Warn user when another always-on VPN blocks onboarding

If another app is set as Always-on VPN, Android silently refuses to
show TrackerControl's VPN consent dialog, so tapping "Enable On-Device
VPN" in onboarding appears to do nothing. Detect this both proactively
(pre-Android S, where the setting is readable) and reactively (via
onActivityResult) and show a dialog pointing the user to system VPN
settings so they can disable the other always-on VPN.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: kasnder

app/src/main/java/net/kollnig/missioncontrol/ActivityOnboarding.java

@@ -3,10 +3,12 @@
 import android.Manifest;
 import android.content.Intent;
 import android.content.SharedPreferences;
+import android.content.DialogInterface;
 import android.net.VpnService;
 import android.os.Build;
 import android.os.Bundle;
 import android.provider.Settings;
+import android.text.TextUtils;
 import android.util.Log;
 import android.view.LayoutInflater;
 import android.view.View;
@@ -23,6 +25,8 @@
 import androidx.recyclerview.widget.RecyclerView;
 import androidx.viewpager2.widget.ViewPager2;
 
+import com.google.android.material.dialog.MaterialAlertDialogBuilder;
+
 import java.util.ArrayList;
 import java.util.List;
 
@@ -274,9 +278,29 @@ private void refreshSlides() {
                 slide.warningResId = vpnPrepared ? 0 : R.string.onboarding_vpn_sure;
                 slide.actionListener = v -> {
                     if (!vpnPrepared) {
-                        Intent intent = VpnService.prepare(ActivityOnboarding.this);
-                        if (intent != null) {
-                            startActivityForResult(intent, 0);
+                        // Proactively detect another Always-on VPN on Android < S,
+                        // where the setting is still readable.
+                        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.S) {
+                            try {
+                                String alwaysOn = Settings.Secure.getString(
+                                        getContentResolver(), "always_on_vpn_app");
+                                if (!TextUtils.isEmpty(alwaysOn)
+                                        && !getPackageName().equals(alwaysOn)) {
+                                    showAlwaysOnVpnBlockedDialog();
+                                    return;
+                                }
+                            } catch (Throwable ex) {
+                                Log.e("Onboarding", ex.toString());
+                            }
+                        }
+                        try {
+                            Intent intent = VpnService.prepare(ActivityOnboarding.this);
+                            if (intent != null) {
+                                startActivityForResult(intent, 0);
+                            }
+                        } catch (Throwable ex) {
+                            Log.e("Onboarding", ex.toString());
+                            showAlwaysOnVpnBlockedDialog();
                         }
                     }
                 };
@@ -425,6 +449,36 @@ private void updateButtons(int position) {
         }
     }
 
+    @Override
+    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
+        super.onActivityResult(requestCode, resultCode, data);
+        if (requestCode == 0 && resultCode != RESULT_OK) {
+            // Consent was denied or silently blocked. If prepare() still returns a
+            // non-null intent, Android refused to show the consent dialog — most
+            // commonly because another app is set as Always-on VPN.
+            if (VpnService.prepare(this) != null) {
+                showAlwaysOnVpnBlockedDialog();
+            }
+        }
+    }
+
+    private void showAlwaysOnVpnBlockedDialog() {
+        new MaterialAlertDialogBuilder(this)
+                .setTitle(R.string.onboarding_vpn_blocked_title)
+                .setMessage(android.text.Html.fromHtml(
+                        getString(R.string.onboarding_vpn_blocked_desc)))
+                .setPositiveButton(R.string.onboarding_vpn_blocked_action,
+                        (DialogInterface.OnClickListener) (dialog, which) -> {
+                            try {
+                                startActivity(new Intent(Settings.ACTION_VPN_SETTINGS));
+                            } catch (Throwable ex) {
+                                Log.e("Onboarding", ex.toString());
+                            }
+                        })
+                .setNegativeButton(android.R.string.cancel, null)
+                .show();
+    }
+
     private void finishOnboarding() {
         boolean vpnPrepared = VpnService.prepare(this) == null;
 

app/src/main/res/values/strings.xml

@@ -566,6 +566,9 @@ Sincerely,\n\n]]></string>
     <string name="onboarding_vpn_desc">TrackerControl uses Android\'s local VPN interface to analyse your internet traffic.\n\n<b>Important:</b> No external VPN server is involved. We don\'t see your data.</string>
     <string name="onboarding_vpn_action">Enable On-Device VPN</string>
     <string name="onboarding_vpn_sure">TrackerControl cannot filter any traffic without the local VPN. Are you sure you want to proceed without enabling it?</string>
+    <string name="onboarding_vpn_blocked_title">Another VPN is active</string>
+    <string name="onboarding_vpn_blocked_desc">Android prevented TrackerControl from starting its local VPN because another app is set as <b>Always-on VPN</b>. Open VPN settings and disable Always-on for the other VPN, then try again.</string>
+    <string name="onboarding_vpn_blocked_action">Open VPN settings</string>
 
     <string name="onboarding_battery_title">Prevent Interruption</string>
     <string name="onboarding_battery_desc">Android may kill background apps to save battery. To ensure continuous protection against trackers, please disable optimisations for TrackerControl.</string>