initial web rssh stage 1

third-party/README.md

@@ -1,15 +1,18 @@
-# Third-party native dependencies
+# Third-party vendored dependencies
 
-Initialize submodules:
+## wireguard-android (optional Gradle module)
+
+Remote access WireGuard v1 can use the in-app `RemoteAccessVpnService` fallback (TUN only).
+For full userspace WireGuard crypto/data plane, initialize the upstream tunnel library:
 
 ```bash
-git submodule update --init --recursive
+bash scripts/init-wireguard-submodule.sh
 ```
 
-| Path | Project | Use |
-|------|---------|-----|
-| `libvpx/` | [webmproject/libvpx](https://github.com/webmproject/libvpx) | VP8/VP9 software codec |
-| `opus/` | [xiph/opus](https://github.com/xiph/opus) | Opus audio (in-band FEC) |
-| `speex/` | [xiph/speex](https://github.com/xiph/speex) | Speex audio |
+Then build with the `:tunnel` module (auto-included when present):
 
-Built via `ndk/CMakeLists.txt` into `libandroidcast_codecs.so`.
+- Submodule path: `third-party/wireguard-android/`
+- Gradle module: `third-party/wireguard-android/tunnel`
+- License: MIT / Apache-2.0 (see upstream `COPYING`)
+
+`WireGuardTunnelBridge` loads `com.wireguard.android.backend.GoBackend` via reflection when the module is on the classpath.