Docs/readme docker (#843)

Fix relative links

.dockerignore

@@ -0,0 +1,28 @@
+.git
+.github
+.gitignore
+__pycache__/
+*.py[cod]
+*.pyo
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.venv/
+venv/
+dist/
+build/
+packaging/
+windows.py
+icon.ico
+*.spec
+*.spec.bak
+*.manifest
+*.log
+.vscode/
+.idea/
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+Desktop.ini

.gitattributes

@@ -0,0 +1,9 @@
+* text=auto eol=lf
+
+*.py text diff=python
+*.spec text linguist-language=Python
+
+*.toml text
+*.txt text
+
+*.ico binary

.github/CODEOWNERS

@@ -0,0 +1,11 @@
+# Default owners
+* @Flowseal
+
+# Automation and repository settings
+.github/** @Flowseal
+
+# Documentation
+docs/** @Flowseal
+
+# Core proxy implementation
+proxy/** @Flowseal

.github/FUNDING.yml

@@ -0,0 +1 @@
+custom: ['https://nowpayments.io/donation/flowseal']

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,23 @@
+name: 🐛 Проблема
+title: '[Проблема] '
+description: Сообщить о проблеме
+labels: ['bug']
+
+body:
+  - type: input
+    id: app_version
+    attributes:
+      label: Версия TG WS Proxy
+      description: Укажите версию приложения (например, v1.2.3)
+      placeholder: vX.Y.Z
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Опишите вашу проблему
+      description: Чётко опишите проблему, с которой вы столкнулись
+      placeholder: Описание проблемы
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,6 @@
+blank_issues_enabled: false
+
+contact_links:
+  - name: 📚 Документация
+    url: https://github.com/Flowseal/tg-ws-proxy/tree/main/docs
+    about: Ознакомьтесь с документацией перед созданием issue

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,37 @@
+name: 🚀 Предложение
+title: '[Предложение] '
+description: Предложить улучшение или новую функциональность
+labels: ['enhancement']
+
+body:
+  - type: textarea
+    id: solution
+    attributes:
+      label: Предлагаемое решение
+      description: Опишите, как именно вы предлагаете улучшить проект
+      placeholder: |
+        Предлагаю добавить ...
+        Это позволит ...
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Для какой платформы актуально?
+      description: Выберите платформу, если предложение связано с конкретной ОС
+      options:
+        - Все платформы
+        - Windows
+        - macOS
+        - Linux
+        - Другое
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Дополнительный контекст
+      description: Добавьте примеры, ссылки, скриншоты или другие детали
+      placeholder: Любые дополнительные материалы по предложению

.github/cfproxy-domains.txt

@@ -0,0 +1,10 @@
+virkgj.com
+vmmzovy.com
+mkuosckvso.com
+zaewayzmplad.com
+twdmbzcm.com
+awzwsldi.com
+clngqrflngqin.com
+tjacxbqtj.com
+bxaxtxmrw.com
+dmohrsgmohcrwb.com

.github/workflows/build.yml

@@ -3,38 +3,451 @@ name: Build & Release
 on:
   workflow_dispatch:
     inputs:
+      make_release:
+        description: 'Create Github Release?'
+        type: boolean
+        required: true
+        default: false
       version:
         description: "Release version tag (e.g. v1.0.0)"
-        required: true
+        required: false
         default: "v1.0.0"
 
 permissions:
   contents: write
 
 jobs:
-  build:
+  build-windows:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.11"
           cache: "pip"
 
+      - name: Setup MSVC 14.40 toolset
+        uses: ilammy/msvc-dev-cmd@v1
+        with:
+          toolset: 14.40
+
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: pip install .
+
+      - name: Build PyInstaller bootloader from source
+        env:
+          PYINSTALLER_COMPILE_BOOTLOADER: "1"
+        run: |
+          pip download --no-binary pyinstaller --no-deps --no-cache-dir -d pyinstaller_src "pyinstaller==6.10.0"
+          pip install (Get-ChildItem pyinstaller_src\*.tar.gz).FullName
 
       - name: Build EXE with PyInstaller
-        run: pyinstaller tg_ws_proxy.spec --noconfirm
+        run: pyinstaller packaging/windows.spec --noconfirm
+
+      - name: Strip Rich PE header
+        shell: bash
+        run: |
+          python -c "
+          import struct, pathlib
+          exe = pathlib.Path('dist/TgWsProxy.exe')
+          data = bytearray(exe.read_bytes())
+          rich = data.find(b'Rich')
+          if rich == -1:
+              raise SystemExit('Rich header not found')
+          ck = struct.unpack_from('<I', data, rich + 4)[0]
+          dans = struct.pack('<I', 0x536E6144 ^ ck)
+          ds = data.find(dans)
+          if ds == -1:
+              raise SystemExit('DanS marker not found')
+          data[ds:rich + 8] = b'\x00' * (rich + 8 - ds)
+          exe.write_bytes(data)
+          print(f'Stripped Rich header: offset {ds}..{rich+8}')
+          "
+
+      - name: Rename artifact
+        run: mv dist/TgWsProxy.exe dist/TgWsProxy_windows.exe
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: TgWsProxy
-          path: dist/TgWsProxy.exe
+          path: dist/TgWsProxy_windows.exe
+
+  build-win7:
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        include:
+          - arch: x64
+            suffix: 64bit
+          - arch: x86
+            suffix: 32bit
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.8"
+          architecture: ${{ matrix.arch }}
+          cache: "pip"
+          
+      - name: Install dependencies & pyinstaller
+        run: pip install . "pyinstaller==5.13.2"
+
+      - name: Build EXE with PyInstaller
+        run: pyinstaller packaging/windows.spec --noconfirm
+
+      - name: Strip Rich PE header
+        shell: bash
+        run: |
+          python -c "
+          import struct, pathlib
+          exe = pathlib.Path('dist/TgWsProxy.exe')
+          data = bytearray(exe.read_bytes())
+          rich = data.find(b'Rich')
+          if rich == -1:
+              raise SystemExit('Rich header not found')
+          ck = struct.unpack_from('<I', data, rich + 4)[0]
+          dans = struct.pack('<I', 0x536E6144 ^ ck)
+          ds = data.find(dans)
+          if ds == -1:
+              raise SystemExit('DanS marker not found')
+          data[ds:rich + 8] = b'\x00' * (rich + 8 - ds)
+          exe.write_bytes(data)
+          print(f'Stripped Rich header: offset {ds}..{rich+8}')
+          "
+
+      - name: Rename artifact
+        run: mv dist/TgWsProxy.exe dist/TgWsProxy_windows_7_${{ matrix.suffix }}.exe
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: TgWsProxy-win7-${{ matrix.suffix }}
+          path: dist/TgWsProxy_windows_7_${{ matrix.suffix }}.exe
+
+  build-macos:
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install universal2 Python
+        run: |
+          set -euo pipefail
+          curl -LO https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg
+          sudo installer -pkg python-3.12.10-macos11.pkg -target /
+          echo "/Library/Frameworks/Python.framework/Versions/3.12/bin" >> "$GITHUB_PATH"
+
+      - name: Install dependencies
+        run: |
+          set -euo pipefail
+          python3.12 -m pip install --upgrade pip setuptools wheel
+          python3.12 -m pip install delocate==0.13.0
+
+          mkdir -p wheelhouse/arm64 wheelhouse/x86_64 wheelhouse/universal2
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_11_0_arm64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/arm64 \
+            'cffi>=2.0.0' \
+            Pillow==12.1.0 \
+            psutil==7.0.0
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_10_13_x86_64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/x86_64 \
+            'cffi>=2.0.0' \
+            Pillow==12.1.0
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_10_9_x86_64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/x86_64 \
+            psutil==7.0.0
+
+          delocate-merge \
+            wheelhouse/arm64/cffi-*.whl \
+            wheelhouse/x86_64/cffi-*.whl \
+            -w wheelhouse/universal2
+
+          delocate-merge \
+            wheelhouse/arm64/pillow-12.1.0-*.whl \
+            wheelhouse/x86_64/pillow-12.1.0-*.whl \
+            -w wheelhouse/universal2
+
+          delocate-merge \
+            wheelhouse/arm64/psutil-7.0.0-*.whl \
+            wheelhouse/x86_64/psutil-7.0.0-*.whl \
+            -w wheelhouse/universal2
+
+          python3.12 -m pip install --no-deps wheelhouse/universal2/*.whl
+          python3.12 -m pip install .
+          python3.12 -m pip install pyinstaller==6.13.0
+
+      - name: Create macOS icon from ICO
+        run: |
+          set -euo pipefail
+          python3.12 - <<'PY'
+          from PIL import Image
+
+          image = Image.open('icon.ico')
+          image = image.resize((1024, 1024), Image.LANCZOS)
+          image.save('icon_1024.png', 'PNG')
+          PY
+
+          mkdir -p icon.iconset
+          sips -z 16 16 icon_1024.png --out icon.iconset/icon_16x16.png
+          sips -z 32 32 icon_1024.png --out icon.iconset/icon_16x16@2x.png
+          sips -z 32 32 icon_1024.png --out icon.iconset/icon_32x32.png
+          sips -z 64 64 icon_1024.png --out icon.iconset/icon_32x32@2x.png
+          sips -z 128 128 icon_1024.png --out icon.iconset/icon_128x128.png
+          sips -z 256 256 icon_1024.png --out icon.iconset/icon_128x128@2x.png
+          sips -z 256 256 icon_1024.png --out icon.iconset/icon_256x256.png
+          sips -z 512 512 icon_1024.png --out icon.iconset/icon_256x256@2x.png
+          sips -z 512 512 icon_1024.png --out icon.iconset/icon_512x512.png
+          sips -z 1024 1024 icon_1024.png --out icon.iconset/icon_512x512@2x.png
+          iconutil -c icns icon.iconset -o icon.icns
+          rm -rf icon.iconset icon_1024.png
+
+      - name: Build app with PyInstaller
+        run: python3.12 -m PyInstaller packaging/macos.spec --noconfirm
+
+      - name: Validate universal2 app bundle
+        run: |
+          set -euo pipefail
+          found=0
+          while IFS= read -r -d '' file; do
+            if file "$file" | grep -q "Mach-O"; then
+              found=1
+              archs="$(lipo -archs "$file" 2>/dev/null || true)"
+              case "$archs" in
+                *arm64*x86_64*|*x86_64*arm64*) ;;
+                *)
+                  echo "Missing universal2 slices in $file: ${archs:-unknown}" >&2
+                  exit 1
+                  ;;
+              esac
+            fi
+          done < <(find "dist/TG WS Proxy.app" -type f -print0)
+
+          if [ "$found" -eq 0 ]; then
+            echo "No Mach-O files found in app bundle" >&2
+            exit 1
+          fi
+
+      - name: Create DMG
+        run: |
+          set -euo pipefail
+          APP_NAME="TG WS Proxy"
+          DMG_TEMP="dist/dmg_temp"
+
+          rm -rf "$DMG_TEMP"
+          mkdir -p "$DMG_TEMP"
+          cp -R "dist/${APP_NAME}.app" "$DMG_TEMP/"
+          ln -s /Applications "$DMG_TEMP/Applications"
+
+          hdiutil create \
+            -volname "$APP_NAME" \
+            -srcfolder "$DMG_TEMP" \
+            -ov \
+            -format UDZO \
+            "dist/TgWsProxy_macos_universal.dmg"
+
+          rm -rf "$DMG_TEMP"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: TgWsProxy-macOS
+          path: dist/TgWsProxy_macos_universal.dmg
+
+  build-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            python3-venv \
+            python3-dev \
+            python3-gi \
+            gir1.2-ayatanaappindicator3-0.1 \
+            python3-tk
+
+      - name: Create venv with system site-packages
+        run: python3 -m venv --system-site-packages .venv
+
+      - name: Install dependencies
+        run: |
+          .venv/bin/pip install --upgrade pip
+          .venv/bin/pip install .
+          .venv/bin/pip install "pyinstaller==6.13.0"
+
+      - name: Build binary with PyInstaller
+        run: .venv/bin/pyinstaller packaging/linux.spec --noconfirm
+
+      - name: Rename binary artifact
+        run: mv dist/TgWsProxy dist/TgWsProxy_linux_amd64
+
+      - name: Create .deb package
+        run: |
+          set -euo pipefail
+          VERSION="${{ github.event.inputs.version }}"
+          VERSION="${VERSION#v}"
+          PKG_ROOT="pkg"
+
+          rm -rf "$PKG_ROOT"
+          mkdir -p \
+            "$PKG_ROOT/DEBIAN" \
+            "$PKG_ROOT/usr/bin" \
+            "$PKG_ROOT/usr/share/applications" \
+            "$PKG_ROOT/usr/share/icons/hicolor/256x256/apps"
+
+          install -m 755 dist/TgWsProxy_linux_amd64 "$PKG_ROOT/usr/bin/tg-ws-proxy"
+
+          .venv/bin/python - <<PY
+          from PIL import Image
+
+          Image.open("icon.ico").save(
+              "${PKG_ROOT}/usr/share/icons/hicolor/256x256/apps/tg-ws-proxy.png",
+              "PNG",
+          )
+          PY
+
+          cat > "$PKG_ROOT/usr/share/applications/tg-ws-proxy.desktop" <<EOF
+          [Desktop Entry]
+          Type=Application
+          Name=TG WS Proxy
+          GenericName=Telegram Proxy
+          Comment=Telegram Desktop WebSocket Bridge Proxy
+          Exec=tg-ws-proxy
+          Icon=tg-ws-proxy
+          Terminal=false
+          Categories=Network;
+          StartupNotify=true
+          Keywords=telegram;proxy;websocket;
+          EOF
+
+          cat > "$PKG_ROOT/DEBIAN/control" <<EOF
+          Package: tg-ws-proxy
+          Version: ${VERSION}
+          Section: net
+          Priority: optional
+          Architecture: amd64
+          Maintainer: Flowseal
+          Depends: libgtk-3-0, libayatana-appindicator3-1, python3-tk
+          Description: Telegram Desktop WebSocket Bridge Proxy
+           MTProto/WebSocket bridge proxy for Telegram Desktop with tray UI.
+          EOF
+
+          dpkg-deb --build --root-owner-group \
+            "$PKG_ROOT" \
+            "dist/TgWsProxy_linux_amd64.deb"
+            
+      - name: Create .rpm package with fpm
+        run: |
+          set -euo pipefail
+          VERSION="${{ github.event.inputs.version }}"
+          VERSION="${VERSION#v}"
+          
+          sudo gem install fpm -v 1.17.0
+          
+          mkdir -p rpm_package/usr/bin
+          mkdir -p rpm_package/usr/share/applications
+          mkdir -p rpm_package/usr/share/icons/hicolor/256x256/apps
+          
+          cp dist/TgWsProxy_linux_amd64 rpm_package/usr/bin/tg-ws-proxy
+          chmod 755 rpm_package/usr/bin/tg-ws-proxy
+          
+          .venv/bin/python - <<PY
+          from PIL import Image
+          Image.open("icon.ico").save(
+              "rpm_package/usr/share/icons/hicolor/256x256/apps/tg-ws-proxy.png",
+              "PNG",
+          )
+          PY
+          
+          cat > rpm_package/usr/share/applications/tg-ws-proxy.desktop <<EOF
+          [Desktop Entry]
+          Type=Application
+          Name=TG WS Proxy
+          GenericName=Telegram Proxy
+          Comment=Telegram Desktop WebSocket Bridge Proxy
+          Exec=tg-ws-proxy
+          Icon=tg-ws-proxy
+          Terminal=false
+          Categories=Network;
+          StartupNotify=true
+          Keywords=telegram;proxy;websocket;
+          EOF
+          
+          cat > post_install.sh <<EOF
+          #!/bin/bash
+          if [ -x /usr/bin/update-desktop-database ]; then
+            /usr/bin/update-desktop-database &> /dev/null || :
+          fi
+          if [ -x /usr/bin/gtk-update-icon-cache ]; then
+            /usr/bin/gtk-update-icon-cache -q /usr/share/icons/hicolor &> /dev/null || :
+          fi
+          EOF
+          
+          chmod +x post_install.sh
+          
+          fpm -s dir \
+              -t rpm \
+              -n tg-ws-proxy \
+              -v ${VERSION} \
+              --iteration 1 \
+              --architecture x86_64 \
+              --license "MIT" \
+              --vendor "Flowseal" \
+              --maintainer "Flowseal" \
+              --url "https://github.com/Flowseal/tg-ws-proxy" \
+              --description "MTProto/WebSocket bridge proxy for Telegram Desktop with tray UI." \
+              --depends "libgtk-3.so.0()(64bit)" \
+              --depends "libayatana-appindicator3.so.1()(64bit)" \
+              --depends "python3-tkinter" \
+              --after-install post_install.sh \
+              --after-remove post_install.sh \
+              -C rpm_package \
+              .
+          
+          mv tg-ws-proxy-${VERSION}-1.x86_64.rpm dist/TgWsProxy_linux_amd64.rpm
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: TgWsProxy-linux
+          path: |
+            dist/TgWsProxy_linux_amd64
+            dist/TgWsProxy_linux_amd64.deb
+            dist/TgWsProxy_linux_amd64.rpm
+
+  release:
+    needs: [build-windows, build-win7, build-macos, build-linux]
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.make_release == 'true' }}
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: TgWsProxy*
+          path: dist
+          merge-multiple: true
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
@@ -42,8 +455,20 @@ jobs:
           tag_name: ${{ github.event.inputs.version }}
           name: "TG WS Proxy ${{ github.event.inputs.version }}"
           body: |
-            ## TG WS Proxy ${{ github.event.inputs.version }}
-          files: dist/TgWsProxy.exe
+            ## 
+            ### [❤️ Поддержать развитие проекта](https://github.com/Flowseal/tg-ws-proxy/blob/main/docs/Funding.md)
+
+            > [!TIP]
+            > Не можете скачать?
+            > Добавьте `185.199.109.133 release-assets.githubusercontent.com` в hosts или воспользуйтесь зеркалом: https://sourceforge.net/projects/tg-ws-proxy.mirror/files/
+          files: |
+            dist/TgWsProxy_windows.exe
+            dist/TgWsProxy_windows_7_64bit.exe
+            dist/TgWsProxy_windows_7_32bit.exe
+            dist/TgWsProxy_macos_universal.dmg
+            dist/TgWsProxy_linux_amd64
+            dist/TgWsProxy_linux_amd64.deb
+            dist/TgWsProxy_linux_amd64.rpm
           draft: false
           prerelease: false
         env:

.github/workflows/issue-triage.yml

@@ -0,0 +1,42 @@
+name: Auto comment on new issues
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: write
+
+jobs:
+  comment:
+    if: contains(github.event.issue.labels.*.name, 'bug')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Comment on new issue
+        uses: peter-evans/create-or-update-comment@v5
+        with:
+          issue-number: ${{ github.event.issue.number }}
+          body: |
+            ### Проверьте две вещи:
+            - вы на последней версии: [Releases](https://github.com/Flowseal/tg-ws-proxy/releases)
+            - запускали по инструкции для своей ОС: [Быстрый старт](https://github.com/Flowseal/tg-ws-proxy#навигация)
+
+            ## Решение частых проблем:
+
+            **Q**: Не запускается, падает с ошибкой, не работает как раньше после обновления?  
+            **A**:
+            1. Удалите всё в папке Temp (или хотя бы всё, что начинается с _MEI) 
+            2. Запускайте от имени админа
+            3. Попробуйте Win7 версию (если вы пользователь Windows)
+            4. Попробуйте отключить антивирус (если помогло, то добавьте exe в исключения). Не забудьте включить антивирус обратно.
+
+            ###
+
+            **Q**: Не грузит медиа? (фото/видео/стикеры)  
+            **A**: Удалите в настройках прокси в поле **DC → IP** всё, кроме `4:149.154.167.220`. Если это не помогло, полностью очистите это поле.
+
+
+            #### Если проблема решена, то закройте Issue
+
+            ### Если проблема осталась, пожалуйста, приложите по возможности логи.
+            Сделать это можно через иконку в трее -> Пкм -> Открыть логи. Сохраните логи в файл и приложите его сюда.

.gitignore

@@ -6,6 +6,8 @@ __pycache__/
 dist/
 build/
 *.spec.bak
+venv/
+.venv/
 
 # PyInstaller
 *.manifest
@@ -22,8 +24,4 @@ Thumbs.db
 Desktop.ini
 .DS_Store
 
-# Project-specific (not for the repo)
-scan_ips.py
-scan.txt
-AyuGramDesktop-dev/
-tweb-master/
+/icon.icns

CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# CONTRIBUTING
+
+Спасибо за желание помочь проекту `tg-ws-proxy`.
+
+## Перед созданием issue
+
+1. Проверьте документацию в `docs/README.md`.
+2. Убедитесь, что похожий issue еще не открыт.
+3. Для корректной работы triage используйте стандартные лейблы из `.github/labels.md`.
+
+## Как сообщать о проблемах
+
+- Используйте шаблон `Проблема`.
+- По возможности укажите:
+  - версию приложения,
+  - ОС,
+  - шаги воспроизведения,
+  - ожидаемое и фактическое поведение,
+  - лог-файл или текст ошибки.
+
+Чем точнее описание, тем быстрее можно помочь.
+
+## Локальный запуск из исходников
+
+Требуется Python `>=3.8`.
+
+```bash
+pip install -e .
+```
+
+Запуск:
+
+- консольный режим: `tg-ws-proxy`
+- Windows tray: `tg-ws-proxy-tray-win`
+- macOS tray: `tg-ws-proxy-tray-macos`
+- Linux tray: `tg-ws-proxy-tray-linux`
+
+Подробности: `docs/BuildFromSource.md`.
+
+## Pull Request
+
+Перед открытием PR:
+
+1. Убедитесь, что изменение решает конкретную проблему.
+2. Проверьте, что не сломаны существующие сценарии.
+3. Обновите документацию, если меняется поведение или настройка.
+
+Небольшие и сфокусированные PR проверяются и принимаются быстрее.

Dockerfile

@@ -0,0 +1,46 @@
+# syntax=docker/dockerfile:1.7
+
+FROM python:3.12-slim AS builder
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    VIRTUAL_ENV=/opt/venv
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential cargo libffi-dev libssl-dev \
+    && python -m venv "$VIRTUAL_ENV" \
+    && "$VIRTUAL_ENV/bin/pip" install --upgrade pip setuptools wheel \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+RUN "$VIRTUAL_ENV/bin/pip" install cryptography==46.0.5
+
+FROM python:3.12-slim AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH=/opt/venv/bin:$PATH \
+    TG_WS_PROXY_HOST=0.0.0.0 \
+    TG_WS_PROXY_PORT=1443 \
+    TG_WS_PROXY_SECRET=""  \
+    TG_WS_PROXY_DC_IPS="2:149.154.167.220 4:149.154.167.220"
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends tini ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system app \
+    && useradd --system --gid app --create-home --home-dir /home/app app
+
+WORKDIR /app
+COPY --from=builder /opt/venv /opt/venv
+COPY proxy ./proxy
+COPY docs/README.md LICENSE ./
+
+USER app
+
+EXPOSE 1443/tcp
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/bin/sh", "-lc", "set -eu; args=\"--host ${TG_WS_PROXY_HOST} --port ${TG_WS_PROXY_PORT}\"; for dc in ${TG_WS_PROXY_DC_IPS}; do args=\"$args --dc-ip $dc\"; done; if [ -n \"${TG_WS_PROXY_SECRET}\" ]; then args=\"$args --secret ${TG_WS_PROXY_SECRET}\"; fi; exec /opt/venv/bin/python -u proxy/tg_ws_proxy.py $args \"$@\"", "--"]
+CMD []

README.md

@@ -1,117 +0,0 @@
-# TG WS Proxy
-
-Локальный SOCKS5-прокси для Telegram Desktop, который перенаправляет трафик через WebSocket-соединения к указанным серверам, помогая частично ускорить работу Telegram.  
-  
-**Ожидаемый результат аналогичен прокидыванию hosts для Web Telegram**: ускорение загрузки и скачивания файлов, загрузки сообщений и части медиа.
-
-## Как это работает
-
-```
-Telegram Desktop → SOCKS5 (127.0.0.1:1080) → TG WS Proxy → WSS (kws*.web.telegram.org) → Telegram DC
-```
-
-1. Приложение поднимает локальный SOCKS5-прокси на `127.0.0.1:1080`
-2. Перехватывает подключения к IP-адресам Telegram
-3. Извлекает DC ID из MTProto obfuscation init-пакета
-4. Устанавливает WebSocket (TLS) соединение к соответствующему DC через домены `kws{N}.web.telegram.org`
-5. Если WS недоступен (302 redirect) — автоматически переключается на прямое TCP-соединение
-
-## Установка
-
-### Из исходников
-
-```bash
-pip install -r requirements.txt
-```
-
-## Использование
-
-### Tray-приложение (рекомендуется для Windows)
-
-```bash
-python tg_ws_tray.py
-```
-
-При первом запуске откроется окно с инструкцией по подключению Telegram Desktop. Приложение сворачивается в системный трей.
-
-**Меню трея:**
-- **Открыть в Telegram** — автоматически настроить прокси через `tg://socks` ссылку
-- **Перезапустить прокси** — перезапуск без выхода из приложения
-- **Настройки...** — GUI-редактор конфигурации
-- **Открыть логи** — открыть файл логов
-- **Выход** — остановить прокси и закрыть приложение
-
-### Консольный режим
-
-```bash
-python tg_ws_proxy.py [--port PORT] [--dc-ip DC:IP ...] [-v]
-```
-
-**Аргументы:**
-
-| Аргумент | По умолчанию | Описание |
-|---|---|---|
-| `--port` | `1080` | Порт SOCKS5-прокси |
-| `--dc-ip` | `2:149.154.167.220`, `4:149.154.167.220` | Целевой IP для DC (можно указать несколько раз) |
-| `-v`, `--verbose` | выкл. | Подробное логирование (DEBUG) |
-
-**Примеры:**
-
-```bash
-# Стандартный запуск
-python tg_ws_proxy.py
-
-# Другой порт и дополнительные DC
-python tg_ws_proxy.py --port 9050 --dc-ip 1:149.154.175.205 --dc-ip 2:149.154.167.220
-
-# С подробным логированием
-python tg_ws_proxy.py -v
-```
-
-## Настройка Telegram Desktop
-
-### Автоматически
-
-ПКМ по иконке в трее → **«Открыть в Telegram»**
-
-### Вручную
-
-1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
-2. Добавить прокси:
-   - **Тип:** SOCKS5
-   - **Сервер:** `127.0.0.1`
-   - **Порт:** `1080`
-   - **Логин/Пароль:** оставить пустыми
-
-## Конфигурация
-
-Tray-приложение хранит конфигурацию в `%APPDATA%/TgWsProxy/config.json`:
-
-```json
-{
-  "port": 1080,
-  "dc_ip": [
-    "2:149.154.167.220",
-    "4:149.154.167.220"
-  ],
-  "verbose": false
-}
-```
-
-Логи записываются в `%APPDATA%/TgWsProxy/proxy.log`.
-
-## Сборка exe
-
-Проект содержит спецификацию PyInstaller ([`tg_ws_proxy.spec`](tg_ws_proxy.spec)) и GitHub Actions workflow ([`.github/workflows/build.yml`](.github/workflows/build.yml)) для автоматической сборки.
-
-```bash
-pip install pyinstaller
-pyinstaller tg_ws_proxy.spec
-```
-
-## Дисклеймер
-Проект частично vibecoded by Opus 4.6. Если вы найдете баг, то создайте Issue с его описанем.
-
-## Лицензия
-
-[MIT License](LICENSE)

docs/BuildFromSource.md

@@ -0,0 +1,75 @@
+# Установка из исходников
+
+## Консольный прокси
+
+Для запуска только прокси без интерфейса системного трея достаточно базовой установки:
+
+```bash
+pip install -e .
+tg-ws-proxy
+```
+
+## Tray-приложение по ОС
+
+### Windows 7/10+
+
+```bash
+pip install -e .
+tg-ws-proxy-tray-win
+```
+
+### macOS
+
+```bash
+pip install -e .
+tg-ws-proxy-tray-macos
+```
+
+### Linux
+
+```bash
+pip install -e .
+tg-ws-proxy-tray-linux
+```
+
+## Консольный режим из исходников
+
+```bash
+tg-ws-proxy [--port PORT] [--host HOST] [--dc-ip DC:IP ...] [-v]
+```
+
+**Аргументы:**
+
+| Аргумент | По умолчанию | Описание |
+|---|---|---|
+| `--port` | `1443` | Порт прокси |
+| `--host` | `127.0.0.1` | Хост прокси |
+| `--secret` | `random` | 32-значный hex-ключ для авторизации клиентов |
+| `--dc-ip` | `2:149.154.167.220`, `4:149.154.167.220` | Целевой IP для DC (параметр можно указывать несколько раз) |
+| `--no-cfproxy` | `false` | Отключить попытку [проксирования через Cloudflare](./CfProxy.md) |
+| `--cfproxy-domain` | | Указать свой домен для проксирования через Cloudflare. [Подробнее](./CfProxy.md) |
+| `--cfproxy-priority` | `true` | Пробовать проксировать через Cloudflare перед прямым TCP подключением |
+| `--fake-tls-domain` | | Включить маскировку Fake TLS (ee-secret) с указанным SNI-доменом |
+| `--proxy-protocol` | выкл. | Принимать HAProxy PROXY protocol v1 (для работы за nginx/haproxy с `proxy_protocol on`) |
+| `--buf-kb` | `256` | Размер буфера в КБ |
+| `--pool-size` | `4` | Количество заготовленных соединений на каждый DC |
+| `--log-file` | выкл. | Путь к файлу, в который будут сохраняться логи |
+| `--log-max-mb` | `5` | Максимальный размер файла логов в МБ (после этого начинается перезапись) |
+| `--log-backups` | `0` | Количество сохранений логов после перезаписи |
+| `-v`, `--verbose` | выкл. | Подробное логирование (DEBUG) |
+
+**Примеры:**
+
+```bash
+# Стандартный запуск
+tg-ws-proxy
+
+# Другой порт и дополнительные DC
+tg-ws-proxy --port 9050 --dc-ip 1:149.154.175.205 --dc-ip 2:149.154.167.220
+
+# С подробным логированием
+tg-ws-proxy -v
+
+# Fake TLS маскировка (ee-secret)
+tg-ws-proxy --fake-tls-domain example.com
+```

docs/CfProxy.md

@@ -0,0 +1,32 @@
+# Cloudflare-прокси
+
+Для недоступных дата-центров можно использовать альтернативный бесплатный способ подключения — проксирование через Cloudflare. **Для работы нужен только домен**. В приложении есть домен по умолчанию, но его можно (и желательно) заменить на свой.
+  
+Прокси возвращает доступ к тому, что раньше не загружалось (реакции, некоторые стикеры). Если на аккаунте без Premium не загружаются фото/видео, оставьте в блоке `DC → IP` только `4:149.154.167.220`. Если CF-прокси работает, медиа снова начнет загружаться.
+
+## Зачем мне настраивать свой домен?
+
+Cloudflare имеет лимиты на одновременное количество WS-подключений. Домен по умолчанию может перестать работать в любой момент.
+
+## Настройка своего домена
+
+1. Добавьте свой домен в Cloudflare (либо купив его напрямую у Cloudflare, либо изменив NS-серверы: https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/). Домены стоят примерно 150 рублей в год, подойдёт любой.
+
+2. В `SSL/TLS` → `Overview` выставьте режим **Flexible**.
+
+3. В `DNS` → `Records` добавьте следующие `A`-записи через `+ Add Record`:
+- Name=`kws1`   IPv4=`149.154.175.50`
+- Name=`kws2`   IPv4=`149.154.167.51`
+- Name=`kws3`   IPv4=`149.154.175.100`
+- Name=`kws4`   IPv4=`149.154.167.91`
+- Name=`kws5`   IPv4=`149.154.171.5`
+- Name=`kws203` IPv4=`91.105.192.100`
+
+4. **Добавьте домен в [zapret](https://github.com/Flowseal/zapret-discord-youtube/) или в любое другое ПО, так как подсеть Cloudflare может быть заблокирована (например, в России).**
+
+5. В настройках `TgWsProxy` замените домен на свой.
+
+## Благодарности
+
+- Идея: https://github.com/Nekogram/WSProxy
+- Спасибо [@UjuiUjuMandan](https://github.com/UjuiUjuMandan) за информацию.

docs/FakeTlsNginx.md

@@ -0,0 +1,52 @@
+# Fake TLS + upstream в nginx
+
+Домен в параметре `--fake-tls-domain` должен указывать на тот же IP, на котором запущен прокси.
+
+## Пример `nginx.conf` для stream-модуля
+
+```nginx
+upstream mtproto {
+    server 127.0.0.1:8446;
+}
+
+map $ssl_preread_server_name $sni_name {
+    hostnames;
+    example.com mtproto;
+    # if you have xray with selfsni running:
+    # sub.example.com  www;
+    # default xray;
+}
+
+# upstream xray {
+#     server 127.0.0.1:8443;
+# }
+#
+# upstream www {
+#     server 127.0.0.1:7443;
+# }
+
+server {
+    proxy_protocol on;
+    set_real_ip_from unix:;
+    listen          443;
+    proxy_pass      $sni_name;
+    ssl_preread     on;
+}
+```
+
+## Запуск прокси за Nginx
+
+```bash
+python3 proxy/tg_ws_proxy.py \
+  --port 8446 \
+  --host 127.0.0.1 \
+  --fake-tls-domain example.com \
+  --proxy-protocol \
+  --secret <32-hex-chars>
+```
+
+Ссылка для подключения будет в формате `ee`-секрета:
+
+```text
+tg://proxy?server=your.domain.com&port=443&secret=ee<secret><domain_hex>
+```

docs/Funding.md

@@ -0,0 +1,12 @@
+> [!TIP]
+>
+> ### 🎉 Поддержать меня
+>
+> **USDT (TRC20)**: `TXPnKs2Ww1RD8JN6nChFUVmi5r2hqrWjuu`  
+> **BTC**: `bc1qr8vd6jelkyyry3m4mq6z5txdx4pl856fu6ss0w`  
+> **ETH**: `0x1417878fdc5047E670a77748B34819b9A49C72F1`  
+> **Другие монеты**: https://nowpayments.io/donation/flowseal
+
+Проект полностью бесплатен для всех.  
+Однако его развитие и стабильная работа при росте числа пользователей требуют вложений.  
+Буду благодарен за любую форму поддержки! Спасибо ❤️

docs/README.docker.md

@@ -0,0 +1,69 @@
+# TG WS Proxy для Docker
+
+## Установка из исходников
+
+Вводите команды последовательно, одну за другой:
+
+```bash
+# Скачиваем репозиторий
+git clone https://github.com/Flowseal/tg-ws-proxy.git
+
+# Переходим в папку с проектом
+cd tg-ws-proxy
+
+# Собираем образ
+docker build -t tg-ws-proxy .
+
+# Запускаем контейнер
+docker run -d \
+  --name tg-ws-proxy \
+  --restart=always \
+  -p 1443:1443 \
+  tg-ws-proxy:latest
+
+# Получаем ссылку для подключения
+docker logs tg-ws-proxy 2>&1 | grep 'tg://proxy'
+```
+
+После выполнения последней команды вы увидите ссылку вида:
+
+```text
+tg://proxy?server=172.17.0.2&port=1443&secret=dd68f127db1d...
+```
+
+## Настройка параметров
+
+Все настройки задаются переменными окружения при запуске контейнера:
+
+| Переменная            | Описание                                       | По умолчанию                         |
+|-----------------------|------------------------------------------------|--------------------------------------|
+| `TG_WS_PROXY_HOST`    | Адрес для приёма подключений                   | `0.0.0.0`                            |
+| `TG_WS_PROXY_PORT`    | Порт внутри контейнера                         | `1443`                               |
+| `TG_WS_PROXY_SECRET`  | Секретный ключ                                 | `random`                             |
+| `TG_WS_PROXY_DC_IPS`  | Пары «номер DC:IP» через пробел                | `2:149.154.167.220 4:149.154.167.220`|
+
+Пример с ручным указанием секрета:
+
+```bash
+docker run -d \
+  --name tg-ws-proxy \
+  --restart=always \
+  -p 1443:1443 \
+  -e TG_WS_PROXY_SECRET="ваш_секрет" \
+  tg-ws-proxy:latest
+```
+
+Для генерации секрета можно использовать:
+
+ ```bash
+openssl rand -hex 16  
+```
+
+## Настройка Telegram Desktop
+
+1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
+2. Добавьте прокси:
+   - **Тип:** MTProto
+   - **Сервер:** `127.0.0.1` (или переопределенный вами)
+   - **Порт:** `1443` (или переопределенный вами)
+   - **Secret:** из настроек или логов

docs/README.linux.md

@@ -0,0 +1,51 @@
+# TG WS Proxy для Linux
+
+## Готовые сборки
+
+Для Debian/Ubuntu скачайте со [страницы релизов](https://github.com/Flowseal/tg-ws-proxy/releases) пакет `TgWsProxy_linux_amd64.deb`.
+
+Для Arch и основанных на Arch дистрибутивов подготовлены пакеты в AUR:
+
+- [tg-ws-proxy-bin](https://aur.archlinux.org/packages/tg-ws-proxy-bin)
+- [tg-ws-proxy-git](https://aur.archlinux.org/packages/tg-ws-proxy-git)
+- [tg-ws-proxy-cli](https://aur.archlinux.org/packages/tg-ws-proxy-cli)
+
+```shell
+# Установка без AUR-helper
+git clone https://aur.archlinux.org/tg-ws-proxy-bin.git
+cd tg-ws-proxy-bin
+makepkg -si
+
+# При помощи AUR-helper
+paru -S tg-ws-proxy-bin
+
+# Для пакета -cli запуск через systemd (8888 — номер порта; secret можно сгенерировать командой openssl rand -hex 16)
+sudo systemctl start tg-ws-proxy@8888:3075abe65830f0325116bb0416cadf9f
+```
+
+Для остальных дистрибутивов можно использовать `TgWsProxy_linux_amd64` (бинарный файл для x86_64).
+
+```bash
+chmod +x TgWsProxy_linux_amd64
+./TgWsProxy_linux_amd64
+```
+
+При первом запуске откроется окно с инструкцией. Приложение работает в системном трее (требуется AppIndicator).
+
+## Настройка Telegram Desktop
+
+1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
+2. Добавьте прокси:
+   - **Тип:** MTProto
+   - **Сервер:** `127.0.0.1` (или переопределенный вами)
+   - **Порт:** `1443` (или переопределенный вами)
+   - **Secret:** из настроек или логов
+
+## Установка из исходников
+
+Подробная инструкция: [BuildFromSource.md](./BuildFromSource.md)
+
+```bash
+pip install -e .
+tg-ws-proxy-tray-linux
+```

docs/README.macos.md

@@ -0,0 +1,30 @@
+# TG WS Proxy для macOS
+
+Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте `TgWsProxy_macos_universal.dmg` (универсальная сборка для Apple Silicon и Intel).
+
+1. Откройте образ
+2. Перенесите `TG WS Proxy.app` в папку `Applications`
+3. При первом запуске macOS может попросить подтвердить открытие: **Системные настройки → Конфиденциальность и безопасность → Всё равно открыть**
+
+Минимально поддерживаемые версии:
+
+- Intel macOS 10.15+
+- Apple Silicon macOS 11.0+
+
+## Настройка Telegram Desktop
+
+1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
+2. Добавьте прокси:
+   - **Тип:** MTProto
+   - **Сервер:** `127.0.0.1` (или переопределенный вами)
+   - **Порт:** `1443` (или переопределенный вами)
+   - **Secret:** из настроек или логов
+
+## Установка из исходников
+
+Подробная инструкция: [BuildFromSource.md](./BuildFromSource.md)
+
+```bash
+pip install -e .
+tg-ws-proxy-tray-macos
+```

docs/README.md

@@ -0,0 +1,126 @@
+> [!TIP]
+>
+> ### [🎉 Поддержать меня](./Funding.md)
+>
+> **USDT (TRC20)**: `TXPnKs2Ww1RD8JN6nChFUVmi5r2hqrWjuu`  
+> **BTC**: `bc1qr8vd6jelkyyry3m4mq6z5txdx4pl856fu6ss0w`  
+> **ETH**: `0x1417878fdc5047E670a77748B34819b9A49C72F1`  
+> **Другие монеты**: https://nowpayments.io/donation/flowseal
+
+> [!CAUTION]
+>
+> ### Реакция антивирусов
+>
+> Антивирусы часто ошибочно помечают приложение как вирус из-за упаковщика.  
+> Если вы не можете скачать из-за блокировки антивирусом, то:
+>
+> 1) **Попробуйте скачать версию для Windows 7 (по функциональности она не отличается)**
+> 2) Отключите антивирус на время скачивания, добавьте файл в исключения и включите обратно  
+>
+> Всегда проверяйте, что скачиваете из интернета, тем более из непроверенных источников. Всегда лучше смотреть на детекты широко известных антивирусов на VirusTotal
+
+# TG WS Proxy
+
+**Локальный MTProto-прокси** для Telegram Desktop, который **ускоряет работу Telegram**, перенаправляя трафик через WebSocket-соединения. Данные передаются в том же зашифрованном виде, а для работы не нужны сторонние серверы.
+
+<picture>
+  <source srcset="https://github.com/user-attachments/assets/17f1d15e-e1c2-41ea-a452-220d13359262" media="(prefers-color-scheme: dark)">
+  <img src="https://github.com/user-attachments/assets/8d595468-83a1-4e4f-bac4-9ce4a07027bd">
+</picture>
+
+## Навигация
+
+- **🚀 Быстрый старт**
+  - **[Windows](./README.windows.md)**
+  - **[macOS](./README.macos.md)**
+  - **[Linux](./README.linux.md)**
+  - **[Docker](./README.docker.md)**
+- [Настройка Cloudflare-домена (CF-прокси)](./CfProxy.md)
+- [Fake TLS + upstream в Nginx](./FakeTlsNginx.md)
+- [Файлы конфигурации Tray-приложения](./TrayConfig.md)
+- [Установка из исходников](./BuildFromSource.md)
+- [Руководство для контрибьюторов](../CONTRIBUTING.md)
+
+## Windows: быстрый вход
+
+Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте:
+
+- `TgWsProxy_windows.exe` (Windows 10+)
+- `TgWsProxy_windows_7_64bit.exe` (Windows 7 x64)
+- `TgWsProxy_windows_7_32bit.exe` (Windows 7 x32)
+
+При первом запуске откроется окно с инструкцией по подключению Telegram Desktop. **Приложение сворачивается в системный трей.**
+
+### Меню трея
+
+- **Открыть в Telegram** — автоматически настроить прокси через ссылку `tg://proxy`
+- **Скопировать ссылку** — скопировать ссылку для подключения
+- **Перезапустить прокси** — перезапуск без выхода из приложения
+- **Настройки...** — GUI-редактор конфигурации (версия приложения, опциональная проверка обновлений с GitHub)
+- **Открыть логи** — открыть файл логов
+- **Выход** — остановить прокси и закрыть приложение
+
+### Настройка Telegram Desktop
+
+**Автоматическая настройка**
+
+Щелкните правой кнопкой мыши по значку в трее и выберите **«Открыть в Telegram»**.
+
+Если не сработало (Telegram не открылся с подключением), выполните шаги ниже:
+
+1. Щелкните правой кнопкой мыши по значку в трее и выберите **«Скопировать ссылку»**
+2. Отправьте ссылку в «Избранное» в Telegram и нажмите по ней левой кнопкой мыши
+3. Подключитесь
+
+**Ручная настройка**
+
+1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
+2. Добавьте прокси:
+   - **Тип:** MTProto
+   - **Сервер:** `127.0.0.1` (или переопределенный вами)
+   - **Порт:** `1443` (или переопределенный вами)
+   - **Secret:** из настроек или логов
+
+## Как это работает
+
+```
+Telegram Desktop → MTProto Proxy (127.0.0.1:1443) → WebSocket → Telegram DC
+```
+
+1. Приложение поднимает MTProto прокси на `127.0.0.1:1443`
+2. Перехватывает подключения к IP-адресам Telegram
+3. Извлекает DC ID из MTProto obfuscation init-пакета
+4. Устанавливает WebSocket-соединение (TLS) к соответствующему DC через домены Telegram
+5. Если WS недоступен (302 redirect) — автоматически переключается на CfProxy / прямое TCP-соединение
+
+> [!IMPORTANT] 
+> ### Не грузит фото/видео?
+> **Удалите в настройках прокси в DC → IP всё, кроме `4:149.154.167.220`**  
+> **Если это не помогло, полностью очистите это поле**  
+> Подобная проблема встречается на аккаунтах без Premium  
+> Если это не помогло, настройте собственный домен по инструкции: [CfProxy.md](./CfProxy.md)
+
+## Автоматическая сборка
+
+Проект содержит спецификации PyInstaller ([`packaging/windows.spec`](../packaging/windows.spec), [`packaging/macos.spec`](../packaging/macos.spec), [`packaging/linux.spec`](../packaging/linux.spec)) и GitHub Actions workflow ([`.github/workflows/build.yml`](../.github/workflows/build.yml)) для автоматической сборки.
+
+Минимально поддерживаемые версии ОС для текущих бинарных сборок:
+
+- Windows 10+ для `TgWsProxy_windows.exe`
+- Windows 7 (x64) для `TgWsProxy_windows_7_64bit.exe`
+- Windows 7 (x32) для `TgWsProxy_windows_7_32bit.exe`
+- Intel macOS 10.15+
+- Apple Silicon macOS 11.0+
+- Linux x86_64 (требуется AppIndicator для системного трея)
+
+## Контрибьюторы
+
+Спасибо всем, кто помогает развивать проект ❤️
+
+<a href="https://github.com/Flowseal/tg-ws-proxy/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=Flowseal/tg-ws-proxy" />
+</a>
+
+## Лицензия
+
+[MIT License](../LICENSE)

docs/README.windows.md

@@ -0,0 +1,52 @@
+# TG WS Proxy для Windows
+
+Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте:
+
+- `TgWsProxy_windows.exe` (Windows 10+)
+- `TgWsProxy_windows_7_64bit.exe` (Windows 7 x64)
+- `TgWsProxy_windows_7_32bit.exe` (Windows 7 x32)
+
+Сборки публикуются автоматически через [GitHub Actions](https://github.com/Flowseal/tg-ws-proxy/actions) из открытого исходного кода.
+
+При первом запуске откроется окно с инструкцией по подключению Telegram Desktop. **Приложение сворачивается в системный трей.**
+
+## Меню трея
+
+- **Открыть в Telegram** — автоматически настроить прокси через ссылку `tg://proxy`
+- **Скопировать ссылку** — скопировать ссылку для подключения
+- **Перезапустить прокси** — перезапуск без выхода из приложения
+- **Настройки...** — GUI-редактор конфигурации (версия приложения, опциональная проверка обновлений с GitHub)
+- **Открыть логи** — открыть файл логов
+- **Выход** — остановить прокси и закрыть приложение
+
+При первом запуске после старта может появиться запрос об открытии страницы релиза, если на GitHub вышла новая версия (эту проверку можно отключить в настройках).
+
+## Настройка Telegram Desktop
+
+### Автоматическая настройка
+
+Щелкните правой кнопкой мыши по значку в трее и выберите **«Открыть в Telegram»**.
+
+Если не сработало (Telegram не открылся с подключением), выполните шаги ниже:
+
+1. Щелкните правой кнопкой мыши по значку в трее и выберите **«Скопировать ссылку»**
+2. Отправьте ссылку в «Избранное» в Telegram и нажмите по ней левой кнопкой мыши
+3. Подключитесь
+
+### Ручная настройка
+
+1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
+2. Добавьте прокси:
+   - **Тип:** MTProto
+   - **Сервер:** `127.0.0.1` (или переопределенный вами)
+   - **Порт:** `1443` (или переопределенный вами)
+   - **Secret:** из настроек или логов
+
+## Установка из исходников
+
+Подробная инструкция: [BuildFromSource.md](./BuildFromSource.md)
+
+```bash
+pip install -e .
+tg-ws-proxy-tray-win
+```

docs/TrayConfig.md

@@ -0,0 +1,31 @@
+# Файлы конфигурации Tray-приложения
+
+Tray-приложение хранит данные в:
+
+- **Windows:** `%APPDATA%/TgWsProxy`
+- **macOS:** `~/Library/Application Support/TgWsProxy`
+- **Linux:** `~/.config/TgWsProxy` (или `$XDG_CONFIG_HOME/TgWsProxy`)
+
+```json
+{
+  "host": "127.0.0.1",
+  "port": 1443,
+  "secret": "...",
+  "dc_ip": [
+    "2:149.154.167.220",
+    "4:149.154.167.220"
+  ],
+  "verbose": false,
+  "buf_kb": 256,
+  "pool_size": 4,
+  "log_max_mb": 5.0,
+  "check_updates": true,
+  "cfproxy": true,
+  "cfproxy_priority": true,
+  "cfproxy_user_domain": "",
+  "appearance": "auto"
+}
+```
+
+Ключ `check_updates`: при `true` выполняется запрос к GitHub и сравнение текущей версии с последним релизом (только уведомление и ссылка на страницу загрузки).  
+На Windows в конфиге может быть `autostart` (автозапуск при входе в систему).

linux.py

@@ -0,0 +1,305 @@
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import threading
+import time
+from typing import Optional
+
+import customtkinter as ctk
+import pyperclip
+import pystray
+from PIL import Image, ImageTk
+
+from proxy import get_link_host
+
+from utils.tray_common import (
+    APP_NAME, DEFAULT_CONFIG, FIRST_RUN_MARKER, LOG_FILE,
+    acquire_lock, bootstrap, check_ipv6_warning, ctk_run_dialog,
+    ensure_ctk_thread, ensure_dirs, load_config, load_icon, log,
+    maybe_notify_update, quit_ctk, release_lock, restart_proxy,
+    save_config, start_proxy, stop_proxy, tg_proxy_url,
+)
+from ui.ctk_tray_ui import (
+    install_tray_config_buttons, install_tray_config_form,
+    populate_first_run_window, tray_settings_scroll_and_footer,
+    validate_config_form,
+)
+from ui.ctk_theme import (
+    CONFIG_DIALOG_FRAME_PAD, CONFIG_DIALOG_SIZE, FIRST_RUN_SIZE,
+    create_ctk_toplevel, ctk_theme_for_platform, main_content_frame,
+)
+
+_tray_icon: Optional[object] = None
+_config: dict = {}
+_exiting = False
+
+# dialogs (tkinter messagebox)
+
+
+def _msgbox(kind: str, text: str, title: str, **kw):
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    root = _tk.Tk()
+    root.withdraw()
+    try:
+        root.attributes("-topmost", True)
+    except Exception:
+        pass
+    result = getattr(_mb, kind)(title, text, parent=root, **kw)
+    root.destroy()
+    return result
+
+
+def _show_error(text: str, title: str = "TG WS Proxy — Ошибка") -> None:
+    _msgbox("showerror", text, title)
+
+
+def _show_info(text: str, title: str = "TG WS Proxy") -> None:
+    _msgbox("showinfo", text, title)
+
+
+def _ask_yes_no(text: str, title: str = "TG WS Proxy") -> bool:
+    return bool(_msgbox("askyesno", text, title))
+
+
+def _apply_window_icon(root) -> None:
+    icon_img = load_icon()
+    if icon_img:
+        root._ctk_icon_photo = ImageTk.PhotoImage(icon_img.resize((64, 64)))
+        root.iconphoto(False, root._ctk_icon_photo)
+
+
+# tray callbacks
+
+
+def _on_open_in_telegram(icon=None, item=None) -> None:
+    url = tg_proxy_url(_config)
+    log.info("Copying %s", url)
+    try:
+        pyperclip.copy(url)
+        _show_info(
+            f"Ссылка скопирована в буфер обмена, отправьте её в Telegram и нажмите по ней ЛКМ:\n{url}"
+        )
+    except Exception as exc:
+        log.error("Clipboard copy failed: %s", exc)
+        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_copy_link(icon=None, item=None) -> None:
+    url = tg_proxy_url(_config)
+    log.info("Copying link: %s", url)
+    try:
+        pyperclip.copy(url)
+    except Exception as exc:
+        log.error("Clipboard copy failed: %s", exc)
+        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_restart(icon=None, item=None) -> None:
+    threading.Thread(
+        target=lambda: restart_proxy(_config, _show_error), daemon=True
+    ).start()
+
+
+def _on_edit_config(icon=None, item=None) -> None:
+    threading.Thread(target=_edit_config_dialog, daemon=True).start()
+
+
+def _on_open_logs(icon=None, item=None) -> None:
+    log.info("Opening log file: %s", LOG_FILE)
+    if LOG_FILE.exists():
+        env = {k: v for k, v in os.environ.items() if k not in ("VIRTUAL_ENV", "PYTHONPATH", "PYTHONHOME")}
+        subprocess.Popen(
+            ["xdg-open", str(LOG_FILE)], env=env,
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+            stdin=subprocess.DEVNULL, start_new_session=True,
+        )
+    else:
+        _show_info("Файл логов ещё не создан.")
+
+
+def _on_exit(icon=None, item=None) -> None:
+    global _exiting
+    if _exiting:
+        os._exit(0)
+        return
+    _exiting = True
+    log.info("User requested exit")
+    quit_ctk()
+    threading.Thread(target=lambda: (time.sleep(3), os._exit(0)), daemon=True, name="force-exit").start()
+    if icon:
+        icon.stop()
+
+
+# settings dialog
+
+
+def _edit_config_dialog() -> None:
+    if not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
+        _show_error("customtkinter не установлен.")
+        return
+
+    cfg = dict(_config)
+
+    def _build(done: threading.Event) -> None:
+        theme = ctk_theme_for_platform()
+        w, h = CONFIG_DIALOG_SIZE
+        root = create_ctk_toplevel(
+            ctk, title="TG WS Proxy — Настройки", width=w, height=h, theme=theme,
+            after_create=_apply_window_icon,
+        )
+        fpx, fpy = CONFIG_DIALOG_FRAME_PAD
+        frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
+        scroll, footer = tray_settings_scroll_and_footer(ctk, frame, theme)
+        widgets = install_tray_config_form(ctk, scroll, theme, cfg, DEFAULT_CONFIG, show_autostart=False)
+
+        _original_appearance = ctk.get_appearance_mode()
+
+        def _finish() -> None:
+            root.destroy()
+            done.set()
+
+        def _cancel() -> None:
+            ctk.set_appearance_mode(_original_appearance)
+            _finish()
+
+        def on_save() -> None:
+            from tkinter import messagebox
+            merged = validate_config_form(widgets, DEFAULT_CONFIG, include_autostart=False)
+            if isinstance(merged, str):
+                messagebox.showerror("TG WS Proxy — Ошибка", merged, parent=root)
+                return
+
+            _ui_only_keys = {"appearance", "check_updates"}
+            config_changed = any(merged.get(k) != cfg.get(k) for k in merged)
+            proxy_changed = any(merged.get(k) != cfg.get(k) for k in merged if k not in _ui_only_keys)
+
+            if not config_changed:
+                _finish()
+                return
+
+            save_config(merged)
+            _config.update(merged)
+            log.info("Config saved: %s", merged)
+            _tray_icon.menu = _build_menu()
+
+            if not proxy_changed:
+                _finish()
+                return
+
+            do_restart = messagebox.askyesno(
+                "Перезапустить?",
+                "Настройки сохранены.\n\nПерезапустить прокси сейчас?",
+                parent=root,
+            )
+            _finish()
+            if do_restart:
+                threading.Thread(target=lambda: restart_proxy(_config, _show_error), daemon=True).start()
+
+        root.protocol("WM_DELETE_WINDOW", _cancel)
+        install_tray_config_buttons(ctk, footer, theme, on_save=on_save, on_cancel=_cancel)
+
+    ctk_run_dialog(_build)
+
+
+# first run
+
+
+def _show_first_run() -> None:
+    ensure_dirs()
+    if FIRST_RUN_MARKER.exists():
+        return
+    if not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
+        FIRST_RUN_MARKER.touch()
+        return
+
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    secret = _config.get("secret", DEFAULT_CONFIG["secret"])
+
+    def _build(done: threading.Event) -> None:
+        theme = ctk_theme_for_platform()
+        w, h = FIRST_RUN_SIZE
+        root = create_ctk_toplevel(
+            ctk, title="TG WS Proxy", width=w, height=h, theme=theme,
+            after_create=_apply_window_icon,
+        )
+
+        def on_done(open_tg: bool) -> None:
+            FIRST_RUN_MARKER.touch()
+            root.destroy()
+            done.set()
+            if open_tg:
+                _on_open_in_telegram()
+
+        populate_first_run_window(ctk, root, theme, host=host, port=port, secret=secret, on_done=on_done)
+
+    ctk_run_dialog(_build)
+
+
+# tray menu
+
+
+def _build_menu():
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    link_host = get_link_host(host)
+    return pystray.Menu(
+        pystray.MenuItem(f"Открыть в Telegram ({link_host}:{port})", _on_open_in_telegram, default=True),
+        pystray.MenuItem("Скопировать ссылку", _on_copy_link),
+        pystray.Menu.SEPARATOR,
+        pystray.MenuItem("Перезапустить прокси", _on_restart),
+        pystray.MenuItem("Настройки...", _on_edit_config),
+        pystray.MenuItem("Открыть логи", _on_open_logs),
+        pystray.Menu.SEPARATOR,
+        pystray.MenuItem("Выход", _on_exit),
+    )
+
+
+# entry point
+
+
+def run_tray() -> None:
+    global _tray_icon, _config
+
+    _config = load_config()
+    bootstrap(_config)
+
+    if pystray is None or Image is None:
+        log.error("pystray or Pillow not installed; running in console mode")
+        start_proxy(_config, _show_error)
+        try:
+            while True:
+                time.sleep(1)
+        except KeyboardInterrupt:
+            stop_proxy()
+        return
+
+    start_proxy(_config, _show_error)
+    maybe_notify_update(_config, lambda: _exiting, _ask_yes_no)
+    _show_first_run()
+    check_ipv6_warning(_show_info)
+
+    _tray_icon = pystray.Icon(APP_NAME, load_icon(), "TG WS Proxy", menu=_build_menu())
+    log.info("Tray icon running")
+    _tray_icon.run()
+
+    stop_proxy()
+    log.info("Tray app exited")
+
+
+def main() -> None:
+    if not acquire_lock():
+        _show_info("Приложение уже запущено.", os.path.basename(sys.argv[0]))
+        return
+    try:
+        run_tray()
+    finally:
+        release_lock()
+
+
+if __name__ == "__main__":
+    main()

macos.py

@@ -0,0 +1,623 @@
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import threading
+import time
+import webbrowser
+from pathlib import Path
+from typing import Optional
+
+try:
+    import rumps
+except ImportError:
+    rumps = None
+
+try:
+    from PIL import Image, ImageDraw, ImageFont
+except ImportError:
+    Image = ImageDraw = ImageFont = None
+
+try:
+    import pyperclip
+except ImportError:
+    pyperclip = None
+
+from proxy import __version__, get_link_host, parse_dc_ip_list, proxy_config
+from proxy.tg_ws_proxy import _run
+
+from utils.tray_common import (
+    APP_DIR, APP_NAME, DEFAULT_CONFIG, FIRST_RUN_MARKER, IPV6_WARN_MARKER,
+    LOG_FILE, acquire_lock, apply_proxy_config, ensure_dirs, load_config,
+    log, release_lock, save_config, setup_logging, stop_proxy, tg_proxy_url,
+)
+
+MENUBAR_ICON_PATH = APP_DIR / "menubar_icon.png"
+
+_proxy_thread: Optional[threading.Thread] = None
+_async_stop: Optional[object] = None
+_app: Optional[object] = None
+_config: dict = {}
+_exiting: bool = False
+
+# osascript dialogs
+
+
+def _esc(text: str) -> str:
+    return text.replace("\\", "\\\\").replace('"', '\\"')
+
+
+def _osascript(script: str) -> str:
+    r = subprocess.run(["osascript", "-e", script], capture_output=True, text=True)
+    return r.stdout.strip()
+
+
+def _show_error(text: str, title: str = "TG WS Proxy") -> None:
+    _osascript(
+        f'display dialog "{_esc(text)}" with title "{_esc(title)}" '
+        f'buttons {{"OK"}} default button "OK" with icon stop'
+    )
+
+
+def _show_info(text: str, title: str = "TG WS Proxy") -> None:
+    _osascript(
+        f'display dialog "{_esc(text)}" with title "{_esc(title)}" '
+        f'buttons {{"OK"}} default button "OK" with icon note'
+    )
+
+
+def _ask_yes_no(text: str, title: str = "TG WS Proxy") -> bool:
+    return _ask_yes_no_close(text, title) is True
+
+
+def _ask_yes_no_close(text: str, title: str = "TG WS Proxy") -> Optional[bool]:
+    r = subprocess.run(
+        [
+            "osascript", "-e",
+            f'button returned of (display dialog "{_esc(text)}" '
+            f'with title "{_esc(title)}" '
+            f'buttons {{"Закрыть", "Нет", "Да"}} '
+            f'default button "Да" cancel button "Закрыть" with icon note)',
+        ],
+        capture_output=True, text=True,
+    )
+    if r.returncode != 0:
+        return None
+    btn = r.stdout.strip()
+    if btn == "Да":
+        return True
+    if btn == "Нет":
+        return False
+    return None
+
+
+def _osascript_input(prompt: str, default: str, title: str = "TG WS Proxy") -> Optional[str]:
+    r = subprocess.run(
+        [
+            "osascript", "-e",
+            f'text returned of (display dialog "{_esc(prompt)}" '
+            f'default answer "{_esc(default)}" '
+            f'with title "{_esc(title)}" '
+            f'buttons {{"Закрыть", "OK"}} '
+            f'default button "OK" cancel button "Закрыть")',
+        ],
+        capture_output=True, text=True,
+    )
+    if r.returncode != 0:
+        return None
+    return r.stdout.rstrip("\r\n")
+
+
+# menubar icon
+
+
+def _make_menubar_icon(size: int = 44):
+    if Image is None:
+        return None
+    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    draw = ImageDraw.Draw(img)
+    margin = size // 11
+    draw.ellipse([margin, margin, size - margin, size - margin], fill=(0, 0, 0, 255))
+    try:
+        font = ImageFont.truetype("/System/Library/Fonts/Helvetica.ttc", size=int(size * 0.55))
+    except Exception:
+        font = ImageFont.load_default()
+    bbox = draw.textbbox((0, 0), "T", font=font)
+    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
+    draw.text(
+        ((size - tw) // 2 - bbox[0], (size - th) // 2 - bbox[1]),
+        "T", fill=(255, 255, 255, 255), font=font,
+    )
+    return img
+
+
+def _ensure_menubar_icon() -> None:
+    if MENUBAR_ICON_PATH.exists():
+        return
+    ensure_dirs()
+    img = _make_menubar_icon(44)
+    if img:
+        img.save(str(MENUBAR_ICON_PATH), "PNG")
+
+
+# proxy lifecycle (macOS-local)
+
+import asyncio as _asyncio
+
+
+def _run_proxy_thread() -> None:
+    global _async_stop
+    loop = _asyncio.new_event_loop()
+    _asyncio.set_event_loop(loop)
+    stop_ev = _asyncio.Event()
+    _async_stop = (loop, stop_ev)
+    try:
+        loop.run_until_complete(_run(stop_event=stop_ev))
+    except Exception as exc:
+        log.error("Proxy thread crashed: %s", exc)
+        if "Address already in use" in str(exc):
+            _show_error(
+                "Не удалось запустить прокси:\n"
+                "Порт уже используется другим приложением.\n\n"
+                "Закройте приложение, использующее этот порт, "
+                "или измените порт в настройках прокси и перезапустите."
+            )
+    finally:
+        loop.close()
+        _async_stop = None
+
+
+def _start_proxy() -> None:
+    global _proxy_thread
+    if _proxy_thread and _proxy_thread.is_alive():
+        log.info("Proxy already running")
+        return
+    if not apply_proxy_config(_config):
+        _show_error("Ошибка конфигурации DC → IP.")
+        return
+    pc = proxy_config
+    log.info("Starting proxy on %s:%d ...", pc.host, pc.port)
+    _proxy_thread = threading.Thread(target=_run_proxy_thread, daemon=True, name="proxy")
+    _proxy_thread.start()
+
+
+def _stop_proxy() -> None:
+    global _proxy_thread, _async_stop
+    if _async_stop:
+        loop, stop_ev = _async_stop
+        loop.call_soon_threadsafe(stop_ev.set)
+        if _proxy_thread:
+            _proxy_thread.join(timeout=2)
+    _proxy_thread = None
+    log.info("Proxy stopped")
+
+
+def _restart_proxy() -> None:
+    log.info("Restarting proxy...")
+    _stop_proxy()
+    time.sleep(0.3)
+    _start_proxy()
+
+
+# menu callbacks
+
+
+def _on_open_in_telegram(_=None) -> None:
+    url = tg_proxy_url(_config)
+    log.info("Opening %s", url)
+    try:
+        result = subprocess.call(["open", url])
+        if result != 0:
+            raise RuntimeError("open command failed")
+    except Exception:
+        log.info("open command failed, trying webbrowser")
+        try:
+            if not webbrowser.open(url):
+                raise RuntimeError("webbrowser.open returned False")
+        except Exception:
+            log.info("Browser open failed, copying to clipboard")
+            try:
+                if pyperclip:
+                    pyperclip.copy(url)
+                else:
+                    subprocess.run(["pbcopy"], input=url.encode(), check=True)
+                _show_info(
+                    "Не удалось открыть Telegram автоматически.\n\n"
+                    f"Ссылка скопирована в буфер обмена:\n{url}"
+                )
+            except Exception as exc:
+                log.error("Clipboard copy failed: %s", exc)
+                _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_copy_link(_=None) -> None:
+    url = tg_proxy_url(_config)
+    log.info("Copying link: %s", url)
+    try:
+        if pyperclip:
+            pyperclip.copy(url)
+        else:
+            subprocess.run(["pbcopy"], input=url.encode(), check=True)
+    except Exception as exc:
+        log.error("Clipboard copy failed: %s", exc)
+        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_restart(_=None) -> None:
+    def _do():
+        global _config
+        _config = load_config()
+        if _app:
+            _app.update_menu_title()
+        _restart_proxy()
+
+    threading.Thread(target=_do, daemon=True).start()
+
+
+def _on_open_logs(_=None) -> None:
+    log.info("Opening log file: %s", LOG_FILE)
+    if LOG_FILE.exists():
+        subprocess.call(["open", str(LOG_FILE)])
+    else:
+        _show_info("Файл логов ещё не создан.")
+
+
+def _on_edit_config(_=None) -> None:
+    threading.Thread(target=_edit_config_dialog, daemon=True).start()
+
+
+def _check_updates_menu_title() -> str:
+    on = bool(_config.get("check_updates", True))
+    return "✓ Проверять обновления при запуске" if on else "Проверять обновления при запуске (выкл)"
+
+
+def _toggle_check_updates(_=None) -> None:
+    global _config
+    _config["check_updates"] = not bool(_config.get("check_updates", True))
+    save_config(_config)
+    if _app is not None:
+        _app._check_updates_item.title = _check_updates_menu_title()
+
+
+def _on_open_release_page(_=None) -> None:
+    from utils.update_check import RELEASES_PAGE_URL
+    webbrowser.open(RELEASES_PAGE_URL)
+
+
+# update check
+
+
+def _maybe_notify_update_async() -> None:
+    def _work():
+        time.sleep(1.5)
+        if _exiting:
+            return
+        if not _config.get("check_updates", True):
+            return
+        try:
+            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update"):
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            if _ask_yes_no(
+                f"Доступна новая версия: {ver}\n\nОткрыть страницу релиза в браузере?",
+                "TG WS Proxy — обновление",
+            ):
+                webbrowser.open(url)
+        except Exception as exc:
+            log.warning("Update check failed: %s", exc)
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
+
+
+# settings dialog
+
+
+def _edit_config_dialog() -> None:
+    cfg = load_config()
+
+    host = _osascript_input("IP-адрес прокси:", cfg.get("host", DEFAULT_CONFIG["host"]))
+    if host is None:
+        return
+    host = host.strip()
+    import socket as _sock
+    try:
+        _sock.inet_aton(host)
+    except OSError:
+        _show_error("Некорректный IP-адрес.")
+        return
+
+    port_str = _osascript_input("Порт прокси:", str(cfg.get("port", DEFAULT_CONFIG["port"])))
+    if port_str is None:
+        return
+    try:
+        port = int(port_str.strip())
+        if not (1 <= port <= 65535):
+            raise ValueError
+    except ValueError:
+        _show_error("Порт должен быть числом 1-65535")
+        return
+
+    secret_str = _osascript_input(
+        "MTProto Secret (32 hex символа):", cfg.get("secret", DEFAULT_CONFIG["secret"])
+    )
+    if secret_str is None:
+        return
+    secret_str = secret_str.strip().lower()
+    if len(secret_str) != 32 or not all(c in "0123456789abcdef" for c in secret_str):
+        _show_error("Secret должен быть строкой из 32 шестнадцатеричных символов.")
+        return
+
+    dc_default = ", ".join(cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"]))
+    dc_str = _osascript_input(
+        "DC → IP маппинги (через запятую, формат DC:IP):\n"
+        "Например: 2:149.154.167.220, 4:149.154.167.220",
+        dc_default,
+    )
+    if dc_str is None:
+        return
+    dc_lines = [s.strip() for s in dc_str.replace(",", "\n").splitlines() if s.strip()]
+    try:
+        parse_dc_ip_list(dc_lines)
+    except ValueError as e:
+        _show_error(str(e))
+        return
+
+    verbose = _ask_yes_no_close("Включить подробное логирование (verbose)?")
+    if verbose is None:
+        return
+
+    adv_str = _osascript_input(
+        "Расширенные настройки (буфер KB, WS пул, лог MB):\n"
+        "Формат: buf_kb,pool_size,log_max_mb",
+        f"{cfg.get('buf_kb', DEFAULT_CONFIG['buf_kb'])},"
+        f"{cfg.get('pool_size', DEFAULT_CONFIG['pool_size'])},"
+        f"{cfg.get('log_max_mb', DEFAULT_CONFIG['log_max_mb'])}",
+    )
+    if adv_str is None:
+        return
+
+    adv = {}
+    if adv_str:
+        parts = [s.strip() for s in adv_str.split(",")]
+        keys = [("buf_kb", int), ("pool_size", int), ("log_max_mb", float)]
+        for i, (k, typ) in enumerate(keys):
+            if i < len(parts):
+                try:
+                    adv[k] = typ(parts[i])
+                except ValueError:
+                    pass
+
+    cfproxy = _ask_yes_no_close("Включить Cloudflare Proxy (CfProxy)?")
+    if cfproxy is None:
+        return
+
+    cfproxy_priority = True
+    if cfproxy:
+        cfproxy_priority_result = _ask_yes_no_close("Приоритет CfProxy (пробовать раньше прямого TCP)?")
+        if cfproxy_priority_result is None:
+            return
+        cfproxy_priority = cfproxy_priority_result
+
+    cfproxy_domain = _osascript_input(
+        "Свой CF-домен (оставьте пустым для автоматического выбора):\n"
+        "DNS записи kws1-kws5,kws203 должны указывать на IP датацентров Telegram через Cloudflare.",
+        cfg.get("cfproxy_user_domain", DEFAULT_CONFIG.get("cfproxy_user_domain", "")),
+    )
+    if cfproxy_domain is None:
+        return
+    cfproxy_domain = cfproxy_domain.strip()
+
+    new_cfg = {
+        "host": host,
+        "port": port,
+        "secret": secret_str,
+        "dc_ip": dc_lines,
+        "verbose": verbose,
+        "buf_kb": adv.get("buf_kb", cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])),
+        "pool_size": adv.get("pool_size", cfg.get("pool_size", DEFAULT_CONFIG["pool_size"])),
+        "log_max_mb": adv.get("log_max_mb", cfg.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"])),
+        "check_updates": cfg.get("check_updates", True),
+        "cfproxy": cfproxy,
+        "cfproxy_priority": cfproxy_priority,
+        "cfproxy_user_domain": cfproxy_domain,
+    }
+    save_config(new_cfg)
+    log.info("Config saved: %s", new_cfg)
+
+    global _config
+    _config = new_cfg
+    if _app:
+        _app.update_menu_title()
+
+    if _ask_yes_no_close("Настройки сохранены.\n\nПерезапустить прокси сейчас?"):
+        _restart_proxy()
+
+
+# first run & ipv6
+
+
+def _show_first_run() -> None:
+    ensure_dirs()
+    if FIRST_RUN_MARKER.exists():
+        return
+
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    secret = _config.get("secret", DEFAULT_CONFIG["secret"])
+    tg_url = tg_proxy_url(_config)
+    link_host = get_link_host(host)
+
+    text = (
+        f"Прокси запущен и работает в строке меню.\n\n"
+        f"Как подключить Telegram Desktop:\n\n"
+        f"Автоматически:\n"
+        f"  Нажмите «Открыть в Telegram» в меню\n"
+        f"  Или ссылка: {tg_url}\n\n"
+        f"Вручную:\n"
+        f"  Настройки → Продвинутые → Тип подключения → Прокси\n"
+        f"  MTProto → {link_host} : {port} \n"
+        f"  Secret: dd{secret} \n\n"
+        f"Открыть прокси в Telegram сейчас?"
+    )
+
+    FIRST_RUN_MARKER.touch()
+    if _ask_yes_no(text, "TG WS Proxy"):
+        _on_open_in_telegram()
+
+
+def _check_ipv6_warning() -> None:
+    ensure_dirs()
+    if IPV6_WARN_MARKER.exists():
+        return
+
+    import socket as _sock
+    has = False
+    try:
+        for addr in _sock.getaddrinfo(_sock.gethostname(), None, _sock.AF_INET6):
+            ip = addr[4][0]
+            if ip and not ip.startswith("::1") and not ip.startswith("fe80::1"):
+                has = True
+                break
+    except Exception:
+        pass
+    if not has:
+        try:
+            s = _sock.socket(_sock.AF_INET6, _sock.SOCK_STREAM)
+            s.bind(("::1", 0))
+            s.close()
+            has = True
+        except Exception:
+            pass
+    if not has:
+        return
+
+    IPV6_WARN_MARKER.touch()
+    _show_info(
+        "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
+        "Telegram может пытаться подключаться через IPv6, "
+        "что не поддерживается и может привести к ошибкам.\n\n"
+        "Если прокси не работает, попробуйте отключить "
+        "попытку соединения по IPv6 в настройках прокси Telegram.\n\n"
+        "Это предупреждение будет показано только один раз."
+    )
+
+
+# rumps app
+
+_TgWsProxyAppBase = rumps.App if rumps else object
+
+
+class TgWsProxyApp(_TgWsProxyAppBase):
+    def __init__(self):
+        _ensure_menubar_icon()
+        icon_path = str(MENUBAR_ICON_PATH) if MENUBAR_ICON_PATH.exists() else None
+
+        host = _config.get("host", DEFAULT_CONFIG["host"])
+        port = _config.get("port", DEFAULT_CONFIG["port"])
+        link_host = get_link_host(host)
+
+        self._open_tg_item = rumps.MenuItem(
+            f"Открыть в Telegram ({link_host}:{port})", callback=_on_open_in_telegram
+        )
+        self._copy_link_item = rumps.MenuItem("Скопировать ссылку", callback=_on_copy_link)
+        self._restart_item = rumps.MenuItem("Перезапустить прокси", callback=_on_restart)
+        self._settings_item = rumps.MenuItem("Настройки...", callback=_on_edit_config)
+        self._logs_item = rumps.MenuItem("Открыть логи", callback=_on_open_logs)
+        self._release_page_item = rumps.MenuItem(
+            "Страница релиза на GitHub…", callback=_on_open_release_page
+        )
+        self._check_updates_item = rumps.MenuItem(
+            _check_updates_menu_title(), callback=_toggle_check_updates
+        )
+        self._version_item = rumps.MenuItem(f"Версия {__version__}", callback=lambda _: None)
+
+        super().__init__(
+            "TG WS Proxy",
+            icon=icon_path,
+            template=False,
+            quit_button="Выход",
+            menu=[
+                self._open_tg_item,
+                self._copy_link_item,
+                None,
+                self._restart_item,
+                self._settings_item,
+                self._logs_item,
+                None,
+                self._release_page_item,
+                self._check_updates_item,
+                None,
+                self._version_item,
+            ],
+        )
+
+    def update_menu_title(self) -> None:
+        host = _config.get("host", DEFAULT_CONFIG["host"])
+        port = _config.get("port", DEFAULT_CONFIG["port"])
+        link_host = get_link_host(host)
+        self._open_tg_item.title = f"Открыть в Telegram ({link_host}:{port})"
+
+
+# entry point
+
+
+def run_menubar() -> None:
+    global _app, _config
+
+    _config = load_config()
+    save_config(_config)
+
+    if LOG_FILE.exists():
+        try:
+            LOG_FILE.unlink()
+        except Exception:
+            pass
+
+    setup_logging(
+        _config.get("verbose", False),
+        log_max_mb=_config.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]),
+    )
+    log.info("TG WS Proxy версия %s, menubar app starting", __version__)
+    log.info("Config: %s", _config)
+    log.info("Log file: %s", LOG_FILE)
+
+    if rumps is None or Image is None:
+        log.error("rumps or Pillow not installed; running in console mode")
+        _start_proxy()
+        try:
+            while True:
+                time.sleep(1)
+        except KeyboardInterrupt:
+            _stop_proxy()
+        return
+
+    _start_proxy()
+    _maybe_notify_update_async()
+    _show_first_run()
+    _check_ipv6_warning()
+
+    _app = TgWsProxyApp()
+    log.info("Menubar app running")
+    _app.run()
+
+    _stop_proxy()
+    log.info("Menubar app exited")
+
+
+def main() -> None:
+    if not acquire_lock():
+        _show_info("Приложение уже запущено.")
+        return
+    try:
+        run_menubar()
+    finally:
+        release_lock()
+
+
+if __name__ == "__main__":
+    main()

packaging/linux.spec

@@ -0,0 +1,94 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+import sys
+import os
+import glob
+
+from PyInstaller.utils.hooks import collect_submodules, collect_data_files
+
+block_cipher = None
+
+# customtkinter ships JSON themes + assets that must be bundled
+import customtkinter
+ctk_path = os.path.dirname(customtkinter.__file__)
+
+# Collect gi (PyGObject) submodules and data so pystray._appindicator works
+gi_hiddenimports = collect_submodules('gi')
+gi_datas = collect_data_files('gi')
+
+# Collect GObject typelib files from the system
+typelib_dirs = glob.glob('/usr/lib/*/girepository-1.0')
+typelib_datas = []
+for d in typelib_dirs:
+    typelib_datas.append((d, 'gi_typelibs'))
+
+a = Analysis(
+    [os.path.join(os.path.dirname(SPEC), os.pardir, 'linux.py')],
+    pathex=[],
+    binaries=[],
+    datas=[(ctk_path, 'customtkinter/')] + gi_datas + typelib_datas,
+    hiddenimports=[
+        'pystray._appindicator',
+        'PIL._tkinter_finder',
+        'customtkinter',
+        'cryptography.hazmat.primitives.ciphers',
+        'cryptography.hazmat.primitives.ciphers.algorithms',
+        'cryptography.hazmat.primitives.ciphers.modes',
+        'cryptography.hazmat.backends.openssl',
+        'gi',
+        '_gi',
+        'gi.repository.GLib',
+        'gi.repository.GObject',
+        'gi.repository.Gtk',
+        'gi.repository.Gdk',
+        'gi.repository.AyatanaAppIndicator3',
+    ] + gi_hiddenimports,
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[
+        'PIL._avif',
+        'PIL._webp',
+        'PIL._imagingtk',
+    ],
+    noarchive=False,
+    cipher=block_cipher,
+)
+
+_PIL_EXCLUDE_PYDS = {
+    '_avif', '_webp', '_imagingtk',
+    'FpxImagePlugin', 'MicImagePlugin',
+}
+a.binaries = [
+    (name, path, typ)
+    for name, path, typ in a.binaries
+    if not any(ex in name for ex in _PIL_EXCLUDE_PYDS)
+]
+
+icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.ico')
+if os.path.exists(icon_path):
+    a.datas += [('icon.ico', icon_path, 'DATA')]
+
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.zipfiles,
+    a.datas,
+    [],
+    name='TgWsProxy',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=True,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=False,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)

packaging/macos.spec

@@ -0,0 +1,97 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+import sys
+import os
+
+block_cipher = None
+
+a = Analysis(
+    [os.path.join(os.path.dirname(SPEC), os.pardir, 'macos.py')],
+    pathex=[],
+    binaries=[],
+    datas=[],
+    hiddenimports=[
+        'rumps',
+        'objc',
+        'Foundation',
+        'AppKit',
+        'PyObjCTools',
+        'PyObjCTools.AppHelper',
+        'cryptography.hazmat.primitives.ciphers',
+        'cryptography.hazmat.primitives.ciphers.algorithms',
+        'cryptography.hazmat.primitives.ciphers.modes',
+        'cryptography.hazmat.backends.openssl',
+    ],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[
+        'PIL._avif',
+        'PIL._webp',
+        'PIL._imagingtk',
+    ],
+    noarchive=False,
+    cipher=block_cipher,
+)
+
+_PIL_EXCLUDE_PYDS = {
+    '_avif', '_webp', '_imagingtk',
+    'FpxImagePlugin', 'MicImagePlugin',
+}
+a.binaries = [
+    (name, path, typ)
+    for name, path, typ in a.binaries
+    if not any(ex in name for ex in _PIL_EXCLUDE_PYDS)
+]
+
+icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.icns')
+if not os.path.exists(icon_path):
+    icon_path = None
+
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    [],
+    exclude_binaries=True,
+    name='TgWsProxy',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=False,
+    console=False,
+    argv_emulation=False,
+    target_arch='universal2',
+    codesign_identity=None,
+    entitlements_file=None,
+)
+
+coll = COLLECT(
+    exe,
+    a.binaries,
+    a.zipfiles,
+    a.datas,
+    strip=False,
+    upx=False,
+    upx_exclude=[],
+    name='TgWsProxy',
+)
+
+app = BUNDLE(
+    coll,
+    name='TG WS Proxy.app',
+    icon=icon_path,
+    bundle_identifier='com.tgwsproxy.app',
+    info_plist={
+        'CFBundleName': 'TG WS Proxy',
+        'CFBundleDisplayName': 'TG WS Proxy',
+        'CFBundleShortVersionString': '1.0.0',
+        'CFBundleVersion': '1.0.0',
+        'LSMinimumSystemVersion': '10.15',
+        'LSUIElement': True,
+        'NSHighResolutionCapable': True,
+        'NSAppleEventsUsageDescription':
+            'TG WS Proxy needs to display dialogs.',
+    },
+)

packaging/version_info.txt

@@ -0,0 +1,36 @@
+# UTF-8
+#
+# For more details about fixed file info 'ffi' see:
+# http://msdn.microsoft.com/en-us/library/ms646997.aspx
+VSVersionInfo(
+  ffi=FixedFileInfo(
+    filevers=(1, 6, 5, 0),
+    prodvers=(1, 6, 5, 0),
+    mask=0x3f,
+    flags=0x0,
+    OS=0x40004,
+    fileType=0x1,
+    subtype=0x0,
+    date=(0, 0)
+  ),
+  kids=[
+    StringFileInfo(
+      [
+        StringTable(
+          u'040904B0',
+          [
+            StringStruct(u'CompanyName', u'Flowseal'),
+            StringStruct(u'FileDescription', u'Telegram Desktop WebSocket Bridge Proxy'),
+            StringStruct(u'FileVersion', u'1.6.6.0'),
+            StringStruct(u'InternalName', u'TgWsProxy'),
+            StringStruct(u'LegalCopyright', u'Copyright (c) Flowseal. MIT License.'),
+            StringStruct(u'OriginalFilename', u'TgWsProxy.exe'),
+            StringStruct(u'ProductName', u'TG WS Proxy'),
+            StringStruct(u'ProductVersion', u'1.6.6.0'),
+          ]
+        )
+      ]
+    ),
+    VarFileInfo([VarStruct(u'Translation', [1033, 1200])])
+  ]
+)

packaging/windows.spec

@@ -10,12 +10,11 @@ import customtkinter
 ctk_path = os.path.dirname(customtkinter.__file__)
 
 a = Analysis(
-    ['tg_ws_tray.py'],
+    [os.path.join(os.path.dirname(SPEC), os.pardir, 'windows.py')],
     pathex=[],
     binaries=[],
     datas=[(ctk_path, 'customtkinter/')],
     hiddenimports=[
-        'tg_ws_proxy',
         'pystray._win32',
         'PIL._tkinter_finder',
         'customtkinter',
@@ -27,14 +26,29 @@ a = Analysis(
     hookspath=[],
     hooksconfig={},
     runtime_hooks=[],
-    excludes=[],
+    excludes=[
+        'PIL._avif',
+        'PIL._webp',
+        'PIL._imagingtk',
+    ],
     win_no_prefer_redirects=False,
     win_private_assemblies=False,
     cipher=block_cipher,
     noarchive=False,
 )
 
-icon_path = os.path.join(os.path.dirname(SPEC), 'icon.ico')
+_PIL_EXCLUDE_PYDS = {
+    '_avif', '_webp', '_imagingtk',
+    'FpxImagePlugin', 'MicImagePlugin',
+}
+a.binaries = [
+    (name, path, typ)
+    for name, path, typ in a.binaries
+    if not any(ex in name for ex in _PIL_EXCLUDE_PYDS)
+]
+
+icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.ico')
+version_path = os.path.join(os.path.dirname(SPEC), 'version_info.txt')
 if os.path.exists(icon_path):
     a.datas += [('icon.ico', icon_path, 'DATA')]
 
@@ -51,7 +65,7 @@ exe = EXE(
     debug=False,
     bootloader_ignore_signals=False,
     strip=False,
-    upx=True,
+    upx=False,
     upx_exclude=[],
     runtime_tmpdir=None,
     console=False,
@@ -61,4 +75,5 @@ exe = EXE(
     codesign_identity=None,
     entitlements_file=None,
     icon=icon_path if os.path.exists(icon_path) else None,
+    version=version_path if os.path.exists(version_path) else None,
 )

proxy/__init__.py

@@ -0,0 +1,6 @@
+from .config import parse_dc_ip_list, proxy_config
+from .utils import get_link_host, build_github_opener
+
+__version__ = "1.6.6"
+
+__all__ = ["__version__", "get_link_host", "proxy_config", "parse_dc_ip_list", "build_github_opener"]

proxy/balancer.py

@@ -0,0 +1,43 @@
+import random
+from collections import Counter
+
+from typing import Dict, List, Iterator 
+
+
+class _Balancer:
+    def __init__(self):
+        self.domains: List[str] = []
+        self._dc_to_domain: Dict[int, str] = {}
+    
+    def update_domains_list(self, domains_list: List[str]) -> None:
+        if Counter(self.domains) == Counter(domains_list):
+            return
+        
+        self.domains = domains_list[:]
+
+        self._dc_to_domain = {
+            dc_id: random.choice(self.domains)
+            for dc_id in (1, 2, 3, 4, 5, 203)
+        }
+
+    def update_domain_for_dc(self, dc_id: int, domain: str) -> bool:
+        if self._dc_to_domain.get(dc_id) == domain:
+            return False
+        
+        self._dc_to_domain[dc_id] = domain
+        return True
+
+    def get_domains_for_dc(self, dc_id: int) -> Iterator[str]:
+        current_domain = self._dc_to_domain.get(dc_id)
+        if current_domain is not None:
+            yield current_domain
+
+        shuffled_domains = self.domains[:]
+        random.shuffle(shuffled_domains)
+
+        for domain in shuffled_domains:
+            if domain != current_domain:
+                yield domain
+
+
+balancer = _Balancer()

proxy/bridge.py

@@ -0,0 +1,355 @@
+import asyncio
+import logging
+import struct
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+from typing import Dict, List, Optional
+
+from .utils import *
+from .stats import stats
+from .balancer import balancer
+from .config import proxy_config
+from .raw_websocket import RawWebSocket
+
+
+log = logging.getLogger('tg-mtproto-proxy')
+_st_I_le = struct.Struct('<I')
+
+ZERO_64 = b'\x00' * 64
+DC_DEFAULT_IPS: Dict[int, str] = {
+    1: '149.154.175.50',
+    2: '149.154.167.51',
+    3: '149.154.175.100',
+    4: '149.154.167.91',
+    5: '149.154.171.5',
+    203: '91.105.192.100'
+}
+
+
+class CryptoCtx:
+    __slots__ = ('clt_dec', 'clt_enc', 'tg_enc', 'tg_dec')
+
+    def __init__(self, clt_dec, clt_enc, tg_enc, tg_dec):
+        self.clt_dec = clt_dec  # decrypt from client
+        self.clt_enc = clt_enc  # encrypt to client
+        self.tg_enc = tg_enc    # encrypt to telegram
+        self.tg_dec = tg_dec    # decrypt from telegram
+
+
+class MsgSplitter:
+    """
+    Splits TCP stream data into individual MTProto transport packets
+    so each can be sent as a separate WS frame.
+    """
+    __slots__ = ('_dec', '_proto', '_cipher_buf', '_plain_buf', '_disabled')
+
+    def __init__(self, relay_init: bytes, proto_int: int):
+        cipher = Cipher(algorithms.AES(relay_init[8:40]),
+                        modes.CTR(relay_init[40:56]))
+        self._dec = cipher.encryptor()
+        self._dec.update(ZERO_64)
+        self._proto = proto_int
+        self._cipher_buf = bytearray()
+        self._plain_buf = bytearray()
+        self._disabled = False
+
+    def split(self, chunk: bytes) -> List[bytes]:
+        if not chunk:
+            return []
+        if self._disabled:
+            return [chunk]
+
+        self._cipher_buf.extend(chunk)
+        self._plain_buf.extend(self._dec.update(chunk))
+
+        parts = []
+        while self._cipher_buf:
+            packet_len = self._next_packet_len()
+            if packet_len is None:
+                break
+            if packet_len <= 0:
+                parts.append(bytes(self._cipher_buf))
+                self._cipher_buf.clear()
+                self._plain_buf.clear()
+                self._disabled = True
+                break
+            parts.append(bytes(self._cipher_buf[:packet_len]))
+            del self._cipher_buf[:packet_len]
+            del self._plain_buf[:packet_len]
+        return parts
+
+    def flush(self) -> List[bytes]:
+        if not self._cipher_buf:
+            return []
+        tail = bytes(self._cipher_buf)
+        self._cipher_buf.clear()
+        self._plain_buf.clear()
+        return [tail]
+
+    def _next_packet_len(self) -> Optional[int]:
+        if not self._plain_buf:
+            return None
+        if self._proto == PROTO_ABRIDGED_INT:
+            return self._next_abridged_len()
+        if self._proto in (PROTO_INTERMEDIATE_INT,
+                           PROTO_PADDED_INTERMEDIATE_INT):
+            return self._next_intermediate_len()
+        return 0
+
+    def _next_abridged_len(self) -> Optional[int]:
+        first = self._plain_buf[0]
+        if first in (0x7F, 0xFF):
+            if len(self._plain_buf) < 4:
+                return None
+            payload_len = int.from_bytes(self._plain_buf[1:4], 'little') * 4
+            header_len = 4
+        else:
+            payload_len = (first & 0x7F) * 4
+            header_len = 1
+        if payload_len <= 0:
+            return 0
+        packet_len = header_len + payload_len
+        if len(self._plain_buf) < packet_len:
+            return None
+        return packet_len
+
+    def _next_intermediate_len(self) -> Optional[int]:
+        if len(self._plain_buf) < 4:
+            return None
+        payload_len = _st_I_le.unpack_from(self._plain_buf, 0)[0] & 0x7FFFFFFF
+        if payload_len <= 0:
+            return 0
+        packet_len = 4 + payload_len
+        if len(self._plain_buf) < packet_len:
+            return None
+        return packet_len
+
+
+
+async def do_fallback(reader, writer, relay_init, label,
+                       dc: int, is_media: bool, media_tag: str,
+                       ctx: CryptoCtx, splitter=None):
+    fallback_dst = DC_DEFAULT_IPS.get(dc)
+    use_cf = proxy_config.fallback_cfproxy
+    cf_first = proxy_config.fallback_cfproxy_priority
+
+    methods: List[str] = ['tcp']
+
+    if use_cf:
+        methods.insert(0 if cf_first else 1, 'cf')
+
+    for method in methods:
+        if method == 'cf':
+            ok = await _cfproxy_fallback(
+                reader, writer, relay_init, label, ctx,
+                dc=dc, is_media=is_media,
+                splitter=splitter)
+            if ok:
+                return True
+        elif method == 'tcp' and fallback_dst:
+            log.info("[%s] DC%d%s -> TCP fallback to %s:443",
+                     label, dc, media_tag, fallback_dst)
+            ok = await _tcp_fallback(
+                reader, writer, fallback_dst, 443,
+                relay_init, label, ctx)
+            if ok:
+                return True
+    return False
+
+
+async def _cfproxy_fallback(reader, writer, relay_init, label,
+                            ctx: CryptoCtx,
+                            dc: int, is_media: bool,
+                            splitter=None):
+    media_tag = ' media' if is_media else ''
+    ws = None
+    chosen_domain = None
+
+    log.info("[%s] DC%d%s -> trying CF proxy",
+            label, dc, media_tag)
+
+    for base_domain in balancer.get_domains_for_dc(dc):
+        domain = f'kws{dc}.{base_domain}'
+        try:
+            ws = await RawWebSocket.connect(domain, domain, timeout=10.0)
+            chosen_domain = base_domain
+            break
+        except Exception as exc:
+            log.warning("[%s] DC%d%s CF proxy failed: %s",
+                        label, dc, media_tag, repr(exc))
+
+    if ws is None:
+        return False
+
+    if chosen_domain and balancer.update_domain_for_dc(dc, chosen_domain):
+        log.info("[%s] Switched active CF domain", label)
+
+    stats.connections_cfproxy += 1
+    await ws.send(relay_init)
+    await bridge_ws_reencrypt(reader, writer, ws, label, ctx,
+                               dc=dc, is_media=is_media,
+                               splitter=splitter)
+    return True
+
+
+async def _tcp_fallback(reader, writer, dst, port, relay_init, label, ctx: CryptoCtx):
+    try:
+        rr, rw = await asyncio.wait_for(
+            asyncio.open_connection(dst, port), timeout=10)
+    except Exception as exc:
+        log.warning("[%s] TCP fallback to %s:%d failed: %s",
+                    label, dst, port, repr(exc))
+        return False
+
+    stats.connections_tcp_fallback += 1
+    rw.write(relay_init)
+    await rw.drain()
+    await _bridge_tcp_reencrypt(reader, writer, rr, rw, label, ctx)
+    return True
+
+
+async def bridge_ws_reencrypt(reader, writer, ws: RawWebSocket, label,
+                               ctx: CryptoCtx,
+                               dc=None, is_media=False,
+                               splitter: Optional[MsgSplitter] = None):
+    """
+    Bidirectional TCP(client) <-> WS(telegram) with re-encryption.
+    client ciphertext → decrypt(clt_key) → encrypt(tg_key) → WS
+    WS data → decrypt(tg_key) → encrypt(clt_key) → client TCP
+    """
+    dc_tag = f"DC{dc}{'m' if is_media else ''}" if dc else "DC?"
+
+    up_bytes = 0
+    down_bytes = 0
+    up_packets = 0
+    down_packets = 0
+    start_time = asyncio.get_running_loop().time()
+
+    async def tcp_to_ws():
+        nonlocal up_bytes, up_packets
+        try:
+            while True:
+                chunk = await reader.read(65536)
+                if not chunk:
+                    if splitter:
+                        tail = splitter.flush()
+                        if tail:
+                            await ws.send(tail[0])
+                    break
+                n = len(chunk)
+                stats.bytes_up += n
+                up_bytes += n
+                up_packets += 1
+                plain = ctx.clt_dec.update(chunk)
+                chunk = ctx.tg_enc.update(plain)
+                if splitter:
+                    parts = splitter.split(chunk)
+                    if not parts:
+                        continue
+                    if len(parts) > 1:
+                        await ws.send_batch(parts)
+                    else:
+                        await ws.send(parts[0])
+                else:
+                    await ws.send(chunk)
+        except (asyncio.CancelledError, ConnectionError, OSError):
+            return
+        except Exception as e:
+            log.debug("[%s] tcp->ws ended: %s", label, e)
+
+    async def ws_to_tcp():
+        nonlocal down_bytes, down_packets
+        try:
+            while True:
+                data = await ws.recv()
+                if data is None:
+                    break
+                n = len(data)
+                stats.bytes_down += n
+                down_bytes += n
+                down_packets += 1
+                plain = ctx.tg_dec.update(data)
+                data = ctx.clt_enc.update(plain)
+                writer.write(data)
+                await writer.drain()
+        except (asyncio.CancelledError, ConnectionError, OSError):
+            return
+        except Exception as e:
+            log.debug("[%s] ws->tcp ended: %s", label, e)
+
+    tasks = [asyncio.create_task(tcp_to_ws()),
+             asyncio.create_task(ws_to_tcp())]
+    try:
+        await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
+    finally:
+        for t in tasks:
+            t.cancel()
+        for t in tasks:
+            try:
+                await t
+            except BaseException:
+                pass
+        elapsed = asyncio.get_running_loop().time() - start_time
+        log.info("[%s] %s WS session closed: "
+                 "^%s (%d pkts) v%s (%d pkts) in %.1fs",
+                 label, dc_tag,
+                 human_bytes(up_bytes), up_packets,
+                 human_bytes(down_bytes), down_packets,
+                 elapsed)
+        try:
+            await ws.close()
+        except BaseException:
+            pass
+        try:
+            writer.close()
+            await writer.wait_closed()
+        except BaseException:
+            pass
+
+
+async def _bridge_tcp_reencrypt(reader, writer, remote_reader, remote_writer,
+                                label, ctx: CryptoCtx):
+    """Bidirectional TCP <-> TCP with re-encryption."""
+
+    async def forward(src, dst_w, is_up):
+        try:
+            while True:
+                data = await src.read(65536)
+                if not data:
+                    break
+                n = len(data)
+                if is_up:
+                    stats.bytes_up += n
+                    plain = ctx.clt_dec.update(data)
+                    data = ctx.tg_enc.update(plain)
+                else:
+                    stats.bytes_down += n
+                    plain = ctx.tg_dec.update(data)
+                    data = ctx.clt_enc.update(plain)
+                dst_w.write(data)
+                await dst_w.drain()
+        except asyncio.CancelledError:
+            pass
+        except Exception as e:
+            log.debug("[%s] forward ended: %s", label, e)
+
+    tasks = [
+        asyncio.create_task(forward(reader, remote_writer, True)),
+        asyncio.create_task(forward(remote_reader, writer, False)),
+    ]
+    try:
+        await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
+    finally:
+        for t in tasks:
+            t.cancel()
+        for t in tasks:
+            try:
+                await t
+            except BaseException:
+                pass
+        for w in (writer, remote_writer):
+            try:
+                w.close()
+                await w.wait_closed()
+            except BaseException:
+                pass

proxy/config.py

@@ -0,0 +1,178 @@
+import logging
+import os
+import string
+import random
+import socket as _socket
+import threading
+
+from dataclasses import dataclass, field
+from typing import Dict, List
+from urllib.request import Request
+
+from .balancer import balancer
+from .utils import build_github_opener
+
+log = logging.getLogger('tg-mtproto-proxy')
+
+CFPROXY_DOMAINS_URL = (
+    "https://raw.githubusercontent.com/Flowseal/tg-ws-proxy/main"
+    "/.github/cfproxy-domains.txt"
+)
+
+_CFPROXY_ENC: List[str] = [
+    'virkgj.com', 
+    'vmmzovy.com', 
+    'mkuosckvso.com', 
+    'zaewayzmplad.com', 
+    'twdmbzcm.com',
+    'awzwsldi.com',
+    'clngqrflngqin.com',
+    'tjacxbqtj.com',
+    'bxaxtxmrw.com',
+    'dmohrsgmohcrwb.com'
+]
+_S = ''.join(chr(c) for c in (46, 99, 111, 46, 117, 107))
+
+
+def _dd(s: str) -> str:
+    """Only for decoding CF proxy domains"""
+    if not s[-4:] == '.com':
+        return s
+    p, n = s[:-4], sum(c.isalpha() for c in s[:-4])
+    return ''.join(
+        chr((ord(c) - (97 if c > '`' else 65) - n) % 26 + (97 if c > '`' else 65))
+        if c.isalpha() else c for c in p
+    ) + _S
+
+
+CFPROXY_DEFAULT_DOMAINS: List[str] = [_dd(d) for d in _CFPROXY_ENC]
+_CFPROXY_MIN_VALID_DOMAINS = 3
+
+
+@dataclass
+class ProxyConfig:
+    port: int = 1443
+    host: str = '127.0.0.1'
+    secret: str = field(default_factory=lambda: os.urandom(16).hex())
+    dc_redirects: Dict[int, str] = field(default_factory=lambda: {2: '149.154.167.220', 4: '149.154.167.220'})
+    buffer_size: int = 256 * 1024
+    pool_size: int = 4
+    fallback_cfproxy: bool = True
+    fallback_cfproxy_priority: bool = True
+    cfproxy_user_domain: str = ''
+    fake_tls_domain: str = ''
+    proxy_protocol: bool = False
+
+
+proxy_config = ProxyConfig()
+
+
+def _fetch_cfproxy_domain_list() -> List[str]:
+    try:
+        req = Request(CFPROXY_DOMAINS_URL + "?" + "".join(random.choices(string.ascii_letters, k=7)),
+                       headers={'User-Agent': 'tg-ws-proxy'})
+        with build_github_opener().open(req, timeout=10) as resp:
+            text = resp.read().decode('utf-8', errors='replace')
+        encoded = [
+            line.strip() for line in text.splitlines()
+            if line.strip() and not line.startswith('#')
+        ]
+        return [_dd(d) for d in encoded]
+    except Exception as exc:
+        log.warning("Failed to fetch CF proxy domain list: %s", repr(exc))
+        return []
+
+
+def _is_valid_domain(domain: str) -> bool:
+    if not domain or len(domain) > 253:
+        return False
+    if domain.startswith('.') or domain.endswith('.'):
+        return False
+    labels = domain.split('.')
+    if len(labels) < 2:
+        return False
+    for label in labels:
+        if not label or len(label) > 63:
+            return False
+        if label[0] == '-' or label[-1] == '-':
+            return False
+        if not all(ch.isalnum() or ch == '-' for ch in label):
+            return False
+    # TLD should contain letters and be at least 2 chars.
+    tld = labels[-1]
+    if len(tld) < 2 or not any(ch.isalpha() for ch in tld):
+        return False
+    return True
+
+
+def _normalize_domain_pool(domains: List[str]) -> List[str]:
+    seen = set()
+    normalized: List[str] = []
+    for domain in domains:
+        item = domain.strip().lower()
+        if not _is_valid_domain(item):
+            continue
+        if item in seen:
+            continue
+        seen.add(item)
+        normalized.append(item)
+    return normalized
+
+
+def refresh_cfproxy_domains() -> None:
+    if proxy_config.cfproxy_user_domain:
+        return
+
+    fetched = _fetch_cfproxy_domain_list()
+    pool = _normalize_domain_pool(fetched)
+    if len(pool) >= _CFPROXY_MIN_VALID_DOMAINS:
+        balancer.update_domains_list(pool)
+        log.info("CF proxy domain pool updated from GitHub (%d domains)", len(pool))
+        return
+
+    if fetched:
+        log.warning(
+            "Ignoring fetched CF proxy domains due to low-quality payload "
+            "(total=%d, valid=%d, required>=%d); keeping current domain pool",
+            len(fetched), len(pool), _CFPROXY_MIN_VALID_DOMAINS,
+        )
+    else:
+        log.warning(
+            "CF proxy domain refresh failed or empty response; "
+            "keeping current domain pool",
+        )
+
+
+_refresh_stop: threading.Event = threading.Event()
+
+
+def start_cfproxy_domain_refresh() -> None:
+    global _refresh_stop
+    _refresh_stop.set()
+    _refresh_stop = threading.Event()
+    stop = _refresh_stop
+
+    balancer.update_domains_list(CFPROXY_DEFAULT_DOMAINS)
+
+    def _loop():
+        refresh_cfproxy_domains()
+        while not stop.wait(timeout=3600):
+            refresh_cfproxy_domains()
+
+    threading.Thread(target=_loop, daemon=True, name='cfproxy-domains-refresh').start()
+
+
+def parse_dc_ip_list(dc_ip_list: List[str]) -> Dict[int, str]:
+    dc_redirects: Dict[int, str] = {}
+    for entry in dc_ip_list:
+        if ':' not in entry:
+            raise ValueError(
+                f"Invalid --dc-ip format {entry!r}, expected DC:IP")
+        dc_s, ip_s = entry.split(':', 1)
+        try:
+            dc_n = int(dc_s)
+            _socket.inet_aton(ip_s)
+        except (ValueError, OSError):
+            raise ValueError(f"Invalid --dc-ip {entry!r}")
+        dc_redirects[dc_n] = ip_s
+    return dc_redirects

proxy/fake_tls.py

@@ -0,0 +1,256 @@
+from __future__ import annotations
+
+import asyncio
+import hmac
+import hashlib
+import os
+import random
+import struct
+import time
+import logging
+
+from typing import Optional, Tuple
+from .stats import stats
+
+
+log = logging.getLogger('tg-mtproto-proxy')
+
+TLS_RECORD_HANDSHAKE = 0x16
+TLS_RECORD_CCS = 0x14
+TLS_RECORD_APPDATA = 0x17
+
+TLS_VERSION_10 = b'\x03\x01'
+TLS_VERSION_12 = b'\x03\x03'
+TLS_VERSION_13 = b'\x03\x04'
+
+CLIENT_RANDOM_OFFSET = 11
+CLIENT_RANDOM_LEN = 32
+SESSION_ID_OFFSET = 44
+SESSION_ID_LEN = 32
+
+TIMESTAMP_TOLERANCE = 120
+
+TLS_APPDATA_MAX = 16384
+
+
+_CCS_FRAME = b'\x14\x03\x03\x00\x01\x01'
+
+_SERVER_HELLO_TEMPLATE = bytearray(
+    b'\x16\x03\x03\x00\x7a'
+    b'\x02\x00\x00\x76'
+    b'\x03\x03'
+    + b'\x00' * 32
+    + b'\x20'
+    + b'\x00' * 32
+    + b'\x13\x01\x00'
+    + b'\x00\x2e'
+    + b'\x00\x33\x00\x24\x00\x1d\x00\x20'
+    + b'\x00' * 32
+    + b'\x00\x2b\x00\x02\x03\x04'
+)
+
+_SH_RANDOM_OFF = 11
+_SH_SESSID_OFF = 44
+_SH_PUBKEY_OFF = 89
+
+
+def verify_client_hello(data: bytes, secret: bytes) -> Optional[Tuple[bytes, bytes, int]]:
+    n = len(data)
+    # 5 (record hdr) + 6 (hs type+len+version) + 32 (random) = 43
+    if n < 43:
+        return None
+    if data[0] != TLS_RECORD_HANDSHAKE:
+        return None
+    if data[5] != 0x01:
+        return None
+
+    client_random = bytes(data[CLIENT_RANDOM_OFFSET:CLIENT_RANDOM_OFFSET + CLIENT_RANDOM_LEN])
+
+    zeroed = bytearray(data)
+    zeroed[CLIENT_RANDOM_OFFSET:CLIENT_RANDOM_OFFSET + CLIENT_RANDOM_LEN] = b'\x00' * CLIENT_RANDOM_LEN
+
+    expected = hmac.new(secret, bytes(zeroed), hashlib.sha256).digest()
+
+    if not hmac.compare_digest(expected[:28], client_random[:28]):
+        return None
+
+    ts_xor = bytes(client_random[28 + i] ^ expected[28 + i] for i in range(4))
+    timestamp = struct.unpack('<I', ts_xor)[0]
+
+    now = int(time.time())
+    if abs(now - timestamp) > TIMESTAMP_TOLERANCE:
+        return None
+
+    session_id = b'\x00' * SESSION_ID_LEN
+    if n >= SESSION_ID_OFFSET + SESSION_ID_LEN and data[43] == 0x20:
+        session_id = bytes(data[SESSION_ID_OFFSET:SESSION_ID_OFFSET + SESSION_ID_LEN])
+
+    return client_random, session_id, timestamp
+
+
+def build_server_hello(secret: bytes, client_random: bytes, session_id: bytes) -> bytes:
+    sh = bytearray(_SERVER_HELLO_TEMPLATE)
+    sh[_SH_SESSID_OFF:_SH_SESSID_OFF + 32] = session_id
+    sh[_SH_PUBKEY_OFF:_SH_PUBKEY_OFF + 32] = os.urandom(32)
+
+    ccs = _CCS_FRAME
+    encrypted_size = random.randint(1900, 2100)
+    encrypted_data = os.urandom(encrypted_size)
+    app_record = b'\x17\x03\x03' + struct.pack('>H', encrypted_size) + encrypted_data
+
+    response = bytes(sh) + ccs + app_record
+
+    hmac_input = client_random + response
+    server_random = hmac.new(secret, hmac_input, hashlib.sha256).digest()
+
+    final = bytearray(response)
+    final[_SH_RANDOM_OFF:_SH_RANDOM_OFF + 32] = server_random
+
+    return bytes(final)
+
+
+def wrap_tls_record(data: bytes) -> bytes:
+    parts = []
+    offset = 0
+    while offset < len(data):
+        chunk = data[offset:offset + TLS_APPDATA_MAX]
+        parts.append(
+            b'\x17\x03\x03'
+            + struct.pack('>H', len(chunk))
+            + chunk
+        )
+        offset += len(chunk)
+    return b''.join(parts)
+
+
+class FakeTlsStream:
+    __slots__ = ('_reader', '_writer', '_read_buf', '_read_left')
+
+    def __init__(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter):
+        self._reader = reader
+        self._writer = writer
+        self._read_buf = bytearray()
+        self._read_left = 0
+
+    async def readexactly(self, n: int) -> bytes:
+        while len(self._read_buf) < n:
+            payload = await self._read_tls_payload()
+            if not payload:
+                raise asyncio.IncompleteReadError(bytes(self._read_buf), n)
+            self._read_buf.extend(payload)
+        result = bytes(self._read_buf[:n])
+        del self._read_buf[:n]
+        return result
+
+    async def read(self, n: int) -> bytes:
+        if self._read_buf:
+            chunk = bytes(self._read_buf[:n])
+            del self._read_buf[:n]
+            return chunk
+        payload = await self._read_tls_payload()
+        if not payload:
+            return b''
+        if len(payload) > n:
+            self._read_buf.extend(payload[n:])
+            return payload[:n]
+        return payload
+
+    async def _read_tls_payload(self) -> bytes:
+        if self._read_left > 0:
+            data = await self._reader.read(self._read_left)
+            if not data:
+                return b''
+            self._read_left -= len(data)
+            return data
+
+        while True:
+            hdr = await self._reader.readexactly(5)
+            rtype = hdr[0]
+            rec_len = struct.unpack('>H', hdr[3:5])[0]
+
+            if rtype == TLS_RECORD_CCS:
+                if rec_len > 0:
+                    await self._reader.readexactly(rec_len)
+                continue
+
+            if rtype != TLS_RECORD_APPDATA:
+                return b''
+
+            data = await self._reader.read(min(rec_len, 65536))
+            if not data:
+                return b''
+            remaining = rec_len - len(data)
+            if remaining > 0:
+                self._read_left = remaining
+            return data
+
+    def write(self, data: bytes) -> None:
+        self._writer.write(wrap_tls_record(data))
+
+    async def drain(self) -> None:
+        await self._writer.drain()
+
+    def close(self) -> None:
+        self._writer.close()
+
+    async def wait_closed(self) -> None:
+        await self._writer.wait_closed()
+
+    def get_extra_info(self, name, default=None):
+        return self._writer.get_extra_info(name, default)
+
+    @property
+    def transport(self):
+        return self._writer.transport
+
+    def is_closing(self):
+        return self._writer.is_closing()
+
+
+async def proxy_to_masking_domain(reader, writer, initial_data: bytes,
+                                    domain: str, label: str) -> None:
+    try:
+        up_reader, up_writer = await asyncio.wait_for(
+            asyncio.open_connection(domain, 443), timeout=10)
+    except Exception as exc:
+        log.warning("[%s] masking: cannot connect to %s:443: %s",
+                  label, domain, repr(exc))
+        return
+
+    log.debug("[%s] masking -> %s:443", label, domain)
+    stats.connections_masked += 1
+
+    try:
+        if initial_data:
+            up_writer.write(initial_data)
+            await up_writer.drain()
+
+        async def _relay(src, dst):
+            try:
+                while True:
+                    chunk = await src.read(16384)
+                    if not chunk:
+                        break
+                    dst.write(chunk)
+                    await dst.drain()
+            except (ConnectionResetError, BrokenPipeError, OSError,
+                    asyncio.CancelledError):
+                pass
+            finally:
+                try:
+                    dst.close()
+                    await dst.wait_closed()
+                except Exception:
+                    pass
+
+        await asyncio.gather(
+            _relay(reader, up_writer),
+            _relay(up_reader, writer),
+        )
+    except Exception:
+        pass
+    finally:
+        try:
+            up_writer.close()
+        except Exception:
+            pass

proxy/raw_websocket.py

@@ -0,0 +1,236 @@
+import os
+import ssl
+import base64
+import struct
+import asyncio
+import socket as _socket
+
+from typing import List, Optional, Tuple
+from .config import proxy_config
+
+
+_st_BB = struct.Struct('>BB')
+_st_BBH = struct.Struct('>BBH')
+_st_BBQ = struct.Struct('>BBQ')
+_st_BB4s = struct.Struct('>BB4s')
+_st_BBH4s = struct.Struct('>BBH4s')
+_st_BBQ4s = struct.Struct('>BBQ4s')
+_st_H = struct.Struct('>H')
+_st_Q = struct.Struct('>Q')
+
+_ssl_ctx = ssl.create_default_context()
+_ssl_ctx.check_hostname = False
+_ssl_ctx.verify_mode = ssl.CERT_NONE
+
+
+class WsHandshakeError(Exception):
+    def __init__(self, status_code: int, status_line: str,
+                 headers: Optional[dict] = None, location: Optional[str] = None):
+        self.status_code = status_code
+        self.status_line = status_line
+        self.headers = headers or {}
+        self.location = location
+        super().__init__(f"HTTP {status_code}: {status_line}")
+
+    @property
+    def is_redirect(self) -> bool:
+        return self.status_code in (301, 302, 303, 307, 308)
+
+
+def _xor_mask(data: bytes, mask: bytes) -> bytes:
+    if not data:
+        return data
+    n = len(data)
+    mask_rep = (mask * (n // 4 + 1))[:n]
+    return (int.from_bytes(data, 'big') ^
+            int.from_bytes(mask_rep, 'big')).to_bytes(n, 'big')
+
+
+def set_sock_opts(transport, buffer_size):
+    sock = transport.get_extra_info('socket')
+    if sock is None:
+        return
+    
+    try:
+        sock.setsockopt(_socket.IPPROTO_TCP, _socket.TCP_NODELAY, 1)
+    except (OSError, AttributeError):
+        pass
+    
+    try:
+        sock.setsockopt(_socket.SOL_SOCKET, _socket.SO_RCVBUF, buffer_size)
+        sock.setsockopt(_socket.SOL_SOCKET, _socket.SO_SNDBUF, buffer_size)
+    except OSError:
+        pass
+
+
+class RawWebSocket:
+    __slots__ = ('reader', 'writer', '_closed')
+
+    OP_BINARY = 0x2
+    OP_CLOSE = 0x8
+    OP_PING = 0x9
+    OP_PONG = 0xA
+
+    def __init__(self, reader: asyncio.StreamReader,
+                 writer: asyncio.StreamWriter):
+        self.reader = reader
+        self.writer = writer
+        self._closed = False
+
+    @staticmethod
+    async def connect(host: str, domain: str, timeout: float = 10.0) -> 'RawWebSocket':
+        reader, writer = await asyncio.wait_for(
+            asyncio.open_connection(host, 443, ssl=_ssl_ctx,
+                                    server_hostname=domain),
+            timeout=min(timeout, 10))
+        
+        set_sock_opts(writer.transport, proxy_config.buffer_size)
+
+        ws_key = base64.b64encode(os.urandom(16)).decode()
+
+        req = (
+            f'GET /apiws HTTP/1.1\r\n'
+            f'Host: {domain}\r\n'
+            f'Upgrade: websocket\r\n'
+            f'Connection: Upgrade\r\n'
+            f'Sec-WebSocket-Key: {ws_key}\r\n'
+            f'Sec-WebSocket-Version: 13\r\n'
+            f'Sec-WebSocket-Protocol: binary\r\n'
+            f'\r\n'
+        )
+        writer.write(req.encode())
+        await writer.drain()
+
+        response_lines: list[str] = []
+        try:
+            while True:
+                line = await asyncio.wait_for(reader.readline(),
+                                              timeout=timeout)
+                if line in (b'\r\n', b'\n', b''):
+                    break
+                response_lines.append(
+                    line.decode('utf-8', errors='replace').strip())
+        except asyncio.TimeoutError:
+            writer.close()
+            raise
+
+        if not response_lines:
+            writer.close()
+            raise WsHandshakeError(0, 'empty response')
+
+        first_line = response_lines[0]
+        parts = first_line.split(' ', 2)
+        try:
+            status_code = int(parts[1]) if len(parts) >= 2 else 0
+        except ValueError:
+            status_code = 0
+
+        if status_code == 101:
+            return RawWebSocket(reader, writer)
+
+        headers: dict[str, str] = {}
+        for hl in response_lines[1:]:
+            if ':' in hl:
+                k, v = hl.split(':', 1)
+                headers[k.strip().lower()] = v.strip()
+
+        writer.close()
+        raise WsHandshakeError(status_code, first_line, headers,
+                                location=headers.get('location'))
+
+    async def send(self, data: bytes):
+        if self._closed:
+            raise ConnectionError("WebSocket closed")
+        frame = self._build_frame(self.OP_BINARY, data, mask=True)
+        self.writer.write(frame)
+        await self.writer.drain()
+
+    async def send_batch(self, parts: List[bytes]):
+        if self._closed:
+            raise ConnectionError("WebSocket closed")
+        for part in parts:
+            self.writer.write(
+                self._build_frame(self.OP_BINARY, part, mask=True))
+        await self.writer.drain()
+
+    async def recv(self) -> Optional[bytes]:
+        while not self._closed:
+            opcode, payload = await self._read_frame()
+
+            if opcode == self.OP_CLOSE:
+                self._closed = True
+                try:
+                    self.writer.write(self._build_frame(
+                        self.OP_CLOSE,
+                        payload[:2] if payload else b'', mask=True))
+                    await self.writer.drain()
+                except Exception:
+                    pass
+                return None
+
+            if opcode == self.OP_PING:
+                try:
+                    self.writer.write(
+                        self._build_frame(self.OP_PONG, payload, mask=True))
+                    await self.writer.drain()
+                except Exception:
+                    pass
+                continue
+
+            if opcode == self.OP_PONG:
+                continue
+
+            if opcode in (0x1, 0x2):
+                return payload
+            continue
+        return None
+
+    async def close(self):
+        if self._closed:
+            return
+        self._closed = True
+        try:
+            self.writer.write(
+                self._build_frame(self.OP_CLOSE, b'', mask=True))
+            await self.writer.drain()
+        except Exception:
+            pass
+        try:
+            self.writer.close()
+            await self.writer.wait_closed()
+        except Exception:
+            pass
+
+    @staticmethod
+    def _build_frame(opcode: int, data: bytes,
+                     mask: bool = False) -> bytes:
+        length = len(data)
+        fb = 0x80 | opcode
+        if not mask:
+            if length < 126:
+                return _st_BB.pack(fb, length) + data
+            if length < 65536:
+                return _st_BBH.pack(fb, 126, length) + data
+            return _st_BBQ.pack(fb, 127, length) + data
+        mask_key = os.urandom(4)
+        masked = _xor_mask(data, mask_key)
+        if length < 126:
+            return _st_BB4s.pack(fb, 0x80 | length, mask_key) + masked
+        if length < 65536:
+            return _st_BBH4s.pack(fb, 0x80 | 126, length, mask_key) + masked
+        return _st_BBQ4s.pack(fb, 0x80 | 127, length, mask_key) + masked
+
+    async def _read_frame(self) -> Tuple[int, bytes]:
+        hdr = await self.reader.readexactly(2)
+        opcode = hdr[0] & 0x0F
+        length = hdr[1] & 0x7F
+        if length == 126:
+            length = _st_H.unpack(await self.reader.readexactly(2))[0]
+        elif length == 127:
+            length = _st_Q.unpack(await self.reader.readexactly(8))[0]
+        if hdr[1] & 0x80:
+            mask_key = await self.reader.readexactly(4)
+            payload = await self.reader.readexactly(length)
+            return opcode, _xor_mask(payload, mask_key)
+        payload = await self.reader.readexactly(length)
+        return opcode, payload

proxy/stats.py

@@ -0,0 +1,35 @@
+from .utils import human_bytes
+
+class _Stats:
+    def __init__(self):
+        self.connections_total = 0
+        self.connections_active = 0
+        self.connections_ws = 0
+        self.connections_tcp_fallback = 0
+        self.connections_cfproxy = 0
+        self.connections_bad = 0
+        self.connections_masked = 0
+        self.ws_errors = 0
+        self.bytes_up = 0
+        self.bytes_down = 0
+        self.pool_hits = 0
+        self.pool_misses = 0
+
+    def summary(self) -> str:
+        pool_total = self.pool_hits + self.pool_misses
+        pool_s = (f"{self.pool_hits}/{pool_total}"
+                  if pool_total else "n/a")
+        return (f"total={self.connections_total} "
+                f"active={self.connections_active} "
+                f"ws={self.connections_ws} "
+                f"tcp_fb={self.connections_tcp_fallback} "
+                f"cf={self.connections_cfproxy} "
+                f"bad={self.connections_bad} "
+                f"masked={self.connections_masked} "
+                f"err={self.ws_errors} "
+                f"pool={pool_s} "
+                f"up={human_bytes(self.bytes_up)} "
+                f"down={human_bytes(self.bytes_down)}")
+
+
+stats = _Stats()

proxy/tg_ws_proxy.py

@@ -0,0 +1,767 @@
+from __future__ import annotations
+
+import os
+import sys
+import time
+import struct
+import asyncio
+import hashlib
+import argparse
+import logging
+import logging.handlers
+import socket as _socket
+
+from collections import deque
+from typing import Dict, List, Optional, Set, Tuple
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+if __name__ == '__main__' and (__package__ is None or __package__ == ''):
+    _repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    if _repo_root not in sys.path:
+        sys.path.insert(0, _repo_root)
+    __package__ = 'proxy'
+
+from .utils import *
+from .stats import stats
+from .config import proxy_config, parse_dc_ip_list, start_cfproxy_domain_refresh
+from .bridge import MsgSplitter, CryptoCtx, do_fallback, bridge_ws_reencrypt
+from .raw_websocket import RawWebSocket, WsHandshakeError, set_sock_opts
+from .fake_tls import proxy_to_masking_domain, verify_client_hello, build_server_hello, FakeTlsStream, TLS_RECORD_HANDSHAKE
+from .balancer import balancer
+
+
+log = logging.getLogger('tg-mtproto-proxy')
+
+DC_FAIL_COOLDOWN = 30.0
+WS_FAIL_TIMEOUT = 2.0
+ws_blacklist: Set[str] = set()
+dc_fail_until: Dict[str, float] = {}
+
+
+def _try_handshake(handshake: bytes, secret: bytes) -> Optional[Tuple[int, bool, bytes, bytes]]:
+    dec_prekey_and_iv = handshake[SKIP_LEN:SKIP_LEN + PREKEY_LEN + IV_LEN]
+    dec_prekey = dec_prekey_and_iv[:PREKEY_LEN]
+    dec_iv = dec_prekey_and_iv[PREKEY_LEN:]
+
+    dec_key = hashlib.sha256(dec_prekey + secret).digest()
+
+    dec_iv_int = int.from_bytes(dec_iv, 'big')
+    decryptor = Cipher(
+        algorithms.AES(dec_key), modes.CTR(dec_iv_int.to_bytes(16, 'big'))
+    ).encryptor()
+    decrypted = decryptor.update(handshake)
+
+    proto_tag = decrypted[PROTO_TAG_POS:PROTO_TAG_POS + 4]
+    if proto_tag not in (PROTO_TAG_ABRIDGED, PROTO_TAG_INTERMEDIATE,
+                         PROTO_TAG_SECURE):
+        return None
+
+    dc_idx = int.from_bytes(
+        decrypted[DC_IDX_POS:DC_IDX_POS + 2], 'little', signed=True)
+
+    dc_id = abs(dc_idx)
+    is_media = dc_idx < 0
+
+    return dc_id, is_media, proto_tag, dec_prekey_and_iv
+
+
+def _generate_relay_init(proto_tag: bytes, dc_idx: int) -> bytes:
+    while True:
+        rnd = bytearray(os.urandom(HANDSHAKE_LEN))
+        if rnd[0] in RESERVED_FIRST_BYTES:
+            continue
+        if bytes(rnd[:4]) in RESERVED_STARTS:
+            continue
+        if rnd[4:8] == RESERVED_CONTINUE:
+            continue
+        break
+
+    rnd_bytes = bytes(rnd)
+
+    enc_key = rnd_bytes[SKIP_LEN:SKIP_LEN + PREKEY_LEN]
+    enc_iv = rnd_bytes[SKIP_LEN + PREKEY_LEN:SKIP_LEN + PREKEY_LEN + IV_LEN]
+
+    encryptor = Cipher(
+        algorithms.AES(enc_key), modes.CTR(enc_iv)
+    ).encryptor()
+
+    dc_bytes = struct.pack('<h', dc_idx)
+    tail_plain = proto_tag + dc_bytes + os.urandom(2)
+
+    encrypted_full = encryptor.update(rnd_bytes)
+    keystream_tail = bytes(
+        encrypted_full[i] ^ rnd_bytes[i] for i in range(56, 64))
+    encrypted_tail = bytes(
+        tail_plain[i] ^ keystream_tail[i] for i in range(8))
+
+    result = bytearray(rnd_bytes)
+    result[PROTO_TAG_POS:HANDSHAKE_LEN] = encrypted_tail
+    return bytes(result)
+
+
+def _ws_domains(dc: int, is_media) -> List[str]:
+    if dc == 203:
+        dc = 2
+    if is_media is None or is_media:
+        return [f'kws{dc}-1.web.telegram.org', f'kws{dc}.web.telegram.org']
+    return [f'kws{dc}.web.telegram.org', f'kws{dc}-1.web.telegram.org']
+
+
+class _WsPool:
+    WS_POOL_MAX_AGE = 120.0
+    
+    def __init__(self):
+        self._idle: Dict[Tuple[int, bool], deque] = {}
+        self._refilling: Set[Tuple[int, bool]] = set()
+
+    async def get(self, dc: int, is_media: bool,
+                  target_ip: str, domains: List[str]
+                  ) -> Optional[RawWebSocket]:
+        key = (dc, is_media)
+        now = time.monotonic()
+
+        bucket = self._idle.get(key)
+        if bucket is None:
+            bucket = deque()
+            self._idle[key] = bucket
+        while bucket:
+            ws, created = bucket.popleft()
+            age = now - created
+            if (age > self.WS_POOL_MAX_AGE or ws._closed
+                    or ws.writer.transport.is_closing()):
+                asyncio.create_task(self._quiet_close(ws))
+                continue
+            stats.pool_hits += 1
+            log.debug("WS pool hit DC%d%s (age=%.1fs, left=%d)",
+                      dc, 'm' if is_media else '', age, len(bucket))
+            self._schedule_refill(key, target_ip, domains)
+            return ws
+
+        stats.pool_misses += 1
+        self._schedule_refill(key, target_ip, domains)
+        return None
+
+    def _schedule_refill(self, key, target_ip, domains):
+        if key in self._refilling:
+            return
+        self._refilling.add(key)
+        asyncio.create_task(self._refill(key, target_ip, domains))
+
+    async def _refill(self, key, target_ip, domains):
+        dc, is_media = key
+        try:
+            bucket = self._idle.setdefault(key, deque())
+            needed = proxy_config.pool_size - len(bucket)
+            if needed <= 0:
+                return
+            tasks = [asyncio.create_task(
+                self._connect_one(target_ip, domains))
+                for _ in range(needed)]
+            for t in tasks:
+                try:
+                    ws = await t
+                    if ws:
+                        bucket.append((ws, time.monotonic()))
+                except Exception:
+                    pass
+            log.debug("WS pool refilled DC%d%s: %d ready",
+                      dc, 'm' if is_media else '', len(bucket))
+        finally:
+            self._refilling.discard(key)
+
+    @staticmethod
+    async def _connect_one(target_ip, domains) -> Optional[RawWebSocket]:
+        for domain in domains:
+            try:
+                return await RawWebSocket.connect(
+                    target_ip, domain, timeout=8)
+            except WsHandshakeError as exc:
+                if exc.is_redirect:
+                    continue
+                return None
+            except Exception:
+                return None
+        return None
+
+    @staticmethod
+    async def _quiet_close(ws):
+        try:
+            await ws.close()
+        except Exception:
+            pass
+
+    async def warmup(self, dc_redirects: Dict[int, str]):
+        for dc, target_ip in dc_redirects.items():
+            if target_ip is None:
+                continue
+            for is_media in (False, True):
+                domains = _ws_domains(dc, is_media)
+                self._schedule_refill((dc, is_media), target_ip, domains)
+        log.info("WS pool warmup started for %d DC(s)", len(dc_redirects))
+
+    def reset(self):
+        self._idle.clear()
+        self._refilling.clear()
+
+_ws_pool = _WsPool()
+
+
+async def _read_client_init(reader, writer, secret, label, masking):
+    if proxy_config.proxy_protocol:
+        try:
+            pp_line = await asyncio.wait_for(
+                reader.readline(), timeout=10)
+        except asyncio.IncompleteReadError:
+            log.debug("[%s] disconnected during PROXY header", label)
+            return None
+        pp_text = pp_line.decode('ascii', errors='replace').strip()
+        if pp_text.startswith('PROXY '):
+            parts = pp_text.split()
+            if len(parts) >= 6:
+                label = f"{parts[2]}:{parts[4]}"
+            log.debug("[%s] PROXY protocol: %s", label, pp_text)
+        else:
+            log.debug("[%s] expected PROXY header, got: %r", label,
+                      pp_text[:60])
+
+    try:
+        first_byte = await asyncio.wait_for(
+            reader.readexactly(1), timeout=10)
+    except asyncio.IncompleteReadError:
+        log.debug("[%s] client disconnected before handshake", label)
+        return None
+
+    if first_byte[0] == TLS_RECORD_HANDSHAKE and masking:
+        try:
+            hdr_rest = await asyncio.wait_for(
+                reader.readexactly(4), timeout=10)
+        except asyncio.IncompleteReadError:
+            log.debug("[%s] incomplete TLS record header", label)
+            return None
+
+        tls_header = first_byte + hdr_rest
+        record_len = struct.unpack('>H', tls_header[3:5])[0]
+
+        try:
+            record_body = await asyncio.wait_for(
+                reader.readexactly(record_len), timeout=10)
+        except asyncio.IncompleteReadError:
+            log.debug("[%s] incomplete TLS record body", label)
+            return None
+
+        client_hello = tls_header + record_body
+
+        tls_result = verify_client_hello(client_hello, secret)
+
+        if tls_result is None:
+            log.debug("[%s] Fake TLS verify failed (size=%d rec=%d) "
+                      "-> masking",
+                      label, len(client_hello), record_len)
+            await proxy_to_masking_domain(
+                reader, writer, client_hello, masking, label)
+            return None
+
+        client_random, session_id, ts = tls_result
+        log.debug("[%s] Fake TLS handshake ok (ts=%d)", label, ts)
+
+        server_hello = build_server_hello(secret, client_random, session_id)
+        writer.write(server_hello)
+        await writer.drain()
+
+        tls_stream = FakeTlsStream(reader, writer)
+
+        try:
+            handshake = await asyncio.wait_for(
+                tls_stream.readexactly(HANDSHAKE_LEN), timeout=10)
+        except asyncio.IncompleteReadError:
+            log.debug("[%s] incomplete obfs2 init inside TLS", label)
+            return None
+
+        return handshake, tls_stream, tls_stream, label
+
+    elif masking:
+        log.debug("[%s] non-TLS byte 0x%02X -> HTTP redirect", label,
+                  first_byte[0])
+        redirect = (
+            f"HTTP/1.1 301 Moved Permanently\r\n"
+            f"Location: https://{masking}/\r\n"
+            f"Content-Length: 0\r\n"
+            f"Connection: close\r\n\r\n"
+        ).encode()
+        writer.write(redirect)
+        await writer.drain()
+        return None
+
+    else:
+        try:
+            rest = await asyncio.wait_for(
+                reader.readexactly(HANDSHAKE_LEN - 1), timeout=10)
+        except asyncio.IncompleteReadError:
+            log.debug("[%s] client disconnected before handshake", label)
+            return None
+        return first_byte + rest, reader, writer, label
+
+
+def _build_crypto_ctx(client_dec_prekey_iv, secret, relay_init):
+    # key = SHA256(prekey + secret), iv from handshake
+    # "dec" = decrypt data from client; "enc" = encrypt data to client
+    clt_dec_prekey = client_dec_prekey_iv[:PREKEY_LEN]
+    clt_dec_iv = client_dec_prekey_iv[PREKEY_LEN:]
+    clt_dec_key = hashlib.sha256(clt_dec_prekey + secret).digest()
+
+    clt_enc_prekey_iv = client_dec_prekey_iv[::-1]
+    clt_enc_key = hashlib.sha256(
+        clt_enc_prekey_iv[:PREKEY_LEN] + secret).digest()
+    clt_enc_iv = clt_enc_prekey_iv[PREKEY_LEN:]
+
+    clt_decryptor = Cipher(
+        algorithms.AES(clt_dec_key), modes.CTR(clt_dec_iv)
+    ).encryptor()
+    clt_encryptor = Cipher(
+        algorithms.AES(clt_enc_key), modes.CTR(clt_enc_iv)
+    ).encryptor()
+
+    # fast-forward client decryptor past the 64-byte init
+    clt_decryptor.update(ZERO_64)
+
+    # relay side: standard obfuscation (no secret hash, raw key)
+    relay_enc_key = relay_init[SKIP_LEN:SKIP_LEN + PREKEY_LEN]
+    relay_enc_iv = relay_init[SKIP_LEN + PREKEY_LEN:
+                              SKIP_LEN + PREKEY_LEN + IV_LEN]
+
+    relay_dec_prekey_iv = relay_init[SKIP_LEN:
+                                     SKIP_LEN + PREKEY_LEN + IV_LEN][::-1]
+    relay_dec_key = relay_dec_prekey_iv[:KEY_LEN]
+    relay_dec_iv = relay_dec_prekey_iv[KEY_LEN:]
+
+    tg_encryptor = Cipher(
+        algorithms.AES(relay_enc_key), modes.CTR(relay_enc_iv)
+    ).encryptor()
+    tg_decryptor = Cipher(
+        algorithms.AES(relay_dec_key), modes.CTR(relay_dec_iv)
+    ).encryptor()
+
+    tg_encryptor.update(ZERO_64)
+
+    return CryptoCtx(clt_decryptor, clt_encryptor, tg_encryptor, tg_decryptor)
+
+
+async def _handle_client(reader, writer, secret: bytes):
+    stats.connections_total += 1
+    stats.connections_active += 1
+    peer = writer.get_extra_info('peername')
+    label = f"{peer[0]}:{peer[1]}" if peer else "?"
+
+    set_sock_opts(writer.transport, proxy_config.buffer_size)
+
+    try:
+        init = await _read_client_init(
+            reader, writer, secret, label, proxy_config.fake_tls_domain)
+        if init is None:
+            return
+
+        handshake, clt_reader, clt_writer, label = init
+
+        result = _try_handshake(handshake, secret)
+        if result is None:
+            stats.connections_bad += 1
+            log.warning("[%s] bad handshake (wrong secret or proto)", label)
+            try:
+                while await clt_reader.read(4096):
+                    pass
+            except Exception:
+                pass
+            return
+
+        dc, is_media, proto_tag, client_dec_prekey_iv = result
+
+        if proto_tag == PROTO_TAG_ABRIDGED:
+            proto_int = PROTO_ABRIDGED_INT
+        elif proto_tag == PROTO_TAG_INTERMEDIATE:
+            proto_int = PROTO_INTERMEDIATE_INT
+        else:
+            proto_int = PROTO_PADDED_INTERMEDIATE_INT
+
+        dc_idx = -dc if is_media else dc
+
+        log.debug("[%s] handshake ok: DC%d%s proto=0x%08X",
+                  label, dc, ' media' if is_media else '', proto_int)
+
+        relay_init = _generate_relay_init(proto_tag, dc_idx)
+        ctx = _build_crypto_ctx(client_dec_prekey_iv, secret, relay_init)
+
+        dc_key = f'{dc}{"m" if is_media else ""}'
+        media_tag = " media" if is_media else ""
+
+        # Fallback if DC not in config or WS blacklisted for this DC/is_media
+        if dc not in proxy_config.dc_redirects or dc_key in ws_blacklist:
+            if dc not in proxy_config.dc_redirects:
+                log.info("[%s] DC%d not in config -> fallback",
+                         label, dc)
+            else:
+                log.info("[%s] DC%d%s WS blacklisted -> fallback",
+                         label, dc, media_tag)
+            splitter = None
+            try:
+                splitter = MsgSplitter(relay_init, proto_int)
+            except Exception:
+                pass
+            ok = await do_fallback(
+                clt_reader, clt_writer, relay_init, label,
+                dc, is_media, media_tag,
+                ctx, splitter=splitter)
+            if not ok:
+                log.warning("[%s] DC%d%s no fallback available",
+                            label, dc, media_tag)
+            return
+
+        now = time.monotonic()
+        fail_until = dc_fail_until.get(dc_key, 0)
+        ws_timeout = WS_FAIL_TIMEOUT if now < fail_until else 10.0
+
+        domains = _ws_domains(dc, is_media)
+        target = proxy_config.dc_redirects[dc]
+        ws = None
+        ws_failed_redirect = False
+        all_redirects = True
+
+        ws = await _ws_pool.get(dc, is_media, target, domains)
+        if ws:
+            log.info("[%s] DC%d%s -> pool hit via %s",
+                     label, dc, media_tag, target)
+        else:
+            for domain in domains:
+                url = f'wss://{domain}/apiws'
+                log.info("[%s] DC%d%s -> %s via %s",
+                         label, dc, media_tag, url, target)
+                try:
+                    ws = await RawWebSocket.connect(target, domain,
+                                                    timeout=ws_timeout)
+                    all_redirects = False
+                    break
+                except WsHandshakeError as exc:
+                    stats.ws_errors += 1
+                    if exc.is_redirect:
+                        ws_failed_redirect = True
+                        log.warning("[%s] DC%d%s got %d from %s -> %s",
+                                    label, dc, media_tag,
+                                    exc.status_code, domain,
+                                    exc.location or '?')
+                        continue
+                    else:
+                        all_redirects = False
+                        log.warning("[%s] DC%d%s WS handshake: %s",
+                                    label, dc, media_tag, exc.status_line)
+                except Exception as exc:
+                    stats.ws_errors += 1
+                    all_redirects = False
+                    log.warning("[%s] DC%d%s WS connect failed: %s",
+                                label, dc, media_tag, repr(exc))
+
+        # WS failed -> fallback
+        if ws is None:
+            if ws_failed_redirect and all_redirects:
+                ws_blacklist.add(dc_key)
+                log.warning("[%s] DC%d%s blacklisted for WS (all 302)",
+                            label, dc, media_tag)
+            elif ws_failed_redirect:
+                dc_fail_until[dc_key] = now + DC_FAIL_COOLDOWN
+            else:
+                dc_fail_until[dc_key] = now + DC_FAIL_COOLDOWN
+                log.info("[%s] DC%d%s WS cooldown for %ds",
+                         label, dc, media_tag, int(DC_FAIL_COOLDOWN))
+
+            splitter_fb = None
+            try:
+                splitter_fb = MsgSplitter(relay_init, proto_int)
+            except Exception:
+                pass
+            ok = await do_fallback(
+                clt_reader, clt_writer, relay_init, label,
+                dc, is_media, media_tag,
+                ctx, splitter=splitter_fb)
+            if ok:
+                log.info("[%s] DC%d%s fallback closed",
+                         label, dc, media_tag)
+            return
+
+        dc_fail_until.pop(dc_key, None)
+        stats.connections_ws += 1
+
+        splitter = None
+        try:
+            splitter = MsgSplitter(relay_init, proto_int)
+            log.debug("[%s] MsgSplitter activated for proto 0x%08X",
+                      label, proto_int)
+        except Exception:
+            pass
+
+        await ws.send(relay_init)
+
+        await bridge_ws_reencrypt(clt_reader, clt_writer, ws, label, ctx,
+                                   dc=dc, is_media=is_media,
+                                   splitter=splitter)
+
+    except asyncio.TimeoutError:
+        log.warning("[%s] timeout during handshake", label)
+    except asyncio.IncompleteReadError:
+        log.debug("[%s] client disconnected", label)
+    except asyncio.CancelledError:
+        log.debug("[%s] cancelled", label)
+    except ConnectionResetError:
+        log.debug("[%s] connection reset", label)
+    except OSError as exc:
+        if getattr(exc, 'winerror', None) == 1236:
+            log.debug("[%s] connection aborted by local system", label)
+        else:
+            log.error("[%s] unexpected OS error: %s", label, repr(exc))
+    except Exception as exc:
+        log.error("[%s] unexpected: %s", label, exc, exc_info=True)
+    finally:
+        stats.connections_active -= 1
+        try:
+            writer.close()
+            await writer.wait_closed()
+        except BaseException:
+            pass
+
+
+_server_instance = None
+_server_stop_event = None
+_client_tasks: Set[asyncio.Task] = set()
+
+
+async def _run(stop_event: Optional[asyncio.Event] = None):
+    global _server_instance, _server_stop_event
+    _server_stop_event = stop_event
+
+    _ws_pool.reset()
+    ws_blacklist.clear()
+    dc_fail_until.clear()
+    _client_tasks.clear()
+
+    if proxy_config.fallback_cfproxy:
+        user = proxy_config.cfproxy_user_domain
+        if user:
+            balancer.update_domains_list([user])
+        else:
+            start_cfproxy_domain_refresh()
+
+    secret_bytes = bytes.fromhex(proxy_config.secret)
+
+    def client_cb(r, w):
+        task = asyncio.create_task(_handle_client(r, w, secret_bytes))
+        _client_tasks.add(task)
+        task.add_done_callback(_client_tasks.discard)
+
+    server = await asyncio.start_server(client_cb, proxy_config.host, proxy_config.port)
+    _server_instance = server
+
+    for sock in server.sockets:
+        try:
+            sock.setsockopt(_socket.IPPROTO_TCP, _socket.TCP_NODELAY, 1)
+        except (OSError, AttributeError):
+            pass
+
+    link_host = get_link_host(proxy_config.host)
+    ftls = proxy_config.fake_tls_domain
+    dd_link = (f"tg://proxy?server={link_host}"
+               f"&port={proxy_config.port}"
+               f"&secret=dd{proxy_config.secret}")
+    ee_link = ""
+    if ftls:
+        domain_hex = ftls.encode('ascii').hex()
+        ee_link = (f"tg://proxy?server={link_host}"
+                   f"&port={proxy_config.port}"
+                   f"&secret=ee{proxy_config.secret}{domain_hex}")
+
+    log.info("=" * 60)
+    log.info("  Telegram MTProto WS Bridge Proxy")
+    log.info("  Listening on   %s:%d", proxy_config.host, proxy_config.port)
+    log.info("  Secret:        %s", proxy_config.secret)
+    if ftls:
+        log.info("  Fake TLS:      %s", ftls)
+    log.info("  Target DC IPs:")
+    for dc in sorted(proxy_config.dc_redirects.keys()):
+        ip = proxy_config.dc_redirects.get(dc)
+        log.info("    DC%d: %s", dc, ip)
+    if proxy_config.fallback_cfproxy:
+        prio = 'CF first' if proxy_config.fallback_cfproxy_priority else 'TCP first'
+        user_domain = "user" if proxy_config.cfproxy_user_domain else "auto"
+        log.info("  CF proxy:      enabled (%s | %s)", prio, user_domain)
+    log.info("=" * 60)
+    log.info("  Connect:")
+    if ftls:
+        log.info("    %s", ee_link)
+    else:
+        log.info("    %s", dd_link)
+    log.info("=" * 60)
+
+    async def log_stats():
+        try:
+            while True:
+                await asyncio.sleep(60)
+                bl = ', '.join(f'DC{k}' for k in sorted(ws_blacklist)) or 'none'
+                log.info("stats: %s | ws_bl: %s", stats.summary(), bl)
+        except asyncio.CancelledError:
+            raise
+
+    log_stats_task = asyncio.create_task(log_stats())
+
+    await _ws_pool.warmup(proxy_config.dc_redirects)
+
+    try:
+        async with server:
+            if stop_event:
+                serve_task = asyncio.create_task(server.serve_forever())
+                stop_task = asyncio.create_task(stop_event.wait())
+                done, _ = await asyncio.wait(
+                    (serve_task, stop_task),
+                    return_when=asyncio.FIRST_COMPLETED,
+                )
+                if stop_task in done:
+                    server.close()
+                    await server.wait_closed()
+                    if not serve_task.done():
+                        serve_task.cancel()
+                        try:
+                            await serve_task
+                        except asyncio.CancelledError:
+                            pass
+                else:
+                    stop_task.cancel()
+                    try:
+                        await stop_task
+                    except asyncio.CancelledError:
+                        pass
+            else:
+                await server.serve_forever()
+    finally:
+        log_stats_task.cancel()
+        try:
+            await log_stats_task
+        except asyncio.CancelledError:
+            pass
+    _server_instance = None
+
+
+def run_proxy(stop_event: Optional[asyncio.Event] = None):
+    asyncio.run(_run(stop_event,))
+
+
+def main():
+    def _parse_bool(value: str) -> bool:
+        lowered = value.strip().lower()
+        if lowered == 'true':
+            return True
+        if lowered == 'false':
+            return False
+        raise argparse.ArgumentTypeError(
+            "Expected boolean value: true or false",
+        )
+
+    ap = argparse.ArgumentParser(
+        description='Telegram MTProto WebSocket Bridge Proxy')
+    ap.add_argument('--port', type=int, default=1443,
+                    help='Listen port (default 1443)')
+    ap.add_argument('--host', type=str, default='127.0.0.1',
+                    help='Listen host (default 127.0.0.1)')
+    ap.add_argument('--secret', type=str, default=None,
+                    help='MTProto proxy secret (32 hex chars). '
+                         'Auto-generated if not provided.')
+    ap.add_argument('--dc-ip', metavar='DC:IP', action='append',
+                    help='Target IP for a DC, e.g. --dc-ip 2:149.154.167.220')
+    ap.add_argument('-v', '--verbose', action='store_true',
+                    help='Debug logging')
+    ap.add_argument('--log-file', type=str, default=None, metavar='PATH',
+                    help='Log to file with rotation (default: stderr only)')
+    ap.add_argument('--log-max-mb', type=float, default=5, metavar='MB',
+                    help='Max log file size in MB before rotation (default 5)')
+    ap.add_argument('--log-backups', type=int, default=0, metavar='N',
+                    help='Number of rotated log files to keep (default 0)')
+    ap.add_argument('--buf-kb', type=int, default=256, metavar='KB',
+                    help='Socket send/recv buffer size in KB (default 256)')
+    ap.add_argument('--pool-size', type=int, default=4, metavar='N',
+                    help='WS connection pool size per DC (default 4, min 0)')
+    ap.add_argument('--cfproxy-domain', type=str, default='',
+                    metavar='DOMAIN',
+                    help='User defined Cloudflare-proxied domain for WS fallback')
+    ap.add_argument('--no-cfproxy', action='store_true',
+                    help='Disable Cloudflare proxy fallback')
+    ap.add_argument('--cfproxy-priority', type=_parse_bool, default=True,
+                    help='Try cfproxy before tcp fallback (default: true)')
+    ap.add_argument('--fake-tls-domain', type=str, default='',
+                    metavar='DOMAIN',
+                    help='Enable Fake TLS (ee-secret) masking with the given '
+                         'SNI domain, e.g. example.com')
+    ap.add_argument('--proxy-protocol', action='store_true',
+                    help='Accept PROXY protocol v1 header '
+                         '(for use behind nginx/haproxy with proxy_protocol on)')
+    args = ap.parse_args()
+
+    if not args.dc_ip:
+        args.dc_ip = ['2:149.154.167.220', '4:149.154.167.220']
+
+    try:
+        dc_redirects = parse_dc_ip_list(args.dc_ip)
+    except ValueError as e:
+        log.error(str(e))
+        sys.exit(1)
+
+    if args.secret:
+        secret_hex = args.secret.strip()
+        if len(secret_hex) != 32:
+            log.error("Secret must be exactly 32 hex characters")
+            sys.exit(1)
+        try:
+            bytes.fromhex(secret_hex)
+        except ValueError:
+            log.error("Secret must be valid hex")
+            sys.exit(1)
+    else:
+        secret_hex = os.urandom(16).hex()
+        log.info("Generated secret: %s", secret_hex)
+
+    proxy_config.port = args.port
+    proxy_config.host = args.host
+    proxy_config.secret = secret_hex
+    proxy_config.dc_redirects = dc_redirects
+    proxy_config.buffer_size = max(4, args.buf_kb) * 1024
+    proxy_config.pool_size = max(0, args.pool_size)
+    proxy_config.fallback_cfproxy = not args.no_cfproxy
+    proxy_config.fallback_cfproxy_priority = args.cfproxy_priority
+    proxy_config.cfproxy_user_domain = args.cfproxy_domain.strip()
+    proxy_config.fake_tls_domain = args.fake_tls_domain.strip()
+    proxy_config.proxy_protocol = args.proxy_protocol
+
+    log_level = logging.DEBUG if args.verbose else logging.INFO
+    log_fmt = logging.Formatter('%(asctime)s  %(levelname)-5s  %(message)s',
+                                datefmt='%H:%M:%S')
+    root = logging.getLogger()
+    root.setLevel(log_level)
+
+    console = logging.StreamHandler()
+    console.setFormatter(log_fmt)
+    root.addHandler(console)
+
+    if args.log_file:
+        fh = logging.handlers.RotatingFileHandler(
+            args.log_file,
+            maxBytes=max(32 * 1024, int(args.log_max_mb * 1024 * 1024)),
+            backupCount=max(0, args.log_backups),
+            encoding='utf-8',
+        )
+        fh.setFormatter(log_fmt)
+        root.addHandler(fh)
+
+    logging.getLogger('asyncio').setLevel(logging.WARNING)
+
+    try:
+        asyncio.run(_run())
+    except KeyboardInterrupt:
+        log.info("Shutting down. Final stats: %s", stats.summary())
+
+
+if __name__ == '__main__':
+    main()

proxy/utils.py

@@ -0,0 +1,87 @@
+import socket as _socket
+import urllib.request
+import http.client
+
+from typing import Optional, Dict
+from urllib.request import Request
+
+
+ZERO_64 = b'\x00' * 64
+HANDSHAKE_LEN = 64
+SKIP_LEN = 8
+PREKEY_LEN = 32
+KEY_LEN = 32
+IV_LEN = 16
+PROTO_TAG_POS = 56
+DC_IDX_POS = 60
+
+PROTO_TAG_ABRIDGED = b'\xef\xef\xef\xef'
+PROTO_TAG_INTERMEDIATE = b'\xee\xee\xee\xee'
+PROTO_TAG_SECURE = b'\xdd\xdd\xdd\xdd'
+
+PROTO_ABRIDGED_INT = 0xEFEFEFEF
+PROTO_INTERMEDIATE_INT = 0xEEEEEEEE
+PROTO_PADDED_INTERMEDIATE_INT = 0xDDDDDDDD
+
+RESERVED_FIRST_BYTES = {0xEF}
+RESERVED_STARTS = {b'\x48\x45\x41\x44', b'\x50\x4F\x53\x54',
+                    b'\x47\x45\x54\x20', b'\xee\xee\xee\xee',
+                    b'\xdd\xdd\xdd\xdd', b'\x16\x03\x01\x02'}
+RESERVED_CONTINUE = b'\x00\x00\x00\x00'
+
+_GITHUB_IPS: Dict[str, str] = {
+    "release-assets.githubusercontent.com": "185.199.109.133",
+    "raw.githubusercontent.com": "185.199.109.133",
+}
+
+
+def human_bytes(n: int) -> str:
+    for unit in ('B', 'KB', 'MB', 'GB'):
+        if abs(n) < 1024:
+            return f"{n:.1f}{unit}"
+        n /= 1024  # type: ignore
+    return f"{n:.1f}TB"
+
+
+def get_link_host(host: str) -> Optional[str]:
+    if host == '0.0.0.0':
+        try:
+            with _socket.socket(_socket.AF_INET, _socket.SOCK_DGRAM) as _s:
+                _s.connect(('8.8.8.8', 80))
+                link_host = _s.getsockname()[0]
+        except OSError:
+            link_host = '127.0.0.1'
+        return link_host
+    else:
+        return host
+
+
+class _PinnedHTTPSHandler(urllib.request.HTTPSHandler):
+    def https_open(self, req: Request):
+        host = req.host.split(":")[0]
+        ip = _GITHUB_IPS.get(host)
+        if not ip:
+            return super().https_open(req)
+        pinned = ip
+
+        class _Conn(http.client.HTTPSConnection):
+            def connect(self):
+                self.sock = _socket.create_connection(
+                    (pinned, self.port or 443),
+                    self.timeout,
+                    self.source_address,
+                )
+                if self._tunnel_host:
+                    self._tunnel()
+                self.sock = self._context.wrap_socket(
+                    self.sock, server_hostname=self._tunnel_host or self.host
+                )
+
+        try:
+            return self.do_open(_Conn, req)
+        except Exception:
+            return super().https_open(req)
+
+
+def build_github_opener() -> urllib.request.OpenerDirector:
+    return urllib.request.build_opener(_PinnedHTTPSHandler())

pyproject.toml

@@ -0,0 +1,76 @@
+[build-system]
+requires = ["hatchling>=1.25.0"]
+build-backend = "hatchling.build"
+
+[project]
+name = "tg-ws-proxy"
+dynamic=["version"]
+
+description = "Telegram Desktop WebSocket Bridge Proxy"
+readme = "docs/README.md"
+requires-python = ">=3.8"
+
+license = { name = "MIT", file = "LICENSE" }
+
+authors = [
+    { name = "Flowseal" }
+]
+
+keywords = [
+    "telegram",
+    "tdesktop",
+    "proxy",
+    "bypass",
+    "websocket",
+    "mtproto",
+]
+classifiers = [
+  "Development Status :: 5 - Production/Stable",
+  "Environment :: Console",
+  "Intended Audience :: Customer Service",
+  "Programming Language :: Python :: 3",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Topic :: System :: Networking :: Firewalls",
+]
+
+dependencies = [
+    "pyperclip==1.9.0",
+
+    "psutil==5.9.8; platform_system == 'Windows' and python_version < '3.9'",
+    "cryptography==41.0.7; platform_system == 'Windows' and python_version < '3.9'",
+    "Pillow==10.4.0; platform_system == 'Windows' and python_version < '3.9'",
+
+    "psutil==7.0.0; platform_system != 'Windows' or python_version >= '3.9'",
+    "cryptography==46.0.5; platform_system != 'Windows' or python_version >= '3.9'",
+    "Pillow==12.1.1; (platform_system != 'Windows' or python_version >= '3.9') and platform_system != 'Darwin'",
+
+    "customtkinter==5.2.2; platform_system != 'Darwin'",
+    "pystray==0.19.5; platform_system != 'Darwin'",
+    "rumps==0.4.0; platform_system == 'Darwin'",
+    "Pillow==12.1.0; platform_system == 'Darwin'",
+]
+
+[project.scripts]
+tg-ws-proxy = "proxy.tg_ws_proxy:main"
+tg-ws-proxy-tray-win = "windows:main"
+tg-ws-proxy-tray-macos = "macos:main"
+tg-ws-proxy-tray-linux = "linux:main"
+
+[project.urls]
+Source = "https://github.com/Flowseal/tg-ws-proxy"
+Issues = "https://github.com/Flowseal/tg-ws-proxy/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["proxy", "ui", "utils"]
+
+[tool.hatch.build.force-include]
+"windows.py" = "windows.py"
+"macos.py" = "macos.py"
+"linux.py" = "linux.py"
+
+[tool.hatch.version]
+path = "proxy/__init__.py"
+
+[tool.ruff.lint]
+ignore = ["F403", "F405"]

requirements.txt

@@ -1,6 +0,0 @@
-cryptography
-pystray
-Pillow
-customtkinter
-pyinstaller
-psutil

tg_ws_proxy.py

@@ -1,865 +0,0 @@
-from __future__ import annotations
-
-import argparse
-import asyncio
-import base64
-import logging
-import os
-import socket as _socket
-import ssl
-import struct
-import sys
-import time
-from typing import Dict, List, Optional, Set, Tuple
-from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-
-
-DEFAULT_PORT = 1080
-DEFAULT_TARGET_IP = '149.154.167.220'  # unthrottled, works for DC2 and DC4
-
-log = logging.getLogger('tg-ws-proxy')
-
-_TG_RANGES = [
-    # 185.76.151.0/24
-    (struct.unpack('!I', _socket.inet_aton('185.76.151.0'))[0],
-     struct.unpack('!I', _socket.inet_aton('185.76.151.255'))[0]),
-    # 149.154.160.0/20
-    (struct.unpack('!I', _socket.inet_aton('149.154.160.0'))[0],
-     struct.unpack('!I', _socket.inet_aton('149.154.175.255'))[0]),
-    # 91.105.192.0/23
-    (struct.unpack('!I', _socket.inet_aton('91.105.192.0'))[0],
-     struct.unpack('!I', _socket.inet_aton('91.105.193.255'))[0]),
-    # 91.108.0.0/16
-    (struct.unpack('!I', _socket.inet_aton('91.108.0.0'))[0],
-     struct.unpack('!I', _socket.inet_aton('91.108.255.255'))[0]),
-]
-
-_dc_opt: Dict[int, Optional[str]] = {}
-
-# DCs where WS is known to fail (302 redirect)
-# Raw TCP fallback will be used instead
-# Keyed by (dc, is_media)
-_ws_blacklist: Set[Tuple[int, bool]] = {}
-
-# Rate-limit re-attempts per (dc, is_media)
-_dc_fail_until: Dict[Tuple[int, bool], float] = {}
-_DC_FAIL_COOLDOWN = 60.0  # seconds
-
-
-_ssl_ctx = ssl.create_default_context()
-_ssl_ctx.check_hostname = False
-_ssl_ctx.verify_mode = ssl.CERT_NONE
-
-
-class WsHandshakeError(Exception):
-    def __init__(self, status_code: int, status_line: str,
-                 headers: dict = None, location: str = None):
-        self.status_code = status_code
-        self.status_line = status_line
-        self.headers = headers or {}
-        self.location = location
-        super().__init__(f"HTTP {status_code}: {status_line}")
-
-    @property
-    def is_redirect(self) -> bool:
-        return self.status_code in (301, 302, 303, 307, 308)
-
-
-def _xor_mask(data: bytes, mask: bytes) -> bytes:
-    if not data:
-        return data
-    a = bytearray(data)
-    for i in range(len(a)):
-        a[i] ^= mask[i & 3]
-    return bytes(a)
-
-
-class RawWebSocket:
-    """
-    Lightweight WebSocket client over asyncio reader/writer streams.
-
-    Connects DIRECTLY to a target IP via TCP+TLS (bypassing any system
-    proxy), performs the HTTP Upgrade handshake, and provides send/recv
-    for binary frames with proper masking, ping/pong, and close handling.
-    """
-
-    OP_CONTINUATION = 0x0
-    OP_TEXT = 0x1
-    OP_BINARY = 0x2
-    OP_CLOSE = 0x8
-    OP_PING = 0x9
-    OP_PONG = 0xA
-
-    def __init__(self, reader: asyncio.StreamReader,
-                 writer: asyncio.StreamWriter):
-        self.reader = reader
-        self.writer = writer
-        self._closed = False
-
-    @staticmethod
-    async def connect(ip: str, domain: str, path: str = '/apiws',
-                      timeout: float = 10.0) -> 'RawWebSocket':
-        """
-        Connect via TLS to the given IP,
-        perform WebSocket upgrade, return a RawWebSocket.
-
-        Raises WsHandshakeError on non-101 response.
-        """
-        reader, writer = await asyncio.wait_for(
-            asyncio.open_connection(ip, 443, ssl=_ssl_ctx,
-                                    server_hostname=domain),
-            timeout=min(timeout, 10))
-
-        ws_key = base64.b64encode(os.urandom(16)).decode()
-        req = (
-            f'GET {path} HTTP/1.1\r\n'
-            f'Host: {domain}\r\n'
-            f'Upgrade: websocket\r\n'
-            f'Connection: Upgrade\r\n'
-            f'Sec-WebSocket-Key: {ws_key}\r\n'
-            f'Sec-WebSocket-Version: 13\r\n'
-            f'Sec-WebSocket-Protocol: binary\r\n'
-            f'Origin: https://web.telegram.org\r\n'
-            f'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) '
-            f'AppleWebKit/537.36 (KHTML, like Gecko) '
-            f'Chrome/131.0.0.0 Safari/537.36\r\n'
-            f'\r\n'
-        )
-        writer.write(req.encode())
-        await writer.drain()
-
-        # Read HTTP response headers line-by-line so the reader stays
-        # positioned right at the start of WebSocket frames.
-        response_lines: list[str] = []
-        try:
-            while True:
-                line = await asyncio.wait_for(reader.readline(),
-                                              timeout=timeout)
-                if line in (b'\r\n', b'\n', b''):
-                    break
-                response_lines.append(
-                    line.decode('utf-8', errors='replace').strip())
-        except asyncio.TimeoutError:
-            writer.close()
-            raise
-
-        if not response_lines:
-            writer.close()
-            raise WsHandshakeError(0, 'empty response')
-
-        first_line = response_lines[0]
-        parts = first_line.split(' ', 2)
-        try:
-            status_code = int(parts[1]) if len(parts) >= 2 else 0
-        except ValueError:
-            status_code = 0
-
-        if status_code == 101:
-            return RawWebSocket(reader, writer)
-
-        headers: dict[str, str] = {}
-        for hl in response_lines[1:]:
-            if ':' in hl:
-                k, v = hl.split(':', 1)
-                headers[k.strip().lower()] = v.strip()
-
-        writer.close()
-        raise WsHandshakeError(status_code, first_line, headers,
-                                location=headers.get('location'))
-
-    async def send(self, data: bytes):
-        """Send a masked binary WebSocket frame."""
-        if self._closed:
-            raise ConnectionError("WebSocket closed")
-        frame = self._build_frame(self.OP_BINARY, data, mask=True)
-        self.writer.write(frame)
-        await self.writer.drain()
-
-    async def recv(self) -> Optional[bytes]:
-        """
-        Receive the next data frame.  Handles ping/pong/close
-        internally.  Returns payload bytes, or None on clean close.
-        """
-        while not self._closed:
-            opcode, payload = await self._read_frame()
-
-            if opcode == self.OP_CLOSE:
-                self._closed = True
-                try:
-                    reply = self._build_frame(
-                        self.OP_CLOSE,
-                        payload[:2] if payload else b'',
-                        mask=True)
-                    self.writer.write(reply)
-                    await self.writer.drain()
-                except Exception:
-                    pass
-                return None
-
-            if opcode == self.OP_PING:
-                try:
-                    pong = self._build_frame(self.OP_PONG, payload,
-                                             mask=True)
-                    self.writer.write(pong)
-                    await self.writer.drain()
-                except Exception:
-                    pass
-                continue
-
-            if opcode == self.OP_PONG:
-                continue
-
-            if opcode in (self.OP_TEXT, self.OP_BINARY):
-                return payload
-
-            # Unknown opcode — skip
-            continue
-
-        return None
-
-    async def close(self):
-        """Send close frame and shut down the transport."""
-        if self._closed:
-            return
-        self._closed = True
-        try:
-            self.writer.write(
-                self._build_frame(self.OP_CLOSE, b'', mask=True))
-            await self.writer.drain()
-        except Exception:
-            pass
-        try:
-            self.writer.close()
-            await self.writer.wait_closed()
-        except Exception:
-            pass
-
-    @staticmethod
-    def _build_frame(opcode: int, data: bytes,
-                     mask: bool = False) -> bytes:
-        header = bytearray()
-        header.append(0x80 | opcode)  # FIN=1 + opcode
-        length = len(data)
-        mask_bit = 0x80 if mask else 0x00
-
-        if length < 126:
-            header.append(mask_bit | length)
-        elif length < 65536:
-            header.append(mask_bit | 126)
-            header.extend(struct.pack('>H', length))
-        else:
-            header.append(mask_bit | 127)
-            header.extend(struct.pack('>Q', length))
-
-        if mask:
-            mask_key = os.urandom(4)
-            header.extend(mask_key)
-            return bytes(header) + _xor_mask(data, mask_key)
-        return bytes(header) + data
-
-    async def _read_frame(self) -> Tuple[int, bytes]:
-        hdr = await self.reader.readexactly(2)
-        opcode = hdr[0] & 0x0F
-        is_masked = bool(hdr[1] & 0x80)
-        length = hdr[1] & 0x7F
-
-        if length == 126:
-            length = struct.unpack('>H',
-                                   await self.reader.readexactly(2))[0]
-        elif length == 127:
-            length = struct.unpack('>Q',
-                                   await self.reader.readexactly(8))[0]
-
-        if is_masked:
-            mask_key = await self.reader.readexactly(4)
-            payload = await self.reader.readexactly(length)
-            return opcode, _xor_mask(payload, mask_key)
-
-        payload = await self.reader.readexactly(length)
-        return opcode, payload
-
-
-def _human_bytes(n: int) -> str:
-    for unit in ('B', 'KB', 'MB', 'GB'):
-        if abs(n) < 1024:
-            return f"{n:.1f}{unit}"
-        n /= 1024
-    return f"{n:.1f}TB"
-
-
-def _is_telegram_ip(ip: str) -> bool:
-    try:
-        n = struct.unpack('!I', _socket.inet_aton(ip))[0]
-        return any(lo <= n <= hi for lo, hi in _TG_RANGES)
-    except OSError:
-        return False
-
-
-def _is_http_transport(data: bytes) -> bool:
-    return (data[:5] == b'POST ' or data[:4] == b'GET ' or
-            data[:5] == b'HEAD ' or data[:8] == b'OPTIONS ')
-
-
-def _dc_from_init(data: bytes) -> Tuple[Optional[int], bool]:
-    """
-    Extract DC ID from the 64-byte MTProto obfuscation init packet.
-    Returns (dc_id, is_media).
-    """
-    try:
-        key = bytes(data[8:40])
-        iv = bytes(data[40:56])
-        cipher = Cipher(algorithms.AES(key), modes.CTR(iv))
-        encryptor = cipher.encryptor()
-        keystream = encryptor.update(b'\x00' * 64) + encryptor.finalize()
-        plain = bytes(a ^ b for a, b in zip(data[56:64], keystream[56:64]))
-        proto = struct.unpack('<I', plain[0:4])[0]
-        dc_raw = struct.unpack('<h', plain[4:6])[0]
-        log.debug("dc_from_init: proto=0x%08X dc_raw=%d plain=%s",
-                  proto, dc_raw, plain.hex())
-        if proto in (0xEFEFEFEF, 0xEEEEEEEE, 0xDDDDDDDD):
-            dc = abs(dc_raw)
-            if 1 <= dc <= 1000:
-                return dc, (dc_raw < 0)
-    except Exception as exc:
-        log.debug("DC extraction failed: %s", exc)
-    return None, False
-
-
-def _ws_domains(dc: int, is_media) -> List[str]:
-    """
-    Return domain names to try for WebSocket connection to a DC.
-
-    DC 1-5:  kws{N}[-1].web.telegram.org
-    DC >5:   kws{N}[-1].telegram.org
-    """
-    base = 'telegram.org' if dc > 5 else 'web.telegram.org'
-    if is_media is None:
-        return [f'kws{dc}-1.{base}', f'kws{dc}.{base}']
-    if is_media:
-        return [f'kws{dc}-1.{base}', f'kws{dc}.{base}']
-    return [f'kws{dc}.{base}', f'kws{dc}-1.{base}']
-
-
-class Stats:
-    def __init__(self):
-        self.connections_total = 0
-        self.connections_ws = 0
-        self.connections_tcp_fallback = 0
-        self.connections_http_rejected = 0
-        self.connections_passthrough = 0
-        self.ws_errors = 0
-        self.bytes_up = 0
-        self.bytes_down = 0
-
-    def summary(self) -> str:
-        return (f"total={self.connections_total} ws={self.connections_ws} "
-                f"tcp_fb={self.connections_tcp_fallback} "
-                f"http_skip={self.connections_http_rejected} "
-                f"pass={self.connections_passthrough} "
-                f"err={self.ws_errors} "
-                f"up={_human_bytes(self.bytes_up)} "
-                f"down={_human_bytes(self.bytes_down)}")
-
-
-_stats = Stats()
-
-
-async def _bridge_ws(reader, writer, ws: RawWebSocket, label,
-                     dc=None, dst=None, port=None, is_media=False):
-    """Bidirectional TCP <-> WebSocket forwarding."""
-    dc_tag = f"DC{dc}{'m' if is_media else ''}" if dc else "DC?"
-    dst_tag = f"{dst}:{port}" if dst else "?"
-
-    up_bytes = 0
-    down_bytes = 0
-    up_packets = 0
-    down_packets = 0
-    start_time = asyncio.get_event_loop().time()
-
-    async def tcp_to_ws():
-        nonlocal up_bytes, up_packets
-        try:
-            while True:
-                chunk = await reader.read(65536)
-                if not chunk:
-                    break
-                _stats.bytes_up += len(chunk)
-                up_bytes += len(chunk)
-                up_packets += 1
-                await ws.send(chunk)
-        except (asyncio.CancelledError, ConnectionError, OSError):
-            return
-        except Exception as e:
-            log.debug("[%s] tcp->ws ended: %s", label, e)
-
-    async def ws_to_tcp():
-        nonlocal down_bytes, down_packets
-        try:
-            while True:
-                data = await ws.recv()
-                if data is None:
-                    break
-                _stats.bytes_down += len(data)
-                down_bytes += len(data)
-                down_packets += 1
-                writer.write(data)
-                await writer.drain()
-        except (asyncio.CancelledError, ConnectionError, OSError):
-            return
-        except Exception as e:
-            log.debug("[%s] ws->tcp ended: %s", label, e)
-
-    tasks = [asyncio.create_task(tcp_to_ws()),
-             asyncio.create_task(ws_to_tcp())]
-    try:
-        await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
-    finally:
-        for t in tasks:
-            t.cancel()
-        for t in tasks:
-            try:
-                await t
-            except BaseException:
-                pass
-        elapsed = asyncio.get_event_loop().time() - start_time
-        log.info("[%s] %s (%s) WS session closed: "
-                 "^%s (%d pkts) v%s (%d pkts) in %.1fs",
-                 label, dc_tag, dst_tag,
-                 _human_bytes(up_bytes), up_packets,
-                 _human_bytes(down_bytes), down_packets,
-                 elapsed)
-        try:
-            await ws.close()
-        except BaseException:
-            pass
-        try:
-            writer.close()
-            await writer.wait_closed()
-        except BaseException:
-            pass
-
-
-async def _bridge_tcp(reader, writer, remote_reader, remote_writer,
-                      label, dc=None, dst=None, port=None,
-                      is_media=False):
-    """Bidirectional TCP <-> TCP forwarding (for fallback)."""
-    async def forward(src, dst_w, tag):
-        try:
-            while True:
-                data = await src.read(65536)
-                if not data:
-                    break
-                if 'up' in tag:
-                    _stats.bytes_up += len(data)
-                else:
-                    _stats.bytes_down += len(data)
-                dst_w.write(data)
-                await dst_w.drain()
-        except asyncio.CancelledError:
-            pass
-        except Exception as e:
-            log.debug("[%s] %s ended: %s", label, tag, e)
-
-    tasks = [
-        asyncio.create_task(forward(reader, remote_writer, 'up')),
-        asyncio.create_task(forward(remote_reader, writer, 'down')),
-    ]
-    try:
-        await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
-    finally:
-        for t in tasks:
-            t.cancel()
-        for t in tasks:
-            try:
-                await t
-            except BaseException:
-                pass
-        for w in (writer, remote_writer):
-            try:
-                w.close()
-                await w.wait_closed()
-            except BaseException:
-                pass
-
-
-async def _pipe(r, w):
-    """Plain TCP relay for non-Telegram traffic."""
-    try:
-        while True:
-            data = await r.read(65536)
-            if not data:
-                break
-            w.write(data)
-            await w.drain()
-    except asyncio.CancelledError:
-        pass
-    except Exception:
-        pass
-    finally:
-        try:
-            w.close()
-            await w.wait_closed()
-        except Exception:
-            pass
-
-
-def _socks5_reply(status):
-    return bytes([0x05, status, 0x00, 0x01]) + b'\x00' * 6
-
-
-async def _tcp_fallback(reader, writer, dst, port, init, label,
-                        dc=None, is_media=False):
-    """
-    Fall back to direct TCP to the original DC IP.
-    Throttled by ISP, but functional.  Returns True on success.
-    """
-    try:
-        rr, rw = await asyncio.wait_for(
-            asyncio.open_connection(dst, port), timeout=10)
-    except Exception as exc:
-        log.warning("[%s] TCP fallback connect to %s:%d failed: %s",
-                    label, dst, port, exc)
-        return False
-
-    _stats.connections_tcp_fallback += 1
-    rw.write(init)
-    await rw.drain()
-    await _bridge_tcp(reader, writer, rr, rw, label,
-                      dc=dc, dst=dst, port=port, is_media=is_media)
-    return True
-
-
-async def _handle_client(reader, writer):
-    _stats.connections_total += 1
-    peer = writer.get_extra_info('peername')
-    label = f"{peer[0]}:{peer[1]}" if peer else "?"
-
-    try:
-        # -- SOCKS5 greeting --
-        hdr = await asyncio.wait_for(reader.readexactly(2), timeout=10)
-        if hdr[0] != 5:
-            log.debug("[%s] not SOCKS5 (ver=%d)", label, hdr[0])
-            writer.close()
-            return
-        nmethods = hdr[1]
-        await reader.readexactly(nmethods)
-        writer.write(b'\x05\x00')  # no-auth
-        await writer.drain()
-
-        # -- SOCKS5 CONNECT request --
-        req = await asyncio.wait_for(reader.readexactly(4), timeout=10)
-        _ver, cmd, _rsv, atyp = req
-        if cmd != 1:
-            writer.write(_socks5_reply(0x07))
-            await writer.drain()
-            writer.close()
-            return
-
-        if atyp == 1:  # IPv4
-            raw = await reader.readexactly(4)
-            dst = _socket.inet_ntoa(raw)
-        elif atyp == 3:  # domain
-            dlen = (await reader.readexactly(1))[0]
-            dst = (await reader.readexactly(dlen)).decode()
-        elif atyp == 4:  # IPv6
-            raw = await reader.readexactly(16)
-            dst = _socket.inet_ntop(_socket.AF_INET6, raw)
-        else:
-            writer.write(_socks5_reply(0x08))
-            await writer.drain()
-            writer.close()
-            return
-
-        port = struct.unpack('!H', await reader.readexactly(2))[0]
-
-        # -- Non-Telegram IP -> direct passthrough --
-        if not _is_telegram_ip(dst):
-            _stats.connections_passthrough += 1
-            log.debug("[%s] passthrough -> %s:%d", label, dst, port)
-            try:
-                rr, rw = await asyncio.wait_for(
-                    asyncio.open_connection(dst, port), timeout=10)
-            except Exception as exc:
-                log.warning("[%s] passthrough failed: %s", label, exc)
-                writer.write(_socks5_reply(0x05))
-                await writer.drain()
-                writer.close()
-                return
-
-            writer.write(_socks5_reply(0x00))
-            await writer.drain()
-
-            tasks = [asyncio.create_task(_pipe(reader, rw)),
-                     asyncio.create_task(_pipe(rr, writer))]
-            await asyncio.wait(tasks,
-                               return_when=asyncio.FIRST_COMPLETED)
-            for t in tasks:
-                t.cancel()
-            for t in tasks:
-                try:
-                    await t
-                except BaseException:
-                    pass
-            return
-
-        # -- Telegram DC: accept SOCKS, read init --
-        writer.write(_socks5_reply(0x00))
-        await writer.drain()
-
-        try:
-            init = await asyncio.wait_for(
-                reader.readexactly(64), timeout=15)
-        except asyncio.IncompleteReadError:
-            log.debug("[%s] client disconnected before init", label)
-            return
-
-        # HTTP transport -> reject
-        if _is_http_transport(init):
-            _stats.connections_http_rejected += 1
-            log.debug("[%s] HTTP transport to %s:%d (rejected)",
-                      label, dst, port)
-            writer.close()
-            return
-
-        # -- Extract DC ID --
-        dc, is_media = _dc_from_init(init)
-        if dc is None or dc not in _dc_opt:
-            log.warning("[%s] unknown DC%s for %s:%d -> TCP passthrough",
-                        label, dc, dst, port)
-            await _tcp_fallback(reader, writer, dst, port, init, label)
-            return
-
-        dc_key = (dc, is_media if is_media is not None else True)
-        now = time.monotonic()
-        media_tag = (" media" if is_media
-                     else (" media?" if is_media is None else ""))
-
-        # -- WS blacklist check --
-        if dc_key in _ws_blacklist:
-            log.debug("[%s] DC%d%s WS blacklisted -> TCP %s:%d",
-                      label, dc, media_tag, dst, port)
-            ok = await _tcp_fallback(reader, writer, dst, port, init,
-                                     label, dc=dc, is_media=is_media)
-            if ok:
-                log.info("[%s] DC%d%s TCP fallback closed",
-                         label, dc, media_tag)
-            return
-
-        # -- Cooldown check --
-        fail_until = _dc_fail_until.get(dc_key, 0)
-        if now < fail_until:
-            remaining = fail_until - now
-            log.debug("[%s] DC%d%s WS cooldown (%.0fs) -> TCP",
-                      label, dc, media_tag, remaining)
-            ok = await _tcp_fallback(reader, writer, dst, port, init,
-                                     label, dc=dc, is_media=is_media)
-            if ok:
-                log.info("[%s] DC%d%s TCP fallback closed",
-                         label, dc, media_tag)
-            return
-
-        # -- Try WebSocket via direct connection --
-        domains = _ws_domains(dc, is_media)
-        target = _dc_opt[dc]
-        ws = None
-        ws_failed_redirect = False
-        all_redirects = True
-
-        for domain in domains:
-            url = f'wss://{domain}/apiws'
-            log.info("[%s] DC%d%s (%s:%d) -> %s via %s",
-                     label, dc, media_tag, dst, port, url, target)
-            try:
-                ws = await RawWebSocket.connect(target, domain,
-                                                timeout=10)
-                all_redirects = False
-                break
-            except WsHandshakeError as exc:
-                _stats.ws_errors += 1
-                if exc.is_redirect:
-                    ws_failed_redirect = True
-                    log.warning("[%s] DC%d%s got %d from %s -> %s",
-                                label, dc, media_tag,
-                                exc.status_code, domain,
-                                exc.location or '?')
-                    continue
-                else:
-                    all_redirects = False
-                    log.warning("[%s] DC%d%s WS handshake: %s",
-                                label, dc, media_tag, exc.status_line)
-            except Exception as exc:
-                _stats.ws_errors += 1
-                all_redirects = False
-                err_str = str(exc)
-                if ('CERTIFICATE_VERIFY_FAILED' in err_str or
-                        'Hostname mismatch' in err_str):
-                    log.warning("[%s] DC%d%s SSL error: %s",
-                                label, dc, media_tag, exc)
-                else:
-                    log.warning("[%s] DC%d%s WS connect failed: %s",
-                                label, dc, media_tag, exc)
-
-        # -- WS failed -> fallback --
-        if ws is None:
-            if ws_failed_redirect and all_redirects:
-                _ws_blacklist.add(dc_key)
-                log.warning(
-                    "[%s] DC%d%s blacklisted for WS (all 302)",
-                    label, dc, media_tag)
-            elif ws_failed_redirect:
-                _dc_fail_until[dc_key] = now + _DC_FAIL_COOLDOWN
-            else:
-                _dc_fail_until[dc_key] = now + _DC_FAIL_COOLDOWN
-                log.info("[%s] DC%d%s WS cooldown for %ds",
-                         label, dc, media_tag, int(_DC_FAIL_COOLDOWN))
-
-            log.info("[%s] DC%d%s -> TCP fallback to %s:%d",
-                     label, dc, media_tag, dst, port)
-            ok = await _tcp_fallback(reader, writer, dst, port, init,
-                                     label, dc=dc, is_media=is_media)
-            if ok:
-                log.info("[%s] DC%d%s TCP fallback closed",
-                         label, dc, media_tag)
-            return
-
-        # -- WS success --
-        _dc_fail_until.pop(dc_key, None)
-        _stats.connections_ws += 1
-
-        # Send the buffered init packet
-        await ws.send(init)
-
-        # Bidirectional bridge
-        await _bridge_ws(reader, writer, ws, label,
-                         dc=dc, dst=dst, port=port, is_media=is_media)
-
-    except asyncio.TimeoutError:
-        log.warning("[%s] timeout during SOCKS5 handshake", label)
-    except asyncio.IncompleteReadError:
-        log.debug("[%s] client disconnected", label)
-    except asyncio.CancelledError:
-        log.debug("[%s] cancelled", label)
-    except ConnectionResetError:
-        log.debug("[%s] connection reset", label)
-    except Exception as exc:
-        log.error("[%s] unexpected: %s", label, exc)
-    finally:
-        try:
-            writer.close()
-        except BaseException:
-            pass
-
-
-_server_instance = None
-_server_stop_event = None
-
-
-async def _run(port: int, dc_opt: Dict[int, Optional[str]],
-               stop_event: Optional[asyncio.Event] = None):
-    global _dc_opt, _server_instance, _server_stop_event
-    _dc_opt = dc_opt
-    _server_stop_event = stop_event
-
-    server = await asyncio.start_server(
-        _handle_client, '127.0.0.1', port)
-    _server_instance = server
-
-    log.info("=" * 60)
-    log.info("  Telegram WS Bridge Proxy")
-    log.info("  Listening on   127.0.0.1:%d", port)
-    log.info("  Target DC IPs:")
-    for dc in dc_opt.keys():
-        ip = dc_opt.get(dc)
-        log.info("    DC%d: %s", dc, ip)
-    log.info("=" * 60)
-    log.info("  Configure Telegram Desktop:")
-    log.info("    SOCKS5 proxy -> 127.0.0.1:%d  (no user/pass)", port)
-    log.info("=" * 60)
-
-    async def log_stats():
-        while True:
-            await asyncio.sleep(60)
-            bl = ', '.join(
-                f'DC{d}{"m" if m else ""}'
-                for d, m in sorted(_ws_blacklist)) or 'none'
-            log.info("stats: %s | ws_bl: %s", _stats.summary(), bl)
-
-    asyncio.create_task(log_stats())
-
-    if stop_event:
-        async def wait_stop():
-            await stop_event.wait()
-            server.close()
-            me = asyncio.current_task()
-            for task in list(asyncio.all_tasks()):
-                if task is not me:
-                    task.cancel()
-            try:
-                await server.wait_closed()
-            except asyncio.CancelledError:
-                pass
-        asyncio.create_task(wait_stop())
-
-    async with server:
-        try:
-            await server.serve_forever()
-        except asyncio.CancelledError:
-            pass
-    _server_instance = None
-
-
-def parse_dc_ip_list(dc_ip_list: List[str]) -> Dict[int, str]:
-    """Parse list of 'DC:IP' strings into {dc: ip} dict."""
-    dc_opt: Dict[int, str] = {}
-    for entry in dc_ip_list:
-        if ':' not in entry:
-            raise ValueError(f"Invalid --dc-ip format {entry!r}, expected DC:IP")
-        dc_s, ip_s = entry.split(':', 1)
-        try:
-            dc_n = int(dc_s)
-            _socket.inet_aton(ip_s)
-        except (ValueError, OSError):
-            raise ValueError(f"Invalid --dc-ip {entry!r}")
-        dc_opt[dc_n] = ip_s
-    return dc_opt
-
-
-def run_proxy(port: int, dc_opt: Dict[int, str],
-              stop_event: Optional[asyncio.Event] = None):
-    """Run the proxy (blocking). Can be called from threads."""
-    asyncio.run(_run(port, dc_opt, stop_event))
-
-
-def main():
-    ap = argparse.ArgumentParser(
-        description='Telegram Desktop WebSocket Bridge Proxy')
-    ap.add_argument('--port', type=int, default=DEFAULT_PORT,
-                    help=f'Listen port (default {DEFAULT_PORT})')
-    ap.add_argument('--dc-ip', metavar='DC:IP', action='append',
-                    default=['2:149.154.167.220', '4:149.154.167.220'],
-                    help='Target IP for a DC, e.g. --dc-ip 1:149.154.175.205'
-                         ' --dc-ip 2:149.154.167.220')
-    ap.add_argument('-v', '--verbose', action='store_true',
-                    help='Debug logging')
-    args = ap.parse_args()
-
-    try:
-        dc_opt = parse_dc_ip_list(args.dc_ip)
-    except ValueError as e:
-        log.error(str(e))
-        sys.exit(1)
-
-    logging.basicConfig(
-        level=logging.DEBUG if args.verbose else logging.INFO,
-        format='%(asctime)s  %(levelname)-5s  %(message)s',
-        datefmt='%H:%M:%S',
-    )
-
-    try:
-        asyncio.run(_run(args.port, dc_opt))
-    except KeyboardInterrupt:
-        log.info("Shutting down. Final stats: %s", _stats.summary())
-
-
-if __name__ == '__main__':
-    main()

tg_ws_tray.py

@@ -1,604 +0,0 @@
-from __future__ import annotations
-
-import ctypes
-import json
-import logging
-import os
-import psutil
-import sys
-import threading
-import time
-import webbrowser
-import asyncio as _asyncio
-from pathlib import Path
-from typing import Dict, List, Optional
-
-try:
-    from PIL import Image, ImageDraw, ImageFont
-except ImportError:
-    Image = ImageDraw = ImageFont = None  # type: ignore
-
-try:
-    import pystray
-except ImportError:
-    pystray = None  # type: ignore
-
-try:
-    import customtkinter as ctk
-except ImportError:
-    ctk = None  # type: ignore
-
-# Proxy engine
-import tg_ws_proxy
-
-
-APP_NAME = "TgWsProxy"
-APP_DIR = Path(os.environ.get("APPDATA", Path.home())) / APP_NAME
-CONFIG_FILE = APP_DIR / "config.json"
-LOG_FILE = APP_DIR / "proxy.log"
-FIRST_RUN_MARKER = APP_DIR / ".first_run_done"
-
-
-DEFAULT_CONFIG = {
-    "port": 1080,
-    "dc_ip": ["2:149.154.167.220", "4:149.154.167.220"],
-    "verbose": False,
-}
-
-
-_proxy_thread: Optional[threading.Thread] = None
-_stop_event: Optional[threading.Event] = None
-_async_stop: Optional[object] = None
-_tray_icon: Optional[object] = None
-_config: dict = {}
-_exiting: bool = False
-
-log = logging.getLogger("tg-ws-tray")
-
-
-def is_already_running():
-    current_proc = os.path.basename(sys.argv[0])
-    count = 0
-    for process in psutil.process_iter(['name']):
-        if process.info['name'] == current_proc:
-            count += 1
-    return count > 2
-
-
-def _ensure_dirs():
-    APP_DIR.mkdir(parents=True, exist_ok=True)
-
-
-def load_config() -> dict:
-    _ensure_dirs()
-    if CONFIG_FILE.exists():
-        try:
-            with open(CONFIG_FILE, "r", encoding="utf-8") as f:
-                data = json.load(f)
-            # Merge with defaults for missing keys
-            for k, v in DEFAULT_CONFIG.items():
-                data.setdefault(k, v)
-            return data
-        except Exception as exc:
-            log.warning("Failed to load config: %s", exc)
-    return dict(DEFAULT_CONFIG)
-
-
-def save_config(cfg: dict):
-    _ensure_dirs()
-    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
-        json.dump(cfg, f, indent=2, ensure_ascii=False)
-
-
-def setup_logging(verbose: bool = False):
-    _ensure_dirs()
-    root = logging.getLogger()
-    root.setLevel(logging.DEBUG if verbose else logging.INFO)
-
-    fh = logging.FileHandler(str(LOG_FILE), encoding="utf-8")
-    fh.setLevel(logging.DEBUG)
-    fh.setFormatter(logging.Formatter(
-        "%(asctime)s  %(levelname)-5s  %(name)s  %(message)s",
-        datefmt="%Y-%m-%d %H:%M:%S"))
-    root.addHandler(fh)
-
-    if not getattr(sys, "frozen", False):
-        ch = logging.StreamHandler(sys.stdout)
-        ch.setLevel(logging.DEBUG if verbose else logging.INFO)
-        ch.setFormatter(logging.Formatter(
-            "%(asctime)s  %(levelname)-5s  %(message)s",
-            datefmt="%H:%M:%S"))
-        root.addHandler(ch)
-
-
-def _make_icon_image(size: int = 64):
-    """Create a simple tray icon: blue circle with a white 'T' letter."""
-    if Image is None:
-        raise RuntimeError("Pillow is required for tray icon")
-    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
-    draw = ImageDraw.Draw(img)
-    
-    # Blue circle
-    margin = 2
-    draw.ellipse([margin, margin, size - margin, size - margin],
-                 fill=(0, 136, 204, 255))
-                 
-    # White "T"
-    try:
-        font = ImageFont.truetype("arial.ttf", size=int(size * 0.55))
-    except Exception:
-        font = ImageFont.load_default()
-    bbox = draw.textbbox((0, 0), "T", font=font)
-    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
-    tx = (size - tw) // 2 - bbox[0]
-    ty = (size - th) // 2 - bbox[1]
-    draw.text((tx, ty), "T", fill=(255, 255, 255, 255), font=font)
-
-    return img
-
-
-def _load_icon():
-    """Load icon from file or generate one."""
-    icon_path = Path(__file__).parent / "icon.ico"
-    if icon_path.exists() and Image:
-        try:
-            return Image.open(str(icon_path))
-        except Exception:
-            pass
-    return _make_icon_image()
-
-
-
-def _run_proxy_thread(port: int, dc_opt: Dict[int, str], verbose: bool):
-    """Target for the proxy thread — runs asyncio event loop."""
-    global _async_stop
-    loop = _asyncio.new_event_loop()
-    _asyncio.set_event_loop(loop)
-    stop_ev = _asyncio.Event()
-    _async_stop = (loop, stop_ev)
-
-    try:
-        loop.run_until_complete(
-            tg_ws_proxy._run(port, dc_opt, stop_event=stop_ev))
-    except Exception as exc:
-        log.error("Proxy thread crashed: %s", exc)
-    finally:
-        loop.close()
-        _async_stop = None
-
-
-def start_proxy():
-    global _proxy_thread, _config
-    if _proxy_thread and _proxy_thread.is_alive():
-        log.info("Proxy already running")
-        return
-
-    cfg = _config
-    port = cfg.get("port", DEFAULT_CONFIG["port"])
-    dc_ip_list = cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])
-    verbose = cfg.get("verbose", False)
-
-    try:
-        dc_opt = tg_ws_proxy.parse_dc_ip_list(dc_ip_list)
-    except ValueError as e:
-        log.error("Bad config dc_ip: %s", e)
-        _show_error(f"Ошибка конфигурации:\n{e}")
-        return
-
-    log.info("Starting proxy on port %d ...", port)
-    _proxy_thread = threading.Thread(
-        target=_run_proxy_thread,
-        args=(port, dc_opt, verbose),
-        daemon=True, name="proxy")
-    _proxy_thread.start()
-
-
-def stop_proxy():
-    global _proxy_thread, _async_stop
-    if _async_stop:
-        loop, stop_ev = _async_stop
-        loop.call_soon_threadsafe(stop_ev.set)
-        if _proxy_thread:
-            _proxy_thread.join(timeout=2)
-    _proxy_thread = None
-    log.info("Proxy stopped")
-
-
-def restart_proxy():
-    log.info("Restarting proxy...")
-    stop_proxy()
-    time.sleep(0.3)
-    start_proxy()
-
-
-def _show_error(text: str, title: str = "TG WS Proxy — Ошибка"):
-    ctypes.windll.user32.MessageBoxW(0, text, title, 0x10)
-
-
-def _show_info(text: str, title: str = "TG WS Proxy"):
-    ctypes.windll.user32.MessageBoxW(0, text, title, 0x40)
-
-
-def _on_open_in_telegram(icon=None, item=None):
-    port = _config.get("port", DEFAULT_CONFIG["port"])
-    url = f"tg://socks?server=127.0.0.1&port={port}"
-    log.info("Opening %s", url)
-    try:
-        result = webbrowser.open(url)
-        if not result:
-            raise RuntimeError("webbrowser.open returned False")
-    except Exception:
-        log.info("Browser open failed, copying to clipboard")
-        try:
-            _copy_to_clipboard(url)
-            _show_info(
-                f"Не удалось открыть Telegram автоматически.\n\n"
-                f"Ссылка скопирована в буфер обмена, отправьте её в телеграмм и нажмите по ней ЛКМ:\n{url}",
-                "TG WS Proxy")
-        except Exception as exc:
-            log.error("Clipboard copy failed: %s", exc)
-            _show_error(f"Не удалось скопировать ссылку:\n{exc}")
-
-
-def _copy_to_clipboard(text: str):
-    """Copy text to Windows clipboard using ctypes."""
-    import ctypes.wintypes
-    CF_UNICODETEXT = 13
-    kernel32 = ctypes.windll.kernel32
-    user32 = ctypes.windll.user32
-
-    user32.OpenClipboard(0)
-    user32.EmptyClipboard()
-
-    encoded = text.encode("utf-16-le") + b"\x00\x00"
-    h = kernel32.GlobalAlloc(0x0042, len(encoded))  # GMEM_MOVEABLE | GMEM_ZEROINIT
-    p = kernel32.GlobalLock(h)
-    ctypes.memmove(p, encoded, len(encoded))
-    kernel32.GlobalUnlock(h)
-    user32.SetClipboardData(CF_UNICODETEXT, h)
-    user32.CloseClipboard()
-
-
-def _on_restart(icon=None, item=None):
-    threading.Thread(target=restart_proxy, daemon=True).start()
-
-
-def _on_edit_config(icon=None, item=None):
-    """Open a simple dialog to edit config."""
-    threading.Thread(target=_edit_config_dialog, daemon=True).start()
-
-
-def _edit_config_dialog():
-    if ctk is None:
-        _show_error("customtkinter не установлен.")
-        return
-
-    cfg = dict(_config)
-
-    ctk.set_appearance_mode("light")
-    ctk.set_default_color_theme("blue")
-
-    root = ctk.CTk()
-    root.title("TG WS Proxy — Настройки")
-    root.resizable(False, False)
-    root.attributes("-topmost", True)
-
-    TG_BLUE = "#3390ec"
-    TG_BLUE_HOVER = "#2b7cd4"
-    BG = "#ffffff"
-    FIELD_BG = "#f0f2f5"
-    FIELD_BORDER = "#d6d9dc"
-    TEXT_PRIMARY = "#000000"
-    TEXT_SECONDARY = "#707579"
-    FONT_FAMILY = "Segoe UI"
-
-    w, h = 420, 400
-    sw = root.winfo_screenwidth()
-    sh = root.winfo_screenheight()
-    root.geometry(f"{w}x{h}+{(sw-w)//2}+{(sh-h)//2}")
-    root.configure(fg_color=BG)
-
-    frame = ctk.CTkFrame(root, fg_color=BG, corner_radius=0)
-    frame.pack(fill="both", expand=True, padx=24, pady=20)
-
-    # Port
-    ctk.CTkLabel(frame, text="Порт прокси",
-                 font=(FONT_FAMILY, 13), text_color=TEXT_PRIMARY,
-                 anchor="w").pack(anchor="w", pady=(0, 4))
-    port_var = ctk.StringVar(value=str(cfg.get("port", 1080)))
-    port_entry = ctk.CTkEntry(frame, textvariable=port_var, width=120, height=36,
-                              font=(FONT_FAMILY, 13), corner_radius=10,
-                              fg_color=FIELD_BG, border_color=FIELD_BORDER,
-                              border_width=1, text_color=TEXT_PRIMARY)
-    port_entry.pack(anchor="w", pady=(0, 12))
-
-    # DC-IP mappings
-    ctk.CTkLabel(frame, text="DC → IP маппинги (по одному на строку, формат DC:IP)",
-                 font=(FONT_FAMILY, 13), text_color=TEXT_PRIMARY,
-                 anchor="w").pack(anchor="w", pady=(0, 4))
-    dc_textbox = ctk.CTkTextbox(frame, width=370, height=120,
-                                font=("Consolas", 12), corner_radius=10,
-                                fg_color=FIELD_BG, border_color=FIELD_BORDER,
-                                border_width=1, text_color=TEXT_PRIMARY)
-    dc_textbox.pack(anchor="w", pady=(0, 12))
-    dc_textbox.insert("1.0", "\n".join(cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])))
-
-    # Verbose
-    verbose_var = ctk.BooleanVar(value=cfg.get("verbose", False))
-    ctk.CTkCheckBox(frame, text="Подробное логирование (verbose)",
-                    variable=verbose_var, font=(FONT_FAMILY, 13),
-                    text_color=TEXT_PRIMARY,
-                    fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                    corner_radius=6, border_width=2,
-                    border_color=FIELD_BORDER).pack(anchor="w", pady=(0, 8))
-
-    # Info label
-    ctk.CTkLabel(frame, text="Изменения вступят в силу после перезапуска прокси.",
-                 font=(FONT_FAMILY, 11), text_color=TEXT_SECONDARY,
-                 anchor="w").pack(anchor="w", pady=(0, 16))
-
-    def on_save():
-        try:
-            port_val = int(port_var.get().strip())
-            if not (1 <= port_val <= 65535):
-                raise ValueError
-        except ValueError:
-            _show_error("Порт должен быть числом 1-65535")
-            return
-
-        lines = [l.strip() for l in dc_textbox.get("1.0", "end").strip().splitlines()
-                 if l.strip()]
-        try:
-            tg_ws_proxy.parse_dc_ip_list(lines)
-        except ValueError as e:
-            _show_error(str(e))
-            return
-
-        new_cfg = {
-            "port": port_val,
-            "dc_ip": lines,
-            "verbose": verbose_var.get(),
-        }
-        save_config(new_cfg)
-        _config.update(new_cfg)
-        log.info("Config saved: %s", new_cfg)
-
-        from tkinter import messagebox
-        if messagebox.askyesno("Перезапустить?",
-                               "Настройки сохранены.\n\n"
-                               "Перезапустить прокси сейчас?",
-                               parent=root):
-            root.destroy()
-            restart_proxy()
-        else:
-            root.destroy()
-
-    def on_cancel():
-        root.destroy()
-
-    btn_frame = ctk.CTkFrame(frame, fg_color="transparent")
-    btn_frame.pack(fill="x")
-    ctk.CTkButton(btn_frame, text="Сохранить", width=140, height=38,
-                  font=(FONT_FAMILY, 14, "bold"), corner_radius=10,
-                  fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                  text_color="#ffffff",
-                  command=on_save).pack(side="left", padx=(0, 10))
-    ctk.CTkButton(btn_frame, text="Отмена", width=140, height=38,
-                  font=(FONT_FAMILY, 14), corner_radius=10,
-                  fg_color=FIELD_BG, hover_color=FIELD_BORDER,
-                  text_color=TEXT_PRIMARY, border_width=1,
-                  border_color=FIELD_BORDER,
-                  command=on_cancel).pack(side="left")
-
-    root.mainloop()
-
-
-def _on_open_logs(icon=None, item=None):
-    log.info("Opening log file: %s", LOG_FILE)
-    if LOG_FILE.exists():
-        os.startfile(str(LOG_FILE))
-    else:
-        _show_info("Файл логов ещё не создан.", "TG WS Proxy")
-
-
-def _on_exit(icon=None, item=None):
-    global _exiting
-    if _exiting:
-        os._exit(0)
-        return
-    _exiting = True
-    log.info("User requested exit")
-
-    def _force_exit():
-        time.sleep(3)
-        os._exit(0)
-    threading.Thread(target=_force_exit, daemon=True, name="force-exit").start()
-
-    if icon:
-        icon.stop()
-
-
-
-def _show_first_run():
-    _ensure_dirs()
-    if FIRST_RUN_MARKER.exists():
-        return
-
-    port = _config.get("port", DEFAULT_CONFIG["port"])
-    tg_url = f"tg://socks?server=127.0.0.1&port={port}"
-
-    if ctk is None:
-        FIRST_RUN_MARKER.touch()
-        return
-
-    ctk.set_appearance_mode("light")
-    ctk.set_default_color_theme("blue")
-
-    TG_BLUE = "#3390ec"
-    TG_BLUE_HOVER = "#2b7cd4"
-    BG = "#ffffff"
-    FIELD_BG = "#f0f2f5"
-    FIELD_BORDER = "#d6d9dc"
-    TEXT_PRIMARY = "#000000"
-    TEXT_SECONDARY = "#707579"
-    FONT_FAMILY = "Segoe UI"
-
-    root = ctk.CTk()
-    root.title("TG WS Proxy")
-    root.resizable(False, False)
-    root.attributes("-topmost", True)
-
-    w, h = 520, 440
-    sw = root.winfo_screenwidth()
-    sh = root.winfo_screenheight()
-    root.geometry(f"{w}x{h}+{(sw-w)//2}+{(sh-h)//2}")
-    root.configure(fg_color=BG)
-
-    frame = ctk.CTkFrame(root, fg_color=BG, corner_radius=0)
-    frame.pack(fill="both", expand=True, padx=28, pady=24)
-
-    title_frame = ctk.CTkFrame(frame, fg_color="transparent")
-    title_frame.pack(anchor="w", pady=(0, 16), fill="x")
-
-    # Blue accent bar
-    accent_bar = ctk.CTkFrame(title_frame, fg_color=TG_BLUE,
-                              width=4, height=32, corner_radius=2)
-    accent_bar.pack(side="left", padx=(0, 12))
-
-    ctk.CTkLabel(title_frame, text="Прокси запущен и работает в системном трее",
-                 font=(FONT_FAMILY, 17, "bold"),
-                 text_color=TEXT_PRIMARY).pack(side="left")
-
-    # Info sections
-    sections = [
-        ("Как подключить Telegram Desktop:", True),
-        ("  Автоматически:", True),
-        (f"  ПКМ по иконке в трее → «Открыть в Telegram»", False),
-        (f"  Или ссылка: {tg_url}", False),
-        ("\n  Вручную:", True),
-        ("  Настройки → Продвинутые → Тип подключения → Прокси", False),
-        (f"  SOCKS5 → 127.0.0.1 : {port} (без логина/пароля)", False),
-    ]
-
-    for text, bold in sections:
-        weight = "bold" if bold else "normal"
-        ctk.CTkLabel(frame, text=text,
-                     font=(FONT_FAMILY, 13, weight),
-                     text_color=TEXT_PRIMARY,
-                     anchor="w", justify="left").pack(anchor="w", pady=1)
-
-    # Spacer
-    ctk.CTkFrame(frame, fg_color="transparent", height=16).pack()
-
-    # Separator
-    ctk.CTkFrame(frame, fg_color=FIELD_BORDER, height=1,
-                 corner_radius=0).pack(fill="x", pady=(0, 12))
-
-    # Checkbox
-    auto_var = ctk.BooleanVar(value=True)
-    ctk.CTkCheckBox(frame, text="Открыть прокси в Telegram сейчас",
-                    variable=auto_var, font=(FONT_FAMILY, 13),
-                    text_color=TEXT_PRIMARY,
-                    fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                    corner_radius=6, border_width=2,
-                    border_color=FIELD_BORDER).pack(anchor="w", pady=(0, 16))
-
-    def on_ok():
-        FIRST_RUN_MARKER.touch()
-        open_tg = auto_var.get()
-        root.destroy()
-        if open_tg:
-            _on_open_in_telegram()
-
-    ctk.CTkButton(frame, text="Начать", width=180, height=42,
-                  font=(FONT_FAMILY, 15, "bold"), corner_radius=10,
-                  fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                  text_color="#ffffff",
-                  command=on_ok).pack(pady=(0, 0))
-
-    root.protocol("WM_DELETE_WINDOW", on_ok)
-    root.mainloop()
-
-
-def _build_menu():
-    if pystray is None:
-        return None
-    port = _config.get("port", DEFAULT_CONFIG["port"])
-    return pystray.Menu(
-        pystray.MenuItem(
-            f"Открыть в Telegram (:{port})",
-            _on_open_in_telegram,
-            default=True),
-        pystray.Menu.SEPARATOR,
-        pystray.MenuItem("Перезапустить прокси", _on_restart),
-        pystray.MenuItem("Настройки...", _on_edit_config),
-        pystray.MenuItem("Открыть логи", _on_open_logs),
-        pystray.Menu.SEPARATOR,
-        pystray.MenuItem("Выход", _on_exit),
-    )
-
-
-def run_tray():
-    global _tray_icon, _config
-
-    _config = load_config()
-    save_config(_config)
-
-    if LOG_FILE.exists():
-        try:
-            LOG_FILE.unlink()
-        except Exception:
-            pass
-
-    setup_logging(_config.get("verbose", False))
-    log.info("TG WS Proxy tray app starting")
-    log.info("Config: %s", _config)
-    log.info("Log file: %s", LOG_FILE)
-
-    if pystray is None or Image is None:
-        log.error("pystray or Pillow not installed; "
-                  "running in console mode")
-        start_proxy()
-        try:
-            while True:
-                time.sleep(1)
-        except KeyboardInterrupt:
-            stop_proxy()
-        return
-
-    start_proxy()
-
-    _show_first_run()
-
-    icon_image = _load_icon()
-    _tray_icon = pystray.Icon(
-        APP_NAME,
-        icon_image,
-        "TG WS Proxy",
-        menu=_build_menu())
-
-    log.info("Tray icon running")
-    _tray_icon.run()
-
-    stop_proxy()
-    log.info("Tray app exited")
-
-
-def main():
-    if is_already_running():
-        _show_info("Приложение уже запущено.", os.path.basename(sys.argv[0]))
-        return
-
-    # Hide console window if running as frozen exe
-    if getattr(sys, "frozen", False):
-        try:
-            ctypes.windll.user32.ShowWindow(
-                ctypes.windll.kernel32.GetConsoleWindow(), 0)
-        except Exception:
-            pass
-
-    run_tray()
-
-
-if __name__ == "__main__":
-    main()

ui/__init__.py

@@ -0,0 +1,4 @@
+"""
+Интерфейс tray (CustomTkinter): тема, диалоги настроек, подсказки.
+Ядро прокси — пакет `proxy`.
+"""

ui/ctk_theme.py

@@ -0,0 +1,111 @@
+from __future__ import annotations
+
+import sys
+import tkinter
+from dataclasses import dataclass
+from typing import Any, Callable, Optional, Tuple
+
+_tk_variable_del_guard_installed = False
+
+
+def install_tkinter_variable_del_guard() -> None:
+    global _tk_variable_del_guard_installed
+    if _tk_variable_del_guard_installed:
+        return
+    _orig = tkinter.Variable.__del__
+
+    def _safe_variable_del(self: Any, _orig: Any = _orig) -> None:
+        try:
+            _orig(self)
+        except (RuntimeError, tkinter.TclError):
+            pass
+
+    tkinter.Variable.__del__ = _safe_variable_del  # type: ignore[assignment]
+    _tk_variable_del_guard_installed = True
+
+CONFIG_DIALOG_SIZE: Tuple[int, int] = (460, 560)
+CONFIG_DIALOG_FRAME_PAD: Tuple[int, int] = (20, 14)
+FIRST_RUN_SIZE: Tuple[int, int] = (520, 480)
+FIRST_RUN_FRAME_PAD: Tuple[int, int] = (28, 24)
+
+
+@dataclass(frozen=True)
+class CtkTheme:
+    tg_blue: tuple = ("#3390ec", "#3390ec")
+    tg_blue_hover: tuple = ("#2b7cd4", "#2b7cd4")
+
+    bg: tuple = ("#ffffff", "#1e1e1e")
+    field_bg: tuple = ("#f0f2f5", "#2b2b2b")
+    field_border: tuple = ("#d6d9dc", "#3a3a3a")
+
+    text_primary: tuple = ("#000000", "#ffffff")
+    text_secondary: tuple = ("#707579", "#aaaaaa")
+
+    ui_font_family: str = "Sans"
+    mono_font_family: str = "Monospace"
+
+
+def ctk_theme_for_platform() -> CtkTheme:
+    if sys.platform == "win32":
+        return CtkTheme(ui_font_family="Segoe UI", mono_font_family="Consolas")
+    return CtkTheme()
+
+
+_APPEARANCE_MODE_MAP = {"auto": "system", "light": "Light", "dark": "Dark"}
+
+
+def apply_ctk_appearance(ctk: Any, mode: str = "auto") -> None:
+    ctk.set_appearance_mode(_APPEARANCE_MODE_MAP.get(mode, "system"))
+    ctk.set_default_color_theme("blue")
+
+def center_ctk_geometry(root: Any, width: int, height: int) -> None:
+    sw = root.winfo_screenwidth()
+    sh = root.winfo_screenheight()
+    root.geometry(f"{width}x{height}+{(sw - width) // 2}+{(sh - height) // 2}")
+
+
+def create_ctk_toplevel(
+    ctk: Any,
+    *,
+    title: str,
+    width: int,
+    height: int,
+    theme: CtkTheme,
+    topmost: bool = True,
+    after_create: Optional[Callable[[Any], None]] = None,
+) -> Any:
+    root = ctk.CTkToplevel()
+    root.title(title)
+    root.resizable(False, False)
+    center_ctk_geometry(root, width, height)
+    root.configure(fg_color=theme.bg)
+    if topmost:
+        root.attributes("-topmost", True)
+    root.lift()
+    root.focus_force()
+    if after_create:
+        _after_id = root.after(300, lambda: after_create(root))
+        _orig_destroy = root.destroy
+
+        def _safe_destroy():
+            try:
+                root.after_cancel(_after_id)
+            except Exception:
+                pass
+            _orig_destroy()
+
+        root.destroy = _safe_destroy
+    return root
+
+
+def main_content_frame(
+    ctk: Any,
+    root: Any,
+    theme: CtkTheme,
+    *,
+    padx: int,
+    pady: int,
+) -> Any:
+    frame = ctk.CTkFrame(root, fg_color=theme.bg, corner_radius=0)
+    frame.pack(fill="both", expand=True, padx=padx, pady=pady)
+    return frame

ui/ctk_tooltip.py

@@ -0,0 +1,109 @@
+from __future__ import annotations
+
+import tkinter as tk
+from typing import Any, List, Optional
+
+
+class CtkTooltip:
+    def __init__(
+        self,
+        widget: Any,
+        text: str,
+        *,
+        delay_ms: int = 450,
+        wraplength: int = 320,
+    ) -> None:
+        self.widget = widget
+        self.text = text
+        self.delay_ms = delay_ms
+        self.wraplength = wraplength
+        self._after_id: Optional[str] = None
+        self._tip: Optional[tk.Toplevel] = None
+        widget.bind("<Enter>", self._schedule, add="+")
+        widget.bind("<Leave>", self._hide, add="+")
+        widget.bind("<Button>", self._hide, add="+")
+        widget.bind("<Destroy>", self._on_destroy, add="+")
+
+    def _schedule(self, _event: Any = None) -> None:
+        if self.widget is None:
+            return
+        self._cancel_after()
+        self._after_id = self.widget.after(self.delay_ms, self._show)
+
+    def _cancel_after(self) -> None:
+        if self._after_id is not None:
+            try:
+                self.widget.after_cancel(self._after_id)
+            except Exception:
+                pass
+            self._after_id = None
+
+    def _show(self) -> None:
+        self._after_id = None
+        if self._tip is not None:
+            return
+        try:
+            if not self.widget.winfo_exists():
+                return
+        except Exception:
+            return
+
+        tw = tk.Toplevel(self.widget.winfo_toplevel())
+        tw.wm_overrideredirect(True)
+        try:
+            tw.wm_attributes("-topmost", True)
+        except Exception:
+            pass
+        tw.configure(bg="#2b2b2b")
+        lbl = tk.Label(
+            tw,
+            text=self.text,
+            justify="left",
+            wraplength=self.wraplength,
+            background="#2b2b2b",
+            foreground="#f0f0f0",
+            relief="flat",
+            borderwidth=0,
+            padx=10,
+            pady=8,
+            font=("Segoe UI", 10) if _is_windows() else None,
+        )
+        lbl.pack()
+        x = self.widget.winfo_rootx() + 12
+        y = self.widget.winfo_rooty() + self.widget.winfo_height() + 4
+        tw.wm_geometry(f"+{x}+{y}")
+        self._tip = tw
+
+    def _hide(self, _event: Any = None) -> None:
+        self._cancel_after()
+        if self._tip is not None:
+            try:
+                self._tip.destroy()
+            except Exception:
+                pass
+            self._tip = None
+
+    def _on_destroy(self, _event: Any = None) -> None:
+        self._hide()
+        self.widget = None
+
+
+def _is_windows() -> bool:
+    import sys
+
+    return sys.platform == "win32"
+
+
+def attach_ctk_tooltip(
+    widget: Any,
+    text: str,
+    *,
+    delay_ms: int = 450,
+    wraplength: int = 320,
+) -> None:
+    CtkTooltip(widget, text, delay_ms=delay_ms, wraplength=wraplength)
+
+
+def attach_tooltip_to_widgets(widgets: List[Any], text: str, **kwargs: Any) -> None:
+    for w in widgets:
+        attach_ctk_tooltip(w, text, **kwargs)

ui/ctk_tray_ui.py

@@ -0,0 +1,807 @@
+from __future__ import annotations
+
+import os
+import webbrowser
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, List, Optional, Tuple, Union
+
+from proxy import __version__, get_link_host, parse_dc_ip_list
+from proxy.balancer import balancer
+from utils.update_check import RELEASES_PAGE_URL, get_status
+
+
+from ui.ctk_theme import (
+    FIRST_RUN_FRAME_PAD,
+    CtkTheme,
+    main_content_frame,
+)
+from ui.ctk_tooltip import attach_ctk_tooltip, attach_tooltip_to_widgets
+
+_TIP_HOST = (
+    "Адрес, на котором прокси принимает подключения.\n"
+    "Обычно 127.0.0.1 — локальная сеть, 0.0.0.0 - все интерфейсы"
+)
+_TIP_PORT = (
+    "Порт прокси. В Telegram Desktop в настройках прокси должен быть "
+    "указан тот же порт"
+)
+_TIP_SECRET = "Секретный ключ для авторизации клиентов"
+_TIP_DC = (
+    "Соответствие номера датацентра Telegram (DC) и IP-адреса сервера.\n"
+    "Каждая строка: «номер:IP», например 4:149.154.167.220. "
+    "Прокси по этим правилам направляет трафик к нужным серверам Telegram\n\n"
+    "Если у вас не работают медиа и работает CF-прокси, то попробуйте убрать строку 2:149.154.167.220"
+)
+_TIP_VERBOSE = (
+    "Если включено, в файл логов пишется больше подробностей — "
+    "необходимо при поиске неполадок"
+)
+_TIP_BUF_KB = (
+    "Размер буфера приёма/передачи в килобайтах.\n"
+    "Больше значение — больше выделение памяти на сокет"
+)
+_TIP_POOL = (
+    "Сколько параллельных WebSocket-сессий к одному датацентру можно держать.\n"
+    "Увеличение может помочь при высокой нагрузке"
+)
+_TIP_LOG_MB = (
+    "Максимальный размер файла лога; при достижении лимита файл перезаписывается"
+)
+_TIP_AUTOSTART = (
+    "Запускать TG WS Proxy при входе в Windows. "
+    "Если вы переместите программу в другую папку, автозапуск сбросится"
+)
+_TIP_CHECK_UPDATES = "При запуске проверять наличие обновлений"
+_TIP_CFPROXY = (
+    "Использовать Cloudflare прокси для недоступных датацентров"
+)
+_TIP_CFPROXY_PRIORITY = (
+    "Пробовать CF-прокси раньше прямого TCP-подключения"
+)
+_TIP_CFPROXY_DOMAIN = (
+    "Ваш собственный домен, проксируемый через Cloudflare, для WS-подключения.\n"
+    "Если не указан — выбирается автоматически из поддерживаемых доменов"
+)
+_TIP_CFPROXY_USER_DOMAIN_CB = (
+    "Указать свой домен вместо автоматического выбора"
+)
+_TIP_SAVE = "Сохранить настройки"
+_TIP_CANCEL = "Закрыть окно без сохранения изменений"
+
+_CFPROXY_HELP_URL = "https://github.com/Flowseal/tg-ws-proxy/blob/main/docs/CfProxy.md"
+_CFPROXY_TEST_DCS = [1, 2, 3, 4, 5, 203]
+
+
+def _run_cfproxy_connectivity_test(domain: str) -> dict:
+    import base64
+    import ssl
+    import socket as _socket
+
+    ctx = ssl.create_default_context()
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+    results = {}
+    for dc in _CFPROXY_TEST_DCS:
+        host = f"kws{dc}.{domain}"
+        try:
+            with _socket.create_connection((host, 443), timeout=5) as raw:
+                with ctx.wrap_socket(raw, server_hostname=host) as ssock:
+                    ws_key = base64.b64encode(os.urandom(16)).decode()
+                    req = (
+                        f"GET /apiws HTTP/1.1\r\n"
+                        f"Host: {host}\r\n"
+                        f"Upgrade: websocket\r\n"
+                        f"Connection: Upgrade\r\n"
+                        f"Sec-WebSocket-Key: {ws_key}\r\n"
+                        f"Sec-WebSocket-Version: 13\r\n"
+                        f"Sec-WebSocket-Protocol: binary\r\n"
+                        f"\r\n"
+                    ).encode()
+                    ssock.sendall(req)
+                    ssock.settimeout(5)
+                    buf = b""
+                    while b"\r\n\r\n" not in buf:
+                        chunk = ssock.recv(512)
+                        if not chunk:
+                            break
+                        buf += chunk
+                    first = buf.decode("utf-8", errors="replace").split("\r\n")[0]
+                    if "101" in first:
+                        results[dc] = True
+                    else:
+                        results[dc] = first or "нет ответа"
+                    ssock.close()
+                raw.close()
+        except _socket.timeout:
+            results[dc] = "таймаут"
+        except OSError as exc:
+            msg = str(exc)
+            results[dc] = msg[:60] if len(msg) > 60 else msg
+    return results
+
+
+def _run_cfproxy_auto_test(domains: list) -> tuple:
+    merged: dict = {}
+    best_domain = None
+    for domain in reversed(domains):
+        res = _run_cfproxy_connectivity_test(domain)
+        if all(v is True for v in res.values()):
+            return domain, res
+        for dc, v in res.items():
+            if v is True:
+                merged[dc] = True
+                best_domain = domain
+            elif dc not in merged:
+                merged[dc] = v
+    return best_domain, merged
+
+
+def _cfproxy_show_test_results(domain: str, results: dict) -> None:
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    ok = [dc for dc, v in results.items() if v is True]
+    fail = [(dc, v) for dc, v in results.items() if v is not True]
+    if len(ok) == len(_CFPROXY_TEST_DCS):
+        title = "CF-прокси: всё работает"
+        msg = f"\u2713 Все {len(_CFPROXY_TEST_DCS)} серверов доступны через {domain}."
+    elif not ok:
+        title = "CF-прокси: недоступен"
+        msg = f"\u2717 Ни один сервер не отвечает через {domain}.\n\nОшибки:\n"
+        msg += "\n".join(f"  kws{dc}: {v}" for dc, v in fail)
+    else:
+        title = "CF-прокси: частично работает"
+        msg = (
+            f"Домен: {domain}\n\n"
+            f"\u2713 Работают: {', '.join(f'kws{dc}' for dc in ok)}\n\n"
+            f"\u2717 Недоступны:\n"
+            + "\n".join(f"  kws{dc}: {v}" for dc, v in fail)
+        )
+    root = _tk.Tk()
+    root.withdraw()
+    try:
+        root.attributes("-topmost", True)
+    except Exception:
+        pass
+    _mb.showinfo(title, msg, parent=root)
+    root.destroy()
+
+
+def _cfproxy_show_auto_test_results(ok_domain, results: dict) -> None:
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    if ok_domain is not None:
+        title = "CF-прокси: доступен"
+        ok = [dc for dc, v in results.items() if v is True]
+        msg = f"\u2713 CF-прокси работает. {len(ok)} из {len(_CFPROXY_TEST_DCS)} серверов доступны."
+    else:
+        title = "CF-прокси: недоступен"
+        msg = "\u2717 Ни один из автоматических CF-доменов не отвечает.\n"
+        msg += "Возможно, блокировка или проблемы с сетью."
+    root = _tk.Tk()
+    root.withdraw()
+    try:
+        root.attributes("-topmost", True)
+    except Exception:
+        pass
+    _mb.showinfo(title, msg, parent=root)
+    root.destroy()
+
+_INNER_W = 396
+
+_APPEARANCE_OPTIONS = ["Авто", "Светлая", "Тёмная"]
+_APPEARANCE_FROM_CFG = {"auto": "Авто", "light": "Светлая", "dark": "Тёмная"}
+_APPEARANCE_TO_CFG = {"Авто": "auto", "Светлая": "light", "Тёмная": "dark"}
+_APPEARANCE_TO_CTK = {"auto": "system", "light": "Light", "dark": "Dark"}
+
+
+def _entry(ctk, parent, theme, *, var=None, width=0, height=36, radius=10, **kw):
+    opts = dict(
+        font=(theme.ui_font_family, 13), corner_radius=radius,
+        fg_color=theme.bg, border_color=theme.field_border,
+        border_width=1, text_color=theme.text_primary,
+    )
+    if var is not None:
+        opts["textvariable"] = var
+    if width:
+        opts["width"] = width
+    opts["height"] = height
+    opts.update(kw)
+    return ctk.CTkEntry(parent, **opts)
+
+
+def _checkbox(ctk, parent, theme, text, variable):
+    return ctk.CTkCheckBox(
+        parent, text=text, variable=variable,
+        font=(theme.ui_font_family, 13), text_color=theme.text_primary,
+        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+        corner_radius=6, border_width=2, border_color=theme.field_border,
+    )
+
+
+def _label(ctk, parent, theme, text, *, size=12, bold=False, secondary=True, **kw):
+    weight = "bold" if bold else "normal"
+    return ctk.CTkLabel(
+        parent, text=text,
+        font=(theme.ui_font_family, size, weight),
+        text_color=theme.text_secondary if secondary else theme.text_primary,
+        anchor="w", **kw,
+    )
+
+
+def _labeled_entry(ctk, parent, theme, label_text, value, *, tip="", width=0, pack_fill=False):
+    col = ctk.CTkFrame(parent, fg_color="transparent")
+    lbl = _label(ctk, col, theme, label_text)
+    lbl.pack(anchor="w", pady=(0, 2))
+    var = ctk.StringVar(value=str(value))
+    ent = _entry(ctk, col, theme, var=var, width=width)
+    if pack_fill:
+        ent.pack(fill="x")
+    else:
+        ent.pack(anchor="w")
+    if tip:
+        attach_tooltip_to_widgets([lbl, ent, col], tip)
+    return col, var
+
+
+def tray_settings_scroll_and_footer(
+    ctk: Any,
+    content_parent: Any,
+    theme: CtkTheme,
+) -> Tuple[Any, Any]:
+    footer = ctk.CTkFrame(content_parent, fg_color=theme.bg)
+    footer.pack(side="bottom", fill="x")
+    scroll = ctk.CTkScrollableFrame(
+        content_parent,
+        fg_color=theme.bg,
+        corner_radius=0,
+        scrollbar_button_color=theme.field_border,
+        scrollbar_button_hover_color=theme.text_secondary,
+    )
+    scroll.pack(fill="both", expand=True)
+    return scroll, footer
+
+
+def _config_section(
+    ctk: Any,
+    parent: Any,
+    theme: CtkTheme,
+    title: str,
+    *,
+    bottom_spacer: int = 6,
+) -> Any:
+    wrap = ctk.CTkFrame(parent, fg_color="transparent")
+    wrap.pack(fill="x", pady=(0, bottom_spacer))
+    _label(ctk, wrap, theme, title, secondary=False, bold=True).pack(anchor="w", pady=(0, 2))
+    card = ctk.CTkFrame(
+        wrap, fg_color=theme.field_bg, corner_radius=10,
+        border_width=1, border_color=theme.field_border,
+    )
+    card.pack(fill="x")
+    inner = ctk.CTkFrame(card, fg_color="transparent")
+    inner.pack(fill="x", padx=10, pady=8)
+    return inner
+
+
+@dataclass
+class TrayConfigFormWidgets:
+    host_var: Any
+    port_var: Any
+    secret_var: Any
+    dc_textbox: Any
+    verbose_var: Any
+    adv_entries: List[Any]
+    adv_keys: Tuple[str, ...]
+    autostart_var: Optional[Any]
+    check_updates_var: Optional[Any]
+    cfproxy_var: Optional[Any] = None
+    cfproxy_priority_var: Optional[Any] = None
+    cfproxy_user_domain_var: Optional[Any] = None
+    appearance_var: Optional[Any] = None
+
+
+def install_tray_config_form(
+    ctk: Any,
+    frame: Any,
+    theme: CtkTheme,
+    cfg: dict,
+    default_config: dict,
+    *,
+    show_autostart: bool = False,
+    autostart_value: bool = False,
+) -> TrayConfigFormWidgets:
+    header = ctk.CTkFrame(frame, fg_color="transparent")
+    header.pack(fill="x", pady=(0, 2))
+    ctk.CTkLabel(
+        header, text="Настройки",
+        font=(theme.ui_font_family, 17, "bold"),
+        text_color=theme.text_primary, anchor="w",
+    ).pack(side="left")
+    ctk.CTkLabel(
+        header, text=f"v{__version__}",
+        font=(theme.ui_font_family, 12),
+        text_color=theme.text_secondary, anchor="e",
+    ).pack(side="right", padx=(4, 0))
+    appearance_var = ctk.StringVar(
+        value=_APPEARANCE_FROM_CFG.get(cfg.get("appearance", "auto"), "Авто")
+    )
+
+    def _on_appearance_change(choice: str) -> None:
+        cfg_val = _APPEARANCE_TO_CFG.get(choice, "auto")
+        ctk.set_appearance_mode(_APPEARANCE_TO_CTK[cfg_val])
+        cfg["appearance"] = cfg_val
+
+    ctk.CTkComboBox(
+        header,
+        values=_APPEARANCE_OPTIONS,
+        variable=appearance_var,
+        width=102,
+        height=28,
+        font=(theme.ui_font_family, 12),
+        text_color=theme.text_secondary,
+        fg_color=theme.field_bg,
+        border_color=theme.field_border,
+        button_color=theme.field_border,
+        button_hover_color=theme.text_secondary,
+        dropdown_fg_color=theme.field_bg,
+        dropdown_text_color=theme.text_primary,
+        dropdown_hover_color=theme.field_border,
+        corner_radius=8,
+        state="readonly",
+        command=_on_appearance_change,
+    ).pack(side="right")
+
+    ctk.CTkButton(
+        header, text="Donate ♥", width=90, height=28,
+        font=(theme.ui_font_family, 13, "bold"), corner_radius=8,
+        fg_color="#22c55e", hover_color="#16a34a",
+        text_color="#ffffff", border_width=0,
+        command=lambda: (
+            header.winfo_toplevel().iconify(),
+            webbrowser.open("https://github.com/Flowseal/tg-ws-proxy/blob/main/docs/Funding.md"),
+        ),
+    ).pack(side="right", padx=(0, 6))
+
+    conn = _config_section(ctk, frame, theme, "Подключение MTProto")
+
+    host_row = ctk.CTkFrame(conn, fg_color="transparent")
+    host_row.pack(fill="x")
+
+    host_col, host_var = _labeled_entry(
+        ctk, host_row, theme, "IP-адрес",
+        cfg.get("host", default_config["host"]),
+        tip=_TIP_HOST, width=160, pack_fill=True,
+    )
+    host_col.pack(side="left", fill="x", expand=True, padx=(0, 10))
+
+    port_col, port_var = _labeled_entry(
+        ctk, host_row, theme, "Порт",
+        cfg.get("port", default_config["port"]),
+        tip=_TIP_PORT, width=100,
+    )
+    port_col.pack(side="left")
+
+    secret_row = ctk.CTkFrame(conn, fg_color="transparent")
+    secret_row.pack(fill="x")
+
+    secret_col, secret_var = _labeled_entry(
+        ctk, secret_row, theme, "Secret",
+        cfg.get("secret", default_config["secret"]),
+        tip=_TIP_SECRET, width=160, pack_fill=True,
+    )
+    secret_col.pack(side="left", fill="x", expand=True, padx=(0, 10))
+
+    regen_col = ctk.CTkFrame(secret_row, fg_color="transparent")
+    regen_col.pack(side="left", anchor="s")
+    ctk.CTkLabel(regen_col, text="", font=(theme.ui_font_family, 12)).pack(pady=(0, 2))
+    ctk.CTkButton(
+        regen_col, text="↺", width=36, height=36,
+        font=(theme.ui_font_family, 18), corner_radius=10,
+        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+        text_color="#ffffff", border_width=1, border_color=theme.field_border,
+        command=lambda: secret_var.set(os.urandom(16).hex()),
+    ).pack()
+
+    dc_inner = _config_section(ctk, frame, theme, "Датацентры Telegram (DC → IP)")
+    dc_lbl = _label(ctk, dc_inner, theme, "По одному правилу на строку, формат: номер:IP", size=11)
+    dc_lbl.pack(anchor="w", pady=(0, 4))
+    dc_textbox = ctk.CTkTextbox(
+        dc_inner, width=_INNER_W, height=88,
+        font=(theme.mono_font_family, 12), corner_radius=10,
+        fg_color=theme.bg, border_color=theme.field_border,
+        border_width=1, text_color=theme.text_primary,
+    )
+    dc_textbox.pack(fill="x")
+    dc_textbox.insert("1.0", "\n".join(cfg.get("dc_ip", default_config["dc_ip"])))
+    attach_tooltip_to_widgets([dc_lbl, dc_textbox], _TIP_DC)
+
+    cf_inner = _config_section(ctk, frame, theme, "Cloudflare Proxy")
+
+    cf_row = ctk.CTkFrame(cf_inner, fg_color="transparent")
+    cf_row.pack(fill="x", pady=(0, 4))
+
+    cfproxy_var = ctk.BooleanVar(
+        value=cfg.get("cfproxy", default_config.get("cfproxy", True))
+    )
+    cf_cb = _checkbox(ctk, cf_row, theme, "Включить CF-прокси", cfproxy_var)
+    cf_cb.pack(side="left", padx=(0, 16))
+    attach_ctk_tooltip(cf_cb, _TIP_CFPROXY)
+
+    cfproxy_priority_var = ctk.BooleanVar(
+        value=cfg.get("cfproxy_priority", default_config.get("cfproxy_priority", True))
+    )
+    cf_prio_cb = _checkbox(ctk, cf_row, theme, "Приоритет", cfproxy_priority_var)
+    cf_prio_cb.pack(side="left")
+    attach_ctk_tooltip(cf_prio_cb, _TIP_CFPROXY_PRIORITY)
+
+    _cf_test_btn = [None]
+
+    def _on_cf_test():
+        user_domain = cfproxy_user_domain_var.get().strip() if cf_custom_cb_var.get() else ""
+        btn = _cf_test_btn[0]
+        if btn:
+            btn.configure(text="...", state="disabled")
+        import threading as _threading
+        if user_domain:
+            def _worker():
+                try:
+                    res = _run_cfproxy_connectivity_test(user_domain)
+                    if btn:
+                        btn.after(0, lambda: _cfproxy_show_test_results(user_domain, res))
+                except Exception as exc:
+                    log.error("CF proxy test failed: %s", exc)
+                finally:
+                    if btn:
+                        btn.after(0, lambda: btn.configure(text="Тест", state="normal"))
+            _threading.Thread(target=_worker, daemon=True).start()
+        else:
+            def _worker_auto():
+                try:
+                    ok_domain, res = _run_cfproxy_auto_test(balancer.domains)
+                    if btn:
+                        btn.after(0, lambda: _cfproxy_show_auto_test_results(ok_domain, res))
+                except Exception as exc:
+                    log.error("CF proxy auto-test failed: %s", exc)
+                finally:
+                    if btn:
+                        btn.after(0, lambda: btn.configure(text="Тест", state="normal"))
+            _threading.Thread(target=_worker_auto, daemon=True).start()
+
+    _cf_test_widget = ctk.CTkButton(
+        cf_row, text="Тест", width=56, height=28,
+        font=(theme.ui_font_family, 13), corner_radius=8,
+        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+        text_color="#ffffff", border_width=1, border_color=theme.field_border,
+        command=_on_cf_test,
+    )
+    _cf_test_widget.pack(side="right")
+    _cf_test_btn[0] = _cf_test_widget
+
+    cf_custom_row = ctk.CTkFrame(cf_inner, fg_color="transparent")
+    cf_custom_row.pack(fill="x")
+
+    saved_user_domain = cfg.get("cfproxy_user_domain", default_config.get("cfproxy_user_domain", ""))
+    cf_custom_cb_var = ctk.BooleanVar(value=bool(saved_user_domain))
+    cf_custom_cb = _checkbox(ctk, cf_custom_row, theme, "Свой домен", cf_custom_cb_var)
+    cf_custom_cb.pack(side="left", padx=(0, 10))
+    attach_ctk_tooltip(cf_custom_cb, _TIP_CFPROXY_USER_DOMAIN_CB)
+
+    ctk.CTkButton(
+        cf_custom_row, text="?", width=28, height=32,
+        font=(theme.ui_font_family, 14), corner_radius=8,
+        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+        text_color="#ffffff", border_width=1, border_color=theme.field_border,
+        command=lambda: webbrowser.open(_CFPROXY_HELP_URL),
+    ).pack(side="right")
+
+    cfproxy_user_domain_var = ctk.StringVar(value=saved_user_domain)
+    cf_domain_entry = _entry(
+        ctk, cf_custom_row, theme, var=cfproxy_user_domain_var,
+        height=32, radius=8,
+    )
+    cf_domain_entry.pack(side="left", fill="x", expand=True, padx=(0, 6))
+    attach_ctk_tooltip(cf_domain_entry, _TIP_CFPROXY_DOMAIN)
+
+    def _sync_domain_entry(*_):
+        state = "normal" if cf_custom_cb_var.get() else "disabled"
+        cf_domain_entry.configure(state=state)
+        if not cf_custom_cb_var.get():
+            cfproxy_user_domain_var.set("")
+
+    cf_custom_cb_var.trace_add("write", _sync_domain_entry)
+    _sync_domain_entry()
+
+    log_inner = _config_section(ctk, frame, theme, "Логи и производительность")
+
+    verbose_var = ctk.BooleanVar(value=cfg.get("verbose", False))
+    verbose_cb = _checkbox(ctk, log_inner, theme, "Подробное логирование (verbose)", verbose_var)
+    verbose_cb.pack(anchor="w", pady=(0, 6))
+    attach_ctk_tooltip(verbose_cb, _TIP_VERBOSE)
+
+    adv_frame = ctk.CTkFrame(log_inner, fg_color="transparent")
+    adv_frame.pack(fill="x")
+
+    adv_rows = [
+        ("Буфер, КБ (по умолчанию 256)", "buf_kb", _TIP_BUF_KB),
+        ("Пул WebSocket-сессий (по умолчанию 4)", "pool_size", _TIP_POOL),
+        ("Макс. размер лога, МБ (по умолчанию 5)", "log_max_mb", _TIP_LOG_MB),
+    ]
+    for label_text, key, tip in adv_rows:
+        col = ctk.CTkFrame(adv_frame, fg_color="transparent")
+        col.pack(fill="x", pady=(0, 0 if key == "log_max_mb" else 5))
+        adv_l = _label(ctk, col, theme, label_text, size=11)
+        adv_l.pack(anchor="w", pady=(0, 2))
+        adv_e = _entry(
+            ctk, col, theme, width=_INNER_W, height=32, radius=8,
+            textvariable=ctk.StringVar(value=str(cfg.get(key, default_config[key]))),
+        )
+        adv_e.pack(fill="x")
+        attach_tooltip_to_widgets([adv_l, adv_e, col], tip)
+
+    adv_entries = list(adv_frame.winfo_children())
+    adv_keys = ("buf_kb", "pool_size", "log_max_mb")
+
+    upd_inner = _config_section(ctk, frame, theme, "Обновления")
+    st = get_status()
+    check_updates_var = ctk.BooleanVar(
+        value=bool(cfg.get("check_updates", default_config.get("check_updates", True)))
+    )
+    upd_cb = _checkbox(ctk, upd_inner, theme, "Проверять обновления при запуске", check_updates_var)
+    upd_cb.pack(anchor="w", pady=(0, 6))
+    attach_ctk_tooltip(upd_cb, _TIP_CHECK_UPDATES)
+
+    if st.get("error"):
+        upd_status = "Не удалось связаться с GitHub. Проверьте сеть."
+    elif not st.get("checked"):
+        upd_status = "Статус появится после фоновой проверки при запуске."
+    elif st.get("has_update") and st.get("latest"):
+        upd_status = (
+            f"На GitHub доступна версия {st['latest']} "
+            f"(у вас {__version__})."
+        )
+    elif st.get("ahead_of_release") and st.get("latest"):
+        upd_status = (
+            f"У вас {__version__} — новее последнего релиза на GitHub "
+            f"({st['latest']})."
+        )
+    else:
+        upd_status = "Установлена последняя известная версия с GitHub."
+
+    _label(ctk, upd_inner, theme, upd_status, size=11,
+           justify="left", wraplength=_INNER_W).pack(anchor="w", pady=(0, 8))
+
+    rel_url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+    ctk.CTkButton(
+        upd_inner, text="Открыть страницу релиза", height=32,
+        font=(theme.ui_font_family, 13), corner_radius=8,
+        fg_color=theme.field_bg, hover_color=theme.field_border,
+        text_color=theme.text_primary, border_width=1,
+        border_color=theme.field_border,
+        command=lambda u=rel_url: webbrowser.open(u),
+    ).pack(anchor="w")
+
+    autostart_var = None
+    if show_autostart:
+        sys_inner = _config_section(ctk, frame, theme, "Запуск Windows", bottom_spacer=4)
+        autostart_var = ctk.BooleanVar(value=autostart_value)
+        as_cb = _checkbox(ctk, sys_inner, theme, "Автозапуск при включении компьютера", autostart_var)
+        as_cb.pack(anchor="w", pady=(0, 4))
+        as_hint = _label(
+            ctk, sys_inner, theme,
+            "Если переместить программу в другую папку, запись автозапуска может сброситься.",
+            size=11, justify="left", wraplength=_INNER_W,
+        )
+        as_hint.pack(anchor="w")
+        attach_tooltip_to_widgets([as_cb, as_hint], _TIP_AUTOSTART)
+
+    return TrayConfigFormWidgets(
+        host_var=host_var, port_var=port_var, secret_var=secret_var,
+        dc_textbox=dc_textbox, verbose_var=verbose_var,
+        adv_entries=adv_entries, adv_keys=adv_keys,
+        autostart_var=autostart_var, check_updates_var=check_updates_var,
+        cfproxy_var=cfproxy_var,
+        cfproxy_priority_var=cfproxy_priority_var,
+        cfproxy_user_domain_var=cfproxy_user_domain_var,
+        appearance_var=appearance_var,
+    )
+
+
+def merge_adv_from_form(
+    widgets: TrayConfigFormWidgets,
+    base: Dict[str, Any],
+    default_config: dict,
+) -> None:
+    for i, key in enumerate(widgets.adv_keys):
+        col_frame = widgets.adv_entries[i]
+        entry = col_frame.winfo_children()[1]
+        try:
+            val = float(entry.get().strip())
+            if key in ("buf_kb", "pool_size"):
+                val = int(val)
+            base[key] = val
+        except ValueError:
+            base[key] = default_config[key]
+
+
+def validate_config_form(
+    widgets: TrayConfigFormWidgets,
+    default_config: dict,
+    *,
+    include_autostart: bool,
+) -> Union[dict, str]:
+    import socket as _sock
+
+    host_val = widgets.host_var.get().strip()
+    try:
+        _sock.inet_aton(host_val)
+    except OSError:
+        return "Некорректный IP-адрес."
+
+    try:
+        port_val = int(widgets.port_var.get().strip())
+        if not (1 <= port_val <= 65535):
+            raise ValueError
+    except ValueError:
+        return "Порт должен быть числом 1-65535"
+
+    lines = [
+        line.strip()
+        for line in widgets.dc_textbox.get("1.0", "end").strip().splitlines()
+        if line.strip()
+    ]
+    try:
+        parse_dc_ip_list(lines)
+    except ValueError as e:
+        return str(e)
+
+    secret_val = widgets.secret_var.get().strip()
+    if len(secret_val) != 32:
+        return "Secret должен содержать ровно 32 hex-символа (16 байт)."
+    try:
+        bytes.fromhex(secret_val)
+    except ValueError:
+        return "Secret должен состоять только из hex-символов (0-9, a-f)."
+
+    new_cfg: Dict[str, Any] = {
+        "host": host_val,
+        "port": port_val,
+        "secret": secret_val,
+        "dc_ip": lines,
+        "verbose": widgets.verbose_var.get(),
+    }
+    if include_autostart:
+        new_cfg["autostart"] = (
+            widgets.autostart_var.get()
+            if widgets.autostart_var is not None
+            else False
+        )
+
+    merge_adv_from_form(widgets, new_cfg, default_config)
+    if widgets.check_updates_var is not None:
+        new_cfg["check_updates"] = bool(widgets.check_updates_var.get())
+    if widgets.cfproxy_var is not None:
+        new_cfg["cfproxy"] = bool(widgets.cfproxy_var.get())
+    if widgets.cfproxy_priority_var is not None:
+        new_cfg["cfproxy_priority"] = bool(widgets.cfproxy_priority_var.get())
+    if widgets.cfproxy_user_domain_var is not None:
+        new_cfg["cfproxy_user_domain"] = widgets.cfproxy_user_domain_var.get().strip()
+    if widgets.appearance_var is not None:
+        new_cfg["appearance"] = _APPEARANCE_TO_CFG.get(widgets.appearance_var.get(), "auto")
+    return new_cfg
+
+
+def install_tray_config_buttons(
+    ctk: Any,
+    frame: Any,
+    theme: CtkTheme,
+    *,
+    on_save: Callable[[], None],
+    on_cancel: Callable[[], None],
+) -> None:
+    ctk.CTkFrame(
+        frame,
+        fg_color=theme.field_border,
+        height=1,
+        corner_radius=0,
+    ).pack(fill="x", pady=(4, 10))
+    btn_frame = ctk.CTkFrame(frame, fg_color="transparent")
+    btn_frame.pack(fill="x", pady=(0, 0))
+    save_btn = ctk.CTkButton(
+        btn_frame, text="Сохранить", height=38,
+        font=(theme.ui_font_family, 14, "bold"), corner_radius=10,
+        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+        text_color="#ffffff",
+        command=on_save)
+    save_btn.pack(side="left", fill="x", expand=True, padx=(0, 8))
+    attach_ctk_tooltip(save_btn, _TIP_SAVE)
+    cancel_btn = ctk.CTkButton(
+        btn_frame, text="Отмена", height=38,
+        font=(theme.ui_font_family, 14), corner_radius=10,
+        fg_color=theme.field_bg, hover_color=theme.field_border,
+        text_color=theme.text_primary, border_width=1,
+        border_color=theme.field_border,
+        command=on_cancel)
+    cancel_btn.pack(side="right", fill="x", expand=True)
+    attach_ctk_tooltip(cancel_btn, _TIP_CANCEL)
+
+
+def populate_first_run_window(
+    ctk: Any,
+    root: Any,
+    theme: CtkTheme,
+    *,
+    host: str,
+    port: int,
+    secret: str,
+    on_done: Callable[[bool], None],
+) -> None:
+    link_host = get_link_host(host)
+    tg_url = f"tg://proxy?server={link_host}&port={port}&secret=dd{secret}"
+    fpx, fpy = FIRST_RUN_FRAME_PAD
+    frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
+
+    title_frame = ctk.CTkFrame(frame, fg_color="transparent")
+    title_frame.pack(anchor="w", pady=(0, 16), fill="x")
+
+    accent_bar = ctk.CTkFrame(title_frame, fg_color=theme.tg_blue,
+                              width=4, height=32, corner_radius=2)
+    accent_bar.pack(side="left", padx=(0, 12))
+
+    ctk.CTkLabel(title_frame, text="Прокси запущен и работает в системном трее",
+                 font=(theme.ui_font_family, 17, "bold"),
+                 text_color=theme.text_primary).pack(side="left")
+
+    sections = [
+        ("Как подключить Telegram Desktop:", True),
+        ("  Автоматически:", True),
+        ("  ПКМ по иконке в трее → «Открыть в Telegram»", False),
+        (f"  Или скопировать ссылку, отправить её себе в TG и нажать по ней: {tg_url}", False),
+        ("\n  Вручную:", True),
+        ("  Настройки → Продвинутые → Тип подключения → Прокси", False),
+        (f"  MTProto → {link_host} : {port}", False),
+        (f"  Secret: dd{secret}", False),
+    ]
+
+    textbox = ctk.CTkTextbox(
+        frame,
+        font=(theme.ui_font_family, 13),
+        fg_color=theme.bg,
+        border_width=0,
+        text_color=theme.text_primary,
+        activate_scrollbars=False,
+        wrap="word",
+        height=275,
+    )
+    textbox._textbox.tag_configure("bold", font=(theme.ui_font_family, 13, "bold"))
+    textbox._textbox.configure(spacing1=1, spacing3=1)
+    for text, bold in sections:
+        if text.startswith("\n"):
+            textbox.insert("end", "\n")
+            text = text[1:]
+        if bold:
+            textbox.insert("end", text + "\n", "bold")
+        else:
+            textbox.insert("end", text + "\n")
+    textbox.configure(state="disabled")
+    textbox.pack(anchor="w", fill="x")
+
+    ctk.CTkFrame(frame, fg_color="transparent", height=16).pack()
+
+    ctk.CTkFrame(frame, fg_color=theme.field_border, height=1,
+                 corner_radius=0).pack(fill="x", pady=(0, 12))
+
+    auto_var = ctk.BooleanVar(value=True)
+    _checkbox(ctk, frame, theme, "Открыть прокси в Telegram сейчас",
+              auto_var).pack(anchor="w", pady=(0, 16))
+
+    def on_ok():
+        on_done(auto_var.get())
+
+    ctk.CTkButton(frame, text="Начать", width=180, height=42,
+                  font=(theme.ui_font_family, 15, "bold"), corner_radius=10,
+                  fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+                  text_color="#ffffff",
+                  command=on_ok).pack(pady=(0, 0))
+
+    root.protocol("WM_DELETE_WINDOW", on_ok)

utils/__init__.py

@@ -0,0 +1,5 @@
+"""Вспомогательные утилиты (проверка релизов и т.п.)."""
+
+from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+
+__all__ = ["RELEASES_PAGE_URL", "get_status", "run_check"]

utils/default_config.py

@@ -0,0 +1,33 @@
+"""
+Общие значения по умолчанию для tray-приложений (Windows / Linux / macOS).
+Единственное отличие по платформе — ключ autostart только на Windows.
+"""
+from __future__ import annotations
+
+import sys
+import os
+from typing import Any, Dict
+
+_TRAY_DEFAULTS_COMMON: Dict[str, Any] = {
+    "port": 1443,
+    "host": "127.0.0.1",
+    "dc_ip": ["2:149.154.167.220", "4:149.154.167.220"],
+    "verbose": False,
+    "check_updates": True,
+    "log_max_mb": 5,
+    "buf_kb": 256,
+    "pool_size": 4,
+    "cfproxy": True,
+    "cfproxy_priority": True,
+    "cfproxy_user_domain": "",
+}
+
+
+def default_tray_config() -> Dict[str, Any]:
+    cfg = dict(_TRAY_DEFAULTS_COMMON)
+    cfg["secret"] = os.urandom(16).hex()
+
+    if sys.platform == "win32":
+        cfg["autostart"] = False
+
+    return cfg

utils/tray_common.py

@@ -0,0 +1,469 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import logging.handlers
+import os
+import socket as _socket
+import sys
+import threading
+import time
+from pathlib import Path
+from typing import Any, Callable, Dict, Optional, Tuple
+
+import psutil
+
+from proxy import __version__, get_link_host, parse_dc_ip_list, proxy_config
+from proxy.tg_ws_proxy import _run
+from utils.default_config import default_tray_config
+
+log = logging.getLogger("tg-ws-tray")
+
+APP_NAME = "TgWsProxy"
+
+
+def _app_dir() -> Path:
+    if sys.platform == "win32":
+        return Path(os.environ.get("APPDATA", Path.home())) / APP_NAME
+    if sys.platform == "darwin":
+        return Path.home() / "Library" / "Application Support" / APP_NAME
+    return Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config")) / APP_NAME
+
+
+APP_DIR = _app_dir()
+CONFIG_FILE = APP_DIR / "config.json"
+LOG_FILE = APP_DIR / "proxy.log"
+FIRST_RUN_MARKER = APP_DIR / ".first_run_done_mtproto"
+IPV6_WARN_MARKER = APP_DIR / ".ipv6_warned"
+
+DEFAULT_CONFIG: Dict[str, Any] = default_tray_config()
+
+IS_FROZEN = bool(getattr(sys, "frozen", False))
+
+
+def ensure_dirs() -> None:
+    APP_DIR.mkdir(parents=True, exist_ok=True)
+
+
+# single-instance lock
+
+_lock_file_path: Optional[Path] = None
+
+
+def _same_process(meta: dict, proc: psutil.Process) -> bool:
+    try:
+        lock_ct = float(meta.get("create_time", 0.0))
+        if lock_ct > 0 and abs(lock_ct - proc.create_time()) > 1.0:
+            return False
+    except Exception:
+        return False
+    if IS_FROZEN:
+        return APP_NAME.lower() in proc.name().lower()
+    return False
+
+
+def acquire_lock() -> bool:
+    global _lock_file_path
+    ensure_dirs()
+    for f in list(APP_DIR.glob("*.lock")):
+        try:
+            pid = int(f.stem)
+        except Exception:
+            try:
+                f.unlink(missing_ok=True)
+            except OSError:
+                pass
+            continue
+        meta: dict = {}
+        try:
+            raw = f.read_text(encoding="utf-8").strip()
+            if raw:
+                meta = json.loads(raw)
+        except Exception:
+            pass
+        is_running = False
+        try:
+            is_running = _same_process(meta, psutil.Process(pid))
+        except Exception:
+            pass
+        if is_running:
+            return False
+        try:
+            f.unlink(missing_ok=True)
+        except OSError:
+            pass
+
+    lock_file = APP_DIR / f"{os.getpid()}.lock"
+    try:
+        proc = psutil.Process(os.getpid())
+        lock_file.write_text(
+            json.dumps({"create_time": proc.create_time()}, ensure_ascii=False),
+            encoding="utf-8",
+        )
+    except Exception:
+        try:
+            lock_file.touch()
+        except Exception:
+            pass
+    _lock_file_path = lock_file
+    return True
+
+
+def release_lock() -> None:
+    global _lock_file_path
+    if _lock_file_path:
+        try:
+            _lock_file_path.unlink(missing_ok=True)
+        except Exception:
+            pass
+        _lock_file_path = None
+
+
+# config
+
+def load_config() -> dict:
+    ensure_dirs()
+    if CONFIG_FILE.exists():
+        try:
+            with open(CONFIG_FILE, "r", encoding="utf-8") as f:
+                data = json.load(f)
+            for k, v in DEFAULT_CONFIG.items():
+                data.setdefault(k, v)
+            return data
+        except Exception as exc:
+            log.warning("Failed to load config: %s", repr(exc))
+    return dict(DEFAULT_CONFIG)
+
+
+def save_config(cfg: dict) -> None:
+    ensure_dirs()
+    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
+        json.dump(cfg, f, indent=2, ensure_ascii=False)
+
+
+# logging
+
+_LOG_FMT_FILE = "%(asctime)s  %(levelname)-5s  %(name)s  %(message)s"
+_LOG_FMT_CONSOLE = "%(asctime)s  %(levelname)-5s  %(message)s"
+
+
+def setup_logging(verbose: bool = False, log_max_mb: float = 5) -> None:
+    ensure_dirs()
+    level = logging.DEBUG if verbose else logging.INFO
+    root = logging.getLogger()
+    root.setLevel(level)
+    logging.getLogger('asyncio').setLevel(logging.WARNING)
+
+    fh = logging.handlers.RotatingFileHandler(
+        str(LOG_FILE),
+        maxBytes=max(32 * 1024, int(log_max_mb * 1024 * 1024)),
+        backupCount=0,
+        encoding="utf-8",
+    )
+    fh.setLevel(logging.DEBUG)
+    fh.setFormatter(logging.Formatter(_LOG_FMT_FILE, datefmt="%Y-%m-%d %H:%M:%S"))
+    root.addHandler(fh)
+
+    if not IS_FROZEN:
+        ch = logging.StreamHandler(sys.stdout)
+        ch.setLevel(level)
+        ch.setFormatter(logging.Formatter(_LOG_FMT_CONSOLE, datefmt="%H:%M:%S"))
+        root.addHandler(ch)
+
+
+# icon
+
+def make_icon_image(size: int = 64, *, color: Tuple[int, ...] = (0, 136, 204, 255)):
+    from PIL import Image, ImageDraw, ImageFont
+
+    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    draw = ImageDraw.Draw(img)
+    margin = 2
+    draw.ellipse([margin, margin, size - margin, size - margin], fill=color)
+
+    for path in _font_paths():
+        try:
+            font = ImageFont.truetype(path, size=int(size * 0.55))
+            break
+        except Exception:
+            continue
+    else:
+        font = ImageFont.load_default()
+
+    bbox = draw.textbbox((0, 0), "T", font=font)
+    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
+    draw.text(
+        ((size - tw) // 2 - bbox[0], (size - th) // 2 - bbox[1]),
+        "T",
+        fill=(255, 255, 255, 255),
+        font=font,
+    )
+    return img
+
+
+def _font_paths():
+    if sys.platform == "win32":
+        return ["arial.ttf"]
+    if sys.platform == "darwin":
+        return ["/System/Library/Fonts/Helvetica.ttc"]
+    return [
+        "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf",
+        "/usr/share/fonts/TTF/DejaVuSans-Bold.ttf",
+    ]
+
+
+def load_icon():
+    from PIL import Image
+
+    icon_path = Path(__file__).parents[1] / "icon.ico"
+    if icon_path.exists():
+        try:
+            return Image.open(str(icon_path))
+        except Exception:
+            pass
+    return make_icon_image(64)
+
+
+# proxy lifecycle
+
+_proxy_thread: Optional[threading.Thread] = None
+_async_stop: Optional[Tuple[asyncio.AbstractEventLoop, asyncio.Event]] = None
+
+
+def _run_proxy_thread(on_port_busy: Callable[[str], None]) -> None:
+    global _async_stop
+
+    loop = asyncio.new_event_loop()
+    asyncio.set_event_loop(loop)
+    stop_ev = asyncio.Event()
+    _async_stop = (loop, stop_ev)
+
+    try:
+        loop.run_until_complete(_run(stop_event=stop_ev))
+    except Exception as exc:
+        log.error("Proxy thread crashed: %s", repr(exc))
+        if "Address already in use" in str(exc) or "10048" in str(exc):
+            on_port_busy(
+                "Не удалось запустить прокси:\n"
+                "Порт уже используется другим приложением.\n\n"
+                "Закройте приложение, использующее этот порт, "
+                "или измените порт в настройках прокси и перезапустите."
+            )
+    finally:
+        loop.close()
+        _async_stop = None
+
+
+def apply_proxy_config(cfg: dict) -> bool:
+    dc_ip_list = cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])
+    try:
+        dc_redirects = parse_dc_ip_list(dc_ip_list)
+    except ValueError as e:
+        log.error("Bad config dc_ip: %s", e)
+        return False
+
+    pc = proxy_config
+    pc.port = cfg.get("port", DEFAULT_CONFIG["port"])
+    pc.host = cfg.get("host", DEFAULT_CONFIG["host"])
+    pc.secret = cfg.get("secret", DEFAULT_CONFIG["secret"])
+    pc.dc_redirects = dc_redirects
+    pc.buffer_size = max(4, cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])) * 1024
+    pc.pool_size = max(0, cfg.get("pool_size", DEFAULT_CONFIG["pool_size"]))
+    pc.fallback_cfproxy = cfg.get("cfproxy", DEFAULT_CONFIG["cfproxy"])
+    pc.fallback_cfproxy_priority = cfg.get("cfproxy_priority", DEFAULT_CONFIG["cfproxy_priority"])
+    pc.cfproxy_user_domain = cfg.get("cfproxy_user_domain", DEFAULT_CONFIG["cfproxy_user_domain"])
+    return True
+
+
+def start_proxy(cfg: dict, on_error: Callable[[str], None]) -> None:
+    global _proxy_thread
+    if _proxy_thread and _proxy_thread.is_alive():
+        log.info("Proxy already running")
+        return
+
+    if not apply_proxy_config(cfg):
+        on_error("Ошибка конфигурации DC → IP.")
+        return
+
+    pc = proxy_config
+    log.info("Starting proxy on %s:%d ...", pc.host, pc.port)
+    _proxy_thread = threading.Thread(
+        target=_run_proxy_thread, args=(on_error,), daemon=True, name="proxy"
+    )
+    _proxy_thread.start()
+
+
+def stop_proxy() -> None:
+    global _proxy_thread, _async_stop
+    if _async_stop:
+        loop, stop_ev = _async_stop
+        loop.call_soon_threadsafe(stop_ev.set)
+        if _proxy_thread:
+            _proxy_thread.join(timeout=5)
+    _proxy_thread = None
+    log.info("Proxy stopped")
+
+
+def restart_proxy(cfg: dict, on_error: Callable[[str], None]) -> None:
+    log.info("Restarting proxy...")
+    stop_proxy()
+    time.sleep(0.3)
+    start_proxy(cfg, on_error)
+
+
+def tg_proxy_url(cfg: dict) -> str:
+    host = cfg.get("host", DEFAULT_CONFIG["host"])
+    port = cfg.get("port", DEFAULT_CONFIG["port"])
+    secret = cfg.get("secret", DEFAULT_CONFIG["secret"])
+    link_host = get_link_host(host)
+    return f"tg://proxy?server={link_host}&port={port}&secret=dd{secret}"
+
+
+_IPV6_WARNING = (
+    "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
+    "Telegram может пытаться подключаться через IPv6, "
+    "что не поддерживается и может привести к ошибкам.\n\n"
+    "Если прокси не работает или в логах присутствуют ошибки, "
+    "связанные с попытками подключения по IPv6 - "
+    "попробуйте отключить в настройках прокси Telegram попытку соединения "
+    "по IPv6. Если данная мера не помогает, попробуйте отключить IPv6 "
+    "в системе.\n\n"
+    "Это предупреждение будет показано только один раз."
+)
+
+
+def _has_ipv6() -> bool:
+    try:
+        for addr in _socket.getaddrinfo(_socket.gethostname(), None, _socket.AF_INET6):
+            ip = addr[4][0]
+            if ip and not ip.startswith("::1") and not ip.startswith("fe80::1"):
+                return True
+    except Exception:
+        pass
+    try:
+        s = _socket.socket(_socket.AF_INET6, _socket.SOCK_STREAM)
+        s.bind(("::1", 0))
+        s.close()
+        return True
+    except Exception:
+        return False
+
+
+def check_ipv6_warning(show_info: Callable[[str, str], None]) -> None:
+    ensure_dirs()
+    if IPV6_WARN_MARKER.exists() or not _has_ipv6():
+        return
+    IPV6_WARN_MARKER.touch()
+    threading.Thread(
+        target=lambda: show_info(_IPV6_WARNING, "TG WS Proxy"),
+        daemon=True,
+    ).start()
+
+
+# update check
+
+def maybe_notify_update(
+    cfg: dict,
+    is_exiting: Callable[[], bool],
+    ask_open: Callable[[str, str], bool],
+) -> None:
+    if not cfg.get("check_updates", True):
+        return
+
+    def _work():
+        time.sleep(1.5)
+        if is_exiting():
+            return
+        try:
+            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+            import webbrowser
+
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update"):
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            if ask_open(
+                f"Доступна новая версия: {ver}\n\nОткрыть страницу релиза в браузере?",
+                "TG WS Proxy — обновление",
+            ):
+                webbrowser.open(url)
+        except Exception as exc:
+            log.warning("Update check failed: %s", repr(exc))
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
+
+
+# ctk thread (windows / linux)
+
+_ctk_root: Any = None
+_ctk_root_ready = threading.Event()
+
+
+def ensure_ctk_thread(ctk: Any, mode: str = "auto") -> bool:
+    global _ctk_root
+    if ctk is None:
+        return False
+    if _ctk_root_ready.is_set():
+        return True
+
+    def _run():
+        global _ctk_root
+        from ui.ctk_theme import apply_ctk_appearance, install_tkinter_variable_del_guard
+
+        install_tkinter_variable_del_guard()
+        apply_ctk_appearance(ctk, mode)
+        _ctk_root = ctk.CTk()
+        _ctk_root.withdraw()
+        _ctk_root_ready.set()
+        _ctk_root.mainloop()
+
+    threading.Thread(target=_run, daemon=True, name="ctk-root").start()
+    _ctk_root_ready.wait(timeout=5.0)
+    return _ctk_root is not None
+
+
+def ctk_run_dialog(build_fn: Callable[[threading.Event], None]) -> None:
+    if _ctk_root is None:
+        return
+    done = threading.Event()
+
+    def _invoke():
+        try:
+            build_fn(done)
+        except Exception:
+            log.exception("CTk dialog failed")
+            done.set()
+
+    _ctk_root.after(0, _invoke)
+    done.wait()
+    import gc
+    gc.collect()
+
+
+def quit_ctk() -> None:
+    if _ctk_root is not None:
+        try:
+            _ctk_root.after(0, _ctk_root.quit)
+        except Exception:
+            pass
+
+
+# common bootstrap
+
+def bootstrap(cfg: dict) -> None:
+    save_config(cfg)
+    if LOG_FILE.exists():
+        try:
+            LOG_FILE.unlink()
+        except Exception:
+            pass
+    setup_logging(
+        cfg.get("verbose", False),
+        log_max_mb=cfg.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]),
+    )
+    log.info("TG WS Proxy версия %s starting", __version__)
+    log.info("Config: %s", cfg)
+    log.info("Log file: %s", LOG_FILE)

utils/update_check.py

@@ -0,0 +1,276 @@
+"""
+Минимальная проверка новой версии через GitHub Releases API (без сторонних зависимостей).
+
+Ограничение частоты запросов: не чаще одного раза в час на машину (кэш в каталоге
+данных приложения). Поддерживается If-None-Match (ETag) для ответа 304.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+import time
+from itertools import zip_longest
+from pathlib import Path
+from typing import Any, Dict, Optional, Tuple
+from urllib.error import HTTPError, URLError
+from urllib.request import Request
+from proxy.utils import build_github_opener
+
+REPO = "Flowseal/tg-ws-proxy"
+RELEASES_LATEST_API = f"https://api.github.com/repos/{REPO}/releases/latest"
+RELEASES_PAGE_URL = f"https://github.com/{REPO}/releases/latest"
+
+# Не чаще одного полного запроса к API в час (без учёта 304 с тем же ETag).
+_MIN_FETCH_INTERVAL_SEC = 3600.0
+
+_state: Dict[str, Any] = {
+    "checked": False,
+    "has_update": False,
+    "ahead_of_release": False,
+    "latest": None,
+    "html_url": None,
+    "error": None,
+    "assets": [],
+}
+
+
+def _cache_file() -> Optional[Path]:
+    try:
+        if sys.platform == "win32":
+            root = Path(os.environ.get("APPDATA", str(Path.home()))) / "TgWsProxy"
+        elif sys.platform == "darwin":
+            root = Path.home() / "Library/Application Support/TgWsProxy"
+        else:
+            xdg = os.environ.get("XDG_CONFIG_HOME")
+            root = (Path(xdg).expanduser() if xdg else Path.home() / ".config") / "TgWsProxy"
+        root.mkdir(parents=True, exist_ok=True)
+        return root / ".update_check_cache.json"
+    except OSError:
+        return None
+
+
+def _load_cache(path: Optional[Path]) -> Dict[str, Any]:
+    if not path or not path.is_file():
+        return {}
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+
+
+def _save_cache(path: Optional[Path], data: Dict[str, Any]) -> None:
+    if not path:
+        return
+    try:
+        path.write_text(json.dumps(data), encoding="utf-8")
+    except OSError:
+        pass
+
+
+def _parse_version_tuple(s: str) -> tuple:
+    s = (s or "").strip().lstrip("vV")
+    if not s:
+        return (0,)
+    parts = []
+    for seg in s.split("."):
+        digits = next((seg[:i] for i, c in enumerate(seg) if not c.isdigit()), seg)
+        if digits:
+            try:
+                parts.append(int(digits))
+            except ValueError:
+                parts.append(0)
+        else:
+            parts.append(0)
+    return tuple(parts) if parts else (0,)
+
+
+def _version_gt(a: str, b: str) -> bool:
+    """True, если версия a новее b (простое сравнение по сегментам)."""
+    ta = _parse_version_tuple(a)
+    tb = _parse_version_tuple(b)
+    for x, y in zip_longest(ta, tb, fillvalue=0):
+        if x > y:
+            return True
+        if x < y:
+            return False
+    return False
+
+
+def _apply_release_tag(
+    tag: str, html_url: str, current_version: str,
+) -> None:
+    global _state
+    if not tag:
+        _state["has_update"] = False
+        _state["ahead_of_release"] = False
+        _state["latest"] = None
+        _state["html_url"] = html_url.strip() or RELEASES_PAGE_URL
+        return
+    latest_clean = tag.lstrip("vV")
+    cur = (current_version or "").strip().lstrip("vV")
+    _state["latest"] = latest_clean
+    _state["html_url"] = html_url.strip() or RELEASES_PAGE_URL
+    _state["has_update"] = _version_gt(latest_clean, cur)
+    _state["ahead_of_release"] = bool(latest_clean) and _version_gt(
+        cur, latest_clean
+    )
+
+
+def fetch_latest_release(
+    timeout: float = 12.0,
+    etag: Optional[str] = None,
+) -> Tuple[Optional[dict], Optional[str], int]:
+    """
+    GET releases/latest. Возвращает (data или None при 304, etag или None, HTTP-код).
+    """
+    headers = {
+        "Accept": "application/vnd.github+json",
+        "User-Agent": "tg-ws-proxy-update-check",
+    }
+    if etag:
+        headers["If-None-Match"] = etag
+    req = Request(
+        RELEASES_LATEST_API,
+        headers=headers,
+        method="GET",
+    )
+    try:
+        with build_github_opener().open(req, timeout=timeout) as resp:
+            code = getattr(resp, "status", None) or resp.getcode()
+            new_etag = resp.headers.get("ETag")
+            raw = resp.read().decode("utf-8", errors="replace")
+            return json.loads(raw), new_etag, int(code)
+    except HTTPError as e:
+        if e.code == 304:
+            hdrs = e.headers
+            new_etag = hdrs.get("ETag") if hdrs else None
+            return None, new_etag or etag, 304
+        raise
+
+
+def run_check(current_version: str) -> None:
+    """Запрашивает последний релиз и обновляет внутреннее состояние."""
+    global _state
+    _state["checked"] = True
+    _state["error"] = None
+
+    cache_path = _cache_file()
+    cache = _load_cache(cache_path)
+    now = time.time()
+    last_attempt = float(cache.get("last_attempt_at") or 0)
+
+    if last_attempt and (now - last_attempt) < _MIN_FETCH_INTERVAL_SEC:
+        tag = (cache.get("tag_name") or "").strip()
+        if tag:
+            _apply_release_tag(tag, cache.get("html_url") or "", current_version)
+            _state["assets"] = cache.get("assets") or []
+            return
+        err = cache.get("last_error")
+        _state["error"] = (
+            err if err else "Проверка обновлений отложена (интервал между запросами)."
+        )
+        _state["has_update"] = False
+        _state["ahead_of_release"] = False
+        _state["latest"] = None
+        _state["html_url"] = RELEASES_PAGE_URL
+        return
+
+    etag = (cache.get("etag") or "").strip() or None
+    try:
+        data, new_etag, code = fetch_latest_release(etag=etag)
+        cache["last_attempt_at"] = now
+        if code == 304:
+            tag = (cache.get("tag_name") or "").strip()
+            url = (cache.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            _apply_release_tag(tag, url, current_version)
+            _state["assets"] = cache.get("assets") or []
+            if new_etag:
+                cache["etag"] = new_etag
+            _save_cache(cache_path, cache)
+            return
+
+        assert data is not None
+        tag = (data.get("tag_name") or "").strip()
+        html_url = (data.get("html_url") or "").strip() or RELEASES_PAGE_URL
+        if not tag:
+            _state["has_update"] = False
+            _state["ahead_of_release"] = False
+            _state["latest"] = None
+            _state["html_url"] = html_url
+        else:
+            _apply_release_tag(tag, html_url, current_version)
+        if new_etag:
+            cache["etag"] = new_etag
+        cache["tag_name"] = tag
+        cache["html_url"] = html_url
+        assets = [
+            {"name": a.get("name", ""), "url": a.get("browser_download_url", ""), "digest": a.get("digest", "")}
+            for a in (data.get("assets") or [])
+            if a.get("name") and a.get("browser_download_url")
+        ]
+        _state["assets"] = assets
+        cache["assets"] = assets
+        cache.pop("last_error", None)
+        _save_cache(cache_path, cache)
+    except (HTTPError, URLError, OSError, TimeoutError, ValueError, json.JSONDecodeError) as e:
+        cache["last_attempt_at"] = now
+        msg = str(e)
+        if isinstance(e, HTTPError) and e.code == 403:
+            msg = (
+                "GitHub API вернул 403 (лимит или доступ). Повторите позже."
+            )
+        cache["last_error"] = msg
+        _save_cache(cache_path, cache)
+        _state["error"] = msg
+        _state["has_update"] = False
+        _state["ahead_of_release"] = False
+        _state["latest"] = None
+        _state["html_url"] = RELEASES_PAGE_URL
+
+
+def get_status() -> Dict[str, Any]:
+    """Снимок состояния после run_check (для подписей в настройках)."""
+    return dict(_state)
+
+
+def get_update_asset(exe_path: Path) -> Optional[Tuple[str, str]]:
+    assets = _state.get("assets") or []
+    if not assets:
+        return None
+
+    # Try SHA256 match against release asset digests
+    try:
+        import hashlib
+        h = hashlib.sha256()
+        with open(exe_path, "rb") as f:
+            while True:
+                chunk = f.read(65536)
+                if not chunk:
+                    break
+                h.update(chunk)
+        exe_sha = h.hexdigest().lower()
+        for a in assets:
+            d = (a.get("digest") or "").lower()
+            if d.startswith("sha256:") and d[7:] == exe_sha:
+                return a["url"], a["name"]
+    except Exception:
+        pass
+
+    # Fallback
+    import struct
+    is_64 = struct.calcsize("P") * 8 == 64
+    try:
+        is_modern = sys.getwindowsversion().major >= 10
+    except Exception:
+        is_modern = True
+    if is_modern:
+        name = "TgWsProxy_windows.exe"
+    elif is_64:
+        name = "TgWsProxy_windows_7_64bit.exe"
+    else:
+        name = "TgWsProxy_windows_7_32bit.exe"
+    for a in assets:
+        if a.get("name") == name:
+            return a["url"], a["name"]
+    return None

utils/win32_theme.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+import sys
+
+def is_windows_dark_theme() -> bool:
+    if sys.platform != "win32":
+        return False
+
+    try:
+        import winreg
+        key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, r"Software\Microsoft\Windows\CurrentVersion\Themes\Personalize")
+        value, _ = winreg.QueryValueEx(key, "AppsUseLightTheme")
+        return value == 0
+    except Exception:
+        return False
+
+def apply_windows_dark_theme() -> None:
+    try:
+        import ctypes
+        uxtheme = ctypes.windll.uxtheme
+        
+        try:
+            set_preferred = uxtheme[135]
+            result = set_preferred(2)
+            if result == 0:
+                flush = uxtheme[136]
+                flush()
+        except Exception:
+            try:
+                allow_dark = uxtheme[135]
+                allow_dark(True)
+            except Exception:
+                pass
+    except Exception:
+        pass

windows.py

@@ -0,0 +1,664 @@
+from __future__ import annotations
+
+import ctypes
+import os
+import subprocess
+import sys
+import threading
+import time
+import webbrowser
+import winreg
+import tempfile
+
+from pathlib import Path
+from typing import Optional
+from proxy.utils import build_github_opener
+
+try:
+    import pyperclip
+except ImportError:
+    pyperclip = None
+
+try:
+    import pystray
+except ImportError:
+    pystray = None
+
+try:
+    import customtkinter as ctk
+except ImportError:
+    ctk = None
+
+try:
+    from PIL import Image
+except ImportError:
+    Image = None
+
+from proxy import get_link_host
+
+from utils.win32_theme import (
+    is_windows_dark_theme, 
+    apply_windows_dark_theme,
+)
+from utils.tray_common import (
+    APP_NAME, DEFAULT_CONFIG, FIRST_RUN_MARKER, IS_FROZEN, LOG_FILE,
+    acquire_lock, bootstrap, check_ipv6_warning, ctk_run_dialog,
+    ensure_ctk_thread, ensure_dirs, load_config, load_icon, log,
+    quit_ctk, release_lock, restart_proxy,
+    save_config, start_proxy, stop_proxy, tg_proxy_url,
+)
+from ui.ctk_tray_ui import (
+    install_tray_config_buttons, install_tray_config_form,
+    populate_first_run_window, tray_settings_scroll_and_footer,
+    validate_config_form,
+)
+from ui.ctk_theme import (
+    CONFIG_DIALOG_FRAME_PAD, CONFIG_DIALOG_SIZE, FIRST_RUN_SIZE,
+    create_ctk_toplevel, ctk_theme_for_platform, main_content_frame,
+)
+
+_tray_icon: Optional[object] = None
+_config: dict = {}
+_exiting = False
+_win_mutex_handle = None
+
+_ERROR_ALREADY_EXISTS = 183
+
+
+def _acquire_win_mutex() -> bool | None:
+    global _win_mutex_handle
+    try:
+        kernel32 = ctypes.windll.kernel32
+        kernel32.CreateMutexW.restype = ctypes.c_void_p
+        kernel32.CreateMutexW.argtypes = [ctypes.c_void_p, ctypes.c_bool, ctypes.c_wchar_p]
+        handle = kernel32.CreateMutexW(None, True, "Local\\TgWsProxy_SingleInstance")
+        if kernel32.GetLastError() == _ERROR_ALREADY_EXISTS:
+            kernel32.CloseHandle(ctypes.c_void_p(handle))
+            return False
+        if not handle:
+            return None
+        _win_mutex_handle = handle
+        return True
+    except Exception:
+        return None
+
+
+def _release_win_mutex() -> None:
+    global _win_mutex_handle
+    if _win_mutex_handle:
+        try:
+            kernel32 = ctypes.windll.kernel32
+            kernel32.ReleaseMutex(ctypes.c_void_p(_win_mutex_handle))
+            kernel32.CloseHandle(ctypes.c_void_p(_win_mutex_handle))
+        except Exception:
+            pass
+        _win_mutex_handle = None
+
+ICON_PATH = str(Path(__file__).parent / "icon.ico")
+
+# win32 dialogs
+
+_u32 = ctypes.windll.user32
+_u32.MessageBoxW.argtypes = [ctypes.c_void_p, ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.c_uint]
+_u32.MessageBoxW.restype = ctypes.c_int
+
+_MB_OK_ERR = 0x10
+_MB_OK_INFO = 0x40
+_MB_YESNO_Q = 0x24
+_MB_YESNOCANCEL_Q = 0x23
+_IDYES = 6
+_IDNO = 7
+
+
+def _show_error(text: str, title: str = "TG WS Proxy — Ошибка") -> None:
+    _u32.MessageBoxW(None, text, title, _MB_OK_ERR)
+
+
+def _show_info(text: str, title: str = "TG WS Proxy") -> None:
+    _u32.MessageBoxW(None, text, title, _MB_OK_INFO)
+
+
+def _ask_yes_no(text: str, title: str = "TG WS Proxy") -> bool:
+    return _u32.MessageBoxW(None, text, title, _MB_YESNO_Q) == _IDYES
+
+
+def update_ctk_form(
+    text: str, title: str = "TG WS Proxy", download_url: Optional[str] = None,
+    release_url: Optional[str] = None,
+) -> str:
+    if ctk is None or not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
+        result = _u32.MessageBoxW(None, text, title, _MB_YESNOCANCEL_Q)
+        if result == _IDYES:
+            return "update"
+        if result == _IDNO:
+            return "open"
+        return "close"
+
+    result = {"value": "close"}
+
+    def _build(done: threading.Event) -> None:
+        theme = ctk_theme_for_platform()
+        root = create_ctk_toplevel(
+            ctk,
+            title=title,
+            width=310 if IS_FROZEN else 210,
+            height=130 if IS_FROZEN else 100,
+            theme=theme,
+            after_create=lambda r: r.iconbitmap(ICON_PATH),
+        )
+        frame = main_content_frame(ctk, root, theme, padx=16, pady=14)
+
+        ctk.CTkLabel(
+            frame,
+            text=text,
+            justify="left",
+            anchor="w",
+            wraplength=270,
+            font=(theme.ui_font_family, 12),
+            text_color=theme.text_primary,
+        ).pack(fill="x", pady=(0, 10))
+
+        row = ctk.CTkFrame(frame, fg_color="transparent")
+        row.pack(fill="x")
+
+        status_label = ctk.CTkLabel(
+            frame, text="", justify="left", anchor="w", wraplength=270,
+            font=(theme.ui_font_family, 11), text_color=theme.text_secondary,
+        )
+        status_label.pack(fill="x", pady=(6, 0))
+
+        btns: list = []
+
+        def _set_status(msg: str) -> None:
+            root.after(0, lambda: status_label.configure(text=msg))
+
+        def _close_with(value: str) -> None:
+            result["value"] = value
+            root.destroy()
+            done.set()
+
+        def _on_update() -> None:
+            if not download_url:
+                if release_url:
+                    webbrowser.open(release_url)
+                _close_with("open")
+                return
+            for b in btns:
+                b.configure(state="disabled")
+            root.protocol("WM_DELETE_WINDOW", lambda: None)
+            def _run():
+                _perform_update(download_url, set_status=_set_status)
+                root.after(0, lambda: [b.configure(state="normal") for b in btns])
+                root.after(0, lambda: root.protocol("WM_DELETE_WINDOW", lambda: _close_with("close")))
+            threading.Thread(target=_run, daemon=True).start()
+
+        if IS_FROZEN:
+            btn_upd = ctk.CTkButton(
+                row, text="Обновить", width=88, height=34,
+                font=(theme.ui_font_family, 13), command=_on_update,
+            )
+            btn_upd.pack(side="left", padx=(0, 6))
+            btns.append(btn_upd)
+        btn_pg = ctk.CTkButton(
+            row, text="Страница", width=88, height=34,
+            font=(theme.ui_font_family, 13), command=lambda: _close_with("open"),
+        )
+        btn_pg.pack(side="left", padx=(0, 6))
+        btns.append(btn_pg)
+        btn_cl = ctk.CTkButton(
+            row, text="Закрыть", width=88, height=34,
+            font=(theme.ui_font_family, 13),
+            fg_color=theme.field_bg, hover_color=theme.field_border,
+            text_color=theme.text_primary, border_width=1, border_color=theme.field_border,
+            command=lambda: _close_with("close"),
+        )
+        btn_cl.pack(side="left")
+        btns.append(btn_cl)
+
+        root.protocol("WM_DELETE_WINDOW", lambda: _close_with("close"))
+
+    ctk_run_dialog(_build)
+    return result["value"]
+
+
+def _perform_update(download_url: str, set_status=None) -> None:
+    def _step(msg: str) -> None:
+        log.info("Update: %s", msg)
+        if set_status:
+            set_status(msg)
+            time.sleep(0.8)
+
+    def _err(msg: str) -> None:
+        log.error("Update error: %s", msg)
+        if set_status:
+            set_status(f"Ошибка: {msg}")
+        else:
+            _show_error(msg)
+
+    _step("Скачивание...")
+    cur_exe = Path(sys.executable)
+    old_exe = cur_exe.with_name(cur_exe.stem + "_oldtgws.exe")
+    tmp_path = None
+    try:
+        fd, tmp_name = tempfile.mkstemp(dir=cur_exe.parent, suffix=".tmp")
+        os.close(fd)
+        tmp_path = Path(tmp_name)
+        log.info("Downloading update from %s", download_url)
+        opener = build_github_opener()
+        with opener.open(download_url) as _resp:
+            with open(str(tmp_path), "wb") as _fout:
+                while True:
+                    _chunk = _resp.read(65536)
+                    if not _chunk:
+                        break
+                    _fout.write(_chunk)
+    except Exception as exc:
+        _err(f"Не удалось скачать:\n{exc}")
+        if tmp_path:
+            try:
+                tmp_path.unlink(missing_ok=True)
+            except OSError:
+                pass
+        return
+
+    _step("Замена файла...")
+    try:
+        if old_exe.exists():
+            old_exe.unlink()
+        cur_exe.rename(old_exe)
+    except Exception as exc:
+        _err(f"Не удалось переименовать файл:\n{exc}")
+        try:
+            tmp_path.unlink(missing_ok=True)
+        except OSError:
+            pass
+        return
+
+    try:
+        tmp_path.rename(cur_exe)
+    except Exception as exc:
+        _err(f"Не удалось переместить файл:\n{exc}")
+        try:
+            old_exe.rename(cur_exe)
+        except OSError:
+            pass
+        try:
+            tmp_path.unlink(missing_ok=True)
+        except OSError:
+            pass
+        return
+
+    _step("Перезапуск...")
+    _release_win_mutex()
+    stop_proxy()
+
+    # Don't reuse existing _MEI* dir
+    env = os.environ.copy()
+    for _k in [k for k in env if k.startswith("_PYI_") or k == "_MEIPASS"]:
+        del env[_k]
+    if hasattr(sys, "_MEIPASS"):
+        _mei = os.path.normcase(sys._MEIPASS.rstrip("\\/"))
+        env["PATH"] = os.pathsep.join(
+            p for p in env.get("PATH", "").split(os.pathsep)
+            if os.path.normcase(p.rstrip("\\/")) != _mei
+        )
+
+    try:
+        subprocess.Popen(
+            [str(cur_exe)],
+            env=env,
+            creationflags=subprocess.DETACHED_PROCESS | subprocess.CREATE_NEW_PROCESS_GROUP,
+        )
+    except Exception as exc:
+        log.error("Failed to launch updated exe: %s", exc)
+    time.sleep(0.5)
+    os._exit(0)
+
+
+def _maybe_do_update(cfg: dict, is_exiting) -> None:
+    if not cfg.get("check_updates", True):
+        return
+
+    def _work():
+        time.sleep(1.5)
+        if is_exiting():
+            return
+        try:
+            from proxy import __version__
+            from utils.update_check import RELEASES_PAGE_URL, get_status, get_update_asset, run_check
+
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update") or is_exiting():
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            asset = get_update_asset(Path(sys.executable)) if IS_FROZEN else None
+            choice = update_ctk_form(
+                f"Доступна новая версия: {ver}",
+                download_url=asset[0] if asset else None,
+                release_url=url,
+            )
+            if choice == "open":
+                webbrowser.open(url)
+        except Exception as exc:
+            log.warning("Update check failed: %s", repr(exc))
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
+
+
+# autostart (registry)
+
+_RUN_KEY = r"Software\Microsoft\Windows\CurrentVersion\Run"
+
+
+def _supports_autostart() -> bool:
+    return IS_FROZEN
+
+
+def _autostart_command() -> str:
+    return f'"{sys.executable}"'
+
+
+def is_autostart_enabled() -> bool:
+    try:
+        with winreg.OpenKey(winreg.HKEY_CURRENT_USER, _RUN_KEY, 0, winreg.KEY_READ) as k:
+            val, _ = winreg.QueryValueEx(k, APP_NAME)
+        return str(val).strip() == _autostart_command().strip()
+    except (FileNotFoundError, OSError):
+        return False
+
+
+def set_autostart_enabled(enabled: bool) -> None:
+    try:
+        with winreg.CreateKey(winreg.HKEY_CURRENT_USER, _RUN_KEY) as k:
+            if enabled:
+                winreg.SetValueEx(k, APP_NAME, 0, winreg.REG_SZ, _autostart_command())
+            else:
+                try:
+                    winreg.DeleteValue(k, APP_NAME)
+                except FileNotFoundError:
+                    pass
+    except OSError as exc:
+        log.error("Failed to update autostart: %s", exc)
+        _show_error(
+            "Не удалось изменить автозапуск.\n\n"
+            "Попробуйте запустить приложение от имени пользователя "
+            f"с правами на реестр.\n\nОшибка: {exc}"
+        )
+
+
+# tray callbacks
+
+def _on_open_in_telegram(icon=None, item=None) -> None:
+    url = tg_proxy_url(_config)
+    log.info("Opening %s", url)
+    try:
+        if not webbrowser.open(url):
+            raise RuntimeError
+    except Exception:
+        log.info("Browser open failed, copying to clipboard")
+        if pyperclip is None:
+            _show_error(
+                "Не удалось открыть Telegram автоматически.\n\n"
+                f"Установите пакет pyperclip для копирования в буфер или откройте вручную:\n{url}"
+            )
+            return
+        try:
+            pyperclip.copy(url)
+            _show_info(
+                "Не удалось открыть Telegram автоматически.\n\n"
+                f"Ссылка скопирована в буфер обмена, отправьте её в Telegram и нажмите по ней ЛКМ:\n{url}"
+            )
+        except Exception as exc:
+            log.error("Clipboard copy failed: %s", exc)
+            _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_copy_link(icon=None, item=None) -> None:
+    url = tg_proxy_url(_config)
+    log.info("Copying link: %s", url)
+    if pyperclip is None:
+        _show_error(
+            "Установите пакет pyperclip для копирования в буфер обмена."
+        )
+        return
+    try:
+        pyperclip.copy(url)
+    except Exception as exc:
+        log.error("Clipboard copy failed: %s", exc)
+        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_restart(icon=None, item=None) -> None:
+    threading.Thread(
+        target=lambda: restart_proxy(_config, _show_error), daemon=True
+    ).start()
+
+
+def _on_edit_config(icon=None, item=None) -> None:
+    threading.Thread(target=_edit_config_dialog, daemon=True).start()
+
+
+def _on_open_logs(icon=None, item=None) -> None:
+    log.info("Opening log file: %s", LOG_FILE)
+    if LOG_FILE.exists():
+        try:
+            os.startfile(str(LOG_FILE))
+        except Exception as exc:
+            log.error("Failed to open log file: %s", exc)
+            _show_error(f"Не удалось открыть файл логов:\n{exc}")
+    else:
+        _show_info("Файл логов ещё не создан.")
+
+
+def _on_exit(icon=None, item=None) -> None:
+    global _exiting
+    if _exiting:
+        os._exit(0)
+        return
+    _exiting = True
+    log.info("User requested exit")
+    quit_ctk()
+    threading.Thread(target=lambda: (time.sleep(3), os._exit(0)), daemon=True, name="force-exit").start()
+    if icon:
+        icon.stop()
+
+
+# settings dialog
+
+def _edit_config_dialog() -> None:
+    if not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
+        _show_error("customtkinter не установлен.")
+        return
+
+    cfg = dict(_config)
+    cfg["autostart"] = is_autostart_enabled()
+    if _supports_autostart() and not cfg["autostart"]:
+        set_autostart_enabled(False)
+
+    def _build(done: threading.Event) -> None:
+        theme = ctk_theme_for_platform()
+        w, h = CONFIG_DIALOG_SIZE
+        if _supports_autostart():
+            h += 100
+
+        root = create_ctk_toplevel(
+            ctk, title="TG WS Proxy — Настройки", width=w, height=h, theme=theme,
+            after_create=lambda r: r.iconbitmap(ICON_PATH),
+        )
+        fpx, fpy = CONFIG_DIALOG_FRAME_PAD
+        frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
+        scroll, footer = tray_settings_scroll_and_footer(ctk, frame, theme)
+        widgets = install_tray_config_form(
+            ctk, scroll, theme, cfg, DEFAULT_CONFIG,
+            show_autostart=_supports_autostart(),
+            autostart_value=cfg.get("autostart", False),
+        )
+
+        _original_appearance = ctk.get_appearance_mode()
+
+        def _finish() -> None:
+            root.destroy()
+            done.set()
+
+        def _cancel() -> None:
+            ctk.set_appearance_mode(_original_appearance)
+            _finish()
+
+        def on_save() -> None:
+            from tkinter import messagebox
+            merged = validate_config_form(widgets, DEFAULT_CONFIG, include_autostart=_supports_autostart())
+            if isinstance(merged, str):
+                messagebox.showerror("TG WS Proxy — Ошибка", merged, parent=root)
+                return
+
+            _ui_only_keys = {"appearance", "autostart", "check_updates"}
+            config_changed = any(merged.get(k) != cfg.get(k) for k in merged)
+            proxy_changed = any(merged.get(k) != cfg.get(k) for k in merged if k not in _ui_only_keys)
+
+            if not config_changed:
+                _finish()
+                return
+
+            save_config(merged)
+            _config.update(merged)
+            log.info("Config saved: %s", merged)
+            if _supports_autostart():
+                set_autostart_enabled(bool(merged.get("autostart", False)))
+            _tray_icon.menu = _build_menu()
+
+            if not proxy_changed:
+                _finish()
+                return
+
+            do_restart = messagebox.askyesno(
+                "Перезапустить?",
+                "Настройки сохранены.\n\nПерезапустить прокси сейчас?",
+                parent=root,
+            )
+            _finish()
+            if do_restart:
+                threading.Thread(target=lambda: restart_proxy(_config, _show_error), daemon=True).start()
+
+        root.protocol("WM_DELETE_WINDOW", _cancel)
+        install_tray_config_buttons(ctk, footer, theme, on_save=on_save, on_cancel=_cancel)
+
+    ctk_run_dialog(_build)
+
+
+# first run
+
+def _show_first_run() -> None:
+    ensure_dirs()
+    if FIRST_RUN_MARKER.exists():
+        return
+    if not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
+        FIRST_RUN_MARKER.touch()
+        return
+
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    secret = _config.get("secret", DEFAULT_CONFIG["secret"])
+
+    def _build(done: threading.Event) -> None:
+        theme = ctk_theme_for_platform()
+        w, h = FIRST_RUN_SIZE
+        root = create_ctk_toplevel(
+            ctk, title="TG WS Proxy", width=w, height=h, theme=theme,
+            after_create=lambda r: r.iconbitmap(ICON_PATH),
+        )
+
+        def on_done(open_tg: bool) -> None:
+            FIRST_RUN_MARKER.touch()
+            root.destroy()
+            done.set()
+            if open_tg:
+                _on_open_in_telegram()
+
+        populate_first_run_window(ctk, root, theme, host=host, port=port, secret=secret, on_done=on_done)
+
+    ctk_run_dialog(_build)
+
+
+# tray menu
+
+def _build_menu():
+    if pystray is None:
+        return None
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    link_host = get_link_host(host)
+    return pystray.Menu(
+        pystray.MenuItem(f"Открыть в Telegram ({link_host}:{port})", _on_open_in_telegram, default=True),
+        pystray.MenuItem("Скопировать ссылку", _on_copy_link),
+        pystray.Menu.SEPARATOR,
+        pystray.MenuItem("Перезапустить прокси", _on_restart),
+        pystray.MenuItem("Настройки...", _on_edit_config),
+        pystray.MenuItem("Открыть логи", _on_open_logs),
+        pystray.Menu.SEPARATOR,
+        pystray.MenuItem("Выход", _on_exit),
+    )
+
+
+# entry point
+
+def run_tray() -> None:
+    global _tray_icon, _config
+
+    _config = load_config()
+
+    if is_windows_dark_theme():
+        apply_windows_dark_theme()
+
+    bootstrap(_config)
+
+    if pystray is None or Image is None or ctk is None:
+        log.error("pystray, Pillow or customtkinter not installed; running in console mode")
+        start_proxy(_config, _show_error)
+        try:
+            while True:
+                time.sleep(1)
+        except KeyboardInterrupt:
+            stop_proxy()
+        return
+
+    start_proxy(_config, _show_error)
+    _maybe_do_update(_config, lambda: _exiting)
+    _show_first_run()
+    check_ipv6_warning(_show_info)
+
+    _tray_icon = pystray.Icon(APP_NAME, load_icon(), "TG WS Proxy", menu=_build_menu())
+    log.info("Tray icon running")
+    _tray_icon.run()
+
+    stop_proxy()
+    log.info("Tray app exited")
+
+
+def main() -> None:
+    if (mutex_result := _acquire_win_mutex()) is False or mutex_result is None and not acquire_lock():
+        _show_info("Приложение уже запущено.", os.path.basename(sys.argv[0]))
+        return
+
+    if IS_FROZEN:
+        def _cleanup_old_exes():
+            exe_dir = Path(sys.executable).parent
+            time.sleep(3)
+            for _f in exe_dir.glob("*_oldtgws.exe"):
+                try:
+                    _f.unlink()
+                    log.info("Deleted leftover: %s", _f)
+                except OSError:
+                    pass
+        threading.Thread(target=_cleanup_old_exes, daemon=True, name="cleanup-old").start()
+
+    try:
+        run_tray()
+    finally:
+        release_lock()
+        _release_win_mutex()
+
+
+if __name__ == "__main__":
+    main()