[allenyelger-hash]

Problem

Apps installed via the OS "app cloning" feature (应用分身 on ColorOS/MIUI/etc., clone user) are invisible to Clash Meta for Android:

• They never appear in the Access Control app list, which only enumerates the main user's packages (discussion #803)
• Connections from cloned app instances cannot be resolved to an app name, and PROCESS-NAME rules cannot match them, because the app list cache (AppListCacheModule) only knows main-user uids
• On Android 17 this got worse: cloned apps can lose network access entirely when the VPN is on (discussion #865, OnePlus 13 / Android 17)

Android VPNs are strictly per-user: a VpnService established in the main profile never covers apps in other users, and there is no app-reachable API to change that. PR #788 already added the INTERACT_ACROSS_USERS permission (ADB-grantable) as groundwork for cross-profile scenarios — this PR builds on that.

Changes

All cross-user enumeration fails soft (empty/null on missing permission or blocked hidden API), so without the ADB grant behavior is unchanged.

1. New helper common/.../compat/CrossUser.kt

   • Context.crossUserProfiles(): non-main profiles via UserManager.getUserProfiles() (work profile / app-cloning clone user)
   • Context.getInstalledPackagesAsUserCompat(): reflection-based PackageManager.getInstalledPackagesAsUser with the already-declared INTERACT_ACROSS_USERS

2. Access Control list (AccessControlActivity): appends cloned app instances (same filters as the main list), with a (clone) label suffix. Since selection is keyed by package name, main and cloned instances share one switch — no schema change. When clone profiles are detected but enumeration is denied, a one-time dialog explains the per-user VPN limitation and shows the ADB grant command (EN + zh-CN strings).

3. App list cache (AppListCacheModule): additionally reports uids from clone profiles (their uids already carry the user offset), so connections from cloned apps resolve to the right package name and PROCESS-NAME rules can match them.

Notes

• This does not (and cannot) make the main-profile VPN route cloned apps' traffic — Android keeps VPNs per user. The dialog guidance mentions the practical workarounds (disable "Block connections without VPN"; clone CMFA itself and run it inside the cloned profile).
• Only values/values-zh strings are added; other locales fall back to English.
• No storage schema change; TunService's allow/deny application logic is untouched.

Test plan

• ./gradlew :app:compileDebugKotlin / assembleDebug locally
• Without ADB grant: access control list unchanged (no crash when clone profiles exist)
• With adb shell pm grant --user 0 com.github.metacubex.clash.meta android.permission.INTERACT_ACROSS_USERS: cloned instances appear with (clone) suffix; hint dialog no longer shown
• Connections from cloned apps show the package name (not a raw uid)

Refs: #788, discussions #803, #865