From 7724dde2efe5c74bb4aeb69b92e62801cb9933a9 Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Tue, 22 Sep 2026 00:09:18 +0200
Subject: [PATCH] =?UTF-8?q?vpn=200.1.0=20=E2=86=92=200.1.1:=20pin=20sing-b?=
 =?UTF-8?q?ox=201.14.1=20sha256s?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Binaries uploaded to bns/theseus/vpn-binaries/<platform>/, served
through the gateway at navigate.st/bns/theseus.x/vpn-binaries/.
Manifest hashes match a curl-fetched copy through the gateway.
---
 bundled-addons/vpn/addon.json           |  2 +-
 bundled-addons/vpn/binary-manifest.json | 22 +++++++++++-----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/bundled-addons/vpn/addon.json b/bundled-addons/vpn/addon.json
index 4779708..8951f14 100644
--- a/bundled-addons/vpn/addon.json
+++ b/bundled-addons/vpn/addon.json
@@ -1,7 +1,7 @@
 {
   "id": "vpn",
   "name": "VPN",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Route Theseus's traffic through a Silent Mode VPN endpoint. Runs sing-box locally, exits at one of our servers, and switches on with one click. Paste any vless:// URL to point it at your own endpoint instead.",
   "author": "Silent Mode",
   "icon": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI+PHBhdGggZD0iTTEyIDJMNCA1djdjMCA1IDMuNSA5LjIgOCAxMCA0LjUtLjggOC01IDgtMTBWNWwtOC0zeiIgZmlsbD0iIzBhYzE4ZSIvPjxwYXRoIGQ9Ik05IDEybDIgMiA0LTQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiLz48L3N2Zz4=",
diff --git a/bundled-addons/vpn/binary-manifest.json b/bundled-addons/vpn/binary-manifest.json
index 08bcdbe..6c5b379 100644
--- a/bundled-addons/vpn/binary-manifest.json
+++ b/bundled-addons/vpn/binary-manifest.json
@@ -1,22 +1,22 @@
 {
-  "version": "1.10.2",
+  "version": "1.14.1",
   "engine": "sing-box",
-  "note": "sha256s are placeholders until the binaries are uploaded to bns/theseus.x/vpn-binaries/. Refuse to activate on a platform whose sha256 is 'PENDING' — a real hash lands here in the addon tarball, signed by the operator OTA key, before that platform's users can flip the toggle on.",
+  "note": "sha256s pin the exact binary this addon version expects. Bumping sing-box means re-uploading, replacing hashes here, and shipping a new addon tarball via the Ed25519 OTA channel.",
   "platforms": {
     "win32-x64": {
-      "url": "https://navigate.st/bns/theseus.x/vpn-binaries/win32-x64/sing-box-1.10.2.exe",
-      "sha256": "PENDING",
-      "bytes": 0
+      "url": "https://navigate.st/bns/theseus.x/vpn-binaries/win32-x64/sing-box-win32-x64.exe",
+      "sha256": "b838de45bd0b2e6ddbed1977e4745622f7dffab3b293807ff4c6b1b640fed909",
+      "bytes": 81883648
     },
     "linux-x64": {
-      "url": "https://navigate.st/bns/theseus.x/vpn-binaries/linux-x64/sing-box-1.10.2",
-      "sha256": "PENDING",
-      "bytes": 0
+      "url": "https://navigate.st/bns/theseus.x/vpn-binaries/linux-x64/sing-box-linux-x64",
+      "sha256": "9334a1c1fe97234911afaedd37226667ebdb3dab2abe383f2c4ae1387706dad9",
+      "bytes": 81236197
     },
     "darwin-arm64": {
-      "url": "https://navigate.st/bns/theseus.x/vpn-binaries/darwin-arm64/sing-box-1.10.2",
-      "sha256": "PENDING",
-      "bytes": 0
+      "url": "https://navigate.st/bns/theseus.x/vpn-binaries/darwin-arm64/sing-box-darwin-arm64",
+      "sha256": "602bce530f540146e8e2feace24a81bdaf7873456203db0cda162811eb44f338",
+      "bytes": 83768930
     }
   }
 }