Register direct transport for unbounded signaling

[myleshorton]

Summary

• Adds lazyDirectTransport — an http.RoundTripper backed by sing-box's direct outbound dialer
• Registers it in the sing-box context before service creation so unbounded can retrieve it via adapter.DirectTransportFromContext
• Resolves it after NewServiceWithContext returns (when the direct outbound exists)

How it works

tunnel.init()
  │
  ├─ Create lazyDirectTransport{}
  ├─ Register in ctx via ContextWithDirectTransport(ctx, transport)
  │
  ├─ libbox.NewServiceWithContext(ctx, ...)
  │    └─ Unbounded outbound constructed, calls DirectTransportFromContext(ctx)
  │       └─ Gets reference to lazyDirectTransport (not yet resolved)
  │
  ├─ directTransport.Resolve(ctx)
  │    └─ Looks up "direct" outbound → wraps its DialContext in http.Transport
  │
  └─ lbService.Start() / PostStart()
       └─ Unbounded makes HTTP calls → lazyDirectTransport delegates to direct outbound
          └─ Socket protection applied automatically by platform

Platform bypass mechanisms (via direct outbound)

Platform	Socket protection
Desktop daemon	Traffic doesn't enter TUN (daemon owns the device)
Android	VpnService.protect(fd)
iOS/macOS	IP_BOUND_IF / IPV6_BOUND_IF
Linux	SO_BINDTOIFINDEX

Dependencies

• Add direct transport context for unbounded signaling lantern-box#200 must be merged first (adds ContextWithDirectTransport / DirectTransportFromContext and wires unbounded to use it)
• After that PR merges, update go.mod here to pick up the new lantern-box version

Test plan

• Build passes after lantern-box dependency is updated
• Verify direct outbound lookup succeeds at tunnel init time
• Integration test: unbounded signaling traffic bypasses tunnel

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds a “lazy” direct http.RoundTripper that can be registered into the sing-box context early (so outbounds like unbounded can capture it during construction) and then resolved after libbox.NewServiceWithContext returns by wiring it to the sing-box direct outbound dialer.

Changes:

• Register a lazyDirectTransport in the tunnel context before creating the libbox service.
• Resolve lazyDirectTransport after service creation by looking up the direct outbound and building an http.Transport that dials via it.
• Add new vpn/direct_transport.go implementing the lazy transport.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
vpn/tunnel.go	Registers and resolves the lazy direct transport around NewServiceWithContext.
vpn/direct_transport.go	Implements an http.RoundTripper that defers to a resolved inner transport built from the direct outbound dialer.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.