unbounded: gate entire UI surface on server Features[unbounded] flag

Censored users should not see a "share your connection" UI on their
device — it can be a red flag on-device evidence even when broflake
itself is server-gated off. Mirror the radiance shouldRunUnbounded
gate up into Flutter so the Unbounded tab, settings sub-page, project
promo tile, first-visit welcome dialog, and auto-enable hooks all
disappear when Features[unbounded] is false.

Adds FeatureFlag.unbounded backed by the same "unbounded" key the
server already emits (common/types.go UNBOUNDED). Default getBool(...)
is false, so any user whose /v1/config-new response omits the flag
(no connectivity, parse failure, censored region) sees the safe state:
no Unbounded UI at all.

The user's "Hide Unbounded tab" toggle (appSettingProvider
unboundedHidden) still wins on top of this for non-censored users who
want it hidden. The new effective predicate is
unboundedAvailable && !unboundedHidden.

The welcome dialog at share_my_connection.dart:572 and the info-bubble
re-opener at :607 are both inside UnboundedTab.build, which never
mounts when the tab is hidden, so no defensive code is needed there.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Adam Fisk

lib/core/models/feature_flags.dart

@@ -2,7 +2,15 @@ enum FeatureFlag {
   privateGcp('private.gcp'),
   metrics('otel.metrics'),
   traces('otel.traces'),
-  autoUpdateEnabled('autoUpdateEnabled');
+  autoUpdateEnabled('autoUpdateEnabled'),
+  // Server-side gate for the entire Unbounded / Share My Connection
+  // surface. When false (the default for censored regions), the
+  // Unbounded tab, settings entry, project link, and auto-enable hooks
+  // all disappear — censored users should never see a "share your
+  // connection" UI that could draw attention to them on-device. Mirrors
+  // radiance/unbounded/unbounded.go shouldRunUnbounded, which already
+  // gates execution on the same Features[UNBOUNDED] flag.
+  unbounded('unbounded');
 
   final String key;
 

lib/features/home/home.dart

@@ -41,6 +41,12 @@ class Home extends HookConsumerWidget {
       appSettingProvider.select((s) => s.unboundedHidden),
     );
     final featureFlag = ref.watch(featureFlagProvider);
+    // Server-side gate for the whole Unbounded UI surface. Censored
+    // regions get the flag off, so the tab, strip, and any auto-enable
+    // hook disappear. The user's own "Hide Unbounded tab" toggle still
+    // wins on top of this for non-censored users who want it hidden.
+    final unboundedAvailable = featureFlag.getBool(FeatureFlag.unbounded);
+    final showUnboundedTab = unboundedAvailable && !unboundedHidden;
     final vpnStatus = ref.watch(vpnProvider);
     final shareActive = ref.watch(shareProvider.select((s) => s.active));
 
@@ -108,6 +114,7 @@ class Home extends HookConsumerWidget {
     // because the user has already opted in via settings.
     useEffect(() {
       WidgetsBinding.instance.addPostFrameCallback((_) {
+        if (!unboundedAvailable) return;
         final appSetting = ref.read(appSettingProvider);
         if (!appSetting.onboardingCompleted) return;
         if (!appSetting.unboundedAutoEnable) return;
@@ -116,11 +123,12 @@ class Home extends HookConsumerWidget {
         ref.read(shareProvider.notifier).autoStart(ref);
       });
       return null;
-    }, const []);
+    }, [unboundedAvailable]);
 
     ref.listen<VPNStatus>(vpnProvider, (prev, next) {
       if (prev == next) return;
       if (next != VPNStatus.connected) return;
+      if (!unboundedAvailable) return;
       final autoEnable =
           ref.read(appSettingProvider).unboundedAutoEnable;
       if (!autoEnable) return;
@@ -166,10 +174,11 @@ class Home extends HookConsumerWidget {
               onPressed: () => appRouter.push(const SignInEmail()),
             ),
         ],
-        // Tab strip collapses when the user has hidden the Unbounded
-        // tab in Unbounded Settings — with only one tab left, a strip
-        // is just noise. Body falls back to VpnTab directly.
-        bottom: unboundedHidden
+        // Tab strip collapses when Unbounded is unavailable — either the
+        // server flag is off (censored region) or the user hid the tab
+        // in Unbounded Settings. With only one tab left, a strip is just
+        // noise; body falls back to VpnTab directly.
+        bottom: !showUnboundedTab
             ? null
             : TabBar(
                 controller: tabController,
@@ -181,7 +190,7 @@ class Home extends HookConsumerWidget {
                 ],
               ),
       ),
-      body: unboundedHidden
+      body: !showUnboundedTab
           ? const VpnTab()
           : TabBarView(
               controller: tabController,

lib/features/setting/setting.dart

@@ -7,7 +7,9 @@ import 'package:lantern/core/localization/localization_constants.dart';
 import 'package:lantern/core/updater/updater.dart';
 import 'package:lantern/core/utils/pro_utils.dart';
 import 'package:lantern/core/widgets/subscription_tags.dart';
+import 'package:lantern/core/models/feature_flags.dart';
 import 'package:lantern/features/home/provider/app_setting_notifier.dart';
+import 'package:lantern/features/home/provider/feature_flag_notifier.dart';
 import 'package:lantern/features/home/provider/home_notifier.dart';
 import 'package:lantern/features/setting/appearance.dart'
     show appearanceModeLabel, showAppearanceBottomSheet;
@@ -45,6 +47,11 @@ class _SettingState extends ConsumerState<Setting> {
     final email = ref.watch(userEmailProvider);
 
     final appSetting = ref.watch(appSettingProvider);
+    // Server-side gate. Censored regions get Features[unbounded]=false,
+    // and every Unbounded-flavoured row in this menu (the settings sub-
+    // page link AND the project promo card at the bottom) disappears.
+    final unboundedAvailable =
+        ref.watch(featureFlagProvider).getBool(FeatureFlag.unbounded);
 
     final hasProSession = (user?.legacyUserData.isPro ?? false) &&
         (user?.legacyUserData.unpassRegistered ?? false);
@@ -124,13 +131,15 @@ class _SettingState extends ConsumerState<Setting> {
                   icon: AppImagePaths.glob,
                   onPressed: () => settingMenuTap(_SettingType.vpnSetting),
                 ),
-                DividerSpace(),
-                AppTile(
-                  label: 'Unbounded Settings',
-                  icon: AppImagePaths.share,
-                  onPressed: () =>
-                      settingMenuTap(_SettingType.unboundedSetting),
-                ),
+                if (unboundedAvailable) ...[
+                  DividerSpace(),
+                  AppTile(
+                    label: 'Unbounded Settings',
+                    icon: AppImagePaths.share,
+                    onPressed: () =>
+                        settingMenuTap(_SettingType.unboundedSetting),
+                  ),
+                ],
                 DividerSpace(),
                 AppTile(
                   label: 'language'.i18n,
@@ -199,36 +208,38 @@ class _SettingState extends ConsumerState<Setting> {
               ),
             ),
           },
-          const SizedBox(height: defaultSize),
-          Padding(
-            padding: const EdgeInsets.only(left: 16),
-            child: Text(
-              'lantern_projects'.i18n,
-              style: textTheme.labelLarge!.copyWith(
-                color: context.textSecondary,
+          if (unboundedAvailable) ...[
+            const SizedBox(height: defaultSize),
+            Padding(
+              padding: const EdgeInsets.only(left: 16),
+              child: Text(
+                'lantern_projects'.i18n,
+                style: textTheme.labelLarge!.copyWith(
+                  color: context.textSecondary,
+                ),
               ),
             ),
-          ),
-          const SizedBox(height: 4),
-          Card(
-            child: AppTile(
-              minHeight: 72,
-              icon: AppImagePaths.lanternLogoRounded,
-              iconUseThemeColor: false,
-              trailing: AppImage(path: AppImagePaths.outsideBrowser),
-              label: 'unbounded'.i18n,
-              subtitle: Text(
-                'help_fight_global_internet_censorship'.i18n,
-                style: textTheme.labelMedium!.copyWith(
-                  color: context.textTertiary,
+            const SizedBox(height: 4),
+            Card(
+              child: AppTile(
+                minHeight: 72,
+                icon: AppImagePaths.lanternLogoRounded,
+                iconUseThemeColor: false,
+                trailing: AppImage(path: AppImagePaths.outsideBrowser),
+                label: 'unbounded'.i18n,
+                subtitle: Text(
+                  'help_fight_global_internet_censorship'.i18n,
+                  style: textTheme.labelMedium!.copyWith(
+                    color: context.textTertiary,
+                  ),
                 ),
+                onPressed: () {
+                  UrlUtils.openUrl(AppUrls.unbounded);
+                },
               ),
-              onPressed: () {
-                UrlUtils.openUrl(AppUrls.unbounded);
-              },
             ),
-          ),
-          SizedBox(height: defaultSize),
+            SizedBox(height: defaultSize),
+          ],
         ],
       ),
     );