provider = entry.upstreamServer.removePrefix("DoH:")
+                    "DoH: ${provider.lowercase().replaceFirstChar { it.uppercase() }}"
+                }
+                entry.upstreamServer.contains("(fallback)") -> entry.upstreamServer
+                else -> entry.upstreamServer
+            }
+            DetailRow("Upstream Server", serverLabel)
         }
         if (entry.cnameChain.isNotEmpty()) {
             Spacer(Modifier.height(8.dp))
-            Text("CNAME Chain", color = TextDim, fontSize = 11.sp, fontWeight = FontWeight.SemiBold)
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                Text("CNAME Chain", color = TextDim, fontSize = 11.sp, fontWeight = FontWeight.SemiBold)
+                if (entry.blocked && entry.cnameChain.isNotBlank()) {
+                    Spacer(Modifier.width(8.dp))
+                    Surface(
+                        shape = RoundedCornerShape(4.dp),
+                        color = Red.copy(alpha = 0.15f)
+                    ) {
+                        Text(
+                            "CNAME CLOAK",
+                            color = Red,
+                            fontSize = 9.sp,
+                            fontWeight = FontWeight.Bold,
+                            modifier = Modifier.padding(horizontal = 6.dp, vertical = 2.dp),
+                            letterSpacing = 0.5.sp
+                        )
+                    }
+                }
+            }
             entry.cnameChain.split(",").filter { it.isNotBlank() }.forEach { cname ->
                 Row(modifier = Modifier.padding(start = 8.dp, top = 2.dp)) {
                     Text("\u2192 ", color = TextDim, fontSize = 12.sp)