Merge 336602e93a into 0d11062c92

add restart action, log viewer, service error state, tray icon

.dockerignore

@@ -0,0 +1,28 @@
+.git
+.github
+.gitignore
+__pycache__/
+*.py[cod]
+*.pyo
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.venv/
+venv/
+dist/
+build/
+packaging/
+windows.py
+icon.ico
+*.spec
+*.spec.bak
+*.manifest
+*.log
+.vscode/
+.idea/
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+Desktop.ini

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,20 @@
+name: 🐛 Проблема
+title: '[Проблема] '
+description: Сообщить о проблеме
+labels: ['type: проблема', 'status: нуждается в сортировке']
+
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Опишите вашу проблему
+      description: Чётко опишите проблему с которой вы столкнулись
+      placeholder: Описание проблемы
+    validations:
+      required: true
+
+  - type: textarea
+    id: additions
+    attributes:
+      label: Дополнительные детали
+      description: Если у вас проблемы с работой прокси, то приложите файл логов в момент возникновения проблемы.

.github/workflows/build.yml

@@ -3,86 +3,430 @@ name: Build & Release
 on:
   workflow_dispatch:
     inputs:
+      make_release:
+        description: 'Create Github Release?'
+        type: boolean
+        required: true
+        default: false
       version:
         description: "Release version tag (e.g. v1.0.0)"
-        required: true
+        required: false
         default: "v1.0.0"
 
 permissions:
   contents: write
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
-  build:
+  build-windows:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
           cache: "pip"
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: pip install .
 
       - name: Install pyinstaller
-        run: pip install pyinstaller
+        run: pip install "pyinstaller==6.13.0"
 
       - name: Build EXE with PyInstaller
         run: pyinstaller packaging/windows.spec --noconfirm
 
+      - name: Rename artifact
+        run: mv dist/TgWsProxy.exe dist/TgWsProxy_windows.exe
+
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: TgWsProxy
-          path: dist/TgWsProxy.exe
+          path: dist/TgWsProxy_windows.exe
 
   build-win7:
     runs-on: windows-latest
+    strategy:
+      matrix:
+        include:
+          - arch: x64
+            suffix: 64bit
+          - arch: x86
+            suffix: 32bit
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - name: Setup Python 3.8 (last version supporting Win7)
-        uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.8"
+          architecture: ${{ matrix.arch }}
           cache: "pip"
+          
+      - name: Install dependencies & pyinstaller
+        run: pip install . "pyinstaller==5.13.2"
 
-      - name: Install dependencies (Win7-compatible)
-        run: pip install -r requirements-win7.txt
-
-      - name: Install pyinstaller
-        run: pip install "pyinstaller==5.13.2"
-
-      - name: Build EXE with PyInstaller (Win7)
+      - name: Build EXE with PyInstaller
         run: pyinstaller packaging/windows.spec --noconfirm
 
       - name: Rename artifact
-        run: mv dist/TgWsProxy.exe dist/TgWsProxy-win7.exe
+        run: mv dist/TgWsProxy.exe dist/TgWsProxy_windows_7_${{ matrix.suffix }}.exe
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: TgWsProxy-win7
-          path: dist/TgWsProxy-win7.exe
+          name: TgWsProxy-win7-${{ matrix.suffix }}
+          path: dist/TgWsProxy_windows_7_${{ matrix.suffix }}.exe
 
-  release:
-    needs: [build, build-win7]
+  build-macos:
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install universal2 Python
+        run: |
+          set -euo pipefail
+          curl -LO https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg
+          sudo installer -pkg python-3.12.10-macos11.pkg -target /
+          echo "/Library/Frameworks/Python.framework/Versions/3.12/bin" >> "$GITHUB_PATH"
+
+      - name: Install dependencies
+        run: |
+          set -euo pipefail
+          python3.12 -m pip install --upgrade pip setuptools wheel
+          python3.12 -m pip install delocate==0.13.0
+
+          mkdir -p wheelhouse/arm64 wheelhouse/x86_64 wheelhouse/universal2
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_11_0_arm64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/arm64 \
+            'cffi>=2.0.0' \
+            Pillow==12.1.0 \
+            psutil==7.0.0
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_10_13_x86_64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/x86_64 \
+            'cffi>=2.0.0' \
+            Pillow==12.1.0
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_10_9_x86_64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/x86_64 \
+            psutil==7.0.0
+
+          delocate-merge \
+            wheelhouse/arm64/cffi-*.whl \
+            wheelhouse/x86_64/cffi-*.whl \
+            -w wheelhouse/universal2
+
+          delocate-merge \
+            wheelhouse/arm64/pillow-12.1.0-*.whl \
+            wheelhouse/x86_64/pillow-12.1.0-*.whl \
+            -w wheelhouse/universal2
+
+          delocate-merge \
+            wheelhouse/arm64/psutil-7.0.0-*.whl \
+            wheelhouse/x86_64/psutil-7.0.0-*.whl \
+            -w wheelhouse/universal2
+
+          python3.12 -m pip install --no-deps wheelhouse/universal2/*.whl
+          python3.12 -m pip install .
+          python3.12 -m pip install pyinstaller==6.13.0
+
+      - name: Create macOS icon from ICO
+        run: |
+          set -euo pipefail
+          python3.12 - <<'PY'
+          from PIL import Image
+
+          image = Image.open('icon.ico')
+          image = image.resize((1024, 1024), Image.LANCZOS)
+          image.save('icon_1024.png', 'PNG')
+          PY
+
+          mkdir -p icon.iconset
+          sips -z 16 16 icon_1024.png --out icon.iconset/icon_16x16.png
+          sips -z 32 32 icon_1024.png --out icon.iconset/icon_16x16@2x.png
+          sips -z 32 32 icon_1024.png --out icon.iconset/icon_32x32.png
+          sips -z 64 64 icon_1024.png --out icon.iconset/icon_32x32@2x.png
+          sips -z 128 128 icon_1024.png --out icon.iconset/icon_128x128.png
+          sips -z 256 256 icon_1024.png --out icon.iconset/icon_128x128@2x.png
+          sips -z 256 256 icon_1024.png --out icon.iconset/icon_256x256.png
+          sips -z 512 512 icon_1024.png --out icon.iconset/icon_256x256@2x.png
+          sips -z 512 512 icon_1024.png --out icon.iconset/icon_512x512.png
+          sips -z 1024 1024 icon_1024.png --out icon.iconset/icon_512x512@2x.png
+          iconutil -c icns icon.iconset -o icon.icns
+          rm -rf icon.iconset icon_1024.png
+
+      - name: Build app with PyInstaller
+        run: python3.12 -m PyInstaller packaging/macos.spec --noconfirm
+
+      - name: Validate universal2 app bundle
+        run: |
+          set -euo pipefail
+          found=0
+          while IFS= read -r -d '' file; do
+            if file "$file" | grep -q "Mach-O"; then
+              found=1
+              archs="$(lipo -archs "$file" 2>/dev/null || true)"
+              case "$archs" in
+                *arm64*x86_64*|*x86_64*arm64*) ;;
+                *)
+                  echo "Missing universal2 slices in $file: ${archs:-unknown}" >&2
+                  exit 1
+                  ;;
+              esac
+            fi
+          done < <(find "dist/TG WS Proxy.app" -type f -print0)
+
+          if [ "$found" -eq 0 ]; then
+            echo "No Mach-O files found in app bundle" >&2
+            exit 1
+          fi
+
+      - name: Create DMG
+        run: |
+          set -euo pipefail
+          APP_NAME="TG WS Proxy"
+          DMG_TEMP="dist/dmg_temp"
+
+          rm -rf "$DMG_TEMP"
+          mkdir -p "$DMG_TEMP"
+          cp -R "dist/${APP_NAME}.app" "$DMG_TEMP/"
+          ln -s /Applications "$DMG_TEMP/Applications"
+
+          hdiutil create \
+            -volname "$APP_NAME" \
+            -srcfolder "$DMG_TEMP" \
+            -ov \
+            -format UDZO \
+            "dist/TgWsProxy_macos_universal.dmg"
+
+          rm -rf "$DMG_TEMP"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: TgWsProxy-macOS
+          path: dist/TgWsProxy_macos_universal.dmg
+
+  build-linux:
     runs-on: ubuntu-latest
     steps:
-      - name: Download main build
-        uses: actions/download-artifact@v4
-        with:
-          name: TgWsProxy
-          path: dist
+      - name: Checkout
+        uses: actions/checkout@v6
 
-      - name: Download Win7 build
-        uses: actions/download-artifact@v4
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            python3-venv \
+            python3-dev \
+            python3-gi \
+            gir1.2-ayatanaappindicator3-0.1 \
+            python3-tk
+
+      - name: Create venv with system site-packages
+        run: python3 -m venv --system-site-packages .venv
+
+      - name: Install dependencies
+        run: |
+          .venv/bin/pip install --upgrade pip
+          .venv/bin/pip install .
+          .venv/bin/pip install "pyinstaller==6.13.0"
+
+      - name: Build binary with PyInstaller
+        run: .venv/bin/pyinstaller packaging/linux.spec --noconfirm
+
+      - name: Rename binary artifact
+        run: mv dist/TgWsProxy dist/TgWsProxy_linux_amd64
+
+      - name: Create .deb package
+        run: |
+          set -euo pipefail
+          VERSION="${{ github.event.inputs.version }}"
+          VERSION="${VERSION#v}"
+          PKG_ROOT="pkg"
+
+          rm -rf "$PKG_ROOT"
+          mkdir -p \
+            "$PKG_ROOT/DEBIAN" \
+            "$PKG_ROOT/usr/bin" \
+            "$PKG_ROOT/usr/share/applications" \
+            "$PKG_ROOT/usr/share/icons/hicolor/256x256/apps"
+
+          install -m 755 dist/TgWsProxy_linux_amd64 "$PKG_ROOT/usr/bin/tg-ws-proxy"
+
+          .venv/bin/python - <<PY
+          from PIL import Image
+
+          Image.open("icon.ico").save(
+              "${PKG_ROOT}/usr/share/icons/hicolor/256x256/apps/tg-ws-proxy.png",
+              "PNG",
+          )
+          PY
+
+          cat > "$PKG_ROOT/usr/share/applications/tg-ws-proxy.desktop" <<EOF
+          [Desktop Entry]
+          Type=Application
+          Name=TG WS Proxy
+          GenericName=Telegram Proxy
+          Comment=Telegram Desktop WebSocket Bridge Proxy
+          Exec=tg-ws-proxy
+          Icon=tg-ws-proxy
+          Terminal=false
+          Categories=Network;
+          StartupNotify=true
+          Keywords=telegram;proxy;websocket;
+          EOF
+
+          cat > "$PKG_ROOT/DEBIAN/control" <<EOF
+          Package: tg-ws-proxy
+          Version: ${VERSION}
+          Section: net
+          Priority: optional
+          Architecture: amd64
+          Maintainer: Flowseal
+          Depends: libgtk-3-0, libayatana-appindicator3-1, python3-tk
+          Description: Telegram Desktop WebSocket Bridge Proxy
+           SOCKS5/WebSocket bridge proxy for Telegram Desktop with tray UI.
+          EOF
+
+          dpkg-deb --build --root-owner-group \
+            "$PKG_ROOT" \
+            "dist/TgWsProxy_linux_amd64.deb"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
         with:
-          name: TgWsProxy-win7
+          name: TgWsProxy-linux
+          path: |
+            dist/TgWsProxy_linux_amd64
+            dist/TgWsProxy_linux_amd64.deb
+
+  build-android:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      ANDROID_APK_STANDARD_NAME: tg-ws-proxy-android-${{ github.event.inputs.version }}.apk
+      ANDROID_APK_LEGACY32_NAME: tg-ws-proxy-android-${{ github.event.inputs.version }}-legacy32.apk
+    defaults:
+      run:
+        working-directory: android
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Validate Android release signing secrets
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          test -n "$ANDROID_KEYSTORE_BASE64" || { echo "Missing secret: ANDROID_KEYSTORE_BASE64"; exit 1; }
+          test -n "$ANDROID_KEYSTORE_PASSWORD" || { echo "Missing secret: ANDROID_KEYSTORE_PASSWORD"; exit 1; }
+          test -n "$ANDROID_KEY_ALIAS" || { echo "Missing secret: ANDROID_KEY_ALIAS"; exit 1; }
+          test -n "$ANDROID_KEY_PASSWORD" || { echo "Missing secret: ANDROID_KEY_PASSWORD"; exit 1; }
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "17"
+          cache: gradle
+          cache-dependency-path: |
+            android/settings.gradle.kts
+            android/build.gradle.kts
+            android/gradle.properties
+            android/app/build.gradle.kts
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Accept Android SDK licenses
+        run: yes | sdkmanager --licenses > /dev/null
+
+      - name: Install Android SDK packages
+        run: sdkmanager "platforms;android-34" "build-tools;34.0.0"
+
+      - name: Prepare Android release keystore
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/android-release.keystore"
+          test -s "$RUNNER_TEMP/android-release.keystore"
+
+      - name: Build Android release APKs
+        env:
+          LOCAL_CHAQUOPY_REPO: ${{ github.workspace }}/android/.m2-chaquopy-ci
+          ANDROID_KEYSTORE_FILE: ${{ runner.temp }}/android-release.keystore
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          chmod +x gradlew build-local-debug.sh
+          ./build-local-debug.sh assembleStandardRelease
+          ./build-local-debug.sh assembleLegacy32Release
+
+      - name: Rename APKs
+        run: |
+          cp app/build/outputs/apk/standard/release/app-standard-release.apk \
+            "app/build/outputs/apk/standard/release/$ANDROID_APK_STANDARD_NAME"
+          cp app/build/outputs/apk/legacy32/release/app-legacy32-release.apk \
+            "app/build/outputs/apk/legacy32/release/$ANDROID_APK_LEGACY32_NAME"
+
+      - name: Stage Android release artifacts
+        run: |
+          mkdir -p dist
+          cp "app/build/outputs/apk/standard/release/$ANDROID_APK_STANDARD_NAME" "dist/$ANDROID_APK_STANDARD_NAME"
+          cp "app/build/outputs/apk/legacy32/release/$ANDROID_APK_LEGACY32_NAME" "dist/$ANDROID_APK_LEGACY32_NAME"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: TgWsProxy-android-release
+          path: |
+            android/dist/${{ env.ANDROID_APK_STANDARD_NAME }}
+            android/dist/${{ env.ANDROID_APK_LEGACY32_NAME }}
+
+  release:
+    needs: [build-windows, build-win7, build-macos, build-linux, build-android]
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.make_release == 'true' }}
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: TgWsProxy*
+          path: dist
+          merge-multiple: true
+
+      - name: Download Android build
+        uses: actions/download-artifact@v8
+        with:
+          name: TgWsProxy-android-release
           path: dist
 
       - name: Create GitHub Release
@@ -93,9 +437,15 @@ jobs:
           body: |
             ## TG WS Proxy ${{ github.event.inputs.version }}
           files: |
-            dist/TgWsProxy.exe
-            dist/TgWsProxy-win7.exe
+            dist/TgWsProxy_windows.exe
+            dist/TgWsProxy_windows_7_64bit.exe
+            dist/TgWsProxy_windows_7_32bit.exe
+            dist/TgWsProxy_macos_universal.dmg
+            dist/TgWsProxy_linux_amd64
+            dist/TgWsProxy_linux_amd64.deb
+            dist/tg-ws-proxy-android-${{ github.event.inputs.version }}.apk
+            dist/tg-ws-proxy-android-${{ github.event.inputs.version }}-legacy32.apk
           draft: false
           prerelease: false
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -16,6 +16,17 @@ build/
 .idea/
 *.swp
 *.swo
+.gradle/
+.gradle-local/
+android/.gradle-local/
+android/.m2-chaquopy*/
+local.properties
+android/.idea/
+android/build/
+android/app/build/
+android/*.jks
+*.keystore
+android/*.keystore.properties
 
 # OS
 Thumbs.db
@@ -27,3 +38,4 @@ scan_ips.py
 scan.txt
 AyuGramDesktop-dev/
 tweb-master/
+/icon.icns

Dockerfile

@@ -0,0 +1,45 @@
+# syntax=docker/dockerfile:1.7
+
+FROM python:3.12-slim AS builder
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    VIRTUAL_ENV=/opt/venv
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential cargo libffi-dev libssl-dev \
+    && python -m venv "$VIRTUAL_ENV" \
+    && "$VIRTUAL_ENV/bin/pip" install --upgrade pip setuptools wheel \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+RUN "$VIRTUAL_ENV/bin/pip" install cryptography==46.0.5
+
+FROM python:3.12-slim AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH=/opt/venv/bin:$PATH \
+    TG_WS_PROXY_HOST=0.0.0.0 \
+    TG_WS_PROXY_PORT=1080 \
+    TG_WS_PROXY_DC_IPS="2:149.154.167.220 4:149.154.167.220"
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends tini ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system app \
+    && useradd --system --gid app --create-home --home-dir /home/app app
+
+WORKDIR /app
+COPY --from=builder /opt/venv /opt/venv
+COPY proxy ./proxy
+COPY README.md LICENSE ./
+
+USER app
+
+EXPOSE 1080/tcp
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/bin/sh", "-lc", "set -eu; args=\"--host ${TG_WS_PROXY_HOST} --port ${TG_WS_PROXY_PORT}\"; for dc in ${TG_WS_PROXY_DC_IPS}; do args=\"$args --dc-ip $dc\"; done; exec python -u proxy/tg_ws_proxy.py $args \"$@\"", "--"]
+CMD []

README.md

@@ -1,53 +1,192 @@
+> [!CAUTION]
+>
+> ### Реакция антивирусов
+>
+> Windows Defender часто ошибочно помечает приложение как **Wacatac**.  
+> Если вы не можете скачать из-за блокировки, то:
+>
+> 1) Попробуйте скачать версию win7 (она ничем не отличается в плане функционала)
+> 2) Отключите антивирус на время скачивания, добавьте файл в исключения и включите обратно  
+>
+> **Всегда проверяйте, что скачиваете из интернета, тем более из непроверенных источников. Всегда лучше смотреть на детекты широко известных антивирусов на VirusTotal**
+
 # TG WS Proxy
 
-Локальный SOCKS5-прокси для Telegram Desktop, который перенаправляет трафик через WebSocket-соединения к указанным серверам, помогая частично ускорить работу Telegram.  
-  
-**Ожидаемый результат аналогичен прокидыванию hosts для Web Telegram**: ускорение загрузки и скачивания файлов, загрузки сообщений и части медиа.
+**Локальный SOCKS5-прокси** для Telegram Desktop, который **ускоряет работу Telegram**, перенаправляя трафик через WebSocket-соединения. Данные передаются в том же зашифрованном виде, а для работы не нужны сторонние сервера.
 
 <img width="529" height="487" alt="image" src="https://github.com/user-attachments/assets/6a4cf683-0df8-43af-86c1-0e8f08682b62" />
 
 ## Как это работает
 
 ```
-Telegram Desktop → SOCKS5 (127.0.0.1:1080) → TG WS Proxy → WSS (kws*.web.telegram.org) → Telegram DC
+Telegram Desktop → SOCKS5 (127.0.0.1:1080) → TG WS Proxy → WSS → Telegram DC
 ```
 
 1. Приложение поднимает локальный SOCKS5-прокси на `127.0.0.1:1080`
 2. Перехватывает подключения к IP-адресам Telegram
 3. Извлекает DC ID из MTProto obfuscation init-пакета
-4. Устанавливает WebSocket (TLS) соединение к соответствующему DC через домены `kws{N}.web.telegram.org`
+4. Устанавливает WebSocket (TLS) соединение к соответствующему DC через домены Telegram
 5. Если WS недоступен (302 redirect) — автоматически переключается на прямое TCP-соединение
 
 ## 🚀 Быстрый старт
 
 ### Windows
-Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте **`TgWsProxy.exe`**. Он собирается автоматически через [Github Actions](https://github.com/Flowseal/tg-ws-proxy/actions) из открытого исходного кода.
+
+Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте **`TgWsProxy_windows.exe`**. Он собирается автоматически через [Github Actions](https://github.com/Flowseal/tg-ws-proxy/actions) из открытого исходного кода.
 
 При первом запуске откроется окно с инструкцией по подключению Telegram Desktop. Приложение сворачивается в системный трей.
 
 **Меню трея:**
+
 - **Открыть в Telegram** — автоматически настроить прокси через `tg://socks` ссылку
 - **Перезапустить прокси** — перезапуск без выхода из приложения
-- **Настройки...** — GUI-редактор конфигурации
+- **Настройки...** — GUI-редактор конфигурации (в т.ч. версия приложения, опциональная проверка обновлений с GitHub)
 - **Открыть логи** — открыть файл логов
 - **Выход** — остановить прокси и закрыть приложение
 
+При первом запуске после старта может появиться запрос об открытии страницы релиза, если на GitHub вышла новая версия (отключается в настройках).
+
+### macOS
+
+Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте **`TgWsProxy_macos_universal.dmg`** — универсальная сборка для Apple Silicon и Intel.
+
+1. Открыть образ
+2. Перенести **TG WS Proxy.app** в папку **Applications**
+3. При первом запуске macOS может попросить подтвердить открытие: **Системные настройки → Конфиденциальность и безопасность → Всё равно открыть**
+
+### Linux
+
+Для Debian/Ubuntu скачайте со [страницы релизов](https://github.com/Flowseal/tg-ws-proxy/releases) пакет **`TgWsProxy_linux_amd64.deb`**.
+
+Для Arch и Arch-Based дистрибутивов подготовлены пакеты в AUR: [tg-ws-proxy-bin](https://aur.archlinux.org/packages/tg-ws-proxy-bin), [tg-ws-proxy-git](https://aur.archlinux.org/packages/tg-ws-proxy-git), [tg-ws-proxy-cli](https://aur.archlinux.org/packages/tg-ws-proxy-cli)
+
+```shell
+# Установка без AUR-helper
+git clone https://aur.archlinux.org/tg-ws-proxy-bin.git
+cd tg-ws-proxy-bin
+makepkg -si
+
+# При помощи AUR-helper
+paru -S tg-ws-proxy-bin
+
+# Если вы установили -cli пакет, то запуск осуществляется через systemctl, где 8888 это номер порта прокси:
+sudo systemctl start tg-ws-proxy-cli@8888
+```
+
+Для остальных дистрибутивов можно использовать **`TgWsProxy_linux_amd64`** (бинарный файл для x86_64).
+
+```bash
+chmod +x TgWsProxy_linux_amd64
+./TgWsProxy_linux_amd64
+```
+
+При первом запуске откроется окно с инструкцией. Приложение работает в системном трее (требуется AppIndicator).
+
+### Android
+
+Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте подписанный APK вида **`tg-ws-proxy-android-vX.Y.Z.apk`**.
+
+После установки:
+
+- откройте приложение
+- проверьте `Android background limits`
+- при необходимости отключите battery optimization и снимите background restrictions
+- нажмите **Start Service**
+- нажмите **Open in Telegram**
+
+Что важно для стабильной работы на Android:
+
+- разрешите уведомления
+- отключите battery optimization для приложения
+
 ## Установка из исходников
 
+### Консольный proxy
+
+Для запуска только SOCKS5/WebSocket proxy без tray-интерфейса достаточно базовой установки:
+
 ```bash
-pip install -r requirements.txt
+pip install -e .
+tg-ws-proxy
 ```
 
-### Windows (Tray-приложение)
+### Windows 7/10+
 
 ```bash
-python windows.py
+pip install -e .
+tg-ws-proxy-tray-win
 ```
 
-### Консольный режим
+### macOS
 
 ```bash
-python proxy/tg_ws_proxy.py [--port PORT] [--dc-ip DC:IP ...] [-v]
+pip install -e .
+tg-ws-proxy-tray-macos
+```
+
+### Linux
+
+```bash
+pip install -e .
+tg-ws-proxy-tray-linux
+```
+
+### Консольный режим из исходников
+
+```bash
+tg-ws-proxy [--port PORT] [--host HOST] [--dc-ip DC:IP ...] [-v]
+```
+
+### Android debug APK
+
+Требуются JDK 17, Android SDK и Gradle. Локальная debug-сборка:
+
+```bash
+./android/build-local-debug.sh assembleStandardDebug
+```
+
+Результат:
+
+```text
+android/app/build/outputs/apk/standard/debug/app-standard-debug.apk
+```
+
+Legacy32 debug-сборка:
+
+```bash
+./android/build-local-debug.sh assembleLegacy32Debug
+```
+
+Результат:
+
+```text
+android/app/build/outputs/apk/legacy32/debug/app-legacy32-debug.apk
+```
+
+### Android signed release APK
+
+Для локальной release-сборки нужен keystore и переменные окружения:
+
+```bash
+export ANDROID_KEYSTORE_FILE=/path/to/tg-ws-proxy-release.keystore
+export ANDROID_KEYSTORE_PASSWORD=...
+export ANDROID_KEY_ALIAS=tg-ws-proxy
+export ANDROID_KEY_PASSWORD=...
+```
+
+Сборка:
+
+```bash
+cd android
+./build-local-debug.sh assembleStandardRelease
+./build-local-debug.sh assembleLegacy32Release
+```
+
+Результат:
+
+```text
+android/app/build/outputs/apk/standard/release/app-standard-release.apk
+android/app/build/outputs/apk/legacy32/release/app-legacy32-release.apk
 ```
 
 **Аргументы:**
@@ -55,6 +194,7 @@ python proxy/tg_ws_proxy.py [--port PORT] [--dc-ip DC:IP ...] [-v]
 | Аргумент | По умолчанию | Описание |
 |---|---|---|
 | `--port` | `1080` | Порт SOCKS5-прокси |
+| `--host` | `127.0.0.1` | Хост SOCKS5-прокси |
 | `--dc-ip` | `2:149.154.167.220`, `4:149.154.167.220` | Целевой IP для DC (можно указать несколько раз) |
 | `-v`, `--verbose` | выкл. | Подробное логирование (DEBUG) |
 
@@ -62,13 +202,27 @@ python proxy/tg_ws_proxy.py [--port PORT] [--dc-ip DC:IP ...] [-v]
 
 ```bash
 # Стандартный запуск
-python proxy/tg_ws_proxy.py
+tg-ws-proxy
 
 # Другой порт и дополнительные DC
-python proxy/tg_ws_proxy.py --port 9050 --dc-ip 1:149.154.175.205 --dc-ip 2:149.154.167.220
+tg-ws-proxy --port 9050 --dc-ip 1:149.154.175.205 --dc-ip 2:149.154.167.220
 
 # С подробным логированием
-python proxy/tg_ws_proxy.py -v
+tg-ws-proxy -v
+```
+
+## CLI-скрипты (pyproject.toml)
+
+CLI команды объявляются в `pyproject.toml` в секции `[project.scripts]` и должны указывать на `module:function`.
+
+Пример:
+
+```toml
+[project.scripts]
+tg-ws-proxy = "proxy.tg_ws_proxy:main"
+tg-ws-proxy-tray-win = "windows:main"
+tg-ws-proxy-tray-macos = "macos:main"
+tg-ws-proxy-tray-linux = "linux:main"
 ```
 
 ## Настройка Telegram Desktop
@@ -86,30 +240,76 @@ python proxy/tg_ws_proxy.py -v
    - **Порт:** `1080`
    - **Логин/Пароль:** оставить пустыми
 
+## Настройка Telegram Android
+
+### Автоматически
+
+В приложении нажмите **Open in Telegram** после запуска foreground service.
+
+### Вручную
+
+1. Telegram → **Настройки** → **Данные и память** → **Настройки прокси**
+2. Добавить прокси:
+   - **Тип:** SOCKS5
+   - **Сервер:** `127.0.0.1`
+   - **Порт:** `1080`
+   - **Логин/Пароль:** оставить пустыми
+
+Важно:
+
+- сначала должен быть запущен foreground service
+- если Telegram был уже открыт, иногда проще закрыть и открыть его заново после запуска прокси
+
 ## Конфигурация
 
-Tray-приложение хранит данные в `%APPDATA%/TgWsProxy`:
+Tray-приложение хранит данные в:
+
+- **Windows:** `%APPDATA%/TgWsProxy`
+- **macOS:** `~/Library/Application Support/TgWsProxy`
+- **Linux:** `~/.config/TgWsProxy` (или `$XDG_CONFIG_HOME/TgWsProxy`)
 
 ```json
 {
+  "host": "127.0.0.1",
   "port": 1080,
   "dc_ip": [
     "2:149.154.167.220",
     "4:149.154.167.220"
   ],
-  "verbose": false
+  "verbose": false,
+  "buf_kb": 256,
+  "pool_size": 4,
+  "log_max_mb": 5.0,
+  "check_updates": true
 }
 ```
 
+Ключ **`check_updates`** — при `true` при запросе к GitHub сравнивается версия с последним релизом (только уведомление и ссылка на страницу загрузки). На Windows в конфиге может быть **`autostart`** (автозапуск при входе в систему).
+
 ## Автоматическая сборка
 
-Проект содержит спецификацию PyInstaller ([`windows.spec`](packaging/windows.spec)) и GitHub Actions workflow ([`.github/workflows/build.yml`](.github/workflows/build.yml)) для автоматической сборки.
+Проект содержит спецификации PyInstaller ([`packaging/windows.spec`](packaging/windows.spec), [`packaging/macos.spec`](packaging/macos.spec), [`packaging/linux.spec`](packaging/linux.spec)) и GitHub Actions workflow ([`.github/workflows/build.yml`](.github/workflows/build.yml)) для автоматической сборки.
 
-```bash
-pip install pyinstaller
-pyinstaller packaging/windows.spec
-```
+Минимально поддерживаемые версии ОС для текущих бинарных сборок:
 
+- Windows 10+ для `TgWsProxy_windows.exe`
+- Windows 7 (x64) для `TgWsProxy_windows_7_64bit.exe`
+- Windows 7 (x32) для `TgWsProxy_windows_7_32bit.exe`
+- Intel macOS 10.15+
+- Apple Silicon macOS 11.0+
+- Linux x86_64 (требуется AppIndicator для системного трея)
+
+Android-артефакты:
+
+- `tg-ws-proxy-android-vX.Y.Z.apk`
+- `tg-ws-proxy-android-vX.Y.Z-legacy32.apk`
+
+Для signed Android release в GitHub Actions нужны secrets:
+
+- `ANDROID_KEYSTORE_BASE64`
+- `ANDROID_KEYSTORE_PASSWORD`
+- `ANDROID_KEY_ALIAS`
+- `ANDROID_KEY_PASSWORD`
 ## Лицензия
 
 [MIT License](LICENSE)

android/app/build.gradle.kts

@@ -0,0 +1,170 @@
+import org.gradle.api.tasks.Sync
+import org.gradle.api.GradleException
+import java.io.File
+
+plugins {
+    id("com.android.application")
+    id("com.chaquo.python")
+    id("org.jetbrains.kotlin.android")
+}
+
+fun loadProxyVersionName(): String {
+    val versionFile = rootProject.projectDir.resolve("../proxy/__init__.py")
+    val match = Regex("""__version__\s*=\s*"([^"]+)"""")
+        .find(versionFile.readText())
+        ?: throw GradleException("Failed to parse proxy version from ${versionFile.absolutePath}")
+    return match.groupValues[1]
+}
+
+data class ReleaseSigningEnv(
+    val keystoreFile: File,
+    val storePassword: String,
+    val keyAlias: String,
+    val keyPassword: String,
+)
+
+fun requiredEnv(name: String): String {
+    return System.getenv(name)?.takeIf { it.isNotBlank() }
+        ?: throw GradleException("Missing required environment variable: $name")
+}
+
+fun loadReleaseSigningEnv(releaseSigningRequested: Boolean): ReleaseSigningEnv? {
+    val keystorePath = System.getenv("ANDROID_KEYSTORE_FILE")?.takeIf { it.isNotBlank() }
+    val anySigningEnvProvided = listOf(
+        keystorePath,
+        System.getenv("ANDROID_KEYSTORE_PASSWORD"),
+        System.getenv("ANDROID_KEY_ALIAS"),
+        System.getenv("ANDROID_KEY_PASSWORD"),
+    ).any { !it.isNullOrBlank() }
+
+    if (!releaseSigningRequested && !anySigningEnvProvided) {
+        return null
+    }
+
+    val keystoreFile = File(requiredEnv("ANDROID_KEYSTORE_FILE"))
+    if (!keystoreFile.isFile) {
+        throw GradleException("ANDROID_KEYSTORE_FILE does not exist: ${keystoreFile.absolutePath}")
+    }
+
+    return ReleaseSigningEnv(
+        keystoreFile = keystoreFile,
+        storePassword = requiredEnv("ANDROID_KEYSTORE_PASSWORD"),
+        keyAlias = requiredEnv("ANDROID_KEY_ALIAS"),
+        keyPassword = requiredEnv("ANDROID_KEY_PASSWORD"),
+    )
+}
+
+val stagedPythonSourcesDir = layout.buildDirectory.dir("generated/chaquopy/python")
+val stagePythonSources by tasks.registering(Sync::class) {
+    from(rootProject.projectDir.resolve("../proxy")) {
+        into("proxy")
+    }
+    from(rootProject.projectDir.resolve("../utils")) {
+        into("utils")
+    }
+    into(stagedPythonSourcesDir)
+}
+val releaseSigningRequested = gradle.startParameter.taskNames.any {
+    it.contains("release", ignoreCase = true)
+}
+val releaseSigningEnv = loadReleaseSigningEnv(releaseSigningRequested)
+val appVersionName = loadProxyVersionName()
+
+android {
+    namespace = "org.flowseal.tgwsproxy"
+    compileSdk = 34
+
+    defaultConfig {
+        applicationId = "org.flowseal.tgwsproxy"
+        minSdk = 26
+        targetSdk = 34
+        versionCode = 1
+        versionName = appVersionName
+
+        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
+    }
+
+    flavorDimensions += "runtime"
+    productFlavors {
+        create("standard") {
+            dimension = "runtime"
+            ndk {
+                abiFilters += listOf("arm64-v8a", "x86_64")
+            }
+        }
+        create("legacy32") {
+            dimension = "runtime"
+            versionNameSuffix = "-legacy32"
+            ndk {
+                abiFilters += listOf("armeabi-v7a")
+            }
+        }
+    }
+
+    signingConfigs {
+        if (releaseSigningEnv != null) {
+            create("release") {
+                storeFile = releaseSigningEnv.keystoreFile
+                storePassword = releaseSigningEnv.storePassword
+                keyAlias = releaseSigningEnv.keyAlias
+                keyPassword = releaseSigningEnv.keyPassword
+            }
+        }
+    }
+
+    buildTypes {
+        release {
+            isMinifyEnabled = false
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro",
+            )
+            if (releaseSigningEnv != null) {
+                signingConfig = signingConfigs.getByName("release")
+            }
+        }
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+
+    kotlinOptions {
+        jvmTarget = "17"
+    }
+
+    buildFeatures {
+        viewBinding = true
+    }
+}
+
+chaquopy {
+    productFlavors {
+        getByName("standard") {
+            version = "3.12"
+        }
+        getByName("legacy32") {
+            version = "3.11"
+        }
+    }
+    sourceSets {
+        getByName("main") {
+            srcDir("src/main/python")
+            srcDir(stagePythonSources)
+        }
+    }
+}
+
+dependencies {
+    implementation("androidx.core:core-ktx:1.13.1")
+    implementation("androidx.appcompat:appcompat:1.7.0")
+    implementation("androidx.activity:activity-ktx:1.9.2")
+    implementation("androidx.lifecycle:lifecycle-runtime-ktx:2.8.6")
+    implementation("androidx.lifecycle:lifecycle-service:2.8.6")
+    implementation("com.google.android.material:material:1.12.0")
+
+    testImplementation("junit:junit:4.13.2")
+    androidTestImplementation("androidx.test.ext:junit:1.2.1")
+    androidTestImplementation("androidx.test.espresso:espresso-core:3.6.1")
+}

android/app/proguard-rules.pro

@@ -0,0 +1 @@
+# Intentionally empty for the initial Android shell.

android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
+
+    <application
+        android:allowBackup="true"
+        android:icon="@drawable/ic_proxy_app"
+        android:label="@string/app_name"
+        android:roundIcon="@drawable/ic_proxy_app"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.TgWsProxy">
+
+        <activity
+            android:name=".LogViewerActivity"
+            android:exported="false" />
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <service
+            android:name=".ProxyForegroundService"
+            android:enabled="true"
+            android:exported="false"
+            android:foregroundServiceType="dataSync" />
+    </application>
+
+</manifest>

android/app/src/main/java/org/flowseal/tgwsproxy/AndroidSystemStatus.kt

@@ -0,0 +1,62 @@
+package org.flowseal.tgwsproxy
+
+import android.app.ActivityManager
+import android.content.Context
+import android.content.Intent
+import android.net.Uri
+import android.os.Build
+import android.os.PowerManager
+import android.provider.Settings
+
+data class AndroidSystemStatus(
+    val ignoringBatteryOptimizations: Boolean,
+    val backgroundRestricted: Boolean,
+) {
+    val canKeepRunningReliably: Boolean
+        get() = ignoringBatteryOptimizations && !backgroundRestricted
+
+    companion object {
+        fun read(context: Context): AndroidSystemStatus {
+            val powerManager = context.getSystemService(Context.POWER_SERVICE) as PowerManager
+            val activityManager = context.getSystemService(Context.ACTIVITY_SERVICE) as ActivityManager
+
+            val ignoringBatteryOptimizations = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                powerManager.isIgnoringBatteryOptimizations(context.packageName)
+            } else {
+                true
+            }
+
+            val backgroundRestricted = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+                activityManager.isBackgroundRestricted
+            } else {
+                false
+            }
+
+            return AndroidSystemStatus(
+                ignoringBatteryOptimizations = ignoringBatteryOptimizations,
+                backgroundRestricted = backgroundRestricted,
+            )
+        }
+
+        fun openBatteryOptimizationSettings(context: Context) {
+            val intent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                Intent(Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS).apply {
+                    data = Uri.parse("package:${context.packageName}")
+                }
+            } else {
+                Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS).apply {
+                    data = Uri.fromParts("package", context.packageName, null)
+                }
+            }
+
+            context.startActivity(intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
+        }
+
+        fun openAppSettings(context: Context) {
+            val intent = Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS).apply {
+                data = Uri.fromParts("package", context.packageName, null)
+            }
+            context.startActivity(intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
+        }
+    }
+}

android/app/src/main/java/org/flowseal/tgwsproxy/LogViewerActivity.kt

@@ -0,0 +1,53 @@
+package org.flowseal.tgwsproxy
+
+import android.os.Bundle
+import androidx.appcompat.app.AppCompatActivity
+import org.flowseal.tgwsproxy.databinding.ActivityLogViewerBinding
+import java.io.File
+
+class LogViewerActivity : AppCompatActivity() {
+    private lateinit var binding: ActivityLogViewerBinding
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        binding = ActivityLogViewerBinding.inflate(layoutInflater)
+        setContentView(binding.root)
+
+        binding.refreshLogsButton.setOnClickListener { renderLog() }
+        binding.closeLogsButton.setOnClickListener { finish() }
+
+        renderLog()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        renderLog()
+    }
+
+    private fun renderLog() {
+        val logFile = File(filesDir, "tg-ws-proxy/proxy.log")
+        binding.logPathValue.text = logFile.absolutePath
+        binding.logContentValue.text = readLogTail(logFile)
+    }
+
+    private fun readLogTail(logFile: File, maxChars: Int = 40000): String {
+        if (!logFile.isFile) {
+            return getString(R.string.logs_empty)
+        }
+
+        val text = runCatching {
+            logFile.readText(Charsets.UTF_8)
+        }.getOrElse { error ->
+            return getString(R.string.logs_read_failed, error.message ?: error.javaClass.simpleName)
+        }
+
+        if (text.isBlank()) {
+            return getString(R.string.logs_empty)
+        }
+        if (text.length <= maxChars) {
+            return text
+        }
+
+        return getString(R.string.logs_truncated_prefix) + "\n\n" + text.takeLast(maxChars)
+    }
+}

android/app/src/main/java/org/flowseal/tgwsproxy/MainActivity.kt

@@ -0,0 +1,328 @@
+package org.flowseal.tgwsproxy
+
+import android.Manifest
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Build
+import android.os.Bundle
+import android.widget.Toast
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.appcompat.app.AppCompatActivity
+import androidx.core.content.ContextCompat
+import androidx.core.view.isVisible
+import androidx.lifecycle.Lifecycle
+import androidx.lifecycle.lifecycleScope
+import androidx.lifecycle.repeatOnLifecycle
+import com.google.android.material.snackbar.Snackbar
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import org.flowseal.tgwsproxy.databinding.ActivityMainBinding
+
+class MainActivity : AppCompatActivity() {
+    private lateinit var binding: ActivityMainBinding
+    private lateinit var settingsStore: ProxySettingsStore
+    private var currentUpdateStatus: ProxyUpdateStatus? = null
+
+    private val notificationPermissionLauncher = registerForActivityResult(
+        ActivityResultContracts.RequestPermission(),
+    ) { granted ->
+        if (!granted) {
+            Toast.makeText(
+                this,
+                "Без уведомлений Android может скрыть foreground service.",
+                Toast.LENGTH_LONG,
+            ).show()
+        }
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        binding = ActivityMainBinding.inflate(layoutInflater)
+        settingsStore = ProxySettingsStore(this)
+        setContentView(binding.root)
+
+        binding.startButton.setOnClickListener { onStartClicked() }
+        binding.stopButton.setOnClickListener { ProxyForegroundService.stop(this) }
+        binding.restartButton.setOnClickListener { onRestartClicked() }
+        binding.saveButton.setOnClickListener { onSaveClicked(showMessage = true) }
+        binding.openLogsButton.setOnClickListener { onOpenLogsClicked() }
+        binding.openTelegramButton.setOnClickListener { onOpenTelegramClicked() }
+        binding.openReleasePageButton.setOnClickListener { onOpenReleasePageClicked() }
+        binding.checkUpdatesSwitch.setOnCheckedChangeListener { _, _ ->
+            renderUpdateStatus(currentUpdateStatus, binding.checkUpdatesSwitch.isChecked)
+        }
+        binding.disableBatteryOptimizationButton.setOnClickListener {
+            AndroidSystemStatus.openBatteryOptimizationSettings(this)
+        }
+        binding.openAppSettingsButton.setOnClickListener {
+            AndroidSystemStatus.openAppSettings(this)
+        }
+
+        val config = settingsStore.load()
+        renderConfig(config)
+        if (config.checkUpdates) {
+            refreshUpdateStatus(checkNow = true)
+        } else {
+            currentUpdateStatus = null
+            renderUpdateStatus(null, false)
+        }
+        requestNotificationPermissionIfNeeded()
+        observeServiceState()
+        renderSystemStatus()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        renderSystemStatus()
+    }
+
+    private fun onSaveClicked(showMessage: Boolean): NormalizedProxyConfig? {
+        val validation = collectConfigFromForm().validate()
+        val config = validation.normalized
+        if (config == null) {
+            binding.errorText.text = validation.errorMessage
+            binding.errorText.isVisible = true
+            return null
+        }
+
+        binding.errorText.isVisible = false
+        settingsStore.save(config)
+        if (showMessage) {
+            Snackbar.make(binding.root, R.string.settings_saved, Snackbar.LENGTH_SHORT).show()
+        }
+        if (config.checkUpdates) {
+            refreshUpdateStatus(checkNow = true)
+        } else {
+            currentUpdateStatus = null
+            renderUpdateStatus(null, false)
+        }
+        return config
+    }
+
+    private fun onStartClicked() {
+        onSaveClicked(showMessage = false) ?: return
+        ProxyForegroundService.start(this)
+        Snackbar.make(binding.root, R.string.service_start_requested, Snackbar.LENGTH_SHORT).show()
+    }
+
+    private fun onRestartClicked() {
+        onSaveClicked(showMessage = false) ?: return
+        ProxyForegroundService.restart(this)
+        Snackbar.make(binding.root, R.string.service_restart_requested, Snackbar.LENGTH_SHORT).show()
+    }
+
+    private fun onOpenLogsClicked() {
+        startActivity(Intent(this, LogViewerActivity::class.java))
+    }
+
+    private fun onOpenTelegramClicked() {
+        val config = onSaveClicked(showMessage = false) ?: return
+        if (!TelegramProxyIntent.open(this, config)) {
+            Snackbar.make(binding.root, R.string.telegram_not_found, Snackbar.LENGTH_LONG).show()
+        }
+    }
+
+    private fun renderConfig(config: ProxyConfig) {
+        binding.hostInput.setText(config.host)
+        binding.portInput.setText(config.portText)
+        binding.dcIpInput.setText(config.dcIpText)
+        binding.logMaxMbInput.setText(config.logMaxMbText)
+        binding.bufferKbInput.setText(config.bufferKbText)
+        binding.poolSizeInput.setText(config.poolSizeText)
+        binding.checkUpdatesSwitch.isChecked = config.checkUpdates
+        binding.verboseSwitch.isChecked = config.verbose
+        renderUpdateStatus(currentUpdateStatus, config.checkUpdates)
+    }
+
+    private fun collectConfigFromForm(): ProxyConfig {
+        return ProxyConfig(
+            host = binding.hostInput.text?.toString().orEmpty(),
+            portText = binding.portInput.text?.toString().orEmpty(),
+            dcIpText = binding.dcIpInput.text?.toString().orEmpty(),
+            logMaxMbText = binding.logMaxMbInput.text?.toString().orEmpty(),
+            bufferKbText = binding.bufferKbInput.text?.toString().orEmpty(),
+            poolSizeText = binding.poolSizeInput.text?.toString().orEmpty(),
+            checkUpdates = binding.checkUpdatesSwitch.isChecked,
+            verbose = binding.verboseSwitch.isChecked,
+        )
+    }
+
+    private fun onOpenReleasePageClicked() {
+        val url = currentUpdateStatus?.htmlUrl ?: "https://github.com/Dark-Avery/tg-ws-proxy/releases/latest"
+        val opened = runCatching {
+            startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(url)))
+        }.isSuccess
+        if (!opened) {
+            Snackbar.make(binding.root, R.string.release_page_open_failed, Snackbar.LENGTH_LONG).show()
+        }
+    }
+
+    private fun refreshUpdateStatus(checkNow: Boolean) {
+        lifecycleScope.launch {
+            val status = runCatching {
+                withContext(Dispatchers.IO) {
+                    PythonProxyBridge.getUpdateStatus(this@MainActivity, checkNow)
+                }
+            }.getOrElse { exc ->
+                ProxyUpdateStatus(
+                    currentVersion = "unknown",
+                    error = exc.message ?: exc.javaClass.simpleName,
+                )
+            }
+            currentUpdateStatus = status
+            renderUpdateStatus(status, binding.checkUpdatesSwitch.isChecked)
+        }
+    }
+
+    private fun renderUpdateStatus(status: ProxyUpdateStatus?, checkUpdatesEnabled: Boolean) {
+        val currentVersion = status?.currentVersion?.takeIf { it.isNotBlank() } ?: currentAppVersionName()
+        binding.currentVersionValue.text = getString(
+            R.string.updates_current_version_format,
+            currentVersion,
+        )
+        binding.updateStatusValue.text = when {
+            !checkUpdatesEnabled -> {
+                getString(R.string.updates_status_disabled)
+            }
+            status == null -> {
+                getString(R.string.updates_status_initial)
+            }
+            !status.error.isNullOrBlank() -> {
+                getString(R.string.updates_status_error, status.error)
+            }
+            !status.checked -> {
+                getString(R.string.updates_status_idle)
+            }
+            status.hasUpdate && !status.latestVersion.isNullOrBlank() -> {
+                getString(
+                    R.string.updates_status_available,
+                    status.latestVersion,
+                    status.currentVersion,
+                )
+            }
+            status.aheadOfRelease -> {
+                getString(R.string.updates_status_newer, status.currentVersion)
+            }
+            else -> {
+                getString(R.string.updates_status_latest, status.currentVersion)
+            }
+        }
+    }
+
+    private fun currentAppVersionName(): String {
+        return runCatching {
+            @Suppress("DEPRECATION")
+            packageManager.getPackageInfo(packageName, 0).versionName
+        }.getOrNull().orEmpty().ifBlank { "unknown" }
+    }
+
+    private fun observeServiceState() {
+        lifecycleScope.launch {
+            repeatOnLifecycle(Lifecycle.State.STARTED) {
+                combine(
+                    ProxyServiceState.isStarting,
+                    ProxyServiceState.isRunning,
+                ) { isStarting, isRunning ->
+                    isStarting to isRunning
+                }.collect { (isStarting, isRunning) ->
+                    binding.statusValue.text = getString(
+                        when {
+                            isStarting -> R.string.status_starting
+                            isRunning -> R.string.status_running
+                            else -> R.string.status_stopped
+                        },
+                    )
+                    binding.startButton.isEnabled = !isStarting && !isRunning
+                    binding.stopButton.isEnabled = isStarting || isRunning
+                    binding.restartButton.isEnabled = !isStarting
+                }
+            }
+        }
+
+        lifecycleScope.launch {
+            repeatOnLifecycle(Lifecycle.State.STARTED) {
+                combine(
+                    ProxyServiceState.activeConfig,
+                    ProxyServiceState.isStarting,
+                ) { config, isStarting ->
+                    config to isStarting
+                }.collect { (config, isStarting) ->
+                    binding.serviceHint.text = if (config == null) {
+                        getString(R.string.service_hint_idle)
+                    } else if (isStarting) {
+                        getString(
+                            R.string.service_hint_starting,
+                            config.host,
+                            config.port,
+                        )
+                    } else {
+                        getString(
+                            R.string.service_hint_running,
+                            config.host,
+                            config.port,
+                        )
+                    }
+                }
+            }
+        }
+
+        lifecycleScope.launch {
+            repeatOnLifecycle(Lifecycle.State.STARTED) {
+                ProxyServiceState.lastError.collect { error ->
+                    if (error.isNullOrBlank()) {
+                        binding.lastErrorCard.isVisible = false
+                    } else {
+                        binding.lastErrorValue.text = error
+                        binding.lastErrorCard.isVisible = true
+                    }
+                }
+            }
+        }
+    }
+
+    private fun renderSystemStatus() {
+        val status = AndroidSystemStatus.read(this)
+
+        binding.systemStatusValue.text = getString(
+            if (status.canKeepRunningReliably) {
+                R.string.system_status_ready
+            } else {
+                R.string.system_status_attention
+            },
+        )
+
+        val lines = mutableListOf<String>()
+        lines += if (status.ignoringBatteryOptimizations) {
+            getString(R.string.system_check_battery_ignored)
+        } else {
+            getString(R.string.system_check_battery_active)
+        }
+        lines += if (status.backgroundRestricted) {
+            getString(R.string.system_check_background_restricted)
+        } else {
+            getString(R.string.system_check_background_ok)
+        }
+        lines += getString(R.string.system_check_oem_note)
+        binding.systemStatusHint.text = lines.joinToString("\n")
+
+        binding.disableBatteryOptimizationButton.isVisible = !status.ignoringBatteryOptimizations
+        binding.openAppSettingsButton.isVisible = status.backgroundRestricted || !status.ignoringBatteryOptimizations
+    }
+
+    private fun requestNotificationPermissionIfNeeded() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) {
+            return
+        }
+        if (ContextCompat.checkSelfPermission(
+                this,
+                Manifest.permission.POST_NOTIFICATIONS,
+            ) == PackageManager.PERMISSION_GRANTED
+        ) {
+            return
+        }
+        notificationPermissionLauncher.launch(Manifest.permission.POST_NOTIFICATIONS)
+    }
+}

android/app/src/main/java/org/flowseal/tgwsproxy/ProxyConfig.kt

@@ -0,0 +1,137 @@
+package org.flowseal.tgwsproxy
+
+data class ProxyConfig(
+    val host: String = DEFAULT_HOST,
+    val portText: String = DEFAULT_PORT.toString(),
+    val dcIpText: String = DEFAULT_DC_IP_LINES.joinToString("\n"),
+    val logMaxMbText: String = formatDecimal(DEFAULT_LOG_MAX_MB),
+    val bufferKbText: String = DEFAULT_BUFFER_KB.toString(),
+    val poolSizeText: String = DEFAULT_POOL_SIZE.toString(),
+    val checkUpdates: Boolean = false,
+    val verbose: Boolean = false,
+) {
+    fun validate(): ValidationResult {
+        val hostValue = host.trim()
+        if (!isIpv4Address(hostValue)) {
+            return ValidationResult(errorMessage = "IP-адрес прокси указан некорректно.")
+        }
+
+        val portValue = portText.trim().toIntOrNull()
+            ?: return ValidationResult(errorMessage = "Порт должен быть числом.")
+        if (portValue !in 1..65535) {
+            return ValidationResult(errorMessage = "Порт должен быть в диапазоне 1-65535.")
+        }
+
+        val lines = dcIpText
+            .lineSequence()
+            .map { it.trim() }
+            .filter { it.isNotEmpty() }
+            .toList()
+
+        if (lines.isEmpty()) {
+            return ValidationResult(errorMessage = "Добавьте хотя бы один DC:IP маппинг.")
+        }
+
+        for (line in lines) {
+            val parts = line.split(":", limit = 2)
+            val dcValue = parts.firstOrNull()?.toIntOrNull()
+            val ipValue = parts.getOrNull(1)?.trim().orEmpty()
+            if (parts.size != 2 || dcValue == null || !isIpv4Address(ipValue)) {
+                return ValidationResult(errorMessage = "Строка \"$line\" должна быть в формате DC:IP.")
+            }
+        }
+
+        val logMaxMbValue = logMaxMbText.trim().toDoubleOrNull()
+            ?: return ValidationResult(
+                errorMessage = "Размер лог-файла должен быть числом."
+            )
+        if (logMaxMbValue <= 0.0) {
+            return ValidationResult(
+                errorMessage = "Размер лог-файла должен быть больше нуля."
+            )
+        }
+
+        val bufferKbValue = bufferKbText.trim().toIntOrNull()
+            ?: return ValidationResult(
+                errorMessage = "Буфер сокета должен быть целым числом."
+            )
+        if (bufferKbValue < 4) {
+            return ValidationResult(
+                errorMessage = "Буфер сокета должен быть не меньше 4 KB."
+            )
+        }
+
+        val poolSizeValue = poolSizeText.trim().toIntOrNull()
+            ?: return ValidationResult(
+                errorMessage = "Размер WS pool должен быть целым числом."
+            )
+        if (poolSizeValue < 0) {
+            return ValidationResult(
+                errorMessage = "Размер WS pool не может быть отрицательным."
+            )
+        }
+
+        return ValidationResult(
+            normalized = NormalizedProxyConfig(
+                host = hostValue,
+                port = portValue,
+                dcIpList = lines,
+                logMaxMb = logMaxMbValue,
+                bufferKb = bufferKbValue,
+                poolSize = poolSizeValue,
+                checkUpdates = checkUpdates,
+                verbose = verbose,
+            )
+        )
+    }
+
+    companion object {
+        const val DEFAULT_HOST = "127.0.0.1"
+        const val DEFAULT_PORT = 1080
+        const val DEFAULT_LOG_MAX_MB = 5.0
+        const val DEFAULT_BUFFER_KB = 256
+        const val DEFAULT_POOL_SIZE = 4
+        val DEFAULT_DC_IP_LINES = listOf(
+            "2:149.154.167.220",
+            "4:149.154.167.220",
+        )
+
+        fun formatDecimal(value: Double): String {
+            return if (value % 1.0 == 0.0) {
+                value.toInt().toString()
+            } else {
+                value.toString()
+            }
+        }
+
+        private fun isIpv4Address(value: String): Boolean {
+            val octets = value.split(".")
+            if (octets.size != 4) {
+                return false
+            }
+
+            return octets.all { octet ->
+                octet.isNotEmpty() &&
+                    octet.length <= 3 &&
+                    octet.all(Char::isDigit) &&
+                    octet.toIntOrNull() in 0..255
+            }
+        }
+    }
+}
+
+data class ValidationResult(
+    val normalized: NormalizedProxyConfig? = null,
+    val errorMessage: String? = null,
+)
+
+data class NormalizedProxyConfig(
+    val host: String,
+    val port: Int,
+    val dcIpList: List<String>,
+    val logMaxMb: Double,
+    val bufferKb: Int,
+    val poolSize: Int,
+    val checkUpdates: Boolean,
+    val verbose: Boolean,
+)

android/app/src/main/java/org/flowseal/tgwsproxy/ProxyForegroundService.kt

@@ -0,0 +1,395 @@
+package org.flowseal.tgwsproxy
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import android.os.IBinder
+import androidx.core.app.TaskStackBuilder
+import androidx.core.app.NotificationCompat
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+import java.util.Locale
+
+class ProxyForegroundService : Service() {
+    private lateinit var settingsStore: ProxySettingsStore
+    private val serviceScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private var trafficJob: Job? = null
+    private var lastTrafficSample: TrafficSample? = null
+
+    override fun onCreate() {
+        super.onCreate()
+        settingsStore = ProxySettingsStore(this)
+        createNotificationChannel()
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        return when (intent?.action) {
+            ACTION_STOP -> {
+                ProxyServiceState.clearError()
+                serviceScope.launch {
+                    stopProxyRuntime(removeNotification = true, stopService = true)
+                }
+                START_NOT_STICKY
+            }
+
+            ACTION_RESTART -> {
+                val config = loadValidatedConfig() ?: return START_NOT_STICKY
+                ProxyServiceState.clearError()
+                beginProxyStart(config)
+                serviceScope.launch {
+                    stopRuntimeOnly()
+                    startProxyRuntime(config)
+                }
+                START_STICKY
+            }
+
+            else -> {
+                val config = loadValidatedConfig() ?: return START_NOT_STICKY
+                beginProxyStart(config)
+                serviceScope.launch {
+                    startProxyRuntime(config)
+                }
+                START_STICKY
+            }
+        }
+    }
+
+    override fun onDestroy() {
+        stopTrafficUpdates()
+        serviceScope.cancel()
+        runCatching { PythonProxyBridge.stop(this) }
+        ProxyServiceState.markStopped()
+        super.onDestroy()
+    }
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    private fun buildNotification(payload: NotificationPayload): Notification {
+        return NotificationCompat.Builder(this, CHANNEL_ID)
+            .setContentTitle(getString(R.string.notification_title))
+            .setContentText(payload.statusText)
+            .setSubText(payload.endpointText)
+            .setStyle(
+                NotificationCompat.BigTextStyle().bigText(payload.detailsText),
+            )
+            .setSmallIcon(R.drawable.ic_proxy_notification)
+            .setContentIntent(createOpenAppPendingIntent())
+            .addAction(
+                0,
+                getString(R.string.notification_action_stop),
+                createStopPendingIntent(),
+            )
+            .setOngoing(true)
+            .setOnlyAlertOnce(true)
+            .build()
+    }
+
+    private suspend fun startProxyRuntime(config: NormalizedProxyConfig) {
+        val result = runCatching {
+            PythonProxyBridge.start(this, config)
+        }
+
+        result.onSuccess {
+            ProxyServiceState.markStarted(config)
+            lastTrafficSample = null
+            updateNotification(
+                buildNotificationPayload(
+                    config = config,
+                    trafficState = TrafficState(running = true),
+                    statusText = getString(
+                        R.string.notification_running,
+                        config.host,
+                        config.port,
+                    ),
+                ),
+            )
+            startTrafficUpdates(config)
+        }.onFailure { error ->
+            ProxyServiceState.markFailed(
+                error.message ?: getString(R.string.proxy_start_failed_generic),
+            )
+            stopTrafficUpdates()
+            stopForeground(STOP_FOREGROUND_REMOVE)
+            stopSelf()
+        }
+    }
+
+    private fun loadValidatedConfig(): NormalizedProxyConfig? {
+        val config = settingsStore.load().validate().normalized
+        if (config == null) {
+            ProxyServiceState.markFailed(getString(R.string.saved_config_invalid))
+            stopForeground(STOP_FOREGROUND_REMOVE)
+            stopSelf()
+        }
+        return config
+    }
+
+    private fun beginProxyStart(config: NormalizedProxyConfig) {
+        ProxyServiceState.markStarting(config)
+        startForeground(
+            NOTIFICATION_ID,
+            buildNotification(
+                buildNotificationPayload(
+                    config = config,
+                    trafficState = TrafficState(),
+                    statusText = getString(
+                        R.string.notification_starting,
+                        config.host,
+                        config.port,
+                    ),
+                ),
+            ),
+        )
+    }
+
+    private fun stopProxyRuntime(removeNotification: Boolean, stopService: Boolean) {
+        stopRuntimeOnly()
+        ProxyServiceState.markStopped()
+
+        if (removeNotification) {
+            stopForeground(STOP_FOREGROUND_REMOVE)
+        }
+        if (stopService) {
+            stopSelf()
+        }
+    }
+
+    private fun stopRuntimeOnly() {
+        stopTrafficUpdates()
+        runCatching { PythonProxyBridge.stop(this) }
+    }
+
+    private fun updateNotification(payload: NotificationPayload) {
+        val manager = getSystemService(NotificationManager::class.java)
+        manager.notify(NOTIFICATION_ID, buildNotification(payload))
+    }
+
+    private fun buildNotificationPayload(
+        config: NormalizedProxyConfig,
+        trafficState: TrafficState,
+        statusText: String,
+    ): NotificationPayload {
+        val endpointText = getString(R.string.notification_endpoint, config.host, config.port)
+        val detailsText = getString(
+            R.string.notification_details,
+            config.dcIpList.size,
+            formatRate(trafficState.upBytesPerSecond),
+            formatRate(trafficState.downBytesPerSecond),
+            formatBytes(trafficState.totalBytesUp),
+            formatBytes(trafficState.totalBytesDown),
+        )
+        return NotificationPayload(
+            statusText = statusText,
+            endpointText = endpointText,
+            detailsText = detailsText,
+        )
+    }
+
+    private fun startTrafficUpdates(config: NormalizedProxyConfig) {
+        stopTrafficUpdates()
+        trafficJob = serviceScope.launch {
+            while (isActive && ProxyServiceState.isRunning.value) {
+                val trafficState = readTrafficState()
+                if (!trafficState.running) {
+                    ProxyServiceState.markFailed(
+                        trafficState.lastError ?: getString(R.string.proxy_runtime_stopped_unexpectedly),
+                    )
+                    stopForeground(STOP_FOREGROUND_REMOVE)
+                    stopSelf()
+                    break
+                }
+                updateNotification(
+                    buildNotificationPayload(
+                        config = config,
+                        trafficState = trafficState,
+                        statusText = getString(
+                            R.string.notification_running,
+                            config.host,
+                            config.port,
+                        ),
+                    ),
+                )
+                delay(1000)
+            }
+        }
+    }
+
+    private fun stopTrafficUpdates() {
+        trafficJob?.cancel()
+        trafficJob = null
+        lastTrafficSample = null
+    }
+
+    private fun readTrafficState(): TrafficState {
+        val nowMillis = System.currentTimeMillis()
+        val current = PythonProxyBridge.getTrafficStats(this)
+        val previous = lastTrafficSample
+        lastTrafficSample = TrafficSample(
+            bytesUp = current.bytesUp,
+            bytesDown = current.bytesDown,
+            timestampMillis = nowMillis,
+        )
+
+        if (!current.running || previous == null) {
+            return TrafficState(
+                upBytesPerSecond = 0L,
+                downBytesPerSecond = 0L,
+                totalBytesUp = current.bytesUp,
+                totalBytesDown = current.bytesDown,
+                running = current.running,
+                lastError = current.lastError,
+            )
+        }
+
+        val elapsedMillis = (nowMillis - previous.timestampMillis).coerceAtLeast(1L)
+        val upDelta = (current.bytesUp - previous.bytesUp).coerceAtLeast(0L)
+        val downDelta = (current.bytesDown - previous.bytesDown).coerceAtLeast(0L)
+        return TrafficState(
+            upBytesPerSecond = (upDelta * 1000L) / elapsedMillis,
+            downBytesPerSecond = (downDelta * 1000L) / elapsedMillis,
+            totalBytesUp = current.bytesUp,
+            totalBytesDown = current.bytesDown,
+            running = current.running,
+            lastError = current.lastError,
+        )
+    }
+
+    private fun formatRate(bytesPerSecond: Long): String = formatBytes(bytesPerSecond)
+
+    private fun formatBytes(bytes: Long): String {
+        val units = arrayOf("B", "KB", "MB", "GB")
+        var value = bytes.toDouble().coerceAtLeast(0.0)
+        var unitIndex = 0
+
+        while (value >= 1024.0 && unitIndex < units.lastIndex) {
+            value /= 1024.0
+            unitIndex += 1
+        }
+
+        return if (unitIndex == 0) {
+            String.format(Locale.US, "%.0f %s", value, units[unitIndex])
+        } else {
+            String.format(Locale.US, "%.1f %s", value, units[unitIndex])
+        }
+    }
+
+    private fun createOpenAppPendingIntent(): PendingIntent {
+        val launchIntent = packageManager.getLaunchIntentForPackage(packageName)
+            ?.apply {
+                addFlags(
+                    Intent.FLAG_ACTIVITY_NEW_TASK or
+                        Intent.FLAG_ACTIVITY_CLEAR_TOP or
+                        Intent.FLAG_ACTIVITY_SINGLE_TOP,
+                )
+            }
+            ?: Intent(this, MainActivity::class.java).apply {
+                addFlags(
+                    Intent.FLAG_ACTIVITY_NEW_TASK or
+                        Intent.FLAG_ACTIVITY_CLEAR_TOP or
+                        Intent.FLAG_ACTIVITY_SINGLE_TOP,
+                )
+            }
+
+        return TaskStackBuilder.create(this)
+            .addNextIntentWithParentStack(launchIntent)
+            .getPendingIntent(
+                1,
+                PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+            )
+            ?: PendingIntent.getActivity(
+                this,
+                1,
+                launchIntent,
+                PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+            )
+    }
+
+    private fun createStopPendingIntent(): PendingIntent {
+        val intent = Intent(this, ProxyForegroundService::class.java).apply {
+            action = ACTION_STOP
+        }
+        return PendingIntent.getService(
+            this,
+            2,
+            intent,
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+    }
+
+    private fun createNotificationChannel() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) {
+            return
+        }
+
+        val manager = getSystemService(NotificationManager::class.java)
+        val channel = NotificationChannel(
+            CHANNEL_ID,
+            getString(R.string.notification_channel_name),
+            NotificationManager.IMPORTANCE_LOW,
+        ).apply {
+            description = getString(R.string.notification_channel_description)
+        }
+        manager.createNotificationChannel(channel)
+    }
+
+    companion object {
+        private const val CHANNEL_ID = "proxy_service"
+        private const val NOTIFICATION_ID = 1001
+        private const val ACTION_START = "org.flowseal.tgwsproxy.action.START"
+        private const val ACTION_STOP = "org.flowseal.tgwsproxy.action.STOP"
+        private const val ACTION_RESTART = "org.flowseal.tgwsproxy.action.RESTART"
+
+        fun start(context: Context) {
+            val intent = Intent(context, ProxyForegroundService::class.java).apply {
+                action = ACTION_START
+            }
+            androidx.core.content.ContextCompat.startForegroundService(context, intent)
+        }
+
+        fun stop(context: Context) {
+            val intent = Intent(context, ProxyForegroundService::class.java).apply {
+                action = ACTION_STOP
+            }
+            context.startService(intent)
+        }
+
+        fun restart(context: Context) {
+            val intent = Intent(context, ProxyForegroundService::class.java).apply {
+                action = ACTION_RESTART
+            }
+            androidx.core.content.ContextCompat.startForegroundService(context, intent)
+        }
+    }
+}
+
+private data class NotificationPayload(
+    val statusText: String,
+    val endpointText: String,
+    val detailsText: String,
+)
+
+private data class TrafficSample(
+    val bytesUp: Long,
+    val bytesDown: Long,
+    val timestampMillis: Long,
+)
+
+private data class TrafficState(
+    val upBytesPerSecond: Long = 0L,
+    val downBytesPerSecond: Long = 0L,
+    val totalBytesUp: Long = 0L,
+    val totalBytesDown: Long = 0L,
+    val running: Boolean = false,
+    val lastError: String? = null,
+)

android/app/src/main/java/org/flowseal/tgwsproxy/ProxyServiceState.kt

@@ -0,0 +1,49 @@
+package org.flowseal.tgwsproxy
+
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+
+object ProxyServiceState {
+    private val _isRunning = MutableStateFlow(false)
+    val isRunning: StateFlow<Boolean> = _isRunning
+
+    private val _isStarting = MutableStateFlow(false)
+    val isStarting: StateFlow<Boolean> = _isStarting
+
+    private val _activeConfig = MutableStateFlow<NormalizedProxyConfig?>(null)
+    val activeConfig: StateFlow<NormalizedProxyConfig?> = _activeConfig
+
+    private val _lastError = MutableStateFlow<String?>(null)
+    val lastError: StateFlow<String?> = _lastError
+
+    fun markStarting(config: NormalizedProxyConfig) {
+        _activeConfig.value = config
+        _isStarting.value = true
+        _isRunning.value = false
+        _lastError.value = null
+    }
+
+    fun markStarted(config: NormalizedProxyConfig) {
+        _activeConfig.value = config
+        _isStarting.value = false
+        _isRunning.value = true
+        _lastError.value = null
+    }
+
+    fun markFailed(message: String) {
+        _activeConfig.value = null
+        _isStarting.value = false
+        _isRunning.value = false
+        _lastError.value = message
+    }
+
+    fun markStopped() {
+        _activeConfig.value = null
+        _isStarting.value = false
+        _isRunning.value = false
+    }
+
+    fun clearError() {
+        _lastError.value = null
+    }
+}

android/app/src/main/java/org/flowseal/tgwsproxy/ProxySettingsStore.kt

@@ -0,0 +1,59 @@
+package org.flowseal.tgwsproxy
+
+import android.content.Context
+
+class ProxySettingsStore(context: Context) {
+    private val preferences = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+
+    fun load(): ProxyConfig {
+        return ProxyConfig(
+            host = preferences.getString(KEY_HOST, ProxyConfig.DEFAULT_HOST).orEmpty(),
+            portText = preferences.getInt(KEY_PORT, ProxyConfig.DEFAULT_PORT).toString(),
+            dcIpText = preferences.getString(
+                KEY_DC_IP_TEXT,
+                ProxyConfig.DEFAULT_DC_IP_LINES.joinToString("\n"),
+            ).orEmpty(),
+            logMaxMbText = ProxyConfig.formatDecimal(
+                preferences.getFloat(
+                    KEY_LOG_MAX_MB,
+                    ProxyConfig.DEFAULT_LOG_MAX_MB.toFloat(),
+                ).toDouble()
+            ),
+            bufferKbText = preferences.getInt(
+                KEY_BUFFER_KB,
+                ProxyConfig.DEFAULT_BUFFER_KB,
+            ).toString(),
+            poolSizeText = preferences.getInt(
+                KEY_POOL_SIZE,
+                ProxyConfig.DEFAULT_POOL_SIZE,
+            ).toString(),
+            checkUpdates = preferences.getBoolean(KEY_CHECK_UPDATES, false),
+            verbose = preferences.getBoolean(KEY_VERBOSE, false),
+        )
+    }
+
+    fun save(config: NormalizedProxyConfig) {
+        preferences.edit()
+            .putString(KEY_HOST, config.host)
+            .putInt(KEY_PORT, config.port)
+            .putString(KEY_DC_IP_TEXT, config.dcIpList.joinToString("\n"))
+            .putFloat(KEY_LOG_MAX_MB, config.logMaxMb.toFloat())
+            .putInt(KEY_BUFFER_KB, config.bufferKb)
+            .putInt(KEY_POOL_SIZE, config.poolSize)
+            .putBoolean(KEY_CHECK_UPDATES, config.checkUpdates)
+            .putBoolean(KEY_VERBOSE, config.verbose)
+            .apply()
+    }
+
+    companion object {
+        private const val PREFS_NAME = "proxy_settings"
+        private const val KEY_HOST = "host"
+        private const val KEY_PORT = "port"
+        private const val KEY_DC_IP_TEXT = "dc_ip_text"
+        private const val KEY_LOG_MAX_MB = "log_max_mb"
+        private const val KEY_BUFFER_KB = "buf_kb"
+        private const val KEY_POOL_SIZE = "pool_size"
+        private const val KEY_CHECK_UPDATES = "check_updates"
+        private const val KEY_VERBOSE = "verbose"
+    }
+}

android/app/src/main/java/org/flowseal/tgwsproxy/PythonProxyBridge.kt

@@ -0,0 +1,101 @@
+package org.flowseal.tgwsproxy
+
+import android.content.Context
+import com.chaquo.python.Python
+import com.chaquo.python.android.AndroidPlatform
+import java.io.File
+import org.json.JSONObject
+
+object PythonProxyBridge {
+    private const val MODULE_NAME = "android_proxy_bridge"
+    private val pythonStartLock = Any()
+
+    fun start(context: Context, config: NormalizedProxyConfig): String {
+        val module = getModule(context)
+        return module.callAttr(
+            "start_proxy",
+            File(context.filesDir, "tg-ws-proxy").absolutePath,
+            config.host,
+            config.port,
+            config.dcIpList,
+            config.logMaxMb,
+            config.bufferKb,
+            config.poolSize,
+            config.verbose,
+        ).toString()
+    }
+
+    fun stop(context: Context) {
+        if (!Python.isStarted()) {
+            return
+        }
+        getModule(context).callAttr("stop_proxy")
+    }
+
+    fun getTrafficStats(context: Context): ProxyTrafficStats {
+        if (!Python.isStarted()) {
+            return ProxyTrafficStats()
+        }
+
+        val payload = getModule(context).callAttr("get_runtime_stats_json").toString()
+        val json = JSONObject(payload)
+        return ProxyTrafficStats(
+            bytesUp = json.optLong("bytes_up", 0L),
+            bytesDown = json.optLong("bytes_down", 0L),
+            running = json.optBoolean("running", false),
+            lastError = json.optString("last_error").ifBlank { null },
+        )
+    }
+
+    fun getUpdateStatus(context: Context, checkNow: Boolean = false): ProxyUpdateStatus {
+        val payload = getModule(context).callAttr("get_update_status_json", checkNow).toString()
+        val json = JSONObject(payload)
+        return ProxyUpdateStatus(
+            currentVersion = json.optString("current_version").ifBlank { "unknown" },
+            latestVersion = json.optString("latest").ifBlank { null },
+            hasUpdate = json.optBoolean("has_update", false),
+            aheadOfRelease = json.optBoolean("ahead_of_release", false),
+            checked = json.optBoolean("checked", false),
+            htmlUrl = json.optString("html_url").ifBlank { null },
+            error = json.optString("error").ifBlank { null },
+        )
+    }
+
+    private fun getModule(context: Context) =
+        getPython(context.applicationContext).getModule(MODULE_NAME)
+
+    private fun getPython(context: Context): Python {
+        if (Python.isStarted()) {
+            return Python.getInstance()
+        }
+        synchronized(pythonStartLock) {
+            if (!Python.isStarted()) {
+                try {
+                    Python.start(AndroidPlatform(context))
+                } catch (exc: IllegalStateException) {
+                    if (!Python.isStarted()) {
+                        throw exc
+                    }
+                }
+            }
+        }
+        return Python.getInstance()
+    }
+}
+
+data class ProxyTrafficStats(
+    val bytesUp: Long = 0L,
+    val bytesDown: Long = 0L,
+    val running: Boolean = false,
+    val lastError: String? = null,
+)
+
+data class ProxyUpdateStatus(
+    val currentVersion: String = "unknown",
+    val latestVersion: String? = null,
+    val hasUpdate: Boolean = false,
+    val aheadOfRelease: Boolean = false,
+    val checked: Boolean = false,
+    val htmlUrl: String? = null,
+    val error: String? = null,
+)

android/app/src/main/java/org/flowseal/tgwsproxy/TelegramProxyIntent.kt

@@ -0,0 +1,23 @@
+package org.flowseal.tgwsproxy
+
+import android.content.ActivityNotFoundException
+import android.content.Context
+import android.content.Intent
+import android.net.Uri
+
+object TelegramProxyIntent {
+    fun open(context: Context, config: NormalizedProxyConfig): Boolean {
+        val uri = Uri.parse(
+            "tg://socks?server=${Uri.encode(config.host)}&port=${config.port}"
+        )
+        val intent = Intent(Intent.ACTION_VIEW, uri)
+            .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+
+        return try {
+            context.startActivity(intent)
+            true
+        } catch (_: ActivityNotFoundException) {
+            false
+        }
+    }
+}

android/app/src/main/python/android_proxy_bridge.py

@@ -0,0 +1,160 @@
+import os
+import threading
+import time
+import json
+from pathlib import Path
+from typing import Iterable, Optional
+
+from proxy.app_runtime import ProxyAppRuntime
+from proxy import __version__
+import proxy.tg_ws_proxy as tg_ws_proxy
+
+
+RELEASES_PAGE_URL = "https://github.com/Dark-Avery/tg-ws-proxy/releases/latest"
+
+
+_RUNTIME_LOCK = threading.RLock()
+_RUNTIME: Optional[ProxyAppRuntime] = None
+_LAST_ERROR: Optional[str] = None
+
+
+def _remember_error(message: str) -> None:
+    global _LAST_ERROR
+    _LAST_ERROR = message
+
+
+def _normalize_dc_ip_list(dc_ip_list: Iterable[object]) -> list[str]:
+    if dc_ip_list is None:
+        return []
+
+    values: list[object]
+    try:
+        values = list(dc_ip_list)
+    except TypeError:
+        # Chaquopy may expose Kotlin's List<String> as java.util.ArrayList,
+        # which isn't always directly iterable from Python.
+        if hasattr(dc_ip_list, "toArray"):
+            values = list(dc_ip_list.toArray())
+        elif hasattr(dc_ip_list, "size") and hasattr(dc_ip_list, "get"):
+            size = int(dc_ip_list.size())
+            values = [dc_ip_list.get(i) for i in range(size)]
+        else:
+            values = [dc_ip_list]
+
+    return [str(item).strip() for item in values if str(item).strip()]
+
+
+def start_proxy(app_dir: str, host: str, port: int,
+                dc_ip_list: Iterable[object], log_max_mb: float = 5.0,
+                buf_kb: int = 256, pool_size: int = 4,
+                verbose: bool = False) -> str:
+    global _RUNTIME, _LAST_ERROR
+
+    with _RUNTIME_LOCK:
+        if _RUNTIME is not None:
+            _RUNTIME.stop_proxy()
+            _RUNTIME = None
+
+        _LAST_ERROR = None
+        os.environ["TG_WS_PROXY_CRYPTO_BACKEND"] = "python"
+        tg_ws_proxy.reset_stats()
+
+        runtime = ProxyAppRuntime(
+            Path(app_dir),
+            logger_name="tg-ws-android",
+            on_error=_remember_error,
+        )
+        runtime.reset_log_file()
+        runtime.setup_logging(verbose=verbose, log_max_mb=float(log_max_mb))
+
+        config = {
+            "host": host,
+            "port": int(port),
+            "dc_ip": _normalize_dc_ip_list(dc_ip_list),
+            "log_max_mb": float(log_max_mb),
+            "buf_kb": int(buf_kb),
+            "pool_size": int(pool_size),
+            "verbose": bool(verbose),
+        }
+        runtime.save_config(config)
+
+        if not runtime.start_proxy(config):
+            _RUNTIME = None
+            raise RuntimeError(_LAST_ERROR or "Failed to start proxy runtime.")
+
+        _RUNTIME = runtime
+
+    # Give the proxy thread a short warm-up window so immediate bind failures
+    # surface before Kotlin reports the service as running.
+    for _ in range(10):
+        time.sleep(0.1)
+        with _RUNTIME_LOCK:
+            if _LAST_ERROR:
+                runtime.stop_proxy()
+                _RUNTIME = None
+                raise RuntimeError(_LAST_ERROR)
+            if runtime.is_proxy_running():
+                return str(runtime.log_file)
+
+    with _RUNTIME_LOCK:
+        runtime.stop_proxy()
+        _RUNTIME = None
+    raise RuntimeError("Proxy runtime did not become ready in time.")
+
+
+def stop_proxy() -> None:
+    global _RUNTIME, _LAST_ERROR
+
+    with _RUNTIME_LOCK:
+        _LAST_ERROR = None
+        if _RUNTIME is not None:
+            _RUNTIME.stop_proxy()
+            _RUNTIME = None
+
+
+def is_running() -> bool:
+    with _RUNTIME_LOCK:
+        return bool(_RUNTIME and _RUNTIME.is_proxy_running())
+
+
+def get_last_error() -> Optional[str]:
+    return _LAST_ERROR
+
+
+def get_runtime_stats_json() -> str:
+    with _RUNTIME_LOCK:
+        running = bool(_RUNTIME and _RUNTIME.is_proxy_running())
+
+    payload = dict(tg_ws_proxy.get_stats_snapshot())
+    payload["running"] = running
+    payload["last_error"] = _LAST_ERROR
+    return json.dumps(payload)
+
+
+def _load_update_check():
+    from utils import update_check
+    return update_check
+
+
+def get_update_status_json(check_now: bool = False) -> str:
+    payload = {
+        "current_version": __version__,
+        "latest": "",
+        "has_update": False,
+        "ahead_of_release": False,
+        "checked": False,
+        "html_url": RELEASES_PAGE_URL,
+        "error": "",
+    }
+    try:
+        update_check = _load_update_check()
+        if check_now:
+            update_check.run_check(__version__)
+        payload.update(update_check.get_status())
+        payload["current_version"] = __version__
+        payload["latest"] = payload.get("latest") or ""
+        payload["html_url"] = payload.get("html_url") or update_check.RELEASES_PAGE_URL
+        payload["error"] = payload.get("error") or ""
+    except Exception as exc:
+        payload["error"] = str(exc)
+    return json.dumps(payload)

android/app/src/main/res/drawable/ic_proxy_app.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+    <path
+        android:fillColor="#1E88E5"
+        android:pathData="M54,10A44,44 0 1,1 10,54A44,44 0 0,1 54,10Z" />
+    <path
+        android:fillColor="#FFFFFF"
+        android:pathData="M33,34h42v10H59v30H49V44H33z" />
+</vector>

android/app/src/main/res/drawable/ic_proxy_notification.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24">
+    <path
+        android:fillColor="#FFFFFFFF"
+        android:pathData="M5,4h14v3h-5v12h-4V7H5z" />
+    <path
+        android:fillColor="#FFFFFFFF"
+        android:pathData="M8,20h8v2H8z" />
+</vector>

android/app/src/main/res/layout/activity_log_viewer.xml

@@ -0,0 +1,94 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ScrollView xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:fillViewport="true">
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:orientation="vertical"
+        android:padding="20dp">
+
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="@string/logs_title"
+            android:textAppearance="@style/TextAppearance.Material3.HeadlineSmall"
+            android:textStyle="bold" />
+
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="8dp"
+            android:text="@string/logs_subtitle"
+            android:textAppearance="@style/TextAppearance.Material3.BodyMedium" />
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="20dp"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/logs_path_label"
+                    android:textAppearance="@style/TextAppearance.Material3.LabelLarge" />
+
+                <TextView
+                    android:id="@+id/logPathValue"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="8dp"
+                    android:textAppearance="@style/TextAppearance.Material3.BodySmall" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="16dp"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:id="@+id/logContentValue"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:fontFamily="monospace"
+                    android:textAppearance="@style/TextAppearance.Material3.BodySmall"
+                    android:textIsSelectable="true" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.button.MaterialButton
+            android:id="@+id/refreshLogsButton"
+            style="@style/Widget.Material3.Button.OutlinedButton"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="16dp"
+            android:text="@string/refresh_logs_button" />
+
+        <com.google.android.material.button.MaterialButton
+            android:id="@+id/closeLogsButton"
+            style="@style/Widget.Material3.Button.OutlinedButton"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            android:text="@string/close_logs_button" />
+
+    </LinearLayout>
+</ScrollView>

android/app/src/main/res/layout/activity_main.xml

@@ -0,0 +1,410 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ScrollView xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:fillViewport="true">
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:orientation="vertical"
+        android:padding="20dp">
+
+        <TextView
+            android:id="@+id/titleText"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="@string/app_name"
+            android:textAppearance="@style/TextAppearance.Material3.HeadlineSmall"
+            android:textStyle="bold" />
+
+        <TextView
+            android:id="@+id/subtitleText"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="8dp"
+            android:text="@string/subtitle"
+            android:textAppearance="@style/TextAppearance.Material3.BodyMedium" />
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="20dp"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/status_label"
+                    android:textAppearance="@style/TextAppearance.Material3.LabelLarge" />
+
+                <TextView
+                    android:id="@+id/statusValue"
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="6dp"
+                    android:text="@string/status_stopped"
+                    android:textAppearance="@style/TextAppearance.Material3.TitleMedium"
+                    android:textStyle="bold" />
+
+                <TextView
+                    android:id="@+id/serviceHint"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="10dp"
+                    android:text="@string/service_hint_idle"
+                    android:textAppearance="@style/TextAppearance.Material3.BodyMedium" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="16dp"
+            android:id="@+id/lastErrorCard"
+            android:visibility="gone"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/last_error_label"
+                    android:textAppearance="@style/TextAppearance.Material3.LabelLarge"
+                    android:textColor="?attr/colorError" />
+
+                <TextView
+                    android:id="@+id/lastErrorValue"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="8dp"
+                    android:textAppearance="@style/TextAppearance.Material3.BodyMedium"
+                    android:textColor="?attr/colorError" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="16dp"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/updates_label"
+                    android:textAppearance="@style/TextAppearance.Material3.LabelLarge" />
+
+                <TextView
+                    android:id="@+id/currentVersionValue"
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="6dp"
+                    android:textAppearance="@style/TextAppearance.Material3.BodySmall" />
+
+                <com.google.android.material.materialswitch.MaterialSwitch
+                    android:id="@+id/checkUpdatesSwitch"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:text="@string/updates_check_label" />
+
+                <TextView
+                    android:id="@+id/updateStatusValue"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="8dp"
+                    android:text="@string/updates_status_initial"
+                    android:textAppearance="@style/TextAppearance.Material3.BodyMedium" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/openReleasePageButton"
+                    style="@style/Widget.Material3.Button.OutlinedButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:text="@string/updates_open_release_button" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="16dp"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/system_status_label"
+                    android:textAppearance="@style/TextAppearance.Material3.LabelLarge" />
+
+                <TextView
+                    android:id="@+id/systemStatusValue"
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="6dp"
+                    android:text="@string/system_status_attention"
+                    android:textAppearance="@style/TextAppearance.Material3.TitleMedium"
+                    android:textStyle="bold" />
+
+                <TextView
+                    android:id="@+id/systemStatusHint"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="10dp"
+                    android:textAppearance="@style/TextAppearance.Material3.BodyMedium" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/disableBatteryOptimizationButton"
+                    style="@style/Widget.Material3.Button.OutlinedButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:text="@string/disable_battery_optimization_button" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/openAppSettingsButton"
+                    style="@style/Widget.Material3.Button.OutlinedButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="12dp"
+                    android:text="@string/open_app_settings_button" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="20dp"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/endpoint_section_label"
+                    android:textAppearance="@style/TextAppearance.Material3.LabelLarge" />
+
+                <com.google.android.material.textfield.TextInputLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:hint="@string/host_hint">
+
+                    <com.google.android.material.textfield.TextInputEditText
+                        android:id="@+id/hostInput"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:inputType="text"
+                        android:maxLines="1" />
+                </com.google.android.material.textfield.TextInputLayout>
+
+                <com.google.android.material.textfield.TextInputLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="16dp"
+                    android:hint="@string/port_hint">
+
+                    <com.google.android.material.textfield.TextInputEditText
+                        android:id="@+id/portInput"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:inputType="number"
+                        android:maxLines="1" />
+                </com.google.android.material.textfield.TextInputLayout>
+
+                <com.google.android.material.textfield.TextInputLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="16dp"
+                    android:hint="@string/dc_ip_hint">
+
+                    <com.google.android.material.textfield.TextInputEditText
+                        android:id="@+id/dcIpInput"
+                        android:layout_width="match_parent"
+                        android:layout_height="140dp"
+                        android:gravity="top|start"
+                        android:inputType="textMultiLine"
+                        android:minLines="5" />
+                </com.google.android.material.textfield.TextInputLayout>
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="16dp"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/advanced_section_label"
+                    android:textAppearance="@style/TextAppearance.Material3.LabelLarge" />
+
+                <com.google.android.material.materialswitch.MaterialSwitch
+                    android:id="@+id/verboseSwitch"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:text="@string/verbose_label" />
+
+                <com.google.android.material.textfield.TextInputLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="16dp"
+                    android:hint="@string/log_max_mb_hint">
+
+                    <com.google.android.material.textfield.TextInputEditText
+                        android:id="@+id/logMaxMbInput"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:inputType="numberDecimal"
+                        android:maxLines="1" />
+                </com.google.android.material.textfield.TextInputLayout>
+
+                <com.google.android.material.textfield.TextInputLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="16dp"
+                    android:hint="@string/buffer_kb_hint">
+
+                    <com.google.android.material.textfield.TextInputEditText
+                        android:id="@+id/bufferKbInput"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:inputType="number"
+                        android:maxLines="1" />
+                </com.google.android.material.textfield.TextInputLayout>
+
+                <com.google.android.material.textfield.TextInputLayout
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="16dp"
+                    android:hint="@string/pool_size_hint">
+
+                    <com.google.android.material.textfield.TextInputEditText
+                        android:id="@+id/poolSizeInput"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:inputType="number"
+                        android:maxLines="1" />
+                </com.google.android.material.textfield.TextInputLayout>
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+        <TextView
+            android:id="@+id/errorText"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            android:textAppearance="@style/TextAppearance.Material3.BodyMedium"
+            android:textColor="?attr/colorError"
+            android:visibility="gone" />
+
+        <com.google.android.material.card.MaterialCardView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            app:cardCornerRadius="20dp">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="vertical"
+                android:padding="18dp">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/actions_section_label"
+                    android:textAppearance="@style/TextAppearance.Material3.LabelLarge" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/saveButton"
+                    style="@style/Widget.Material3.Button.OutlinedButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="14dp"
+                    android:text="@string/save_button" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/startButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="12dp"
+                    android:text="@string/start_button" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/stopButton"
+                    style="@style/Widget.Material3.Button.OutlinedButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="12dp"
+                    android:enabled="false"
+                    android:text="@string/stop_button" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/restartButton"
+                    style="@style/Widget.Material3.Button.OutlinedButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="12dp"
+                    android:text="@string/restart_button" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/openTelegramButton"
+                    style="@style/Widget.Material3.Button.OutlinedButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="12dp"
+                    android:text="@string/open_telegram_button" />
+
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/openLogsButton"
+                    style="@style/Widget.Material3.Button.OutlinedButton"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:layout_marginTop="12dp"
+                    android:text="@string/open_logs_button" />
+            </LinearLayout>
+        </com.google.android.material.card.MaterialCardView>
+
+    </LinearLayout>
+</ScrollView>

android/app/src/main/res/values/colors.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="proxy_blue">#1E88E5</color>
+    <color name="proxy_navy">#0B1F33</color>
+    <color name="proxy_surface">#F4F8FC</color>
+    <color name="proxy_white">#FFFFFF</color>
+</resources>

android/app/src/main/res/values/strings.xml

@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">TG WS Proxy</string>
+    <string name="subtitle">Android app for the local Telegram SOCKS5 proxy.</string>
+    <string name="status_label">Foreground service</string>
+    <string name="status_starting">Starting</string>
+    <string name="status_running">Running</string>
+    <string name="status_stopped">Stopped</string>
+    <string name="service_hint_idle">Configure the proxy settings, then start the foreground service.</string>
+    <string name="service_hint_starting">Starting embedded Python proxy for %1$s:%2$d.</string>
+    <string name="service_hint_running">Foreground service active for %1$s:%2$d.</string>
+    <string name="system_status_label">Android background limits</string>
+    <string name="system_status_ready">Ready</string>
+    <string name="system_status_attention">Needs attention</string>
+    <string name="system_check_battery_ignored">Battery optimization: disabled for this app.</string>
+    <string name="system_check_battery_active">Battery optimization: still enabled, Android may stop the proxy in background.</string>
+    <string name="system_check_background_ok">Background restriction: not detected.</string>
+    <string name="system_check_background_restricted">Background restriction: enabled, Android may block long-running work.</string>
+    <string name="system_check_oem_note">Some phones also require manual vendor settings such as Autostart, Lock in recents, or Unrestricted battery mode.</string>
+    <string name="endpoint_section_label">Proxy endpoint</string>
+    <string name="advanced_section_label">Advanced</string>
+    <string name="actions_section_label">Actions</string>
+    <string name="updates_label">Updates</string>
+    <string name="updates_current_version_format">v%1$s</string>
+    <string name="updates_check_label">Check for updates on launch</string>
+    <string name="updates_status_initial">Checking GitHub release…</string>
+    <string name="updates_status_idle">Not checked yet</string>
+    <string name="updates_status_disabled">Automatic update checks are disabled.</string>
+    <string name="updates_status_latest">Installed version %1$s matches the latest GitHub release.</string>
+    <string name="updates_status_newer">Installed version %1$s is newer than the latest GitHub release.</string>
+    <string name="updates_status_available">Version %1$s is available on GitHub (installed: %2$s).</string>
+    <string name="updates_status_error">Update check failed: %1$s</string>
+    <string name="updates_open_release_button">Open Release Page</string>
+    <string name="host_hint">Proxy host</string>
+    <string name="port_hint">Proxy port</string>
+    <string name="dc_ip_hint">DC to IP mappings (one DC:IP per line)</string>
+    <string name="log_max_mb_hint">Max log size before rotation (MB)</string>
+    <string name="buffer_kb_hint">Socket buffer size (KB)</string>
+    <string name="pool_size_hint">WS pool size per DC</string>
+    <string name="verbose_label">Verbose logging</string>
+    <string name="save_button">Save Settings</string>
+    <string name="start_button">Start Service</string>
+    <string name="stop_button">Stop Service</string>
+    <string name="restart_button">Restart Proxy</string>
+    <string name="open_telegram_button">Open in Telegram</string>
+    <string name="open_logs_button">Open Logs</string>
+    <string name="disable_battery_optimization_button">Disable Battery Optimization</string>
+    <string name="open_app_settings_button">Open App Settings</string>
+    <string name="last_error_label">Last service error</string>
+    <string name="release_page_open_failed">Failed to open release page.</string>
+    <string name="settings_saved">Settings saved</string>
+    <string name="service_start_requested">Foreground service start requested</string>
+    <string name="service_restart_requested">Foreground service restart requested</string>
+    <string name="telegram_not_found">Telegram app was not found for tg://socks.</string>
+    <string name="notification_title">TG WS Proxy</string>
+    <string name="notification_channel_name">Proxy service</string>
+    <string name="notification_channel_description">Keeps the Telegram proxy service alive in the foreground.</string>
+    <string name="notification_starting">SOCKS5 %1$s:%2$d • starting embedded Python</string>
+    <string name="notification_running">SOCKS5 %1$s:%2$d • proxy active</string>
+    <string name="notification_endpoint">%1$s:%2$d</string>
+    <string name="notification_details">DC mappings: %1$d\nTraffic: ↑ %2$s/s ↓ %3$s/s\nTransferred: ↑ %4$s ↓ %5$s</string>
+    <string name="notification_action_stop">Stop</string>
+    <string name="saved_config_invalid">Saved proxy settings are invalid.</string>
+    <string name="proxy_start_failed_generic">Failed to start embedded Python proxy.</string>
+    <string name="proxy_runtime_stopped_unexpectedly">Proxy runtime stopped unexpectedly.</string>
+    <string name="logs_title">Proxy Logs</string>
+    <string name="logs_subtitle">Shows the latest lines from the embedded Python proxy log.</string>
+    <string name="logs_path_label">Log file</string>
+    <string name="refresh_logs_button">Refresh Logs</string>
+    <string name="close_logs_button">Close</string>
+    <string name="logs_empty">The log file is empty or has not been created yet.</string>
+    <string name="logs_read_failed">Failed to read log file: %1$s</string>
+    <string name="logs_truncated_prefix">Showing the last part of the log file.</string>
+</resources>

android/app/src/main/res/values/themes.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <style name="Theme.TgWsProxy" parent="Theme.Material3.Light.NoActionBar">
+        <item name="colorPrimary">@color/proxy_blue</item>
+        <item name="colorSecondary">@color/proxy_navy</item>
+        <item name="android:statusBarColor">@color/proxy_navy</item>
+        <item name="android:navigationBarColor">@color/proxy_white</item>
+        <item name="colorSurface">@color/proxy_surface</item>
+        <item name="android:windowLightStatusBar" tools:targetApi="m">false</item>
+    </style>
+</resources>

android/build-local-debug.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ -z "${GRADLE_USER_HOME:-}" ]]; then
+  if [[ -d "$HOME/.gradle" && -w "$HOME/.gradle" ]]; then
+    export GRADLE_USER_HOME="$HOME/.gradle"
+  else
+    export GRADLE_USER_HOME="$ROOT_DIR/.gradle-local"
+  fi
+fi
+
+mkdir -p "$GRADLE_USER_HOME"
+
+if [[ -d "$HOME/.local/jdk" ]]; then
+  export JAVA_HOME="$HOME/.local/jdk"
+fi
+
+if [[ -d "$HOME/android-sdk" ]]; then
+  export ANDROID_SDK_ROOT="$HOME/android-sdk"
+fi
+
+if [[ -n "${JAVA_HOME:-}" ]]; then
+  export PATH="$JAVA_HOME/bin:$PATH"
+fi
+
+if [[ -n "${ANDROID_SDK_ROOT:-}" ]]; then
+  export PATH="$ANDROID_SDK_ROOT/cmdline-tools/latest/bin:$ANDROID_SDK_ROOT/platform-tools:$PATH"
+fi
+
+if [[ -d "$HOME/.local/gradle/gradle-8.7/bin" ]]; then
+  export PATH="$HOME/.local/gradle/gradle-8.7/bin:$PATH"
+fi
+
+unset HTTP_PROXY HTTPS_PROXY ALL_PROXY http_proxy https_proxy all_proxy
+
+GRADLE_BIN="gradle"
+if [[ -x "$ROOT_DIR/gradlew" ]]; then
+  GRADLE_BIN="$ROOT_DIR/gradlew"
+fi
+
+ATTEMPTS="${ATTEMPTS:-5}"
+SLEEP_SECONDS="${SLEEP_SECONDS:-15}"
+TASK="${1:-assembleStandardDebug}"
+LOCAL_CHAQUOPY_REPO="${LOCAL_CHAQUOPY_REPO:-$ROOT_DIR/.m2-chaquopy}"
+CHAQUOPY_MAVEN_BASE="${CHAQUOPY_MAVEN_BASE:-https://repo.maven.apache.org/maven2}"
+
+task_uses_legacy32() {
+  [[ "$TASK" =~ [Ll]egacy32 ]]
+}
+
+task_uses_standard() {
+  if [[ "$TASK" =~ [Ss]tandard ]]; then
+    return 0
+  fi
+
+  if task_uses_legacy32; then
+    return 1
+  fi
+
+  return 0
+}
+
+prefetch_artifact() {
+  local relative_path="$1"
+  local destination="$LOCAL_CHAQUOPY_REPO/$relative_path"
+
+  if [[ -f "$destination" ]]; then
+    return 0
+  fi
+
+  mkdir -p "$(dirname "$destination")"
+  echo "Prefetching $relative_path"
+  curl \
+    --fail \
+    --location \
+    --retry 8 \
+    --retry-all-errors \
+    --continue-at - \
+    --connect-timeout 15 \
+    --speed-limit 1024 \
+    --speed-time 20 \
+    --max-time 90 \
+    --output "$destination" \
+    "$CHAQUOPY_MAVEN_BASE/$relative_path"
+}
+
+prefetch_chaquopy_runtime() {
+  local artifacts=(
+    "com/chaquo/python/runtime/chaquopy_java/17.0.0/chaquopy_java-17.0.0.pom"
+    "com/chaquo/python/runtime/chaquopy_java/17.0.0/chaquopy_java-17.0.0.jar"
+    "com/chaquo/python/runtime/libchaquopy_java/17.0.0/libchaquopy_java-17.0.0.pom"
+  )
+
+  if task_uses_standard; then
+    artifacts+=(
+      "com/chaquo/python/runtime/libchaquopy_java/17.0.0/libchaquopy_java-17.0.0-3.12-arm64-v8a.so"
+      "com/chaquo/python/runtime/libchaquopy_java/17.0.0/libchaquopy_java-17.0.0-3.12-x86_64.so"
+      "com/chaquo/python/target/3.12.12-0/target-3.12.12-0.pom"
+      "com/chaquo/python/target/3.12.12-0/target-3.12.12-0-arm64-v8a.zip"
+      "com/chaquo/python/target/3.12.12-0/target-3.12.12-0-stdlib-pyc.zip"
+      "com/chaquo/python/target/3.12.12-0/target-3.12.12-0-stdlib.zip"
+      "com/chaquo/python/target/3.12.12-0/target-3.12.12-0-x86_64.zip"
+    )
+  fi
+
+  if task_uses_legacy32; then
+    artifacts+=(
+      "com/chaquo/python/runtime/libchaquopy_java/17.0.0/libchaquopy_java-17.0.0-3.11-armeabi-v7a.so"
+      "com/chaquo/python/target/3.11.10-0/target-3.11.10-0.pom"
+      "com/chaquo/python/target/3.11.10-0/target-3.11.10-0-armeabi-v7a.zip"
+      "com/chaquo/python/target/3.11.10-0/target-3.11.10-0-stdlib-pyc.zip"
+      "com/chaquo/python/target/3.11.10-0/target-3.11.10-0-stdlib.zip"
+    )
+  fi
+
+  for artifact in "${artifacts[@]}"; do
+    prefetch_artifact "$artifact"
+  done
+}
+
+cleanup_stale_build_state() {
+  local stale_dirs=(
+    "$ROOT_DIR/app/build/python/env"
+    "$ROOT_DIR/app/build/intermediates/project_dex_archive"
+    "$ROOT_DIR/app/build/intermediates/desugar_graph"
+    "$ROOT_DIR/app/build/tmp/kotlin-classes"
+    "$ROOT_DIR/app/build/snapshot/kotlin"
+  )
+
+  for stale_dir in "${stale_dirs[@]}"; do
+    if [[ -d "$stale_dir" ]]; then
+      rm -rf "$stale_dir"
+    fi
+  done
+}
+
+prefetch_chaquopy_runtime
+
+for attempt in $(seq 1 "$ATTEMPTS"); do
+  echo "==> Android build attempt $attempt/$ATTEMPTS ($TASK)"
+  if "$GRADLE_BIN" --no-daemon --console=plain "$TASK"; then
+    exit 0
+  fi
+
+  if [[ "$attempt" -lt "$ATTEMPTS" ]]; then
+    cleanup_stale_build_state
+    echo "Build failed, retrying in ${SLEEP_SECONDS}s..."
+    sleep "$SLEEP_SECONDS"
+  fi
+done
+
+echo "Android build failed after $ATTEMPTS attempts."
+exit 1

android/build.gradle.kts

@@ -0,0 +1,5 @@
+plugins {
+    id("com.android.application") version "8.5.2" apply false
+    id("com.chaquo.python") version "17.0.0" apply false
+    id("org.jetbrains.kotlin.android") version "1.9.24" apply false
+}

android/gradle.properties

@@ -0,0 +1,6 @@
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+android.useAndroidX=true
+android.nonTransitiveRClass=true
+kotlin.code.style=official
+systemProp.org.gradle.internal.http.connectionTimeout=120000
+systemProp.org.gradle.internal.http.socketTimeout=120000

android/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+networkTimeout=120000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

android/gradlew

@@ -0,0 +1,249 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"

android/gradlew.bat

@@ -0,0 +1,92 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

android/settings.gradle.kts

@@ -0,0 +1,28 @@
+pluginManagement {
+    repositories {
+        val localChaquopyRepo = file(System.getenv("LOCAL_CHAQUOPY_REPO") ?: ".m2-chaquopy")
+        if (localChaquopyRepo.isDirectory) {
+            maven(url = localChaquopyRepo.toURI())
+        }
+        maven("https://chaquo.com/maven")
+        gradlePluginPortal()
+        google()
+        mavenCentral()
+    }
+}
+
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        val localChaquopyRepo = file(System.getenv("LOCAL_CHAQUOPY_REPO") ?: ".m2-chaquopy")
+        if (localChaquopyRepo.isDirectory) {
+            maven(url = localChaquopyRepo.toURI())
+        }
+        maven("https://chaquo.com/maven")
+        google()
+        mavenCentral()
+    }
+}
+
+rootProject.name = "tg-ws-proxy-android"
+include(":app")

linux.py

@@ -0,0 +1,575 @@
+from __future__ import annotations
+
+import json
+import logging
+import logging.handlers
+import os
+import subprocess
+import sys
+import threading
+import webbrowser
+import time
+from pathlib import Path
+from typing import Optional
+
+import customtkinter as ctk
+import psutil
+import pyperclip
+import pystray
+from PIL import Image, ImageDraw, ImageFont
+
+import proxy.tg_ws_proxy as tg_ws_proxy
+from proxy.app_runtime import ProxyAppRuntime
+from proxy import __version__
+from utils.default_config import default_tray_config
+from ui.ctk_tray_ui import (
+    install_tray_config_buttons,
+    install_tray_config_form,
+    populate_first_run_window,
+    tray_settings_scroll_and_footer,
+    validate_config_form,
+)
+from ui.ctk_theme import (
+    CONFIG_DIALOG_FRAME_PAD,
+    CONFIG_DIALOG_SIZE,
+    FIRST_RUN_SIZE,
+    create_ctk_root,
+    ctk_theme_for_platform,
+    main_content_frame,
+)
+
+APP_NAME = "TgWsProxy"
+APP_DIR = Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config")) / APP_NAME
+CONFIG_FILE = APP_DIR / "config.json"
+LOG_FILE = APP_DIR / "proxy.log"
+FIRST_RUN_MARKER = APP_DIR / ".first_run_done"
+IPV6_WARN_MARKER = APP_DIR / ".ipv6_warned"
+
+
+DEFAULT_CONFIG = default_tray_config()
+
+
+_tray_icon: Optional[object] = None
+_config: dict = {}
+_exiting: bool = False
+_lock_file_path: Optional[Path] = None
+
+log = logging.getLogger("tg-ws-tray")
+_runtime = ProxyAppRuntime(
+    APP_DIR,
+    default_config=DEFAULT_CONFIG,
+    logger_name="tg-ws-tray",
+    on_error=lambda text: _show_error(text),
+)
+CONFIG_FILE = _runtime.config_file
+LOG_FILE = _runtime.log_file
+
+
+def _same_process(lock_meta: dict, proc: psutil.Process) -> bool:
+    try:
+        lock_ct = float(lock_meta.get("create_time", 0.0))
+        proc_ct = float(proc.create_time())
+        if lock_ct > 0 and abs(lock_ct - proc_ct) > 1.0:
+            return False
+    except Exception:
+        return False
+
+    try:
+        cmdline = proc.cmdline()
+        for arg in cmdline:
+            if "linux.py" in arg:
+                return True
+    except Exception:
+        pass
+
+    frozen = bool(getattr(sys, "frozen", False))
+    if frozen:
+        return APP_NAME.lower() in proc.name().lower()
+
+    return False
+
+
+def _release_lock():
+    global _lock_file_path
+    if not _lock_file_path:
+        return
+    try:
+        _lock_file_path.unlink(missing_ok=True)
+    except Exception:
+        pass
+    _lock_file_path = None
+
+
+def _acquire_lock() -> bool:
+    global _lock_file_path
+    _ensure_dirs()
+    lock_files = list(APP_DIR.glob("*.lock"))
+
+    for f in lock_files:
+        pid = None
+        meta: dict = {}
+
+        try:
+            pid = int(f.stem)
+        except Exception:
+            f.unlink(missing_ok=True)
+            continue
+
+        try:
+            raw = f.read_text(encoding="utf-8").strip()
+            if raw:
+                meta = json.loads(raw)
+        except Exception:
+            meta = {}
+
+        try:
+            proc = psutil.Process(pid)
+            if _same_process(meta, proc):
+                return False
+        except Exception:
+            pass
+
+        f.unlink(missing_ok=True)
+
+    lock_file = APP_DIR / f"{os.getpid()}.lock"
+    try:
+        proc = psutil.Process(os.getpid())
+        payload = {
+            "create_time": proc.create_time(),
+        }
+        lock_file.write_text(json.dumps(payload, ensure_ascii=False), encoding="utf-8")
+    except Exception:
+        lock_file.touch()
+
+    _lock_file_path = lock_file
+    return True
+
+
+def _ensure_dirs():
+    _runtime.ensure_dirs()
+
+
+def load_config() -> dict:
+    return _runtime.load_config()
+
+
+def save_config(cfg: dict):
+    _runtime.save_config(cfg)
+
+
+def setup_logging(verbose: bool = False, log_max_mb: float = 5):
+    _runtime.setup_logging(verbose, log_max_mb=log_max_mb)
+
+
+def _make_icon_image(size: int = 64):
+    if Image is None:
+        raise RuntimeError("Pillow is required for tray icon")
+    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    draw = ImageDraw.Draw(img)
+
+    margin = 2
+    draw.ellipse(
+        [margin, margin, size - margin, size - margin], fill=(0, 136, 204, 255)
+    )
+
+    try:
+        font = ImageFont.truetype(
+            "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf",
+            size=int(size * 0.55),
+        )
+    except Exception:
+        try:
+            font = ImageFont.truetype(
+                "/usr/share/fonts/TTF/DejaVuSans-Bold.ttf", size=int(size * 0.55)
+            )
+        except Exception:
+            font = ImageFont.load_default()
+    bbox = draw.textbbox((0, 0), "T", font=font)
+    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
+    tx = (size - tw) // 2 - bbox[0]
+    ty = (size - th) // 2 - bbox[1]
+    draw.text((tx, ty), "T", fill=(255, 255, 255, 255), font=font)
+
+    return img
+
+
+def _load_icon():
+    icon_path = Path(__file__).parent / "icon.ico"
+    if icon_path.exists() and Image:
+        try:
+            return Image.open(str(icon_path))
+        except Exception:
+            pass
+    return _make_icon_image()
+
+
+def start_proxy():
+    _runtime.start_proxy(_config)
+
+
+def stop_proxy():
+    _runtime.stop_proxy()
+
+
+def restart_proxy():
+    _runtime.restart_proxy()
+
+
+def _show_error(text: str, title: str = "TG WS Proxy — Ошибка"):
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    root = _tk.Tk()
+    root.withdraw()
+    _mb.showerror(title, text, parent=root)
+    root.destroy()
+
+
+def _show_info(text: str, title: str = "TG WS Proxy"):
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    root = _tk.Tk()
+    root.withdraw()
+    _mb.showinfo(title, text, parent=root)
+    root.destroy()
+
+
+def _ask_yes_no_dialog(text: str, title: str = "TG WS Proxy") -> bool:
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    root = _tk.Tk()
+    root.withdraw()
+    try:
+        root.attributes("-topmost", True)
+    except Exception:
+        pass
+    r = _mb.askyesno(title, text, parent=root)
+    root.destroy()
+    return bool(r)
+
+
+def _maybe_notify_update_async():
+    def _work():
+        time.sleep(1.5)
+        if _exiting:
+            return
+        if not _config.get("check_updates", True):
+            return
+        try:
+            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update"):
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            text = (
+                f"Доступна новая версия: {ver}\n\n"
+                f"Открыть страницу релиза в браузере?"
+            )
+            if _ask_yes_no_dialog(text, "TG WS Proxy — обновление"):
+                webbrowser.open(url)
+        except Exception as exc:
+            log.debug("Update check failed: %s", exc)
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
+
+
+def _on_open_in_telegram(icon=None, item=None):
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    url = f"tg://socks?server={host}&port={port}"
+    log.info("Copying %s", url)
+
+    try:
+        pyperclip.copy(url)
+        _show_info(
+            f"Ссылка скопирована в буфер обмена, отправьте её в Telegram и нажмите по ней ЛКМ:\n{url}",
+            "TG WS Proxy",
+        )
+    except Exception as exc:
+        log.error("Clipboard copy failed: %s", exc)
+        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_restart(icon=None, item=None):
+    threading.Thread(target=restart_proxy, daemon=True).start()
+
+
+def _on_edit_config(icon=None, item=None):
+    threading.Thread(target=_edit_config_dialog, daemon=True).start()
+
+
+def _edit_config_dialog():
+    if ctk is None:
+        _show_error("customtkinter не установлен.")
+        return
+
+    cfg = dict(_config)
+
+    theme = ctk_theme_for_platform()
+    w, h = CONFIG_DIALOG_SIZE
+
+    root = create_ctk_root(
+        ctk,
+        title="TG WS Proxy — Настройки",
+        width=w,
+        height=h,
+        theme=theme,
+        after_create=_apply_linux_ctk_window_icon,
+    )
+
+    fpx, fpy = CONFIG_DIALOG_FRAME_PAD
+    frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
+
+    scroll, footer = tray_settings_scroll_and_footer(ctk, frame, theme)
+
+    widgets = install_tray_config_form(
+        ctk, scroll, theme, cfg, DEFAULT_CONFIG,
+        show_autostart=False,
+    )
+
+    def on_save():
+        merged = validate_config_form(
+            widgets, DEFAULT_CONFIG, include_autostart=False)
+        if isinstance(merged, str):
+            _show_error(merged)
+            return
+
+        new_cfg = merged
+        save_config(new_cfg)
+        _config.update(new_cfg)
+        log.info("Config saved: %s", new_cfg)
+
+        _tray_icon.menu = _build_menu()
+
+        from tkinter import messagebox
+
+        if messagebox.askyesno(
+            "Перезапустить?",
+            "Настройки сохранены.\n\nПерезапустить прокси сейчас?",
+            parent=root,
+        ):
+            root.destroy()
+            restart_proxy()
+        else:
+            root.destroy()
+
+    def on_cancel():
+        root.destroy()
+
+    install_tray_config_buttons(
+        ctk, footer, theme, on_save=on_save, on_cancel=on_cancel)
+
+    try:
+        root.mainloop()
+    finally:
+        import tkinter as tk
+        try:
+            if root.winfo_exists():
+                root.destroy()
+        except tk.TclError:
+            pass
+
+
+def _on_open_logs(icon=None, item=None):
+    log.info("Opening log file: %s", LOG_FILE)
+    if LOG_FILE.exists():
+        env = os.environ.copy()
+        env.pop("VIRTUAL_ENV", None)
+        env.pop("PYTHONPATH", None)
+        env.pop("PYTHONHOME", None)
+
+        subprocess.Popen(
+            ["xdg-open", str(LOG_FILE)],
+            env=env,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            stdin=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+    else:
+        _show_info("Файл логов ещё не создан.", "TG WS Proxy")
+
+
+def _on_exit(icon=None, item=None):
+    global _exiting
+    if _exiting:
+        os._exit(0)
+        return
+    _exiting = True
+    log.info("User requested exit")
+
+    def _force_exit():
+        time.sleep(3)
+        os._exit(0)
+
+    threading.Thread(target=_force_exit, daemon=True, name="force-exit").start()
+
+    if icon:
+        icon.stop()
+
+
+def _show_first_run():
+    _ensure_dirs()
+    if FIRST_RUN_MARKER.exists():
+        return
+
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+
+    if ctk is None:
+        FIRST_RUN_MARKER.touch()
+        return
+
+    theme = ctk_theme_for_platform()
+    w, h = FIRST_RUN_SIZE
+
+    root = create_ctk_root(
+        ctk,
+        title="TG WS Proxy",
+        width=w,
+        height=h,
+        theme=theme,
+        after_create=_apply_linux_ctk_window_icon,
+    )
+
+    def on_done(open_tg: bool):
+        FIRST_RUN_MARKER.touch()
+        root.destroy()
+        if open_tg:
+            _on_open_in_telegram()
+
+    populate_first_run_window(
+        ctk, root, theme, host=host, port=port, on_done=on_done)
+
+    try:
+        root.mainloop()
+    finally:
+        import tkinter as tk
+        try:
+            if root.winfo_exists():
+                root.destroy()
+        except tk.TclError:
+            pass
+
+
+def _has_ipv6_enabled() -> bool:
+    import socket as _sock
+
+    try:
+        addrs = _sock.getaddrinfo(_sock.gethostname(), None, _sock.AF_INET6)
+        for addr in addrs:
+            ip = addr[4][0]
+            if ip and not ip.startswith("::1") and not ip.startswith("fe80::1"):
+                return True
+    except Exception:
+        pass
+    try:
+        s = _sock.socket(_sock.AF_INET6, _sock.SOCK_STREAM)
+        s.bind(("::1", 0))
+        s.close()
+        return True
+    except Exception:
+        return False
+
+
+def _check_ipv6_warning():
+    _ensure_dirs()
+    if IPV6_WARN_MARKER.exists():
+        return
+    if not _has_ipv6_enabled():
+        return
+
+    IPV6_WARN_MARKER.touch()
+
+    threading.Thread(target=_show_ipv6_dialog, daemon=True).start()
+
+
+def _show_ipv6_dialog():
+    _show_info(
+        "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
+        "Telegram может пытаться подключаться через IPv6, "
+        "что не поддерживается и может привести к ошибкам.\n\n"
+        "Если прокси не работает или в логах присутствуют ошибки, "
+        "связанные с попытками подключения по IPv6 - "
+        "попробуйте отключить в настройках прокси Telegram попытку соединения "
+        "по IPv6. Если данная мера не помогает, попробуйте отключить IPv6 "
+        "в системе.\n\n"
+        "Это предупреждение будет показано только один раз.",
+        "TG WS Proxy",
+    )
+
+
+def _build_menu():
+    if pystray is None:
+        return None
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    return pystray.Menu(
+        pystray.MenuItem(
+            f"Открыть в Telegram ({host}:{port})", _on_open_in_telegram, default=True
+        ),
+        pystray.Menu.SEPARATOR,
+        pystray.MenuItem("Перезапустить прокси", _on_restart),
+        pystray.MenuItem("Настройки...", _on_edit_config),
+        pystray.MenuItem("Открыть логи", _on_open_logs),
+        pystray.Menu.SEPARATOR,
+        pystray.MenuItem("Выход", _on_exit),
+    )
+
+
+def run_tray():
+    global _tray_icon, _config
+
+    _config = _runtime.prepare()
+    _runtime.reset_log_file()
+
+    setup_logging(_config.get("verbose", False),
+                  log_max_mb=_config.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]))
+    log.info("TG WS Proxy версия %s, tray app starting", __version__)
+    log.info("Config: %s", _config)
+    log.info("Log file: %s", LOG_FILE)
+
+    if pystray is None or Image is None:
+        log.error("pystray or Pillow not installed; running in console mode")
+        start_proxy()
+        try:
+            while True:
+                time.sleep(1)
+        except KeyboardInterrupt:
+            stop_proxy()
+        return
+
+    start_proxy()
+
+    _maybe_notify_update_async()
+
+    _show_first_run()
+    _check_ipv6_warning()
+
+    icon_image = _load_icon()
+    _tray_icon = pystray.Icon(APP_NAME, icon_image, "TG WS Proxy", menu=_build_menu())
+
+    log.info("Tray icon running")
+    _tray_icon.run()
+
+    stop_proxy()
+    log.info("Tray app exited")
+
+
+def main():
+    if not _acquire_lock():
+        _show_info("Приложение уже запущено.", os.path.basename(sys.argv[0]))
+        return
+
+    try:
+        run_tray()
+    finally:
+        _release_lock()
+
+
+if __name__ == "__main__":
+    main()

macos.py

@@ -0,0 +1,654 @@
+from __future__ import annotations
+
+import json
+import logging
+import logging.handlers
+import os
+import psutil
+import subprocess
+import sys
+import threading
+import time
+import webbrowser
+from pathlib import Path
+from typing import Optional
+
+try:
+    import rumps
+except ImportError:
+    rumps = None
+
+try:
+    from PIL import Image, ImageDraw, ImageFont
+except ImportError:
+    Image = ImageDraw = ImageFont = None
+
+try:
+    import pyperclip
+except ImportError:
+    pyperclip = None
+
+import proxy.tg_ws_proxy as tg_ws_proxy
+from proxy.app_runtime import ProxyAppRuntime
+from proxy import __version__
+from utils.default_config import default_tray_config
+
+APP_NAME = "TgWsProxy"
+APP_DIR = Path.home() / "Library" / "Application Support" / APP_NAME
+CONFIG_FILE = APP_DIR / "config.json"
+LOG_FILE = APP_DIR / "proxy.log"
+FIRST_RUN_MARKER = APP_DIR / ".first_run_done"
+IPV6_WARN_MARKER = APP_DIR / ".ipv6_warned"
+MENUBAR_ICON_PATH = APP_DIR / "menubar_icon.png"
+
+DEFAULT_CONFIG = default_tray_config()
+
+_app: Optional[object] = None
+_config: dict = {}
+_exiting: bool = False
+_lock_file_path: Optional[Path] = None
+
+log = logging.getLogger("tg-ws-tray")
+_runtime = ProxyAppRuntime(
+    APP_DIR,
+    default_config=DEFAULT_CONFIG,
+    logger_name="tg-ws-tray",
+    on_error=lambda text: _show_error(text),
+)
+CONFIG_FILE = _runtime.config_file
+LOG_FILE = _runtime.log_file
+
+
+# Single-instance lock
+
+def _same_process(lock_meta: dict, proc: psutil.Process) -> bool:
+    try:
+        lock_ct = float(lock_meta.get("create_time", 0.0))
+        proc_ct = float(proc.create_time())
+        if lock_ct > 0 and abs(lock_ct - proc_ct) > 1.0:
+            return False
+    except Exception:
+        return False
+
+    frozen = bool(getattr(sys, "frozen", False))
+    if frozen:
+        return APP_NAME.lower() in proc.name().lower()
+    return False
+
+
+def _release_lock():
+    global _lock_file_path
+    if not _lock_file_path:
+        return
+    try:
+        _lock_file_path.unlink(missing_ok=True)
+    except Exception:
+        pass
+    _lock_file_path = None
+
+
+def _acquire_lock() -> bool:
+    global _lock_file_path
+    _ensure_dirs()
+    lock_files = list(APP_DIR.glob("*.lock"))
+
+    for f in lock_files:
+        pid = None
+        meta: dict = {}
+
+        try:
+            pid = int(f.stem)
+        except Exception:
+            f.unlink(missing_ok=True)
+            continue
+
+        try:
+            raw = f.read_text(encoding="utf-8").strip()
+            if raw:
+                meta = json.loads(raw)
+        except Exception:
+            meta = {}
+
+        try:
+            proc = psutil.Process(pid)
+            if _same_process(meta, proc):
+                return False
+        except Exception:
+            pass
+
+        f.unlink(missing_ok=True)
+
+    lock_file = APP_DIR / f"{os.getpid()}.lock"
+    try:
+        proc = psutil.Process(os.getpid())
+        payload = {"create_time": proc.create_time()}
+        lock_file.write_text(json.dumps(payload, ensure_ascii=False),
+                             encoding="utf-8")
+    except Exception:
+        lock_file.touch()
+
+    _lock_file_path = lock_file
+    return True
+
+
+# Filesystem helpers
+
+def _ensure_dirs():
+    _runtime.ensure_dirs()
+
+
+def load_config() -> dict:
+    return _runtime.load_config()
+
+
+def save_config(cfg: dict):
+    _runtime.save_config(cfg)
+
+
+def setup_logging(verbose: bool = False, log_max_mb: float = 5):
+    _runtime.setup_logging(verbose, log_max_mb=log_max_mb)
+
+
+# Menubar icon
+
+def _make_menubar_icon(size: int = 44):
+    if Image is None:
+        return None
+    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    draw = ImageDraw.Draw(img)
+
+    margin = size // 11
+    draw.ellipse([margin, margin, size - margin, size - margin],
+                 fill=(0, 0, 0, 255))
+
+    try:
+        font = ImageFont.truetype(
+            "/System/Library/Fonts/Helvetica.ttc",
+            size=int(size * 0.55))
+    except Exception:
+        font = ImageFont.load_default()
+
+    bbox = draw.textbbox((0, 0), "T", font=font)
+    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
+    tx = (size - tw) // 2 - bbox[0]
+    ty = (size - th) // 2 - bbox[1]
+    draw.text((tx, ty), "T", fill=(255, 255, 255, 255), font=font)
+    return img
+
+# Generate menubar icon PNG if it does not exist.
+def _ensure_menubar_icon():
+    if MENUBAR_ICON_PATH.exists():
+        return
+    _ensure_dirs()
+    img = _make_menubar_icon(44)
+    if img:
+        img.save(str(MENUBAR_ICON_PATH), "PNG")
+
+
+# Native macOS dialogs
+
+def _escape_osascript_text(text: str) -> str:
+    return text.replace('\\', '\\\\').replace('"', '\\"')
+
+
+def _osascript(script: str) -> str:
+    r = subprocess.run(
+        ['osascript', '-e', script],
+        capture_output=True, text=True)
+    return r.stdout.strip()
+
+
+def _show_error(text: str, title: str = "TG WS Proxy"):
+    text_esc = _escape_osascript_text(text)
+    title_esc = _escape_osascript_text(title)
+    _osascript(
+        f'display dialog "{text_esc}" with title "{title_esc}" '
+        f'buttons {{"OK"}} default button "OK" with icon stop')
+
+
+def _show_info(text: str, title: str = "TG WS Proxy"):
+    text_esc = _escape_osascript_text(text)
+    title_esc = _escape_osascript_text(title)
+    _osascript(
+        f'display dialog "{text_esc}" with title "{title_esc}" '
+        f'buttons {{"OK"}} default button "OK" with icon note')
+
+
+def _ask_yes_no(text: str, title: str = "TG WS Proxy") -> bool:
+    result = _ask_yes_no_close(text, title)
+    return result is True
+
+
+def _ask_yes_no_close(text: str,
+                      title: str = "TG WS Proxy") -> Optional[bool]:
+    text_esc = _escape_osascript_text(text)
+    title_esc = _escape_osascript_text(title)
+    r = subprocess.run(
+        ['osascript', '-e',
+         f'button returned of (display dialog "{text_esc}" '
+         f'with title "{title_esc}" '
+         f'buttons {{"Закрыть", "Нет", "Да"}} '
+         f'default button "Да" cancel button "Закрыть" with icon note)'],
+        capture_output=True, text=True)
+    if r.returncode != 0:
+        return None
+
+    result = r.stdout.strip()
+    if result == "Да":
+        return True
+    if result == "Нет":
+        return False
+    return None
+
+
+# Proxy lifecycle
+
+def start_proxy():
+    _runtime.start_proxy(_config)
+
+
+def stop_proxy():
+    _runtime.stop_proxy()
+
+
+def restart_proxy():
+    _runtime.restart_proxy()
+
+
+# Menu callbacks
+
+def _on_open_in_telegram(_=None):
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    url = f"tg://socks?server={host}&port={port}"
+    log.info("Opening %s", url)
+    try:
+        result = subprocess.call(['open', url])
+        if result != 0:
+            raise RuntimeError("open command failed")
+    except Exception:
+        log.info("open command failed, trying webbrowser")
+        try:
+            if not webbrowser.open(url):
+                raise RuntimeError("webbrowser.open returned False")
+        except Exception:
+            log.info("Browser open failed, copying to clipboard")
+            try:
+                if pyperclip:
+                    pyperclip.copy(url)
+                else:
+                    subprocess.run(['pbcopy'], input=url.encode(),
+                                   check=True)
+                _show_info(
+                    "Не удалось открыть Telegram автоматически.\n\n"
+                    f"Ссылка скопирована в буфер обмена:\n{url}")
+            except Exception as exc:
+                log.error("Clipboard copy failed: %s", exc)
+                _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_restart(_=None):
+    def _do_restart():
+        global _config
+        _config = load_config()
+        if _app:
+            _app.update_menu_title()
+        restart_proxy()
+
+    threading.Thread(target=_do_restart, daemon=True).start()
+
+
+def _on_open_logs(_=None):
+    log.info("Opening log file: %s", LOG_FILE)
+    if LOG_FILE.exists():
+        subprocess.call(['open', str(LOG_FILE)])
+    else:
+        _show_info("Файл логов ещё не создан.")
+
+# Show a native text input dialog. Returns None if cancelled.
+def _osascript_input(prompt: str, default: str,
+                     title: str = "TG WS Proxy") -> Optional[str]:
+    prompt_esc = _escape_osascript_text(prompt)
+    default_esc = _escape_osascript_text(default)
+    title_esc = _escape_osascript_text(title)
+    r = subprocess.run(
+        ['osascript', '-e',
+         f'text returned of (display dialog "{prompt_esc}" '
+         f'default answer "{default_esc}" '
+         f'with title "{title_esc}" '
+         f'buttons {{"Закрыть", "OK"}} '
+         f'default button "OK" cancel button "Закрыть")'],
+        capture_output=True, text=True)
+    if r.returncode != 0:
+        return None
+    return r.stdout.rstrip("\r\n")
+
+
+def _on_edit_config(_=None):
+    threading.Thread(target=_edit_config_dialog, daemon=True).start()
+
+
+def _check_updates_menu_title() -> str:
+    on = bool(_config.get("check_updates", True))
+    return (
+        "✓ Проверять обновления при запуске"
+        if on
+        else "Проверять обновления при запуске (выкл)"
+    )
+
+
+def _toggle_check_updates(_=None):
+    global _config
+    _config["check_updates"] = not bool(_config.get("check_updates", True))
+    save_config(_config)
+    if _app is not None:
+        _app._check_updates_item.title = _check_updates_menu_title()
+
+
+def _on_open_release_page(_=None):
+    from utils.update_check import RELEASES_PAGE_URL
+    webbrowser.open(RELEASES_PAGE_URL)
+
+
+def _maybe_notify_update_async():
+    def _work():
+        time.sleep(1.5)
+        if _exiting:
+            return
+        if not _config.get("check_updates", True):
+            return
+        try:
+            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update"):
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            if _ask_yes_no(
+                f"Доступна новая версия: {ver}\n\n"
+                f"Открыть страницу релиза в браузере?",
+                "TG WS Proxy — обновление",
+            ):
+                webbrowser.open(url)
+        except Exception as exc:
+            log.debug("Update check failed: %s", exc)
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
+
+
+# Settings via native macOS dialogs
+def _edit_config_dialog():
+    cfg = load_config()
+
+    # Host
+    host = _osascript_input(
+        "IP-адрес прокси:",
+        cfg.get("host", DEFAULT_CONFIG["host"]))
+    if host is None:
+        return
+    host = host.strip()
+
+    import socket as _sock
+    try:
+        _sock.inet_aton(host)
+    except OSError:
+        _show_error("Некорректный IP-адрес.")
+        return
+
+    # Port
+    port_str = _osascript_input(
+        "Порт прокси:",
+        str(cfg.get("port", DEFAULT_CONFIG["port"])))
+    if port_str is None:
+        return
+    try:
+        port = int(port_str.strip())
+        if not (1 <= port <= 65535):
+            raise ValueError
+    except ValueError:
+        _show_error("Порт должен быть числом 1-65535")
+        return
+
+    # DC-IP mappings
+    dc_default = ", ".join(cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"]))
+    dc_str = _osascript_input(
+        "DC → IP маппинги (через запятую, формат DC:IP):\n"
+        "Например: 2:149.154.167.220, 4:149.154.167.220",
+        dc_default)
+    if dc_str is None:
+        return
+    dc_lines = [s.strip() for s in dc_str.replace(',', '\n').splitlines()
+                if s.strip()]
+    try:
+        tg_ws_proxy.parse_dc_ip_list(dc_lines)
+    except ValueError as e:
+        _show_error(str(e))
+        return
+
+    # Verbose
+    verbose = _ask_yes_no_close("Включить подробное логирование (verbose)?")
+    if verbose is None:
+        return
+
+    # Advanced settings
+    adv_str = _osascript_input(
+        "Расширенные настройки (буфер KB, WS пул, лог MB):\n"
+        "Формат: buf_kb,pool_size,log_max_mb",
+        f"{cfg.get('buf_kb', DEFAULT_CONFIG['buf_kb'])},"
+        f"{cfg.get('pool_size', DEFAULT_CONFIG['pool_size'])},"
+        f"{cfg.get('log_max_mb', DEFAULT_CONFIG['log_max_mb'])}")
+    if adv_str is None:
+        return
+
+    adv = {}
+    if adv_str:
+        parts = [s.strip() for s in adv_str.split(',')]
+        keys = [("buf_kb", int), ("pool_size", int),
+                ("log_max_mb", float)]
+        for i, (k, typ) in enumerate(keys):
+            if i < len(parts):
+                try:
+                    adv[k] = typ(parts[i])
+                except ValueError:
+                    pass
+
+    new_cfg = {
+        "host": host,
+        "port": port,
+        "dc_ip": dc_lines,
+        "verbose": verbose,
+        "buf_kb": adv.get("buf_kb", cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])),
+        "pool_size": adv.get("pool_size", cfg.get("pool_size", DEFAULT_CONFIG["pool_size"])),
+        "log_max_mb": adv.get("log_max_mb", cfg.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"])),
+    }
+    save_config(new_cfg)
+    log.info("Config saved: %s", new_cfg)
+
+    global _config
+    _config = new_cfg
+    if _app:
+        _app.update_menu_title()
+
+    if _ask_yes_no_close(
+            "Настройки сохранены.\n\nПерезапустить прокси сейчас?"):
+        restart_proxy()
+
+
+# First-run & IPv6 dialogs
+
+def _show_first_run():
+    _ensure_dirs()
+    if FIRST_RUN_MARKER.exists():
+        return
+
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    tg_url = f"tg://socks?server={host}&port={port}"
+
+    text = (
+        f"Прокси запущен и работает в строке меню.\n\n"
+        f"Как подключить Telegram Desktop:\n\n"
+        f"Автоматически:\n"
+        f"  Нажмите «Открыть в Telegram» в меню\n"
+        f"  Или ссылка: {tg_url}\n\n"
+        f"Вручную:\n"
+        f"  Настройки → Продвинутые → Тип подключения → Прокси\n"
+        f"  SOCKS5 → {host} : {port} (без логина/пароля)\n\n"
+        f"Открыть прокси в Telegram сейчас?"
+    )
+
+    FIRST_RUN_MARKER.touch()
+
+    if _ask_yes_no(text, "TG WS Proxy"):
+        _on_open_in_telegram()
+
+
+def _has_ipv6_enabled() -> bool:
+    import socket as _sock
+    try:
+        addrs = _sock.getaddrinfo(_sock.gethostname(), None, _sock.AF_INET6)
+        for addr in addrs:
+            ip = addr[4][0]
+            if ip and not ip.startswith('::1') and not ip.startswith('fe80::1'):
+                return True
+    except Exception:
+        pass
+    try:
+        s = _sock.socket(_sock.AF_INET6, _sock.SOCK_STREAM)
+        s.bind(('::1', 0))
+        s.close()
+        return True
+    except Exception:
+        return False
+
+
+def _check_ipv6_warning():
+    _ensure_dirs()
+    if IPV6_WARN_MARKER.exists():
+        return
+    if not _has_ipv6_enabled():
+        return
+
+    IPV6_WARN_MARKER.touch()
+
+    _show_info(
+        "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
+        "Telegram может пытаться подключаться через IPv6, "
+        "что не поддерживается и может привести к ошибкам.\n\n"
+        "Если прокси не работает, попробуйте отключить "
+        "попытку соединения по IPv6 в настройках прокси Telegram.\n\n"
+        "Это предупреждение будет показано только один раз.")
+
+
+# rumps menubar app
+
+_TgWsProxyAppBase = rumps.App if rumps else object
+
+
+class TgWsProxyApp(_TgWsProxyAppBase):
+    def __init__(self):
+        _ensure_menubar_icon()
+        icon_path = (str(MENUBAR_ICON_PATH)
+                     if MENUBAR_ICON_PATH.exists() else None)
+
+        host = _config.get("host", DEFAULT_CONFIG["host"])
+        port = _config.get("port", DEFAULT_CONFIG["port"])
+
+        self._open_tg_item = rumps.MenuItem(
+            f"Открыть в Telegram ({host}:{port})",
+            callback=_on_open_in_telegram)
+        self._restart_item = rumps.MenuItem(
+            "Перезапустить прокси",
+            callback=_on_restart)
+        self._settings_item = rumps.MenuItem(
+            "Настройки...",
+            callback=_on_edit_config)
+        self._logs_item = rumps.MenuItem(
+            "Открыть логи",
+            callback=_on_open_logs)
+        self._release_page_item = rumps.MenuItem(
+            "Страница релиза на GitHub…",
+            callback=_on_open_release_page)
+        self._check_updates_item = rumps.MenuItem(
+            _check_updates_menu_title(),
+            callback=_toggle_check_updates)
+        self._version_item = rumps.MenuItem(
+            f"Версия {__version__}",
+            callback=lambda _: None)
+
+        super().__init__(
+            "TG WS Proxy",
+            icon=icon_path,
+            template=False,
+            quit_button="Выход",
+            menu=[
+                self._open_tg_item,
+                None,
+                self._restart_item,
+                self._settings_item,
+                self._logs_item,
+                None,
+                self._release_page_item,
+                self._check_updates_item,
+                None,
+                self._version_item,
+            ])
+
+    def update_menu_title(self):
+        host = _config.get("host", DEFAULT_CONFIG["host"])
+        port = _config.get("port", DEFAULT_CONFIG["port"])
+        self._open_tg_item.title = (
+            f"Открыть в Telegram ({host}:{port})")
+
+
+def run_menubar():
+    global _app, _config
+
+    _config = _runtime.prepare()
+    _runtime.reset_log_file()
+
+    setup_logging(_config.get("verbose", False),
+                  log_max_mb=_config.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]))
+    log.info("TG WS Proxy версия %s, menubar app starting", __version__)
+    log.info("Config: %s", _config)
+    log.info("Log file: %s", LOG_FILE)
+
+    if rumps is None or Image is None:
+        log.error("rumps or Pillow not installed; running in console mode")
+        start_proxy()
+        try:
+            while True:
+                time.sleep(1)
+        except KeyboardInterrupt:
+            stop_proxy()
+        return
+
+    start_proxy()
+
+    _maybe_notify_update_async()
+
+    _show_first_run()
+    _check_ipv6_warning()
+
+    _app = TgWsProxyApp()
+    log.info("Menubar app running")
+    _app.run()
+
+    stop_proxy()
+    log.info("Menubar app exited")
+
+
+def main():
+    if not _acquire_lock():
+        _show_info("Приложение уже запущено.")
+        return
+
+    try:
+        run_menubar()
+    finally:
+        _release_lock()
+
+
+if __name__ == "__main__":
+    main()

packaging/linux.spec

@@ -0,0 +1,80 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+import sys
+import os
+import glob
+
+from PyInstaller.utils.hooks import collect_submodules, collect_data_files
+
+block_cipher = None
+
+# customtkinter ships JSON themes + assets that must be bundled
+import customtkinter
+ctk_path = os.path.dirname(customtkinter.__file__)
+
+# Collect gi (PyGObject) submodules and data so pystray._appindicator works
+gi_hiddenimports = collect_submodules('gi')
+gi_datas = collect_data_files('gi')
+
+# Collect GObject typelib files from the system
+typelib_dirs = glob.glob('/usr/lib/*/girepository-1.0')
+typelib_datas = []
+for d in typelib_dirs:
+    typelib_datas.append((d, 'gi_typelibs'))
+
+a = Analysis(
+    [os.path.join(os.path.dirname(SPEC), os.pardir, 'linux.py')],
+    pathex=[],
+    binaries=[],
+    datas=[(ctk_path, 'customtkinter/')] + gi_datas + typelib_datas,
+    hiddenimports=[
+        'pystray._appindicator',
+        'PIL._tkinter_finder',
+        'customtkinter',
+        'cryptography.hazmat.primitives.ciphers',
+        'cryptography.hazmat.primitives.ciphers.algorithms',
+        'cryptography.hazmat.primitives.ciphers.modes',
+        'cryptography.hazmat.backends.openssl',
+        'gi',
+        '_gi',
+        'gi.repository.GLib',
+        'gi.repository.GObject',
+        'gi.repository.Gtk',
+        'gi.repository.Gdk',
+        'gi.repository.AyatanaAppIndicator3',
+    ] + gi_hiddenimports,
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    cipher=block_cipher,
+)
+
+icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.ico')
+if os.path.exists(icon_path):
+    a.datas += [('icon.ico', icon_path, 'DATA')]
+
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.zipfiles,
+    a.datas,
+    [],
+    name='TgWsProxy',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=True,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=False,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)

packaging/macos.spec

@@ -0,0 +1,83 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+import sys
+import os
+
+block_cipher = None
+
+a = Analysis(
+    [os.path.join(os.path.dirname(SPEC), os.pardir, 'macos.py')],
+    pathex=[],
+    binaries=[],
+    datas=[],
+    hiddenimports=[
+        'rumps',
+        'objc',
+        'Foundation',
+        'AppKit',
+        'PyObjCTools',
+        'PyObjCTools.AppHelper',
+        'cryptography.hazmat.primitives.ciphers',
+        'cryptography.hazmat.primitives.ciphers.algorithms',
+        'cryptography.hazmat.primitives.ciphers.modes',
+        'cryptography.hazmat.backends.openssl',
+    ],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    cipher=block_cipher,
+)
+
+icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.icns')
+if not os.path.exists(icon_path):
+    icon_path = None
+
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    [],
+    exclude_binaries=True,
+    name='TgWsProxy',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=False,
+    console=False,
+    argv_emulation=False,
+    target_arch='universal2',
+    codesign_identity=None,
+    entitlements_file=None,
+)
+
+coll = COLLECT(
+    exe,
+    a.binaries,
+    a.zipfiles,
+    a.datas,
+    strip=False,
+    upx=False,
+    upx_exclude=[],
+    name='TgWsProxy',
+)
+
+app = BUNDLE(
+    coll,
+    name='TG WS Proxy.app',
+    icon=icon_path,
+    bundle_identifier='com.tgwsproxy.app',
+    info_plist={
+        'CFBundleName': 'TG WS Proxy',
+        'CFBundleDisplayName': 'TG WS Proxy',
+        'CFBundleShortVersionString': '1.0.0',
+        'CFBundleVersion': '1.0.0',
+        'LSMinimumSystemVersion': '10.15',
+        'LSUIElement': True,
+        'NSHighResolutionCapable': True,
+        'NSAppleEventsUsageDescription':
+            'TG WS Proxy needs to display dialogs.',
+    },
+)

proxy/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.3.0"

proxy/app_runtime.py

@@ -0,0 +1,203 @@
+from __future__ import annotations
+
+import asyncio as _asyncio
+import json
+import logging
+import logging.handlers
+import sys
+import threading
+import time
+from pathlib import Path
+from typing import Callable, Dict, Optional
+
+import proxy.tg_ws_proxy as tg_ws_proxy
+
+
+DEFAULT_CONFIG = {
+    "port": 1080,
+    "host": "127.0.0.1",
+    "dc_ip": ["2:149.154.167.220", "4:149.154.167.220"],
+    "log_max_mb": 5,
+    "buf_kb": 256,
+    "pool_size": 4,
+    "verbose": False,
+}
+
+
+class ProxyAppRuntime:
+    def __init__(self, app_dir: Path,
+                 default_config: Optional[dict] = None,
+                 logger_name: str = "tg-ws-runtime",
+                 on_error: Optional[Callable[[str], None]] = None,
+                 parse_dc_ip_list: Optional[
+                     Callable[[list[str]], Dict[int, str]]
+                 ] = None,
+                 run_proxy: Optional[Callable[..., object]] = None,
+                 thread_factory: Optional[Callable[..., object]] = None):
+        self.app_dir = Path(app_dir)
+        self.config_file = self.app_dir / "config.json"
+        self.log_file = self.app_dir / "proxy.log"
+        self.default_config = dict(default_config or DEFAULT_CONFIG)
+        self.log = logging.getLogger(logger_name)
+        self.on_error = on_error
+        self.parse_dc_ip_list = parse_dc_ip_list or \
+            tg_ws_proxy.parse_dc_ip_list
+        self.run_proxy = run_proxy or tg_ws_proxy._run
+        self.thread_factory = thread_factory or threading.Thread
+        self.config: dict = {}
+        self._proxy_thread = None
+        self._async_stop = None
+
+    def ensure_dirs(self):
+        self.app_dir.mkdir(parents=True, exist_ok=True)
+
+    def load_config(self) -> dict:
+        self.ensure_dirs()
+        if self.config_file.exists():
+            try:
+                with open(self.config_file, "r", encoding="utf-8") as f:
+                    data = json.load(f)
+                for key, value in self.default_config.items():
+                    data.setdefault(key, value)
+                self.config = data
+                return data
+            except Exception as exc:
+                self.log.warning("Failed to load config: %s", exc)
+
+        self.config = dict(self.default_config)
+        return dict(self.config)
+
+    def save_config(self, cfg: dict):
+        self.ensure_dirs()
+        self.config = dict(cfg)
+        with open(self.config_file, "w", encoding="utf-8") as f:
+            json.dump(cfg, f, indent=2, ensure_ascii=False)
+
+    def reset_log_file(self):
+        if self.log_file.exists():
+            try:
+                self.log_file.unlink()
+            except Exception:
+                pass
+
+    def setup_logging(self, verbose: bool = False, log_max_mb: float = 5):
+        self.ensure_dirs()
+        root = logging.getLogger()
+        root.setLevel(logging.DEBUG if verbose else logging.INFO)
+
+        for handler in list(root.handlers):
+            if getattr(handler, "_tg_ws_proxy_runtime_handler", False):
+                root.removeHandler(handler)
+                try:
+                    handler.close()
+                except Exception:
+                    pass
+
+        fh = logging.handlers.RotatingFileHandler(
+            str(self.log_file),
+            maxBytes=max(32 * 1024, log_max_mb * 1024 * 1024),
+            backupCount=0,
+            encoding="utf-8",
+        )
+        fh.setLevel(logging.DEBUG)
+        fh.setFormatter(logging.Formatter(
+            "%(asctime)s  %(levelname)-5s  %(name)s  %(message)s",
+            datefmt="%Y-%m-%d %H:%M:%S"))
+        fh._tg_ws_proxy_runtime_handler = True
+        root.addHandler(fh)
+
+        if not getattr(sys, "frozen", False):
+            ch = logging.StreamHandler(sys.stdout)
+            ch.setLevel(logging.DEBUG if verbose else logging.INFO)
+            ch.setFormatter(logging.Formatter(
+                "%(asctime)s  %(levelname)-5s  %(message)s",
+                datefmt="%H:%M:%S"))
+            ch._tg_ws_proxy_runtime_handler = True
+            root.addHandler(ch)
+
+    def prepare(self) -> dict:
+        cfg = self.load_config()
+        self.save_config(cfg)
+        return cfg
+
+    def _emit_error(self, text: str):
+        if self.on_error:
+            self.on_error(text)
+
+    def _run_proxy_thread(self, port: int, dc_opt: Dict[int, str],
+                          host: str = "127.0.0.1"):
+        loop = _asyncio.new_event_loop()
+        _asyncio.set_event_loop(loop)
+        stop_ev = _asyncio.Event()
+        self._async_stop = (loop, stop_ev)
+
+        try:
+            loop.run_until_complete(
+                self.run_proxy(port, dc_opt, stop_event=stop_ev, host=host))
+        except Exception as exc:
+            self.log.error("Proxy thread crashed: %s", exc)
+            if ("10048" in str(exc) or
+                    "Address already in use" in str(exc)):
+                self._emit_error(
+                    "Не удалось запустить прокси:\n"
+                    "Порт уже используется другим приложением.\n\n"
+                    "Закройте приложение, использующее этот порт, "
+                    "или измените порт в настройках прокси и перезапустите.")
+        finally:
+            loop.close()
+            self._async_stop = None
+
+    def start_proxy(self, cfg: Optional[dict] = None) -> bool:
+        if self._proxy_thread and self._proxy_thread.is_alive():
+            self.log.info("Proxy already running")
+            return True
+
+        active_cfg = dict(cfg or self.config or self.default_config)
+        self.config = dict(active_cfg)
+        port = active_cfg.get("port", self.default_config["port"])
+        host = active_cfg.get("host", self.default_config["host"])
+        dc_ip_list = active_cfg.get("dc_ip", self.default_config["dc_ip"])
+        buf_kb = active_cfg.get("buf_kb", self.default_config["buf_kb"])
+        pool_size = active_cfg.get(
+            "pool_size", self.default_config["pool_size"])
+
+        try:
+            dc_opt = self.parse_dc_ip_list(dc_ip_list)
+        except ValueError as exc:
+            self.log.error("Bad config dc_ip: %s", exc)
+            self._emit_error("Ошибка конфигурации:\n%s" % exc)
+            return False
+
+        self.log.info("Starting proxy on %s:%d ...", host, port)
+        tg_ws_proxy._RECV_BUF = max(4, buf_kb) * 1024
+        tg_ws_proxy._SEND_BUF = tg_ws_proxy._RECV_BUF
+        tg_ws_proxy._WS_POOL_SIZE = max(0, pool_size)
+        self._proxy_thread = self.thread_factory(
+            target=self._run_proxy_thread,
+            args=(
+                port,
+                dc_opt,
+                host,
+            ),
+            daemon=True,
+            name="proxy")
+        self._proxy_thread.start()
+        return True
+
+    def stop_proxy(self):
+        if self._async_stop:
+            loop, stop_ev = self._async_stop
+            loop.call_soon_threadsafe(stop_ev.set)
+            if self._proxy_thread:
+                self._proxy_thread.join(timeout=2)
+        self._proxy_thread = None
+        self.log.info("Proxy stopped")
+
+    def restart_proxy(self, delay_seconds: float = 0.3) -> bool:
+        self.log.info("Restarting proxy...")
+        self.stop_proxy()
+        time.sleep(delay_seconds)
+        return self.start_proxy()
+
+    def is_proxy_running(self) -> bool:
+        return bool(self._proxy_thread and self._proxy_thread.is_alive())

proxy/crypto_backend.py

@@ -0,0 +1,208 @@
+from __future__ import annotations
+
+import os
+from typing import Protocol
+
+
+_SBOX = (
+    0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B,
+    0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
+    0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26,
+    0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
+    0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2,
+    0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
+    0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED,
+    0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
+    0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F,
+    0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
+    0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 0x13, 0xEC,
+    0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
+    0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14,
+    0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
+    0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D,
+    0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
+    0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F,
+    0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
+    0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11,
+    0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
+    0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F,
+    0xB0, 0x54, 0xBB, 0x16,
+)
+_RCON = (0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36)
+
+
+class AesCtrTransform(Protocol):
+    def update(self, data: bytes) -> bytes:
+        ...
+
+    def finalize(self) -> bytes:
+        ...
+
+
+def _xtime(value: int) -> int:
+    value <<= 1
+    if value & 0x100:
+        value ^= 0x11B
+    return value & 0xFF
+
+
+def _mul2(value: int) -> int:
+    return _xtime(value)
+
+
+def _mul3(value: int) -> int:
+    return _xtime(value) ^ value
+
+
+def _add_round_key(state: list[int], round_key: bytes):
+    for idx in range(16):
+        state[idx] ^= round_key[idx]
+
+
+def _sub_bytes(state: list[int]):
+    for idx in range(16):
+        state[idx] = _SBOX[state[idx]]
+
+
+def _shift_rows(state: list[int]):
+    state[1], state[5], state[9], state[13] = (
+        state[5], state[9], state[13], state[1]
+    )
+    state[2], state[6], state[10], state[14] = (
+        state[10], state[14], state[2], state[6]
+    )
+    state[3], state[7], state[11], state[15] = (
+        state[15], state[3], state[7], state[11]
+    )
+
+
+def _mix_columns(state: list[int]):
+    for offset in range(0, 16, 4):
+        s0, s1, s2, s3 = state[offset:offset + 4]
+        state[offset + 0] = _mul2(s0) ^ _mul3(s1) ^ s2 ^ s3
+        state[offset + 1] = s0 ^ _mul2(s1) ^ _mul3(s2) ^ s3
+        state[offset + 2] = s0 ^ s1 ^ _mul2(s2) ^ _mul3(s3)
+        state[offset + 3] = _mul3(s0) ^ s1 ^ s2 ^ _mul2(s3)
+
+
+def _rot_word(word: list[int]) -> list[int]:
+    return word[1:] + word[:1]
+
+
+def _sub_word(word: list[int]) -> list[int]:
+    return [_SBOX[value] for value in word]
+
+
+def _expand_round_keys(key: bytes) -> tuple[list[bytes], int]:
+    if len(key) not in (16, 24, 32):
+        raise ValueError("AES key must be 16, 24, or 32 bytes long")
+
+    nk = len(key) // 4
+    nr = {4: 10, 6: 12, 8: 14}[nk]
+    words = [list(key[idx:idx + 4]) for idx in range(0, len(key), 4)]
+    total_words = 4 * (nr + 1)
+
+    for idx in range(nk, total_words):
+        temp = words[idx - 1][:]
+        if idx % nk == 0:
+            temp = _sub_word(_rot_word(temp))
+            temp[0] ^= _RCON[idx // nk - 1]
+        elif nk > 6 and idx % nk == 4:
+            temp = _sub_word(temp)
+        words.append([
+            words[idx - nk][byte_idx] ^ temp[byte_idx]
+            for byte_idx in range(4)
+        ])
+
+    round_keys = []
+    for round_idx in range(nr + 1):
+        start = round_idx * 4
+        round_keys.append(bytes(sum(words[start:start + 4], [])))
+    return round_keys, nr
+
+
+class _PurePythonAesCtrTransform:
+    def __init__(self, key: bytes, iv: bytes):
+        if len(iv) != 16:
+            raise ValueError("AES-CTR IV must be 16 bytes long")
+        self._round_keys, self._rounds = _expand_round_keys(key)
+        self._counter = bytearray(iv)
+        self._buffer = b""
+        self._buffer_offset = 0
+
+    def update(self, data: bytes) -> bytes:
+        if not data:
+            return b""
+
+        out = bytearray(len(data))
+        data_offset = 0
+
+        while data_offset < len(data):
+            if self._buffer_offset >= len(self._buffer):
+                self._buffer = self._encrypt_block(bytes(self._counter))
+                self._buffer_offset = 0
+                self._increment_counter()
+
+            available = len(self._buffer) - self._buffer_offset
+            chunk_size = min(len(data) - data_offset, available)
+            for chunk_idx in range(chunk_size):
+                out[data_offset + chunk_idx] = (
+                    data[data_offset + chunk_idx]
+                    ^ self._buffer[self._buffer_offset + chunk_idx]
+                )
+            data_offset += chunk_size
+            self._buffer_offset += chunk_size
+
+        return bytes(out)
+
+    def finalize(self) -> bytes:
+        return b""
+
+    def _encrypt_block(self, block: bytes) -> bytes:
+        state = list(block)
+        _add_round_key(state, self._round_keys[0])
+
+        for round_idx in range(1, self._rounds):
+            _sub_bytes(state)
+            _shift_rows(state)
+            _mix_columns(state)
+            _add_round_key(state, self._round_keys[round_idx])
+
+        _sub_bytes(state)
+        _shift_rows(state)
+        _add_round_key(state, self._round_keys[self._rounds])
+        return bytes(state)
+
+    def _increment_counter(self):
+        for idx in range(15, -1, -1):
+            self._counter[idx] = (self._counter[idx] + 1) & 0xFF
+            if self._counter[idx] != 0:
+                break
+
+
+def _create_cryptography_transform(key: bytes,
+                                   iv: bytes) -> AesCtrTransform:
+    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+    cipher = Cipher(algorithms.AES(key), modes.CTR(iv))
+    return cipher.encryptor()
+
+
+def create_aes_ctr_transform(key: bytes, iv: bytes,
+                             backend: str | None = None) -> AesCtrTransform:
+    """
+    Create a stateful AES-CTR transform.
+
+    Windows keeps using `cryptography` by default. Android can select the
+    pure-Python backend to avoid native build dependencies.
+    """
+    selected = backend or os.environ.get(
+        'TG_WS_PROXY_CRYPTO_BACKEND', 'cryptography')
+
+    if selected == 'cryptography':
+        return _create_cryptography_transform(key, iv)
+
+    if selected == 'python':
+        return _PurePythonAesCtrTransform(key, iv)
+
+    raise ValueError(f"Unsupported AES-CTR backend: {selected}")

proxy/tg_ws_proxy.py

@@ -4,6 +4,8 @@ import argparse
 import asyncio
 import base64
 import logging
+from collections import deque
+import logging.handlers
 import os
 import socket as _socket
 import ssl
@@ -11,12 +13,19 @@ import struct
 import sys
 import time
 from typing import Dict, List, Optional, Set, Tuple
-from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+from proxy.crypto_backend import create_aes_ctr_transform
 
 
 DEFAULT_PORT = 1080
 log = logging.getLogger('tg-ws-proxy')
 
+_TCP_NODELAY = True
+_RECV_BUF = 256 * 1024
+_SEND_BUF = 256 * 1024
+_WS_POOL_SIZE = 4
+_WS_POOL_MAX_AGE = 120.0
+
 _TG_RANGES = [
     # 185.76.151.0/24
     (struct.unpack('!I', _socket.inet_aton('185.76.151.0'))[0],
@@ -32,24 +41,39 @@ _TG_RANGES = [
      struct.unpack('!I', _socket.inet_aton('91.108.255.255'))[0]),
 ]
 
-_IP_TO_DC: Dict[str, int] = {
+# IP -> (dc_id, is_media)
+_IP_TO_DC: Dict[str, Tuple[int, bool]] = {
     # DC1
-    '149.154.175.50': 1, '149.154.175.51': 1, '149.154.175.54': 1,
+    '149.154.175.50': (1, False), '149.154.175.51': (1, False),
+    '149.154.175.53': (1, False), '149.154.175.54': (1, False),
+    '149.154.175.52': (1, True),
     # DC2
-    '149.154.167.41': 2,
-    '149.154.167.50': 2, '149.154.167.51': 2, '149.154.167.220': 2,
+    '149.154.167.41': (2, False), '149.154.167.50': (2, False),
+    '149.154.167.51': (2, False), '149.154.167.220': (2, False),
+    '95.161.76.100':  (2, False),
+    '149.154.167.151': (2, True), '149.154.167.222': (2, True),
+    '149.154.167.223': (2, True), '149.154.162.123': (2, True),
     # DC3
-    '149.154.175.100': 3, '149.154.175.101': 3,
+    '149.154.175.100': (3, False), '149.154.175.101': (3, False),
+    '149.154.175.102': (3, True),
     # DC4
-    '149.154.167.91': 4, '149.154.167.92': 4,
+    '149.154.167.91': (4, False), '149.154.167.92': (4, False),
+    '149.154.164.250': (4, True), '149.154.166.120': (4, True),
+    '149.154.166.121': (4, True), '149.154.167.118': (4, True),
+    '149.154.165.111': (4, True),
     # DC5
-    '91.108.56.100': 5, 
-    '91.108.56.126': 5, '91.108.56.101': 5, '91.108.56.116': 5, 
+    '91.108.56.100': (5, False), '91.108.56.101': (5, False),
+    '91.108.56.116': (5, False), '91.108.56.126': (5, False),
+    '149.154.171.5':  (5, False),
+    '91.108.56.102': (5, True), '91.108.56.128': (5, True),
+    '91.108.56.151': (5, True),
     # DC203
-    '91.105.192.100': 203,
-    # Media DCs
-    # '149.154.167.151': 2, '149.154.167.223': 2, 
-    # '149.154.166.120': 4, '149.154.166.121': 4,
+    '91.105.192.100': (203, False),
+}
+
+# This case might work but not actually sure
+_DC_OVERRIDES: Dict[int, int] = {
+    203: 2
 }
 
 _dc_opt: Dict[int, Optional[str]] = {}
@@ -61,7 +85,10 @@ _ws_blacklist: Set[Tuple[int, bool]] = set()
 
 # Rate-limit re-attempts per (dc, is_media)
 _dc_fail_until: Dict[Tuple[int, bool], float] = {}
-_DC_FAIL_COOLDOWN = 60.0  # seconds
+_DC_FAIL_COOLDOWN = 30.0   # seconds to keep reduced WS timeout after failure
+_WS_FAIL_TIMEOUT = 2.0    # quick-retry timeout after a recent WS failure
+
+_ZERO_64 = b'\x00' * 64
 
 
 _ssl_ctx = ssl.create_default_context()
@@ -69,6 +96,22 @@ _ssl_ctx.check_hostname = False
 _ssl_ctx.verify_mode = ssl.CERT_NONE
 
 
+def _set_sock_opts(transport):
+    sock = transport.get_extra_info('socket')
+    if sock is None:
+        return
+    if _TCP_NODELAY:
+        try:
+            sock.setsockopt(_socket.IPPROTO_TCP, _socket.TCP_NODELAY, 1)
+        except (OSError, AttributeError):
+            pass
+    try:
+        sock.setsockopt(_socket.SOL_SOCKET, _socket.SO_RCVBUF, _RECV_BUF)
+        sock.setsockopt(_socket.SOL_SOCKET, _socket.SO_SNDBUF, _SEND_BUF)
+    except OSError:
+        pass
+
+
 class WsHandshakeError(Exception):
     def __init__(self, status_code: int, status_line: str,
                  headers: dict = None, location: str = None):
@@ -86,10 +129,31 @@ class WsHandshakeError(Exception):
 def _xor_mask(data: bytes, mask: bytes) -> bytes:
     if not data:
         return data
-    a = bytearray(data)
-    for i in range(len(a)):
-        a[i] ^= mask[i & 3]
-    return bytes(a)
+    n = len(data)
+    mask_rep = (mask * (n // 4 + 1))[:n]
+    return (int.from_bytes(data, 'big') ^ int.from_bytes(mask_rep, 'big')).to_bytes(n, 'big')
+
+
+# Pre-compiled struct formats
+_st_BB = struct.Struct('>BB')
+_st_BBH = struct.Struct('>BBH')
+_st_BBQ = struct.Struct('>BBQ')
+_st_BB4s = struct.Struct('>BB4s')
+_st_BBH4s = struct.Struct('>BBH4s')
+_st_BBQ4s = struct.Struct('>BBQ4s')
+_st_H = struct.Struct('>H')
+_st_Q = struct.Struct('>Q')
+_st_I_net = struct.Struct('!I')
+_st_Ih = struct.Struct('<Ih')
+_st_I_le = struct.Struct('<I')
+_PROTO_ABRIDGED = 0xEFEFEFEF
+_PROTO_INTERMEDIATE = 0xEEEEEEEE
+_PROTO_PADDED_INTERMEDIATE = 0xDDDDDDDD
+_VALID_PROTOS = frozenset((
+    _PROTO_ABRIDGED,
+    _PROTO_INTERMEDIATE,
+    _PROTO_PADDED_INTERMEDIATE,
+))
 
 
 class RawWebSocket:
@@ -100,6 +164,7 @@ class RawWebSocket:
     proxy), performs the HTTP Upgrade handshake, and provides send/recv
     for binary frames with proper masking, ping/pong, and close handling.
     """
+    __slots__ = ('reader', 'writer', '_closed')
 
     OP_CONTINUATION = 0x0
     OP_TEXT = 0x1
@@ -127,6 +192,7 @@ class RawWebSocket:
             asyncio.open_connection(ip, 443, ssl=_ssl_ctx,
                                     server_hostname=domain),
             timeout=min(timeout, 10))
+        _set_sock_opts(writer.transport)
 
         ws_key = base64.b64encode(os.urandom(16)).decode()
         req = (
@@ -193,6 +259,15 @@ class RawWebSocket:
         self.writer.write(frame)
         await self.writer.drain()
 
+    async def send_batch(self, parts: List[bytes]):
+        """Send multiple binary frames with a single drain (less overhead)."""
+        if self._closed:
+            raise ConnectionError("WebSocket closed")
+        for part in parts:
+            frame = self._build_frame(self.OP_BINARY, part, mask=True)
+            self.writer.write(frame)
+        await self.writer.drain()
+
     async def recv(self) -> Optional[bytes]:
         """
         Receive the next data frame.  Handles ping/pong/close
@@ -255,40 +330,37 @@ class RawWebSocket:
     @staticmethod
     def _build_frame(opcode: int, data: bytes,
                      mask: bool = False) -> bytes:
-        header = bytearray()
-        header.append(0x80 | opcode)  # FIN=1 + opcode
         length = len(data)
-        mask_bit = 0x80 if mask else 0x00
+        fb = 0x80 | opcode
 
+        if not mask:
+            if length < 126:
+                return _st_BB.pack(fb, length) + data
+            if length < 65536:
+                return _st_BBH.pack(fb, 126, length) + data
+            return _st_BBQ.pack(fb, 127, length) + data
+
+        mask_key = os.urandom(4)
+        masked = _xor_mask(data, mask_key)
         if length < 126:
-            header.append(mask_bit | length)
-        elif length < 65536:
-            header.append(mask_bit | 126)
-            header.extend(struct.pack('>H', length))
-        else:
-            header.append(mask_bit | 127)
-            header.extend(struct.pack('>Q', length))
-
-        if mask:
-            mask_key = os.urandom(4)
-            header.extend(mask_key)
-            return bytes(header) + _xor_mask(data, mask_key)
-        return bytes(header) + data
+            return _st_BB4s.pack(fb, 0x80 | length, mask_key) + masked
+        if length < 65536:
+            return _st_BBH4s.pack(fb, 0x80 | 126, length, mask_key) + masked
+        return _st_BBQ4s.pack(fb, 0x80 | 127, length, mask_key) + masked
 
     async def _read_frame(self) -> Tuple[int, bytes]:
         hdr = await self.reader.readexactly(2)
         opcode = hdr[0] & 0x0F
-        is_masked = bool(hdr[1] & 0x80)
         length = hdr[1] & 0x7F
 
         if length == 126:
-            length = struct.unpack('>H',
-                                   await self.reader.readexactly(2))[0]
+            length = _st_H.unpack(
+                await self.reader.readexactly(2))[0]
         elif length == 127:
-            length = struct.unpack('>Q',
-                                   await self.reader.readexactly(8))[0]
+            length = _st_Q.unpack(
+                await self.reader.readexactly(8))[0]
 
-        if is_masked:
+        if hdr[1] & 0x80:
             mask_key = await self.reader.readexactly(4)
             payload = await self.reader.readexactly(length)
             return opcode, _xor_mask(payload, mask_key)
@@ -307,7 +379,7 @@ def _human_bytes(n: int) -> str:
 
 def _is_telegram_ip(ip: str) -> bool:
     try:
-        n = struct.unpack('!I', _socket.inet_aton(ip))[0]
+        n = _st_I_net.unpack(_socket.inet_aton(ip))[0]
         return any(lo <= n <= hi for lo, hi in _TG_RANGES)
     except OSError:
         return False
@@ -318,42 +390,161 @@ def _is_http_transport(data: bytes) -> bool:
             data[:5] == b'HEAD ' or data[:8] == b'OPTIONS ')
 
 
-def _dc_from_init(data: bytes) -> Tuple[Optional[int], bool]:
-    """
-    Extract DC ID from the 64-byte MTProto obfuscation init packet.
-    Returns (dc_id, is_media).
-    """
+def _dc_from_init(data: bytes, *, return_proto: bool = False):
     try:
         key = bytes(data[8:40])
         iv = bytes(data[40:56])
-        cipher = Cipher(algorithms.AES(key), modes.CTR(iv))
-        encryptor = cipher.encryptor()
+        encryptor = create_aes_ctr_transform(key, iv)
         keystream = encryptor.update(b'\x00' * 64) + encryptor.finalize()
         plain = bytes(a ^ b for a, b in zip(data[56:64], keystream[56:64]))
         proto = struct.unpack('<I', plain[0:4])[0]
         dc_raw = struct.unpack('<h', plain[4:6])[0]
         log.debug("dc_from_init: proto=0x%08X dc_raw=%d plain=%s",
                   proto, dc_raw, plain.hex())
-        if proto in (0xEFEFEFEF, 0xEEEEEEEE, 0xDDDDDDDD):
+        if proto in _VALID_PROTOS:
             dc = abs(dc_raw)
-            if 1 <= dc <= 1000:
-                return dc, (dc_raw < 0)
+            if 1 <= dc <= 5 or dc == 203:
+                return (
+                    (dc, (dc_raw < 0), proto)
+                    if return_proto else (dc, (dc_raw < 0))
+                )
+            return (None, False, proto) if return_proto else (None, False)
     except Exception as exc:
         log.debug("DC extraction failed: %s", exc)
-    return None, False
+    return (None, False, None) if return_proto else (None, False)
+
+def _patch_init_dc(data: bytes, dc: int) -> bytes:
+    """
+    Patch dc_id in the 64-byte MTProto init packet.
+
+    Mobile clients with useSecret=0 leave bytes 60-61 as random.
+    The WS relay needs a valid dc_id to route correctly.
+    """
+    if len(data) < 64:
+        return data
+
+    new_dc = struct.pack('<h', dc)
+    try:
+        key_raw = bytes(data[8:40])
+        iv = bytes(data[40:56])
+        enc = create_aes_ctr_transform(key_raw, iv)
+        ks = enc.update(b'\x00' * 64) + enc.finalize()
+        patched = bytearray(data[:64])
+        patched[60] = ks[60] ^ new_dc[0]
+        patched[61] = ks[61] ^ new_dc[1]
+        log.debug("init patched: dc_id -> %d", dc)
+        if len(data) > 64:
+            return bytes(patched) + data[64:]
+        return bytes(patched)
+    except Exception:
+        return data
+
+
+class _MsgSplitter:
+    """
+    Splits client TCP data into individual MTProto transport packets so
+    each can be sent as a separate WebSocket frame.
+
+    Some mobile clients coalesce multiple MTProto packets into one TCP
+    write, and TCP reads may also cut a packet in half.  Keep a rolling
+    buffer so incomplete packets are not forwarded as standalone frames.
+    """
+
+    __slots__ = ('_dec', '_proto', '_cipher_buf', '_plain_buf', '_disabled')
+
+    def __init__(self, init_data: bytes, proto: Optional[int] = None):
+        if proto is None:
+            _, _, proto = _dc_from_init(init_data, return_proto=True)
+        key_raw = bytes(init_data[8:40])
+        iv = bytes(init_data[40:56])
+        self._dec = create_aes_ctr_transform(key_raw, iv)
+        self._dec.update(b'\x00' * 64)  # skip init packet
+        self._proto = proto
+        self._cipher_buf = bytearray()
+        self._plain_buf = bytearray()
+        self._disabled = False
+
+    def split(self, chunk: bytes) -> List[bytes]:
+        """Decrypt to find packet boundaries, return complete ciphertext packets."""
+        if not chunk:
+            return []
+        if self._disabled:
+            return [chunk]
+
+        self._cipher_buf.extend(chunk)
+        self._plain_buf.extend(self._dec.update(chunk))
+
+        parts = []
+        while self._cipher_buf:
+            packet_len = self._next_packet_len()
+            if packet_len is None:
+                break
+            if packet_len <= 0:
+                parts.append(bytes(self._cipher_buf))
+                self._cipher_buf.clear()
+                self._plain_buf.clear()
+                self._disabled = True
+                break
+            parts.append(bytes(self._cipher_buf[:packet_len]))
+            del self._cipher_buf[:packet_len]
+            del self._plain_buf[:packet_len]
+        return parts
+
+    def flush(self) -> List[bytes]:
+        if not self._cipher_buf:
+            return []
+        tail = bytes(self._cipher_buf)
+        self._cipher_buf.clear()
+        self._plain_buf.clear()
+        return [tail]
+
+    def _next_packet_len(self) -> Optional[int]:
+        if not self._plain_buf:
+            return None
+        if self._proto == _PROTO_ABRIDGED:
+            return self._next_abridged_len()
+        if self._proto in (_PROTO_INTERMEDIATE, _PROTO_PADDED_INTERMEDIATE):
+            return self._next_intermediate_len()
+        return 0
+
+    def _next_abridged_len(self) -> Optional[int]:
+        first = self._plain_buf[0]
+        if first in (0x7F, 0xFF):
+            if len(self._plain_buf) < 4:
+                return None
+            payload_len = int.from_bytes(self._plain_buf[1:4], 'little') * 4
+            header_len = 4
+        else:
+            payload_len = (first & 0x7F) * 4
+            header_len = 1
+
+        if payload_len <= 0:
+            return 0
+
+        packet_len = header_len + payload_len
+        if len(self._plain_buf) < packet_len:
+            return None
+        return packet_len
+
+    def _next_intermediate_len(self) -> Optional[int]:
+        if len(self._plain_buf) < 4:
+            return None
+
+        payload_len = _st_I_le.unpack_from(self._plain_buf, 0)[0] & 0x7FFFFFFF
+        if payload_len <= 0:
+            return 0
+
+        packet_len = 4 + payload_len
+        if len(self._plain_buf) < packet_len:
+            return None
+        return packet_len
 
 
 def _ws_domains(dc: int, is_media) -> List[str]:
-    """
-    Return domain names to try for WebSocket connection to a DC.
-
-    DC 1-5:  kws{N}[-1].web.telegram.org
-    DC >5:   kws{N}[-1].telegram.org
-    """
-    base = 'telegram.org' if dc > 5 else 'web.telegram.org'
+    dc = _DC_OVERRIDES.get(dc, dc)
     if is_media is None or is_media:
-        return [f'kws{dc}-1.{base}', f'kws{dc}.{base}']
-    return [f'kws{dc}.{base}', f'kws{dc}-1.{base}']
+        return [f'kws{dc}-1.web.telegram.org', f'kws{dc}.web.telegram.org']
+    return [f'kws{dc}.web.telegram.org', f'kws{dc}-1.web.telegram.org']
 
 
 class Stats:
@@ -366,13 +557,19 @@ class Stats:
         self.ws_errors = 0
         self.bytes_up = 0
         self.bytes_down = 0
+        self.pool_hits = 0
+        self.pool_misses = 0
 
     def summary(self) -> str:
+        pool_total = self.pool_hits + self.pool_misses
+        pool_s = (
+            f"{self.pool_hits}/{pool_total}" if pool_total else "n/a")
         return (f"total={self.connections_total} ws={self.connections_ws} "
                 f"tcp_fb={self.connections_tcp_fallback} "
                 f"http_skip={self.connections_http_rejected} "
                 f"pass={self.connections_passthrough} "
                 f"err={self.ws_errors} "
+                f"pool={pool_s} "
                 f"up={_human_bytes(self.bytes_up)} "
                 f"down={_human_bytes(self.bytes_down)}")
 
@@ -380,8 +577,121 @@ class Stats:
 _stats = Stats()
 
 
+def reset_stats() -> None:
+    global _stats
+    _stats = Stats()
+
+
+def get_stats_snapshot() -> Dict[str, int]:
+    return {
+        "bytes_up": _stats.bytes_up,
+        "bytes_down": _stats.bytes_down,
+        "connections_total": _stats.connections_total,
+        "connections_ws": _stats.connections_ws,
+        "connections_tcp_fallback": _stats.connections_tcp_fallback,
+    }
+
+
+class _WsPool:
+    def __init__(self):
+        self._idle: Dict[Tuple[int, bool], deque] = {}
+        self._refilling: Set[Tuple[int, bool]] = set()
+
+    async def get(self, dc: int, is_media: bool,
+                  target_ip: str, domains: List[str]
+                  ) -> Optional[RawWebSocket]:
+        key = (dc, is_media)
+        now = time.monotonic()
+
+        bucket = self._idle.get(key)
+        if bucket is None:
+            bucket = deque()
+            self._idle[key] = bucket
+        while bucket:
+            ws, created = bucket.popleft()
+            age = now - created
+            if age > _WS_POOL_MAX_AGE or ws._closed:
+                asyncio.create_task(self._quiet_close(ws))
+                continue
+            _stats.pool_hits += 1
+            log.debug("WS pool hit for DC%d%s (age=%.1fs, left=%d)",
+                      dc, 'm' if is_media else '', age, len(bucket))
+            self._schedule_refill(key, target_ip, domains)
+            return ws
+
+        _stats.pool_misses += 1
+        self._schedule_refill(key, target_ip, domains)
+        return None
+
+    def _schedule_refill(self, key, target_ip, domains):
+        if key in self._refilling:
+            return
+        self._refilling.add(key)
+        asyncio.create_task(self._refill(key, target_ip, domains))
+
+    async def _refill(self, key, target_ip, domains):
+        dc, is_media = key
+        try:
+            bucket = self._idle.setdefault(key, deque())
+            needed = _WS_POOL_SIZE - len(bucket)
+            if needed <= 0:
+                return
+            tasks = []
+            for _ in range(needed):
+                tasks.append(asyncio.create_task(
+                    self._connect_one(target_ip, domains)))
+            for t in tasks:
+                try:
+                    ws = await t
+                    if ws:
+                        bucket.append((ws, time.monotonic()))
+                except Exception:
+                    pass
+            log.debug("WS pool refilled DC%d%s: %d ready",
+                      dc, 'm' if is_media else '', len(bucket))
+        finally:
+            self._refilling.discard(key)
+
+    @staticmethod
+    async def _connect_one(target_ip, domains) -> Optional[RawWebSocket]:
+        for domain in domains:
+            try:
+                ws = await RawWebSocket.connect(
+                    target_ip, domain, timeout=8)
+                return ws
+            except WsHandshakeError as exc:
+                if exc.is_redirect:
+                    continue
+                return None
+            except Exception:
+                return None
+        return None
+
+    @staticmethod
+    async def _quiet_close(ws):
+        try:
+            await ws.close()
+        except Exception:
+            pass
+
+    async def warmup(self, dc_opt: Dict[int, Optional[str]]):
+        """Pre-fill pool for all configured DCs on startup."""
+        for dc, target_ip in dc_opt.items():
+            if target_ip is None:
+                continue
+            for is_media in (False, True):
+                domains = _ws_domains(dc, is_media)
+                key = (dc, is_media)
+                self._schedule_refill(key, target_ip, domains)
+        log.info("WS pool warmup started for %d DC(s)", len(dc_opt))
+
+
+_ws_pool = _WsPool()
+
+
 async def _bridge_ws(reader, writer, ws: RawWebSocket, label,
-                     dc=None, dst=None, port=None, is_media=False):
+                     dc=None, dst=None, port=None, is_media=False,
+                     splitter: _MsgSplitter = None):
     """Bidirectional TCP <-> WebSocket forwarding."""
     dc_tag = f"DC{dc}{'m' if is_media else ''}" if dc else "DC?"
     dst_tag = f"{dst}:{port}" if dst else "?"
@@ -398,11 +708,25 @@ async def _bridge_ws(reader, writer, ws: RawWebSocket, label,
             while True:
                 chunk = await reader.read(65536)
                 if not chunk:
+                    if splitter:
+                        tail = splitter.flush()
+                        if tail:
+                            await ws.send(tail[0])
                     break
-                _stats.bytes_up += len(chunk)
-                up_bytes += len(chunk)
+                n = len(chunk)
+                _stats.bytes_up += n
+                up_bytes += n
                 up_packets += 1
-                await ws.send(chunk)
+                if splitter:
+                    parts = splitter.split(chunk)
+                    if not parts:
+                        continue
+                    if len(parts) > 1:
+                        await ws.send_batch(parts)
+                    else:
+                        await ws.send(parts[0])
+                else:
+                    await ws.send(chunk)
         except (asyncio.CancelledError, ConnectionError, OSError):
             return
         except Exception as e:
@@ -415,8 +739,9 @@ async def _bridge_ws(reader, writer, ws: RawWebSocket, label,
                 data = await ws.recv()
                 if data is None:
                     break
-                _stats.bytes_down += len(data)
-                down_bytes += len(data)
+                n = len(data)
+                _stats.bytes_down += n
+                down_bytes += n
                 down_packets += 1
                 writer.write(data)
                 await writer.drain()
@@ -459,26 +784,27 @@ async def _bridge_tcp(reader, writer, remote_reader, remote_writer,
                       label, dc=None, dst=None, port=None,
                       is_media=False):
     """Bidirectional TCP <-> TCP forwarding (for fallback)."""
-    async def forward(src, dst_w, tag):
+    async def forward(src, dst_w, is_up):
         try:
             while True:
                 data = await src.read(65536)
                 if not data:
                     break
-                if 'up' in tag:
-                    _stats.bytes_up += len(data)
+                n = len(data)
+                if is_up:
+                    _stats.bytes_up += n
                 else:
-                    _stats.bytes_down += len(data)
+                    _stats.bytes_down += n
                 dst_w.write(data)
                 await dst_w.drain()
         except asyncio.CancelledError:
             pass
         except Exception as e:
-            log.debug("[%s] %s ended: %s", label, tag, e)
+            log.debug("[%s] forward ended: %s", label, e)
 
     tasks = [
-        asyncio.create_task(forward(reader, remote_writer, 'up')),
-        asyncio.create_task(forward(remote_reader, writer, 'down')),
+        asyncio.create_task(forward(reader, remote_writer, True)),
+        asyncio.create_task(forward(remote_reader, writer, False)),
     ]
     try:
         await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
@@ -519,8 +845,12 @@ async def _pipe(r, w):
             pass
 
 
+_SOCKS5_REPLIES = {s: bytes([0x05, s, 0x00, 0x01, 0, 0, 0, 0, 0, 0])
+                   for s in (0x00, 0x05, 0x07, 0x08)}
+
+
 def _socks5_reply(status):
-    return bytes([0x05, status, 0x00, 0x01]) + b'\x00' * 6
+    return _SOCKS5_REPLIES[status]
 
 
 async def _tcp_fallback(reader, writer, dst, port, init, label,
@@ -550,6 +880,8 @@ async def _handle_client(reader, writer):
     peer = writer.get_extra_info('peername')
     label = f"{peer[0]}:{peer[1]}" if peer else "?"
 
+    _set_sock_opts(writer.transport)
+
     try:
         # -- SOCKS5 greeting --
         hdr = await asyncio.wait_for(reader.readexactly(2), timeout=10)
@@ -586,7 +918,18 @@ async def _handle_client(reader, writer):
             writer.close()
             return
 
-        port = struct.unpack('!H', await reader.readexactly(2))[0]
+        port = _st_H.unpack(await reader.readexactly(2))[0]
+
+        if ':' in dst:
+            log.error(
+                "[%s] IPv6 address detected: %s:%d — "
+                "IPv6 addresses are not supported; "
+                "disable IPv6 to continue using the proxy.",
+                label, dst, port)
+            writer.write(_socks5_reply(0x05))
+            await writer.drain()
+            writer.close()
+            return
 
         # -- Non-Telegram IP -> direct passthrough --
         if not _is_telegram_ip(dst):
@@ -638,9 +981,15 @@ async def _handle_client(reader, writer):
             return
 
         # -- Extract DC ID --
-        dc, is_media = _dc_from_init(init)
+        dc, is_media, proto = _dc_from_init(init)
+        
+        init_patched = False
+        # Android (may be ios too) with useSecret=0 has random dc_id bytes — patch it
         if dc is None and dst in _IP_TO_DC:
-            dc = _IP_TO_DC.get(dst)
+            dc, is_media = _IP_TO_DC.get(dst)
+            if dc in _dc_opt:
+                init = _patch_init_dc(init, -dc if is_media else dc)
+                init_patched = True
 
         if dc is None or dc not in _dc_opt:
             log.warning("[%s] unknown DC%s for %s:%d -> TCP passthrough",
@@ -664,59 +1013,54 @@ async def _handle_client(reader, writer):
                          label, dc, media_tag)
             return
 
-        # -- Cooldown check --
-        fail_until = _dc_fail_until.get(dc_key, 0)
-        if now < fail_until:
-            remaining = fail_until - now
-            log.debug("[%s] DC%d%s WS cooldown (%.0fs) -> TCP",
-                      label, dc, media_tag, remaining)
-            ok = await _tcp_fallback(reader, writer, dst, port, init,
-                                     label, dc=dc, is_media=is_media)
-            if ok:
-                log.info("[%s] DC%d%s TCP fallback closed",
-                         label, dc, media_tag)
-            return
-
         # -- Try WebSocket via direct connection --
+        fail_until = _dc_fail_until.get(dc_key, 0)
+        ws_timeout = _WS_FAIL_TIMEOUT if now < fail_until else 10.0
+
         domains = _ws_domains(dc, is_media)
         target = _dc_opt[dc]
         ws = None
         ws_failed_redirect = False
         all_redirects = True
 
-        for domain in domains:
-            url = f'wss://{domain}/apiws'
-            log.info("[%s] DC%d%s (%s:%d) -> %s via %s",
-                     label, dc, media_tag, dst, port, url, target)
-            try:
-                ws = await RawWebSocket.connect(target, domain,
-                                                timeout=10)
-                all_redirects = False
-                break
-            except WsHandshakeError as exc:
-                _stats.ws_errors += 1
-                if exc.is_redirect:
-                    ws_failed_redirect = True
-                    log.warning("[%s] DC%d%s got %d from %s -> %s",
-                                label, dc, media_tag,
-                                exc.status_code, domain,
-                                exc.location or '?')
-                    continue
-                else:
+        ws = await _ws_pool.get(dc, is_media, target, domains)
+        if ws:
+            log.info("[%s] DC%d%s (%s:%d) -> pool hit via %s",
+                     label, dc, media_tag, dst, port, target)
+        else:
+            for domain in domains:
+                url = f'wss://{domain}/apiws'
+                log.info("[%s] DC%d%s (%s:%d) -> %s via %s",
+                         label, dc, media_tag, dst, port, url, target)
+                try:
+                    ws = await RawWebSocket.connect(target, domain,
+                                                    timeout=ws_timeout)
                     all_redirects = False
-                    log.warning("[%s] DC%d%s WS handshake: %s",
-                                label, dc, media_tag, exc.status_line)
-            except Exception as exc:
-                _stats.ws_errors += 1
-                all_redirects = False
-                err_str = str(exc)
-                if ('CERTIFICATE_VERIFY_FAILED' in err_str or
-                        'Hostname mismatch' in err_str):
-                    log.warning("[%s] DC%d%s SSL error: %s",
-                                label, dc, media_tag, exc)
-                else:
-                    log.warning("[%s] DC%d%s WS connect failed: %s",
-                                label, dc, media_tag, exc)
+                    break
+                except WsHandshakeError as exc:
+                    _stats.ws_errors += 1
+                    if exc.is_redirect:
+                        ws_failed_redirect = True
+                        log.warning("[%s] DC%d%s got %d from %s -> %s",
+                                    label, dc, media_tag,
+                                    exc.status_code, domain,
+                                    exc.location or '?')
+                        continue
+                    else:
+                        all_redirects = False
+                        log.warning("[%s] DC%d%s WS handshake: %s",
+                                    label, dc, media_tag, exc.status_line)
+                except Exception as exc:
+                    _stats.ws_errors += 1
+                    all_redirects = False
+                    err_str = str(exc)
+                    if ('CERTIFICATE_VERIFY_FAILED' in err_str or
+                            'Hostname mismatch' in err_str):
+                        log.warning("[%s] DC%d%s SSL error: %s",
+                                    label, dc, media_tag, exc)
+                    else:
+                        log.warning("[%s] DC%d%s WS connect failed: %s",
+                                    label, dc, media_tag, exc)
 
         # -- WS failed -> fallback --
         if ws is None:
@@ -745,12 +1089,23 @@ async def _handle_client(reader, writer):
         _dc_fail_until.pop(dc_key, None)
         _stats.connections_ws += 1
 
+        splitter = None
+
+        # Turning splitter on for mobile clients or media-connections, so as the big files don't get fragmented by the TCP socket.
+        if proto is not None and (init_patched or is_media or proto != _PROTO_INTERMEDIATE):
+            try:
+                splitter = _MsgSplitter(init, proto)
+                log.debug("[%s] MsgSplitter activated for proto 0x%08X", label, proto)
+            except Exception:
+                pass
+
         # Send the buffered init packet
         await ws.send(init)
 
         # Bidirectional bridge
         await _bridge_ws(reader, writer, ws, label,
-                         dc=dc, dst=dst, port=port, is_media=is_media)
+                         dc=dc, dst=dst, port=port, is_media=is_media,
+                         splitter=splitter)
 
     except asyncio.TimeoutError:
         log.warning("[%s] timeout during SOCKS5 handshake", label)
@@ -760,6 +1115,11 @@ async def _handle_client(reader, writer):
         log.debug("[%s] cancelled", label)
     except ConnectionResetError:
         log.debug("[%s] connection reset", label)
+    except OSError as exc:
+        if getattr(exc, 'winerror', None) == 1236:
+            log.debug("[%s] connection aborted by local system", label)
+        else:
+            log.error("[%s] unexpected os error: %s", label, exc)
     except Exception as exc:
         log.error("[%s] unexpected: %s", label, exc)
     finally:
@@ -784,6 +1144,12 @@ async def _run(port: int, dc_opt: Dict[int, Optional[str]],
         _handle_client, host, port)
     _server_instance = server
 
+    for sock in server.sockets:
+        try:
+            sock.setsockopt(_socket.IPPROTO_TCP, _socket.TCP_NODELAY, 1)
+        except (OSError, AttributeError):
+            pass
+
     log.info("=" * 60)
     log.info("  Telegram WS Bridge Proxy")
     log.info("  Listening on   %s:%d", host, port)
@@ -797,32 +1163,50 @@ async def _run(port: int, dc_opt: Dict[int, Optional[str]],
     log.info("=" * 60)
 
     async def log_stats():
-        while True:
-            await asyncio.sleep(60)
-            bl = ', '.join(
-                f'DC{d}{"m" if m else ""}'
-                for d, m in sorted(_ws_blacklist)) or 'none'
-            log.info("stats: %s | ws_bl: %s", _stats.summary(), bl)
-
-    asyncio.create_task(log_stats())
-
-    if stop_event:
-        async def wait_stop():
-            await stop_event.wait()
-            server.close()
-            me = asyncio.current_task()
-            for task in list(asyncio.all_tasks()):
-                if task is not me:
-                    task.cancel()
-            try:
-                await server.wait_closed()
-            except asyncio.CancelledError:
-                pass
-        asyncio.create_task(wait_stop())
-
-    async with server:
         try:
-            await server.serve_forever()
+            while True:
+                await asyncio.sleep(60)
+                bl = ', '.join(
+                    f'DC{d}{"m" if m else ""}'
+                    for d, m in sorted(_ws_blacklist)) or 'none'
+                log.info("stats: %s | ws_bl: %s", _stats.summary(), bl)
+        except asyncio.CancelledError:
+            raise
+
+    log_stats_task = asyncio.create_task(log_stats())
+
+    await _ws_pool.warmup(dc_opt)
+
+    try:
+        async with server:
+            if stop_event:
+                serve_task = asyncio.create_task(server.serve_forever())
+                stop_task = asyncio.create_task(stop_event.wait())
+                done, _pending = await asyncio.wait(
+                    (serve_task, stop_task),
+                    return_when=asyncio.FIRST_COMPLETED,
+                )
+                if stop_task in done:
+                    server.close()
+                    await server.wait_closed()
+                    if not serve_task.done():
+                        serve_task.cancel()
+                        try:
+                            await serve_task
+                        except asyncio.CancelledError:
+                            pass
+                else:
+                    stop_task.cancel()
+                    try:
+                        await stop_task
+                    except asyncio.CancelledError:
+                        pass
+            else:
+                await server.serve_forever()
+    finally:
+        log_stats_task.cancel()
+        try:
+            await log_stats_task
         except asyncio.CancelledError:
             pass
     _server_instance = None
@@ -859,24 +1243,56 @@ def main():
     ap.add_argument('--host', type=str, default='127.0.0.1',
                     help='Listen host (default 127.0.0.1)')
     ap.add_argument('--dc-ip', metavar='DC:IP', action='append',
-                    default=['2:149.154.167.220', '4:149.154.167.220'],
+                    default=[],
                     help='Target IP for a DC, e.g. --dc-ip 1:149.154.175.205'
                          ' --dc-ip 2:149.154.167.220')
     ap.add_argument('-v', '--verbose', action='store_true',
                     help='Debug logging')
+    ap.add_argument('--log-file', type=str, default=None, metavar='PATH',
+                    help='Log to file with rotation (default: stderr only)')
+    ap.add_argument('--log-max-mb', type=float, default=5, metavar='MB',
+                    help='Max log file size in MB before rotation (default 5)')
+    ap.add_argument('--log-backups', type=int, default=0, metavar='N',
+                    help='Number of rotated log files to keep (default 0)')
+    ap.add_argument('--buf-kb', type=int, default=256, metavar='KB',
+                    help='Socket send/recv buffer size in KB (default 256)')
+    ap.add_argument('--pool-size', type=int, default=4, metavar='N',
+                    help='WS connection pool size per DC (default 4, min 0)')
     args = ap.parse_args()
 
+    if not args.dc_ip:
+        args.dc_ip = ['2:149.154.167.220', '4:149.154.167.220']
+
     try:
         dc_opt = parse_dc_ip_list(args.dc_ip)
     except ValueError as e:
         log.error(str(e))
         sys.exit(1)
 
-    logging.basicConfig(
-        level=logging.DEBUG if args.verbose else logging.INFO,
-        format='%(asctime)s  %(levelname)-5s  %(message)s',
-        datefmt='%H:%M:%S',
-    )
+    log_level = logging.DEBUG if args.verbose else logging.INFO
+    log_fmt = logging.Formatter('%(asctime)s  %(levelname)-5s  %(message)s',
+                                datefmt='%H:%M:%S')
+    root = logging.getLogger()
+    root.setLevel(log_level)
+
+    console = logging.StreamHandler()
+    console.setFormatter(log_fmt)
+    root.addHandler(console)
+
+    if args.log_file:
+        fh = logging.handlers.RotatingFileHandler(
+            args.log_file,
+            maxBytes=max(32 * 1024, args.log_max_mb * 1024 * 1024),
+            backupCount=max(0, args.log_backups),
+            encoding='utf-8',
+        )
+        fh.setFormatter(log_fmt)
+        root.addHandler(fh)
+
+    global _RECV_BUF, _SEND_BUF, _WS_POOL_SIZE
+    _RECV_BUF = max(4, args.buf_kb) * 1024
+    _SEND_BUF = _RECV_BUF
+    _WS_POOL_SIZE = max(0, args.pool_size)
 
     try:
         asyncio.run(_run(args.port, dc_opt, host=args.host))

pyproject.toml

@@ -0,0 +1,73 @@
+[build-system]
+requires = ["hatchling>=1.25.0"]
+build-backend = "hatchling.build"
+
+[project]
+name = "tg-ws-proxy"
+dynamic=["version"]
+
+description = "Telegram Desktop WebSocket Bridge Proxy"
+readme = "README.md"
+requires-python = ">=3.8"
+
+license = { name = "MIT", file = "LICENSE" }
+
+authors = [
+    { name = "Flowseal" }
+]
+
+keywords = [
+    "telegram",
+    "tdesktop",
+    "proxy",
+    "bypass",
+    "websocket",
+    "socks5",
+]
+classifiers = [
+  "Development Status :: 5 - Production/Stable",
+  "Environment :: Console",
+  "Intended Audience :: Customer Service",
+  "Programming Language :: Python :: 3",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Topic :: System :: Networking :: Firewalls",
+]
+
+dependencies = [
+    "pyperclip==1.9.0",
+
+    "psutil==5.9.8; platform_system == 'Windows' and python_version < '3.9'",
+    "cryptography==41.0.7; platform_system == 'Windows' and python_version < '3.9'",
+    "Pillow==10.4.0; platform_system == 'Windows' and python_version < '3.9'",
+
+    "psutil==7.0.0; platform_system != 'Windows' or python_version >= '3.9'",
+    "cryptography==46.0.5; platform_system != 'Windows' or python_version >= '3.9'",
+    "Pillow==12.1.1; (platform_system != 'Windows' or python_version >= '3.9') and platform_system != 'Darwin'",
+
+    "customtkinter==5.2.2; platform_system != 'Darwin'",
+    "pystray==0.19.5; platform_system != 'Darwin'",
+    "rumps==0.4.0; platform_system == 'Darwin'",
+    "Pillow==12.1.0; platform_system == 'Darwin'",
+]
+
+[project.scripts]
+tg-ws-proxy = "proxy.tg_ws_proxy:main"
+tg-ws-proxy-tray-win = "windows:main"
+tg-ws-proxy-tray-macos = "macos:main"
+tg-ws-proxy-tray-linux = "linux:main"
+
+[project.urls]
+Source = "https://github.com/Flowseal/tg-ws-proxy"
+Issues = "https://github.com/Flowseal/tg-ws-proxy/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["proxy", "ui", "utils"]
+
+[tool.hatch.build.force-include]
+"windows.py" = "windows.py"
+"macos.py" = "macos.py"
+"linux.py" = "linux.py"
+
+[tool.hatch.version]
+path = "proxy/__init__.py"

requirements-win7.txt

@@ -1,6 +0,0 @@
-cryptography==41.0.7
-customtkinter==5.2.2
-Pillow==10.4.0
-psutil==5.9.8
-pystray==0.19.5
-pyperclip==1.9.0

requirements.txt

@@ -1,6 +0,0 @@
-cryptography==46.0.5
-customtkinter==5.2.2
-Pillow==12.1.1
-psutil==7.0.0
-pystray==0.19.5
-pyperclip==1.9.0

tests/test_android_proxy_bridge.py

@@ -0,0 +1,229 @@
+import sys
+import unittest
+import json
+from pathlib import Path
+
+
+sys.path.insert(0, str(
+    Path(__file__).resolve().parents[1] / "android" / "app" / "src" / "main" / "python"
+))
+
+import android_proxy_bridge  # noqa: E402
+import proxy.tg_ws_proxy as tg_ws_proxy  # noqa: E402
+
+
+class FakeJavaArrayList:
+    def __init__(self, items):
+        self._items = list(items)
+
+    def size(self):
+        return len(self._items)
+
+    def get(self, index):
+        return self._items[index]
+
+
+class AndroidProxyBridgeTests(unittest.TestCase):
+    def tearDown(self):
+        tg_ws_proxy.reset_stats()
+        android_proxy_bridge._LAST_ERROR = None
+
+    def test_normalize_dc_ip_list_with_python_iterable(self):
+        result = android_proxy_bridge._normalize_dc_ip_list([
+            "2:149.154.167.220",
+            "  ",
+            "4:149.154.167.220 ",
+        ])
+
+        self.assertEqual(result, [
+            "2:149.154.167.220",
+            "4:149.154.167.220",
+        ])
+
+    def test_get_runtime_stats_json_reports_proxy_counters(self):
+        tg_ws_proxy.reset_stats()
+        snapshot = tg_ws_proxy.get_stats_snapshot()
+        snapshot["bytes_up"] = 1536
+        snapshot["bytes_down"] = 4096
+        tg_ws_proxy._stats.bytes_up = snapshot["bytes_up"]
+        tg_ws_proxy._stats.bytes_down = snapshot["bytes_down"]
+
+        result = json.loads(android_proxy_bridge.get_runtime_stats_json())
+
+        self.assertEqual(result["bytes_up"], 1536)
+        self.assertEqual(result["bytes_down"], 4096)
+        self.assertFalse(result["running"])
+        self.assertIsNone(result["last_error"])
+
+    def test_get_runtime_stats_json_includes_last_error(self):
+        android_proxy_bridge._LAST_ERROR = "boom"
+
+        result = json.loads(android_proxy_bridge.get_runtime_stats_json())
+
+        self.assertEqual(result["last_error"], "boom")
+
+    def test_normalize_dc_ip_list_with_java_array_list_shape(self):
+        result = android_proxy_bridge._normalize_dc_ip_list(FakeJavaArrayList([
+            "2:149.154.167.220",
+            "4:149.154.167.220",
+        ]))
+
+        self.assertEqual(result, [
+            "2:149.154.167.220",
+            "4:149.154.167.220",
+        ])
+
+    def test_start_proxy_saves_advanced_runtime_config(self):
+        captured = {}
+
+        class FakeRuntime:
+            def __init__(self, *args, **kwargs):
+                captured["runtime_init"] = kwargs
+                self.log_file = Path("/tmp/proxy.log")
+
+            def reset_log_file(self):
+                captured["reset_log_file"] = True
+
+            def setup_logging(self, verbose=False, log_max_mb=5):
+                captured["verbose"] = verbose
+                captured["log_max_mb"] = log_max_mb
+
+            def save_config(self, config):
+                captured["config"] = dict(config)
+
+            def start_proxy(self, config):
+                captured["start_proxy"] = dict(config)
+                return True
+
+            def is_proxy_running(self):
+                return True
+
+            def stop_proxy(self):
+                captured["stop_proxy"] = True
+
+        original_runtime = android_proxy_bridge.ProxyAppRuntime
+        try:
+            android_proxy_bridge.ProxyAppRuntime = FakeRuntime
+            log_path = android_proxy_bridge.start_proxy(
+                "/tmp/app",
+                "127.0.0.1",
+                1080,
+                ["2:149.154.167.220"],
+                7.0,
+                512,
+                6,
+                True,
+            )
+        finally:
+            android_proxy_bridge.ProxyAppRuntime = original_runtime
+
+        self.assertEqual(log_path, "/tmp/proxy.log")
+        self.assertEqual(captured["config"]["log_max_mb"], 7.0)
+        self.assertEqual(captured["config"]["buf_kb"], 512)
+        self.assertEqual(captured["config"]["pool_size"], 6)
+        self.assertEqual(captured["log_max_mb"], 7.0)
+        self.assertTrue(captured["verbose"])
+
+    def test_get_update_status_json_merges_python_update_state(self):
+        original_load_update_check = android_proxy_bridge._load_update_check
+        try:
+            captured = {}
+
+            class FakeUpdateCheck:
+                RELEASES_PAGE_URL = "https://example.com/releases/latest"
+
+                @staticmethod
+                def run_check(version):
+                    captured["run_check_version"] = version
+
+                @staticmethod
+                def get_status():
+                    return {
+                        "checked": True,
+                        "latest": "1.3.1",
+                        "has_update": True,
+                        "ahead_of_release": False,
+                        "html_url": "https://example.com/release",
+                        "error": "",
+                    }
+
+            android_proxy_bridge._load_update_check = lambda: FakeUpdateCheck
+            result = json.loads(android_proxy_bridge.get_update_status_json(True))
+        finally:
+            android_proxy_bridge._load_update_check = original_load_update_check
+
+        self.assertEqual(captured["run_check_version"], android_proxy_bridge.__version__)
+        self.assertEqual(result["current_version"], android_proxy_bridge.__version__)
+        self.assertEqual(result["latest"], "1.3.1")
+        self.assertTrue(result["has_update"])
+        self.assertTrue(result["checked"])
+        self.assertEqual(result["html_url"], "https://example.com/release")
+
+    def test_get_update_status_json_reports_unchecked_state(self):
+        original_load_update_check = android_proxy_bridge._load_update_check
+        try:
+            class FakeUpdateCheck:
+                RELEASES_PAGE_URL = "https://example.com/releases/latest"
+
+                @staticmethod
+                def get_status():
+                    return {
+                        "checked": False,
+                        "latest": "",
+                        "has_update": False,
+                        "ahead_of_release": False,
+                        "html_url": "",
+                        "error": "",
+                    }
+
+            android_proxy_bridge._load_update_check = lambda: FakeUpdateCheck
+            result = json.loads(android_proxy_bridge.get_update_status_json(False))
+        finally:
+            android_proxy_bridge._load_update_check = original_load_update_check
+
+        self.assertFalse(result["checked"])
+        self.assertEqual(result["current_version"], android_proxy_bridge.__version__)
+
+    def test_get_update_status_json_reports_import_error_without_breaking_bridge(self):
+        original_load_update_check = android_proxy_bridge._load_update_check
+        try:
+            def fail():
+                raise ModuleNotFoundError("No module named 'utils'")
+
+            android_proxy_bridge._load_update_check = fail
+            result = json.loads(android_proxy_bridge.get_update_status_json(True))
+        finally:
+            android_proxy_bridge._load_update_check = original_load_update_check
+
+        self.assertFalse(result["checked"])
+        self.assertIn("No module named 'utils'", result["error"])
+
+    def test_get_update_status_json_normalizes_none_fields_for_kotlin(self):
+        original_load_update_check = android_proxy_bridge._load_update_check
+        try:
+            class FakeUpdateCheck:
+                RELEASES_PAGE_URL = "https://example.com/releases/latest"
+
+                @staticmethod
+                def get_status():
+                    return {
+                        "checked": True,
+                        "latest": None,
+                        "has_update": False,
+                        "ahead_of_release": True,
+                        "html_url": None,
+                        "error": None,
+                    }
+
+            android_proxy_bridge._load_update_check = lambda: FakeUpdateCheck
+            result = json.loads(android_proxy_bridge.get_update_status_json(False))
+        finally:
+            android_proxy_bridge._load_update_check = original_load_update_check
+
+        self.assertEqual(result["latest"], "")
+        self.assertEqual(result["error"], "")
+        self.assertEqual(result["html_url"], "https://example.com/releases/latest")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_app_runtime.py

@@ -0,0 +1,121 @@
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+from proxy.app_runtime import DEFAULT_CONFIG, ProxyAppRuntime
+
+
+class _FakeThread:
+    def __init__(self, target=None, args=(), daemon=None, name=None):
+        self.target = target
+        self.args = args
+        self.daemon = daemon
+        self.name = name
+        self.started = False
+        self.join_timeout = None
+        self._alive = False
+
+    def start(self):
+        self.started = True
+        self._alive = True
+
+    def is_alive(self):
+        return self._alive
+
+    def join(self, timeout=None):
+        self.join_timeout = timeout
+        self._alive = False
+
+
+class ProxyAppRuntimeTests(unittest.TestCase):
+    def test_load_config_returns_defaults_when_missing(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            runtime = ProxyAppRuntime(Path(tmpdir))
+
+            cfg = runtime.load_config()
+
+            self.assertEqual(cfg, DEFAULT_CONFIG)
+
+    def test_load_config_merges_defaults_into_saved_config(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            app_dir = Path(tmpdir)
+            config_path = app_dir / "config.json"
+            app_dir.mkdir(parents=True, exist_ok=True)
+            config_path.write_text(
+                json.dumps({"port": 9050, "host": "127.0.0.2"}),
+                encoding="utf-8")
+            runtime = ProxyAppRuntime(app_dir)
+
+            cfg = runtime.load_config()
+
+            self.assertEqual(cfg["port"], 9050)
+            self.assertEqual(cfg["host"], "127.0.0.2")
+            self.assertEqual(cfg["dc_ip"], DEFAULT_CONFIG["dc_ip"])
+            self.assertEqual(cfg["verbose"], DEFAULT_CONFIG["verbose"])
+
+    def test_invalid_config_file_falls_back_to_defaults(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            app_dir = Path(tmpdir)
+            app_dir.mkdir(parents=True, exist_ok=True)
+            (app_dir / "config.json").write_text("{broken", encoding="utf-8")
+            runtime = ProxyAppRuntime(app_dir)
+
+            cfg = runtime.load_config()
+
+            self.assertEqual(cfg, DEFAULT_CONFIG)
+
+    def test_start_proxy_starts_thread_with_parsed_dc_options(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            captured = {}
+            thread_holder = {}
+
+            def fake_parse(entries):
+                captured["dc_ip"] = list(entries)
+                return {2: "149.154.167.220"}
+
+            def fake_thread_factory(**kwargs):
+                thread = _FakeThread(**kwargs)
+                thread_holder["thread"] = thread
+                return thread
+
+            runtime = ProxyAppRuntime(
+                Path(tmpdir),
+                parse_dc_ip_list=fake_parse,
+                thread_factory=fake_thread_factory)
+
+            started = runtime.start_proxy(dict(DEFAULT_CONFIG))
+
+            self.assertTrue(started)
+            self.assertEqual(captured["dc_ip"], DEFAULT_CONFIG["dc_ip"])
+            self.assertTrue(thread_holder["thread"].started)
+            self.assertEqual(
+                thread_holder["thread"].args,
+                (DEFAULT_CONFIG["port"], {2: "149.154.167.220"},
+                 DEFAULT_CONFIG["host"]))
+
+    def test_start_proxy_reports_bad_config(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            errors = []
+
+            def fake_parse(entries):
+                raise ValueError("bad dc mapping")
+
+            runtime = ProxyAppRuntime(
+                Path(tmpdir),
+                parse_dc_ip_list=fake_parse,
+                on_error=errors.append)
+
+            started = runtime.start_proxy({
+                "host": "127.0.0.1",
+                "port": 1080,
+                "dc_ip": ["broken"],
+                "verbose": False,
+            })
+
+            self.assertFalse(started)
+            self.assertEqual(errors, ["Ошибка конфигурации:\nbad dc mapping"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_crypto_mtproto.py

@@ -0,0 +1,107 @@
+import struct
+import unittest
+
+from proxy.crypto_backend import create_aes_ctr_transform
+from proxy.tg_ws_proxy import _MsgSplitter, _dc_from_init, _patch_init_dc
+
+
+KEY = bytes(range(32))
+IV = bytes(range(16))
+PROTO_TAG = 0xEFEFEFEF
+
+
+def _xor(left: bytes, right: bytes) -> bytes:
+    return bytes(a ^ b for a, b in zip(left, right))
+
+
+def _keystream(size: int) -> bytes:
+    transform = create_aes_ctr_transform(KEY, IV)
+    return transform.update(b"\x00" * size) + transform.finalize()
+
+
+def _build_init_packet(dc_raw: int, proto: int = PROTO_TAG) -> bytes:
+    packet = bytearray(64)
+    packet[8:40] = KEY
+    packet[40:56] = IV
+
+    plain_tail = struct.pack("<Ih", proto, dc_raw) + b"\x00\x00"
+    packet[56:64] = _xor(plain_tail, _keystream(64)[56:64])
+    return bytes(packet)
+
+
+def _encrypt_after_init(init_packet: bytes, plaintext: bytes) -> bytes:
+    transform = create_aes_ctr_transform(init_packet[8:40], init_packet[40:56])
+    transform.update(b"\x00" * 64)
+    return transform.update(plaintext) + transform.finalize()
+
+
+class CryptoBackendTests(unittest.TestCase):
+    def test_python_backend_matches_cryptography_stream(self):
+        cryptography_transform = create_aes_ctr_transform(
+            KEY, IV, backend="cryptography")
+        python_transform = create_aes_ctr_transform(KEY, IV, backend="python")
+
+        chunks = [
+            b"",
+            b"\x00" * 16,
+            bytes(range(31)),
+            b"telegram-proxy",
+            b"\xff" * 64,
+        ]
+
+        cryptography_out = b"".join(
+            cryptography_transform.update(chunk) for chunk in chunks
+        ) + cryptography_transform.finalize()
+        python_out = b"".join(
+            python_transform.update(chunk) for chunk in chunks
+        ) + python_transform.finalize()
+
+        self.assertEqual(python_out, cryptography_out)
+
+    def test_unknown_backend_raises_error(self):
+        with self.assertRaises(ValueError):
+            create_aes_ctr_transform(KEY, IV, backend="missing")
+
+
+class MtProtoInitTests(unittest.TestCase):
+    def test_dc_from_init_reads_non_media_dc(self):
+        init_packet = _build_init_packet(dc_raw=2)
+
+        self.assertEqual(_dc_from_init(init_packet), (2, False))
+
+    def test_dc_from_init_reads_media_dc(self):
+        init_packet = _build_init_packet(dc_raw=-4)
+
+        self.assertEqual(_dc_from_init(init_packet), (4, True))
+
+    def test_patch_init_dc_updates_signed_dc_and_preserves_tail(self):
+        original = _build_init_packet(dc_raw=99) + b"tail"
+
+        patched = _patch_init_dc(original, -3)
+
+        self.assertEqual(_dc_from_init(patched[:64]), (3, True))
+        self.assertEqual(patched[64:], b"tail")
+
+
+class MsgSplitterTests(unittest.TestCase):
+    def test_splitter_splits_multiple_abridged_messages(self):
+        init_packet = _build_init_packet(dc_raw=-2)
+        plain_chunk = b"\x01abcd\x02EFGH1234"
+        encrypted_chunk = _encrypt_after_init(init_packet, plain_chunk)
+
+        parts = _MsgSplitter(init_packet).split(encrypted_chunk)
+
+        self.assertEqual(parts, [encrypted_chunk[:5], encrypted_chunk[5:14]])
+
+    def test_splitter_leaves_single_message_intact(self):
+        init_packet = _build_init_packet(dc_raw=2)
+        plain_chunk = b"\x02abcdefgh"
+        encrypted_chunk = _encrypt_after_init(init_packet, plain_chunk)
+
+        parts = _MsgSplitter(init_packet).split(encrypted_chunk)
+
+        self.assertEqual(parts, [encrypted_chunk])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_socks5_protocol.py

@@ -0,0 +1,129 @@
+import asyncio
+import socket
+import unittest
+from unittest.mock import patch
+
+from proxy.tg_ws_proxy import _handle_client, _socks5_reply
+
+
+class _FakeTransport:
+    def get_extra_info(self, name):
+        return None
+
+    def get_write_buffer_size(self):
+        return 0
+
+
+class _FakeReader:
+    def __init__(self, payload: bytes):
+        self._payload = payload
+        self._offset = 0
+
+    async def readexactly(self, n: int) -> bytes:
+        end = self._offset + n
+        if end > len(self._payload):
+            partial = self._payload[self._offset:]
+            self._offset = len(self._payload)
+            raise asyncio.IncompleteReadError(partial, n)
+        chunk = self._payload[self._offset:end]
+        self._offset = end
+        return chunk
+
+
+class _FakeWriter:
+    def __init__(self):
+        self.transport = _FakeTransport()
+        self.writes = []
+        self.closed = False
+        self.close_calls = 0
+
+    def get_extra_info(self, name):
+        if name == "peername":
+            return ("127.0.0.1", 50000)
+        return None
+
+    def write(self, data: bytes):
+        self.writes.append(data)
+
+    async def drain(self):
+        return None
+
+    def close(self):
+        self.closed = True
+        self.close_calls += 1
+
+    async def wait_closed(self):
+        return None
+
+
+def _ipv4_connect_request(ip: str, port: int, cmd: int = 1) -> bytes:
+    return bytes([0x05, cmd, 0x00, 0x01]) + socket.inet_aton(ip) + port.to_bytes(2, "big")
+
+
+def _domain_connect_request(domain: str, port: int, cmd: int = 1) -> bytes:
+    encoded = domain.encode("utf-8")
+    return (
+        bytes([0x05, cmd, 0x00, 0x03, len(encoded)])
+        + encoded
+        + port.to_bytes(2, "big")
+    )
+
+
+def _ipv6_connect_request(ip: str, port: int) -> bytes:
+    return (
+        bytes([0x05, 0x01, 0x00, 0x04])
+        + socket.inet_pton(socket.AF_INET6, ip)
+        + port.to_bytes(2, "big")
+    )
+
+
+class Socks5ProtocolTests(unittest.IsolatedAsyncioTestCase):
+    async def test_rejects_non_socks5_greeting(self):
+        reader = _FakeReader(b"\x04\x01")
+        writer = _FakeWriter()
+
+        await _handle_client(reader, writer)
+
+        self.assertEqual(writer.writes, [])
+        self.assertTrue(writer.closed)
+
+    async def test_rejects_unsupported_command(self):
+        reader = _FakeReader(b"\x05\x01\x00" + _ipv4_connect_request("1.1.1.1", 443, cmd=2))
+        writer = _FakeWriter()
+
+        await _handle_client(reader, writer)
+
+        self.assertEqual(writer.writes, [b"\x05\x00", _socks5_reply(0x07)])
+        self.assertTrue(writer.closed)
+
+    async def test_rejects_unsupported_address_type(self):
+        reader = _FakeReader(b"\x05\x01\x00" + b"\x05\x01\x00\x02")
+        writer = _FakeWriter()
+
+        await _handle_client(reader, writer)
+
+        self.assertEqual(writer.writes, [b"\x05\x00", _socks5_reply(0x08)])
+        self.assertTrue(writer.closed)
+
+    async def test_rejects_ipv6_destinations(self):
+        reader = _FakeReader(b"\x05\x01\x00" + _ipv6_connect_request("2001:db8::1", 443))
+        writer = _FakeWriter()
+
+        await _handle_client(reader, writer)
+
+        self.assertEqual(writer.writes, [b"\x05\x00", _socks5_reply(0x05)])
+        self.assertTrue(writer.closed)
+
+    async def test_passthrough_connect_failure_returns_error(self):
+        reader = _FakeReader(b"\x05\x01\x00" + _domain_connect_request("example.com", 443))
+        writer = _FakeWriter()
+
+        with patch("proxy.tg_ws_proxy.asyncio.open_connection", side_effect=OSError("boom")):
+            await _handle_client(reader, writer)
+
+        self.assertEqual(writer.writes, [b"\x05\x00", _socks5_reply(0x05)])
+        self.assertTrue(writer.closed)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_update_check.py

@@ -0,0 +1,53 @@
+import unittest
+
+from utils import update_check
+
+
+class UpdateCheckTests(unittest.TestCase):
+    def setUp(self):
+        self._orig_state = dict(update_check._state)
+
+    def tearDown(self):
+        update_check._state.clear()
+        update_check._state.update(self._orig_state)
+
+    def test_apply_release_tag_marks_update_available(self):
+        update_check._apply_release_tag(
+            tag="v1.3.1",
+            html_url="https://example.com/release",
+            current_version="1.3.0",
+        )
+
+        status = update_check.get_status()
+        self.assertTrue(status["has_update"])
+        self.assertFalse(status["ahead_of_release"])
+        self.assertEqual(status["latest"], "1.3.1")
+        self.assertEqual(status["html_url"], "https://example.com/release")
+
+    def test_apply_release_tag_marks_ahead_of_release(self):
+        update_check._apply_release_tag(
+            tag="v1.1.2-relay",
+            html_url="https://example.com/release",
+            current_version="1.3.0",
+        )
+
+        status = update_check.get_status()
+        self.assertFalse(status["has_update"])
+        self.assertTrue(status["ahead_of_release"])
+        self.assertEqual(status["latest"], "1.1.2-relay")
+
+    def test_apply_release_tag_marks_latest_when_versions_match(self):
+        update_check._apply_release_tag(
+            tag="v1.3.0",
+            html_url="https://example.com/release",
+            current_version="1.3.0",
+        )
+
+        status = update_check.get_status()
+        self.assertFalse(status["has_update"])
+        self.assertFalse(status["ahead_of_release"])
+        self.assertEqual(status["latest"], "1.3.0")
+
+
+if __name__ == "__main__":
+    unittest.main()

ui/__init__.py

@@ -0,0 +1,4 @@
+"""
+Интерфейс tray (CustomTkinter): тема, диалоги настроек, подсказки.
+Ядро прокси — пакет `proxy`.
+"""

ui/ctk_theme.py

@@ -0,0 +1,112 @@
+"""
+Общая светлая тема и фабрика окон CustomTkinter для tray-приложений (Windows / Linux).
+Цвета и отступы задаются в одном месте — правки темы не дублируются по платформам.
+"""
+
+from __future__ import annotations
+
+import sys
+import tkinter
+from dataclasses import dataclass
+from typing import Any, Callable, Optional, Tuple
+
+_tk_variable_del_guard_installed = False
+
+
+def _install_tkinter_variable_del_guard() -> None:
+    """
+    Убирает «Exception ignored» при выходе процесса: Tcl уже разрушен, а GC ещё
+    вызывает Variable.__del__ (StringVar и т.д.) — напр. окно CTk в фоновом потоке.
+    """
+    global _tk_variable_del_guard_installed
+    if _tk_variable_del_guard_installed:
+        return
+    _orig = tkinter.Variable.__del__
+
+    def _safe_variable_del(self: Any, _orig: Any = _orig) -> None:
+        try:
+            _orig(self)
+        except (RuntimeError, tkinter.TclError):
+            pass
+
+    tkinter.Variable.__del__ = _safe_variable_del  # type: ignore[assignment]
+    _tk_variable_del_guard_installed = True
+
+# Размеры и отступы (единые для диалогов настроек и первого запуска)
+CONFIG_DIALOG_SIZE: Tuple[int, int] = (460, 560)
+CONFIG_DIALOG_FRAME_PAD: Tuple[int, int] = (20, 14)
+FIRST_RUN_SIZE: Tuple[int, int] = (520, 440)
+FIRST_RUN_FRAME_PAD: Tuple[int, int] = (28, 24)
+
+
+@dataclass(frozen=True)
+class CtkTheme:
+    """Палитра Telegram-style и семейства шрифтов для UI и моноширинного текста."""
+
+    tg_blue: str = "#3390ec"
+    tg_blue_hover: str = "#2b7cd4"
+    bg: str = "#ffffff"
+    field_bg: str = "#f0f2f5"
+    field_border: str = "#d6d9dc"
+    text_primary: str = "#000000"
+    text_secondary: str = "#707579"
+    ui_font_family: str = "Sans"
+    mono_font_family: str = "Monospace"
+
+
+def ctk_theme_for_platform() -> CtkTheme:
+    if sys.platform == "win32":
+        return CtkTheme(ui_font_family="Segoe UI", mono_font_family="Consolas")
+    return CtkTheme()
+
+
+def apply_ctk_appearance(ctk: Any) -> None:
+    ctk.set_appearance_mode("light")
+    ctk.set_default_color_theme("blue")
+
+
+def center_ctk_geometry(root: Any, width: int, height: int) -> None:
+    sw = root.winfo_screenwidth()
+    sh = root.winfo_screenheight()
+    root.geometry(f"{width}x{height}+{(sw - width) // 2}+{(sh - height) // 2}")
+
+
+def create_ctk_root(
+    ctk: Any,
+    *,
+    title: str,
+    width: int,
+    height: int,
+    theme: CtkTheme,
+    topmost: bool = True,
+    after_create: Optional[Callable[[Any], None]] = None,
+) -> Any:
+    """
+    Создаёт CTk: глобальная тема, заголовок, без ресайза, по центру экрана, фон из палитры.
+    after_create — опционально: установка иконки окна (различается по ОС).
+    """
+    _install_tkinter_variable_del_guard()
+    apply_ctk_appearance(ctk)
+    root = ctk.CTk()
+    root.title(title)
+    root.resizable(False, False)
+    if topmost:
+        root.attributes("-topmost", True)
+    center_ctk_geometry(root, width, height)
+    root.configure(fg_color=theme.bg)
+    if after_create:
+        after_create(root)
+    return root
+
+
+def main_content_frame(
+    ctk: Any,
+    root: Any,
+    theme: CtkTheme,
+    *,
+    padx: int,
+    pady: int,
+) -> Any:
+    frame = ctk.CTkFrame(root, fg_color=theme.bg, corner_radius=0)
+    frame.pack(fill="both", expand=True, padx=padx, pady=pady)
+    return frame

ui/ctk_tooltip.py

@@ -0,0 +1,114 @@
+"""
+Всплывающие подсказки для CustomTkinter / tk: задержка, Toplevel без рамки, wrap.
+"""
+
+from __future__ import annotations
+
+import tkinter as tk
+from typing import Any, List, Optional
+
+
+class CtkTooltip:
+    """Показ текста при наведении на виджет."""
+
+    def __init__(
+        self,
+        widget: Any,
+        text: str,
+        *,
+        delay_ms: int = 450,
+        wraplength: int = 320,
+    ) -> None:
+        self.widget = widget
+        self.text = text
+        self.delay_ms = delay_ms
+        self.wraplength = wraplength
+        self._after_id: Optional[str] = None
+        self._tip: Optional[tk.Toplevel] = None
+        widget.bind("<Enter>", self._schedule, add="+")
+        widget.bind("<Leave>", self._hide, add="+")
+        widget.bind("<Button>", self._hide, add="+")
+        widget.bind("<Destroy>", self._on_destroy, add="+")
+
+    def _schedule(self, _event: Any = None) -> None:
+        self._cancel_after()
+        self._after_id = self.widget.after(self.delay_ms, self._show)
+
+    def _cancel_after(self) -> None:
+        if self._after_id is not None:
+            try:
+                self.widget.after_cancel(self._after_id)
+            except Exception:
+                pass
+            self._after_id = None
+
+    def _show(self) -> None:
+        self._after_id = None
+        if self._tip is not None:
+            return
+        try:
+            if not self.widget.winfo_exists():
+                return
+        except Exception:
+            return
+
+        tw = tk.Toplevel(self.widget.winfo_toplevel())
+        tw.wm_overrideredirect(True)
+        try:
+            tw.wm_attributes("-topmost", True)
+        except Exception:
+            pass
+        tw.configure(bg="#2b2b2b")
+        lbl = tk.Label(
+            tw,
+            text=self.text,
+            justify="left",
+            wraplength=self.wraplength,
+            background="#2b2b2b",
+            foreground="#f0f0f0",
+            relief="flat",
+            borderwidth=0,
+            padx=10,
+            pady=8,
+            font=("Segoe UI", 10) if _is_windows() else None,
+        )
+        lbl.pack()
+        x = self.widget.winfo_rootx() + 12
+        y = self.widget.winfo_rooty() + self.widget.winfo_height() + 4
+        tw.wm_geometry(f"+{x}+{y}")
+        self._tip = tw
+
+    def _hide(self, _event: Any = None) -> None:
+        self._cancel_after()
+        if self._tip is not None:
+            try:
+                self._tip.destroy()
+            except Exception:
+                pass
+            self._tip = None
+
+    def _on_destroy(self, _event: Any = None) -> None:
+        self._hide()
+
+
+def _is_windows() -> bool:
+    import sys
+
+    return sys.platform == "win32"
+
+
+def attach_ctk_tooltip(
+    widget: Any,
+    text: str,
+    *,
+    delay_ms: int = 450,
+    wraplength: int = 320,
+) -> None:
+    """Повесить подсказку на виджет (CTk или tk)."""
+    CtkTooltip(widget, text, delay_ms=delay_ms, wraplength=wraplength)
+
+
+def attach_tooltip_to_widgets(widgets: List[Any], text: str, **kwargs: Any) -> None:
+    """Одна и та же подсказка на несколько виджетов (подпись + поле)."""
+    for w in widgets:
+        attach_ctk_tooltip(w, text, **kwargs)

ui/ctk_tray_ui.py

@@ -0,0 +1,579 @@
+"""
+Общая разметка CustomTkinter для tray (Windows / Linux): настройки и первый запуск.
+Логика сохранения и колбэки остаются в платформенных модулях.
+"""
+
+from __future__ import annotations
+
+import webbrowser
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, List, Optional, Tuple, Union
+
+import proxy.tg_ws_proxy as tg_ws_proxy
+from proxy import __version__
+from utils.update_check import RELEASES_PAGE_URL, get_status
+
+from ui.ctk_theme import (
+    FIRST_RUN_FRAME_PAD,
+    CtkTheme,
+    main_content_frame,
+)
+from ui.ctk_tooltip import attach_ctk_tooltip, attach_tooltip_to_widgets
+
+# Подсказки для формы настроек (новые пользователи)
+_TIP_HOST = (
+    "Адрес, на котором прокси принимает SOCKS5-подключения.\n"
+    "Обычно 127.0.0.1 — локальная сеть, 0.0.0.0 - все интерфейсы"
+)
+_TIP_PORT = (
+    "Порт SOCKS5. В Telegram Desktop в настройках прокси должен быть "
+    "указан тот же порт"
+)
+_TIP_DC = (
+    "Соответствие номера датацентра Telegram (DC) и IP-адреса сервера.\n"
+    "Каждая строка: «номер:IP», например 2:149.154.167.220. "
+    "Прокси по этим правилам направляет трафик к нужным серверам Telegram"
+)
+_TIP_VERBOSE = (
+    "Если включено, в файл логов пишется больше подробностей — "
+    "необходимо при поиске неполадок"
+)
+_TIP_BUF_KB = (
+    "Размер буфера приёма/передачи в килобайтах.\n"
+    "Больше значение — больше выделение памяти на сокет"
+)
+_TIP_POOL = (
+    "Сколько параллельных WebSocket-сессий к одному датацентру можно держать.\n"
+    "Увеличение может помочь при высокой нагрузке"
+)
+_TIP_LOG_MB = (
+    "Максимальный размер файла лога; при достижении лимита файл перезаписывается"
+)
+_TIP_AUTOSTART = (
+    "Запускать TG WS Proxy при входе в Windows. "
+    "Если вы переместите программу в другую папку, автозапуск сбросится"
+)
+_TIP_CHECK_UPDATES = (
+    "При запуске проверять наличие обновлений"
+)
+_TIP_SAVE = "Сохранить настройки"
+_TIP_CANCEL = "Закрыть окно без сохранения изменений"
+
+# Внутренняя ширина полей относительно ширины окна настроек (см. CONFIG_DIALOG_SIZE)
+_CONFIG_FORM_INNER_WIDTH = 396
+
+
+def tray_settings_scroll_and_footer(
+    ctk: Any,
+    content_parent: Any,
+    theme: CtkTheme,
+) -> Tuple[Any, Any]:
+    """
+    Нижняя панель под кнопки и прокручиваемая область для формы (форма не обрезает кнопки).
+    Возвращает (scroll_frame, footer_frame).
+    """
+    footer = ctk.CTkFrame(content_parent, fg_color=theme.bg)
+    footer.pack(side="bottom", fill="x")
+    scroll = ctk.CTkScrollableFrame(
+        content_parent,
+        fg_color=theme.bg,
+        corner_radius=0,
+        scrollbar_button_color=theme.field_border,
+        scrollbar_button_hover_color=theme.text_secondary,
+    )
+    scroll.pack(fill="both", expand=True)
+    return scroll, footer
+
+
+def _config_section(
+    ctk: Any,
+    parent: Any,
+    theme: CtkTheme,
+    title: str,
+    *,
+    bottom_spacer: int = 6,
+) -> Any:
+    """Заголовок секции и карточка с рамкой для группировки полей."""
+    wrap = ctk.CTkFrame(parent, fg_color="transparent")
+    wrap.pack(fill="x", pady=(0, bottom_spacer))
+    ctk.CTkLabel(
+        wrap,
+        text=title,
+        font=(theme.ui_font_family, 12, "bold"),
+        text_color=theme.text_primary,
+        anchor="w",
+    ).pack(anchor="w", pady=(0, 2))
+    card = ctk.CTkFrame(
+        wrap,
+        fg_color=theme.field_bg,
+        corner_radius=10,
+        border_width=1,
+        border_color=theme.field_border,
+    )
+    card.pack(fill="x")
+    inner = ctk.CTkFrame(card, fg_color="transparent")
+    inner.pack(fill="x", padx=10, pady=8)
+    return inner
+
+
+@dataclass
+class TrayConfigFormWidgets:
+    host_var: Any
+    port_var: Any
+    dc_textbox: Any
+    verbose_var: Any
+    adv_entries: List[Any]
+    adv_keys: Tuple[str, ...]
+    autostart_var: Optional[Any]
+    check_updates_var: Optional[Any]
+
+
+def install_tray_config_form(
+    ctk: Any,
+    frame: Any,
+    theme: CtkTheme,
+    cfg: dict,
+    default_config: dict,
+    *,
+    show_autostart: bool = False,
+    autostart_value: bool = False,
+) -> TrayConfigFormWidgets:
+    """Поля настроек прокси внутри уже созданного `frame`."""
+    header = ctk.CTkFrame(frame, fg_color="transparent")
+    header.pack(fill="x", pady=(0, 2))
+    ctk.CTkLabel(
+        header,
+        text="Настройки прокси",
+        font=(theme.ui_font_family, 17, "bold"),
+        text_color=theme.text_primary,
+        anchor="w",
+    ).pack(side="left")
+    ctk.CTkLabel(
+        header,
+        text=f"v{__version__}",
+        font=(theme.ui_font_family, 12),
+        text_color=theme.text_secondary,
+        anchor="e",
+    ).pack(side="right")
+
+    inner_w = _CONFIG_FORM_INNER_WIDTH
+
+    conn = _config_section(ctk, frame, theme, "Подключение SOCKS5")
+
+    host_row = ctk.CTkFrame(conn, fg_color="transparent")
+    host_row.pack(fill="x")
+
+    host_col = ctk.CTkFrame(host_row, fg_color="transparent")
+    host_col.pack(side="left", fill="x", expand=True, padx=(0, 10))
+    host_lbl = ctk.CTkLabel(
+        host_col,
+        text="IP-адрес",
+        font=(theme.ui_font_family, 12),
+        text_color=theme.text_secondary,
+        anchor="w",
+    )
+    host_lbl.pack(anchor="w", pady=(0, 2))
+    host_var = ctk.StringVar(value=cfg.get("host", default_config["host"]))
+    host_entry = ctk.CTkEntry(
+        host_col,
+        textvariable=host_var,
+        width=160,
+        height=36,
+        font=(theme.ui_font_family, 13),
+        corner_radius=10,
+        fg_color=theme.bg,
+        border_color=theme.field_border,
+        border_width=1,
+        text_color=theme.text_primary,
+    )
+    host_entry.pack(fill="x", pady=(0, 0))
+    attach_tooltip_to_widgets([host_lbl, host_entry, host_col], _TIP_HOST)
+
+    port_col = ctk.CTkFrame(host_row, fg_color="transparent")
+    port_col.pack(side="left")
+    port_lbl = ctk.CTkLabel(
+        port_col,
+        text="Порт",
+        font=(theme.ui_font_family, 12),
+        text_color=theme.text_secondary,
+        anchor="w",
+    )
+    port_lbl.pack(anchor="w", pady=(0, 2))
+    port_var = ctk.StringVar(value=str(cfg.get("port", default_config["port"])))
+    port_entry = ctk.CTkEntry(
+        port_col,
+        textvariable=port_var,
+        width=100,
+        height=36,
+        font=(theme.ui_font_family, 13),
+        corner_radius=10,
+        fg_color=theme.bg,
+        border_color=theme.field_border,
+        border_width=1,
+        text_color=theme.text_primary,
+    )
+    port_entry.pack(anchor="w")
+    attach_tooltip_to_widgets([port_lbl, port_entry, port_col], _TIP_PORT)
+
+    dc_inner = _config_section(ctk, frame, theme, "Датацентры Telegram (DC → IP)")
+    dc_lbl = ctk.CTkLabel(
+        dc_inner,
+        text="По одному правилу на строку, формат: номер:IP",
+        font=(theme.ui_font_family, 11),
+        text_color=theme.text_secondary,
+        anchor="w",
+    )
+    dc_lbl.pack(anchor="w", pady=(0, 4))
+    dc_textbox = ctk.CTkTextbox(
+        dc_inner,
+        width=inner_w,
+        height=88,
+        font=(theme.mono_font_family, 12),
+        corner_radius=10,
+        fg_color=theme.bg,
+        border_color=theme.field_border,
+        border_width=1,
+        text_color=theme.text_primary,
+    )
+    dc_textbox.pack(fill="x")
+    dc_textbox.insert("1.0", "\n".join(cfg.get("dc_ip", default_config["dc_ip"])))
+    attach_tooltip_to_widgets([dc_lbl, dc_textbox], _TIP_DC)
+
+    log_inner = _config_section(ctk, frame, theme, "Логи и производительность")
+
+    verbose_var = ctk.BooleanVar(value=cfg.get("verbose", False))
+    verbose_cb = ctk.CTkCheckBox(
+        log_inner,
+        text="Подробное логирование (verbose)",
+        variable=verbose_var,
+        font=(theme.ui_font_family, 13),
+        text_color=theme.text_primary,
+        fg_color=theme.tg_blue,
+        hover_color=theme.tg_blue_hover,
+        corner_radius=6,
+        border_width=2,
+        border_color=theme.field_border,
+    )
+    verbose_cb.pack(anchor="w", pady=(0, 6))
+    attach_ctk_tooltip(verbose_cb, _TIP_VERBOSE)
+
+    adv_frame = ctk.CTkFrame(log_inner, fg_color="transparent")
+    adv_frame.pack(fill="x")
+
+    adv_rows = [
+        ("Буфер, КБ (по умолчанию 256)", "buf_kb", _TIP_BUF_KB),
+        ("Пул WebSocket-сессий (по умолчанию 4)", "pool_size", _TIP_POOL),
+        ("Макс. размер лога, МБ (по умолчанию 5)", "log_max_mb", _TIP_LOG_MB),
+    ]
+    for lbl, key, tip in adv_rows:
+        col_frame = ctk.CTkFrame(adv_frame, fg_color="transparent")
+        col_frame.pack(fill="x", pady=(0, 0 if key == "log_max_mb" else 5))
+        adv_l = ctk.CTkLabel(
+            col_frame,
+            text=lbl,
+            font=(theme.ui_font_family, 11),
+            text_color=theme.text_secondary,
+            anchor="w",
+        )
+        adv_l.pack(anchor="w", pady=(0, 2))
+        adv_e = ctk.CTkEntry(
+            col_frame,
+            width=inner_w,
+            height=32,
+            font=(theme.ui_font_family, 13),
+            corner_radius=8,
+            fg_color=theme.bg,
+            border_color=theme.field_border,
+            border_width=1,
+            text_color=theme.text_primary,
+            textvariable=ctk.StringVar(
+                value=str(cfg.get(key, default_config[key]))
+            ),
+        )
+        adv_e.pack(fill="x")
+        attach_tooltip_to_widgets([adv_l, adv_e, col_frame], tip)
+
+    adv_entries = list(adv_frame.winfo_children())
+    adv_keys = ("buf_kb", "pool_size", "log_max_mb")
+
+    upd_inner = _config_section(ctk, frame, theme, "Обновления")
+    st = get_status()
+    check_updates_var = ctk.BooleanVar(
+        value=bool(
+            cfg.get("check_updates", default_config.get("check_updates", True))
+        )
+    )
+    upd_cb = ctk.CTkCheckBox(
+        upd_inner,
+        text="Проверять обновления при запуске",
+        variable=check_updates_var,
+        font=(theme.ui_font_family, 13),
+        text_color=theme.text_primary,
+        fg_color=theme.tg_blue,
+        hover_color=theme.tg_blue_hover,
+        corner_radius=6,
+        border_width=2,
+        border_color=theme.field_border,
+    )
+    upd_cb.pack(anchor="w", pady=(0, 6))
+    attach_ctk_tooltip(upd_cb, _TIP_CHECK_UPDATES)
+
+    if st.get("error"):
+        upd_status = "Не удалось связаться с GitHub. Проверьте сеть."
+    elif not st.get("checked"):
+        upd_status = "Статус появится после фоновой проверки при запуске."
+    elif st.get("has_update") and st.get("latest"):
+        upd_status = (
+            f"На GitHub доступна версия {st['latest']} "
+            f"(у вас {__version__})."
+        )
+    elif st.get("ahead_of_release") and st.get("latest"):
+        upd_status = (
+            f"У вас {__version__} — новее последнего релиза на GitHub "
+            f"({st['latest']})."
+        )
+    else:
+        upd_status = "Установлена последняя известная версия с GitHub."
+
+    ctk.CTkLabel(
+        upd_inner,
+        text=upd_status,
+        font=(theme.ui_font_family, 11),
+        text_color=theme.text_secondary,
+        anchor="w",
+        justify="left",
+        wraplength=inner_w,
+    ).pack(anchor="w", pady=(0, 8))
+
+    rel_url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+    open_rel_btn = ctk.CTkButton(
+        upd_inner,
+        text="Открыть страницу релиза",
+        height=32,
+        font=(theme.ui_font_family, 13),
+        corner_radius=8,
+        fg_color=theme.field_bg,
+        hover_color=theme.field_border,
+        text_color=theme.text_primary,
+        border_width=1,
+        border_color=theme.field_border,
+        command=lambda u=rel_url: webbrowser.open(u),
+    )
+    open_rel_btn.pack(anchor="w")
+
+    autostart_var = None
+    if show_autostart:
+        sys_inner = _config_section(
+            ctk, frame, theme, "Запуск Windows", bottom_spacer=4
+        )
+        autostart_var = ctk.BooleanVar(value=autostart_value)
+        as_cb = ctk.CTkCheckBox(
+            sys_inner,
+            text="Автозапуск при включении компьютера",
+            variable=autostart_var,
+            font=(theme.ui_font_family, 13),
+            text_color=theme.text_primary,
+            fg_color=theme.tg_blue,
+            hover_color=theme.tg_blue_hover,
+            corner_radius=6,
+            border_width=2,
+            border_color=theme.field_border,
+        )
+        as_cb.pack(anchor="w", pady=(0, 4))
+        as_hint = ctk.CTkLabel(
+            sys_inner,
+            text="Если переместить программу в другую папку, запись автозапуска может сброситься.",
+            font=(theme.ui_font_family, 11),
+            text_color=theme.text_secondary,
+            anchor="w",
+            justify="left",
+            wraplength=inner_w,
+        )
+        as_hint.pack(anchor="w")
+        attach_tooltip_to_widgets([as_cb, as_hint], _TIP_AUTOSTART)
+
+    return TrayConfigFormWidgets(
+        host_var=host_var,
+        port_var=port_var,
+        dc_textbox=dc_textbox,
+        verbose_var=verbose_var,
+        adv_entries=adv_entries,
+        adv_keys=adv_keys,
+        autostart_var=autostart_var,
+        check_updates_var=check_updates_var,
+    )
+
+
+def merge_adv_from_form(
+    widgets: TrayConfigFormWidgets,
+    base: Dict[str, Any],
+    default_config: dict,
+) -> None:
+    """Дополняет base значениями buf_kb / pool_size / log_max_mb (in-place)."""
+    for i, key in enumerate(widgets.adv_keys):
+        col_frame = widgets.adv_entries[i]
+        entry = col_frame.winfo_children()[1]
+        try:
+            val = float(entry.get().strip())
+            if key in ("buf_kb", "pool_size"):
+                val = int(val)
+            base[key] = val
+        except ValueError:
+            base[key] = default_config[key]
+
+
+def validate_config_form(
+    widgets: TrayConfigFormWidgets,
+    default_config: dict,
+    *,
+    include_autostart: bool,
+) -> Union[dict, str]:
+    """
+    Возвращает словарь полей конфига или строку ошибки для показа пользователю.
+    """
+    import socket as _sock
+
+    host_val = widgets.host_var.get().strip()
+    try:
+        _sock.inet_aton(host_val)
+    except OSError:
+        return "Некорректный IP-адрес."
+
+    try:
+        port_val = int(widgets.port_var.get().strip())
+        if not (1 <= port_val <= 65535):
+            raise ValueError
+    except ValueError:
+        return "Порт должен быть числом 1-65535"
+
+    lines = [
+        l.strip()
+        for l in widgets.dc_textbox.get("1.0", "end").strip().splitlines()
+        if l.strip()
+    ]
+    try:
+        tg_ws_proxy.parse_dc_ip_list(lines)
+    except ValueError as e:
+        return str(e)
+
+    new_cfg: Dict[str, Any] = {
+        "host": host_val,
+        "port": port_val,
+        "dc_ip": lines,
+        "verbose": widgets.verbose_var.get(),
+    }
+    if include_autostart:
+        new_cfg["autostart"] = (
+            widgets.autostart_var.get()
+            if widgets.autostart_var is not None
+            else False
+        )
+
+    merge_adv_from_form(widgets, new_cfg, default_config)
+    if widgets.check_updates_var is not None:
+        new_cfg["check_updates"] = bool(widgets.check_updates_var.get())
+    return new_cfg
+
+
+def install_tray_config_buttons(
+    ctk: Any,
+    frame: Any,
+    theme: CtkTheme,
+    *,
+    on_save: Callable[[], None],
+    on_cancel: Callable[[], None],
+) -> None:
+    ctk.CTkFrame(
+        frame,
+        fg_color=theme.field_border,
+        height=1,
+        corner_radius=0,
+    ).pack(fill="x", pady=(4, 10))
+    btn_frame = ctk.CTkFrame(frame, fg_color="transparent")
+    btn_frame.pack(fill="x", pady=(0, 0))
+    save_btn = ctk.CTkButton(
+        btn_frame, text="Сохранить", height=38,
+        font=(theme.ui_font_family, 14, "bold"), corner_radius=10,
+        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+        text_color="#ffffff",
+        command=on_save)
+    save_btn.pack(side="left", fill="x", expand=True, padx=(0, 8))
+    attach_ctk_tooltip(save_btn, _TIP_SAVE)
+    cancel_btn = ctk.CTkButton(
+        btn_frame, text="Отмена", height=38,
+        font=(theme.ui_font_family, 14), corner_radius=10,
+        fg_color=theme.field_bg, hover_color=theme.field_border,
+        text_color=theme.text_primary, border_width=1,
+        border_color=theme.field_border,
+        command=on_cancel)
+    cancel_btn.pack(side="right", fill="x", expand=True)
+    attach_ctk_tooltip(cancel_btn, _TIP_CANCEL)
+
+
+def populate_first_run_window(
+    ctk: Any,
+    root: Any,
+    theme: CtkTheme,
+    *,
+    host: str,
+    port: int,
+    on_done: Callable[[bool], None],
+) -> None:
+    """
+    Содержимое окна первого запуска. on_done(open_in_telegram) — по «Начать» и по закрытию окна.
+    """
+    tg_url = f"tg://socks?server={host}&port={port}"
+    fpx, fpy = FIRST_RUN_FRAME_PAD
+    frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
+
+    title_frame = ctk.CTkFrame(frame, fg_color="transparent")
+    title_frame.pack(anchor="w", pady=(0, 16), fill="x")
+
+    accent_bar = ctk.CTkFrame(title_frame, fg_color=theme.tg_blue,
+                              width=4, height=32, corner_radius=2)
+    accent_bar.pack(side="left", padx=(0, 12))
+
+    ctk.CTkLabel(title_frame, text="Прокси запущен и работает в системном трее",
+                 font=(theme.ui_font_family, 17, "bold"),
+                 text_color=theme.text_primary).pack(side="left")
+
+    sections = [
+        ("Как подключить Telegram Desktop:", True),
+        ("  Автоматически:", True),
+        ("  ПКМ по иконке в трее → «Открыть в Telegram»", False),
+        (f"  Или ссылка: {tg_url}", False),
+        ("\n  Вручную:", True),
+        ("  Настройки → Продвинутые → Тип подключения → Прокси", False),
+        (f"  SOCKS5 → {host} : {port} (без логина/пароля)", False),
+    ]
+
+    for text, bold in sections:
+        weight = "bold" if bold else "normal"
+        ctk.CTkLabel(frame, text=text,
+                     font=(theme.ui_font_family, 13, weight),
+                     text_color=theme.text_primary,
+                     anchor="w", justify="left").pack(anchor="w", pady=1)
+
+    ctk.CTkFrame(frame, fg_color="transparent", height=16).pack()
+
+    ctk.CTkFrame(frame, fg_color=theme.field_border, height=1,
+                 corner_radius=0).pack(fill="x", pady=(0, 12))
+
+    auto_var = ctk.BooleanVar(value=True)
+    ctk.CTkCheckBox(frame, text="Открыть прокси в Telegram сейчас",
+                    variable=auto_var, font=(theme.ui_font_family, 13),
+                    text_color=theme.text_primary,
+                    fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+                    corner_radius=6, border_width=2,
+                    border_color=theme.field_border).pack(anchor="w", pady=(0, 16))
+
+    def on_ok():
+        on_done(auto_var.get())
+
+    ctk.CTkButton(frame, text="Начать", width=180, height=42,
+                  font=(theme.ui_font_family, 15, "bold"), corner_radius=10,
+                  fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+                  text_color="#ffffff",
+                  command=on_ok).pack(pady=(0, 0))
+
+    root.protocol("WM_DELETE_WINDOW", on_ok)

utils/__init__.py

@@ -0,0 +1,5 @@
+"""Вспомогательные утилиты (проверка релизов и т.п.)."""
+
+from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+
+__all__ = ["RELEASES_PAGE_URL", "get_status", "run_check"]

utils/default_config.py

@@ -0,0 +1,27 @@
+"""
+Общие значения по умолчанию для tray-приложений (Windows / Linux / macOS).
+Единственное отличие по платформе — ключ autostart только на Windows.
+"""
+from __future__ import annotations
+
+import sys
+from typing import Any, Dict
+
+_TRAY_DEFAULTS_COMMON: Dict[str, Any] = {
+    "port": 1080,
+    "host": "127.0.0.1",
+    "dc_ip": ["2:149.154.167.220", "4:149.154.167.220"],
+    "verbose": False,
+    "check_updates": True,
+    "log_max_mb": 5,
+    "buf_kb": 256,
+    "pool_size": 4,
+}
+
+
+def default_tray_config() -> Dict[str, Any]:
+    """Новая копия конфига по умолчанию для текущей ОС."""
+    cfg = dict(_TRAY_DEFAULTS_COMMON)
+    if sys.platform == "win32":
+        cfg["autostart"] = False
+    return cfg

utils/update_check.py

@@ -0,0 +1,223 @@
+"""
+Минимальная проверка новой версии через GitHub Releases API (без сторонних зависимостей).
+
+Ограничение частоты запросов: не чаще одного раза в час на машину (кэш в каталоге
+данных приложения). Поддерживается If-None-Match (ETag) для ответа 304.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+import time
+from itertools import zip_longest
+from pathlib import Path
+from typing import Any, Dict, Optional, Tuple
+from urllib.error import HTTPError, URLError
+from urllib.request import Request, urlopen
+
+REPO = "Dark-Avery/tg-ws-proxy"
+RELEASES_LATEST_API = f"https://api.github.com/repos/{REPO}/releases/latest"
+RELEASES_PAGE_URL = f"https://github.com/{REPO}/releases/latest"
+
+# Не чаще одного полного запроса к API в час (без учёта 304 с тем же ETag).
+_MIN_FETCH_INTERVAL_SEC = 3600.0
+
+_state: Dict[str, Any] = {
+    "checked": False,
+    "has_update": False,
+    "ahead_of_release": False,
+    "latest": None,
+    "html_url": None,
+    "error": None,
+}
+
+
+def _cache_file() -> Optional[Path]:
+    try:
+        if sys.platform == "win32":
+            root = Path(os.environ.get("APPDATA", str(Path.home()))) / "TgWsProxy"
+        elif sys.platform == "darwin":
+            root = Path.home() / "Library/Application Support/TgWsProxy"
+        else:
+            xdg = os.environ.get("XDG_CONFIG_HOME")
+            root = (Path(xdg).expanduser() if xdg else Path.home() / ".config") / "TgWsProxy"
+        root.mkdir(parents=True, exist_ok=True)
+        return root / ".update_check_cache.json"
+    except OSError:
+        return None
+
+
+def _load_cache(path: Optional[Path]) -> Dict[str, Any]:
+    if not path or not path.is_file():
+        return {}
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+
+
+def _save_cache(path: Optional[Path], data: Dict[str, Any]) -> None:
+    if not path:
+        return
+    try:
+        path.write_text(json.dumps(data), encoding="utf-8")
+    except OSError:
+        pass
+
+
+def _parse_version_tuple(s: str) -> tuple:
+    s = (s or "").strip().lstrip("vV")
+    if not s:
+        return (0,)
+    parts = []
+    for seg in s.split("."):
+        digits = "".join(c for c in seg if c.isdigit())
+        if digits:
+            try:
+                parts.append(int(digits))
+            except ValueError:
+                parts.append(0)
+        else:
+            parts.append(0)
+    return tuple(parts) if parts else (0,)
+
+
+def _version_gt(a: str, b: str) -> bool:
+    """True, если версия a новее b (простое сравнение по сегментам)."""
+    ta = _parse_version_tuple(a)
+    tb = _parse_version_tuple(b)
+    for x, y in zip_longest(ta, tb, fillvalue=0):
+        if x > y:
+            return True
+        if x < y:
+            return False
+    return False
+
+
+def _apply_release_tag(
+    tag: str, html_url: str, current_version: str,
+) -> None:
+    global _state
+    if not tag:
+        _state["has_update"] = False
+        _state["ahead_of_release"] = False
+        _state["latest"] = None
+        _state["html_url"] = html_url.strip() or RELEASES_PAGE_URL
+        return
+    latest_clean = tag.lstrip("vV")
+    cur = (current_version or "").strip().lstrip("vV")
+    _state["latest"] = latest_clean
+    _state["html_url"] = html_url.strip() or RELEASES_PAGE_URL
+    _state["has_update"] = _version_gt(latest_clean, cur)
+    _state["ahead_of_release"] = bool(latest_clean) and _version_gt(
+        cur, latest_clean
+    )
+
+
+def fetch_latest_release(
+    timeout: float = 12.0,
+    etag: Optional[str] = None,
+) -> Tuple[Optional[dict], Optional[str], int]:
+    """
+    GET releases/latest. Возвращает (data или None при 304, etag или None, HTTP-код).
+    """
+    headers = {
+        "Accept": "application/vnd.github+json",
+        "User-Agent": "tg-ws-proxy-update-check",
+    }
+    if etag:
+        headers["If-None-Match"] = etag
+    req = Request(
+        RELEASES_LATEST_API,
+        headers=headers,
+        method="GET",
+    )
+    try:
+        with urlopen(req, timeout=timeout) as resp:
+            code = getattr(resp, "status", None) or resp.getcode()
+            new_etag = resp.headers.get("ETag")
+            raw = resp.read().decode("utf-8", errors="replace")
+            return json.loads(raw), new_etag, int(code)
+    except HTTPError as e:
+        if e.code == 304:
+            hdrs = e.headers
+            new_etag = hdrs.get("ETag") if hdrs else None
+            return None, new_etag or etag, 304
+        raise
+
+
+def run_check(current_version: str) -> None:
+    """Запрашивает последний релиз и обновляет внутреннее состояние."""
+    global _state
+    _state["checked"] = True
+    _state["error"] = None
+
+    cache_path = _cache_file()
+    cache = _load_cache(cache_path)
+    now = time.time()
+    last_attempt = float(cache.get("last_attempt_at") or 0)
+
+    if last_attempt and (now - last_attempt) < _MIN_FETCH_INTERVAL_SEC:
+        tag = (cache.get("tag_name") or "").strip()
+        if tag:
+            _apply_release_tag(tag, cache.get("html_url") or "", current_version)
+            return
+        err = cache.get("last_error")
+        _state["error"] = (
+            err if err else "Проверка обновлений отложена (интервал между запросами)."
+        )
+        _state["has_update"] = False
+        _state["ahead_of_release"] = False
+        _state["latest"] = None
+        _state["html_url"] = RELEASES_PAGE_URL
+        return
+
+    etag = (cache.get("etag") or "").strip() or None
+    try:
+        data, new_etag, code = fetch_latest_release(etag=etag)
+        cache["last_attempt_at"] = now
+        if code == 304:
+            tag = (cache.get("tag_name") or "").strip()
+            url = (cache.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            _apply_release_tag(tag, url, current_version)
+            if new_etag:
+                cache["etag"] = new_etag
+            _save_cache(cache_path, cache)
+            return
+
+        assert data is not None
+        tag = (data.get("tag_name") or "").strip()
+        html_url = (data.get("html_url") or "").strip() or RELEASES_PAGE_URL
+        if not tag:
+            _state["has_update"] = False
+            _state["ahead_of_release"] = False
+            _state["latest"] = None
+            _state["html_url"] = html_url
+        else:
+            _apply_release_tag(tag, html_url, current_version)
+        if new_etag:
+            cache["etag"] = new_etag
+        cache["tag_name"] = tag
+        cache["html_url"] = html_url
+        cache.pop("last_error", None)
+        _save_cache(cache_path, cache)
+    except (HTTPError, URLError, OSError, TimeoutError, ValueError, json.JSONDecodeError) as e:
+        cache["last_attempt_at"] = now
+        msg = str(e)
+        if isinstance(e, HTTPError) and e.code == 403:
+            msg = (
+                "GitHub API вернул 403 (лимит или доступ). Повторите позже."
+            )
+        cache["last_error"] = msg
+        _save_cache(cache_path, cache)
+        _state["error"] = msg
+        _state["has_update"] = False
+        _state["ahead_of_release"] = False
+        _state["latest"] = None
+        _state["html_url"] = RELEASES_PAGE_URL
+
+
+def get_status() -> Dict[str, Any]:
+    """Снимок состояния после run_check (для подписей в настройках)."""
+    return dict(_state)

windows.py

@@ -1,115 +1,254 @@
 from __future__ import annotations
 
 import ctypes
+import ipaddress
 import json
 import logging
+import logging.handlers
 import os
+import winreg
 import psutil
 import sys
 import threading
 import time
 import webbrowser
-import pystray
-import pyperclip
-import asyncio as _asyncio
-import customtkinter as ctk
+import ipaddress
 from pathlib import Path
-from typing import Dict, Optional
-from PIL import Image, ImageDraw, ImageFont
+from typing import Optional
+
+try:
+    import pyperclip
+except ImportError:
+    pyperclip = None
+
+try:
+    import pystray
+except ImportError:
+    pystray = None
+
+try:
+    import customtkinter as ctk
+except ImportError:
+    ctk = None
+
+try:
+    from PIL import Image, ImageDraw, ImageFont
+except ImportError:
+    Image = ImageDraw = ImageFont = None
 
 import proxy.tg_ws_proxy as tg_ws_proxy
+from proxy.app_runtime import ProxyAppRuntime
+from proxy import __version__
+from utils.default_config import default_tray_config
+from ui.ctk_tray_ui import (
+    install_tray_config_buttons,
+    install_tray_config_form,
+    populate_first_run_window,
+    tray_settings_scroll_and_footer,
+    validate_config_form,
+)
+from ui.ctk_theme import (
+    CONFIG_DIALOG_FRAME_PAD,
+    CONFIG_DIALOG_SIZE,
+    FIRST_RUN_SIZE,
+    create_ctk_root,
+    ctk_theme_for_platform,
+    main_content_frame,
+)
 
 
+IS_FROZEN = bool(getattr(sys, "frozen", False))
+
 APP_NAME = "TgWsProxy"
 APP_DIR = Path(os.environ.get("APPDATA", Path.home())) / APP_NAME
 CONFIG_FILE = APP_DIR / "config.json"
 LOG_FILE = APP_DIR / "proxy.log"
 FIRST_RUN_MARKER = APP_DIR / ".first_run_done"
+IPV6_WARN_MARKER = APP_DIR / ".ipv6_warned"
 
 
-DEFAULT_CONFIG = {
-    "port": 1080,
-    "host": "127.0.0.1",
-    "dc_ip": ["2:149.154.167.220", "4:149.154.167.220"],
-    "verbose": False,
-}
+DEFAULT_CONFIG = default_tray_config()
 
 
-_proxy_thread: Optional[threading.Thread] = None
-_async_stop: Optional[object] = None
 _tray_icon: Optional[object] = None
 _config: dict = {}
 _exiting: bool = False
+_lock_file_path: Optional[Path] = None
 
 log = logging.getLogger("tg-ws-tray")
+_runtime = ProxyAppRuntime(
+    APP_DIR,
+    default_config=DEFAULT_CONFIG,
+    logger_name="tg-ws-tray",
+    on_error=lambda text: _show_error(text),
+)
+CONFIG_FILE = _runtime.config_file
+LOG_FILE = _runtime.log_file
+
+_user32 = ctypes.windll.user32
+_user32.MessageBoxW.argtypes = [
+    ctypes.c_void_p,
+    ctypes.c_wchar_p,
+    ctypes.c_wchar_p,
+    ctypes.c_uint,
+]
+_user32.MessageBoxW.restype = ctypes.c_int
+
+
+def _same_process(lock_meta: dict, proc: psutil.Process) -> bool:
+    try:
+        lock_ct = float(lock_meta.get("create_time", 0.0))
+        proc_ct = float(proc.create_time())
+        if lock_ct > 0 and abs(lock_ct - proc_ct) > 1.0:
+            return False
+    except Exception:
+        return False
+
+    try:
+        for arg in proc.cmdline():
+            if "windows.py" in arg:
+                return True
+    except Exception:
+        pass
+
+    frozen = bool(getattr(sys, "frozen", False))
+    if frozen:
+        return (
+            os.path.basename(sys.executable).lower() == proc.name().lower()
+        )
+
+    return False
+
+
+def _release_lock():
+    global _lock_file_path
+    if not _lock_file_path:
+        return
+    try:
+        _lock_file_path.unlink(missing_ok=True)
+    except Exception:
+        pass
+    _lock_file_path = None
 
 
 def _acquire_lock() -> bool:
+    global _lock_file_path
     _ensure_dirs()
     lock_files = list(APP_DIR.glob("*.lock"))
-        
+
     for f in lock_files:
+        pid = None
+        meta: dict = {}
+
         try:
             pid = int(f.stem)
-            if psutil.pid_exists(pid):
-                try:
-                    psutil.Process(pid).status()
-                    return False
-                except (psutil.NoSuchProcess, psutil.ZombieProcess):
-                    pass
+        except Exception:
+            f.unlink(missing_ok=True)
+            continue
+
+        try:
+            raw = f.read_text(encoding="utf-8").strip()
+            if raw:
+                meta = json.loads(raw)
+        except Exception:
+            meta = {}
+
+        try:
+            proc = psutil.Process(pid)
+            if _same_process(meta, proc):
+                return False
         except Exception:
             pass
 
         f.unlink(missing_ok=True)
 
     lock_file = APP_DIR / f"{os.getpid()}.lock"
-    lock_file.touch()
+    try:
+        proc = psutil.Process(os.getpid())
+        payload = {
+            "create_time": proc.create_time(),
+        }
+        lock_file.write_text(json.dumps(payload, ensure_ascii=False),
+                             encoding="utf-8")
+    except Exception:
+        lock_file.touch()
+
+    _lock_file_path = lock_file
     return True
 
 
 def _ensure_dirs():
-    APP_DIR.mkdir(parents=True, exist_ok=True)
+    _runtime.ensure_dirs()
 
 
 def load_config() -> dict:
-    _ensure_dirs()
-    if CONFIG_FILE.exists():
-        try:
-            with open(CONFIG_FILE, "r", encoding="utf-8") as f:
-                data = json.load(f)
-            for k, v in DEFAULT_CONFIG.items():
-                data.setdefault(k, v)
-            return data
-        except Exception as exc:
-            log.warning("Failed to load config: %s", exc)
-    return dict(DEFAULT_CONFIG)
+    return _runtime.load_config()
 
 
 def save_config(cfg: dict):
-    _ensure_dirs()
-    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
-        json.dump(cfg, f, indent=2, ensure_ascii=False)
+    _runtime.save_config(cfg)
 
 
-def setup_logging(verbose: bool = False):
-    _ensure_dirs()
-    root = logging.getLogger()
-    root.setLevel(logging.DEBUG if verbose else logging.INFO)
+def setup_logging(verbose: bool = False, log_max_mb: float = 5):
+    _runtime.setup_logging(verbose, log_max_mb=log_max_mb)
 
-    fh = logging.FileHandler(str(LOG_FILE), encoding="utf-8")
-    fh.setLevel(logging.DEBUG)
-    fh.setFormatter(logging.Formatter(
-        "%(asctime)s  %(levelname)-5s  %(name)s  %(message)s",
-        datefmt="%Y-%m-%d %H:%M:%S"))
-    root.addHandler(fh)
 
-    if not getattr(sys, "frozen", False):
-        ch = logging.StreamHandler(sys.stdout)
-        ch.setLevel(logging.DEBUG if verbose else logging.INFO)
-        ch.setFormatter(logging.Formatter(
-            "%(asctime)s  %(levelname)-5s  %(message)s",
-            datefmt="%H:%M:%S"))
-        root.addHandler(ch)
+def _autostart_reg_name() -> str:
+    return APP_NAME
+
+
+def _supports_autostart() -> bool:
+    return IS_FROZEN
+
+
+def _autostart_command() -> str:
+    return f'"{sys.executable}"'
+
+
+def is_autostart_enabled() -> bool:
+    try:
+        with winreg.OpenKey(
+            winreg.HKEY_CURRENT_USER,
+            r"Software\Microsoft\Windows\CurrentVersion\Run",
+            0,
+            winreg.KEY_READ,
+        ) as k:
+            val, _ = winreg.QueryValueEx(k, _autostart_reg_name())
+        stored = str(val).strip()
+        expected = _autostart_command().strip()
+        return stored == expected
+    except FileNotFoundError:
+        return False
+    except OSError:
+        return False
+
+
+def set_autostart_enabled(enabled: bool) -> None:
+    try:
+        with winreg.CreateKey(
+            winreg.HKEY_CURRENT_USER,
+            r"Software\Microsoft\Windows\CurrentVersion\Run",
+        ) as k:
+            if enabled:
+                winreg.SetValueEx(
+                    k,
+                    _autostart_reg_name(),
+                    0,
+                    winreg.REG_SZ,
+                    _autostart_command(),
+                )
+            else:
+                try:
+                    winreg.DeleteValue(k, _autostart_reg_name())
+                except FileNotFoundError:
+                    pass
+    except OSError as exc:
+        log.error("Failed to update autostart: %s", exc)
+        _show_error(
+            "Не удалось изменить автозапуск.\n\n"
+            "Попробуйте запустить приложение от имени пользователя с правами на реестр.\n\n"
+            f"Ошибка: {exc}"
+        )
 
 
 def _make_icon_image(size: int = 64):
@@ -146,77 +285,68 @@ def _load_icon():
 
 
 
-def _run_proxy_thread(port: int, dc_opt: Dict[int, str], verbose: bool,
-                      host: str = '127.0.0.1'):
-    global _async_stop
-    loop = _asyncio.new_event_loop()
-    _asyncio.set_event_loop(loop)
-    stop_ev = _asyncio.Event()
-    _async_stop = (loop, stop_ev)
-
-    try:
-        loop.run_until_complete(
-            tg_ws_proxy._run(port, dc_opt, stop_event=stop_ev, host=host))
-    except Exception as exc:
-        log.error("Proxy thread crashed: %s", exc)
-        if "10048" in str(exc) or "Address already in use" in str(exc):
-            _show_error("Не удалось запустить прокси:\nПорт уже используется другим приложением.\n\nЗакройте приложение, использующее этот порт, или измените порт в настройках прокси и перезапустите.")
-    finally:
-        loop.close()
-        _async_stop = None
-
-
 def start_proxy():
-    global _proxy_thread, _config
-    if _proxy_thread and _proxy_thread.is_alive():
-        log.info("Proxy already running")
-        return
-
-    cfg = _config
-    port = cfg.get("port", DEFAULT_CONFIG["port"])
-    host = cfg.get("host", DEFAULT_CONFIG["host"])
-    dc_ip_list = cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])
-    verbose = cfg.get("verbose", False)
-
-    try:
-        dc_opt = tg_ws_proxy.parse_dc_ip_list(dc_ip_list)
-    except ValueError as e:
-        log.error("Bad config dc_ip: %s", e)
-        _show_error(f"Ошибка конфигурации:\n{e}")
-        return
-
-    log.info("Starting proxy on %s:%d ...", host, port)
-    _proxy_thread = threading.Thread(
-        target=_run_proxy_thread,
-        args=(port, dc_opt, verbose, host),
-        daemon=True, name="proxy")
-    _proxy_thread.start()
+    _runtime.start_proxy(_config)
 
 
 def stop_proxy():
-    global _proxy_thread, _async_stop
-    if _async_stop:
-        loop, stop_ev = _async_stop
-        loop.call_soon_threadsafe(stop_ev.set)
-        if _proxy_thread:
-            _proxy_thread.join(timeout=2)
-    _proxy_thread = None
-    log.info("Proxy stopped")
+    _runtime.stop_proxy()
 
 
 def restart_proxy():
-    log.info("Restarting proxy...")
-    stop_proxy()
-    time.sleep(0.3)
-    start_proxy()
+    _runtime.restart_proxy()
 
 
 def _show_error(text: str, title: str = "TG WS Proxy — Ошибка"):
-    ctypes.windll.user32.MessageBoxW(0, text, title, 0x10)
+    _user32.MessageBoxW(None, text, title, 0x10)
 
 
 def _show_info(text: str, title: str = "TG WS Proxy"):
-    ctypes.windll.user32.MessageBoxW(0, text, title, 0x40)
+    _user32.MessageBoxW(None, text, title, 0x40)
+
+
+def _ask_open_release_page(latest_version: str, url: str) -> bool:
+    """Win32 Yes/No: открыть страницу релиза."""
+    MB_YESNO = 0x4
+    MB_ICONQUESTION = 0x20
+    IDYES = 6
+    text = (
+        f"Доступна новая версия: {latest_version}\n\n"
+        f"Открыть страницу релиза в браузере?"
+    )
+    r = _user32.MessageBoxW(
+        None,
+        text,
+        "TG WS Proxy — обновление",
+        MB_YESNO | MB_ICONQUESTION,
+    )
+    return r == IDYES
+
+
+def _maybe_notify_update_async():
+    """
+    Фоновая проверка GitHub Releases и уведомление (не блокирует трей).
+    """
+    def _work():
+        time.sleep(1.5)
+        if _exiting:
+            return
+        if not _config.get("check_updates", True):
+            return
+        try:
+            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update"):
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            if _ask_open_release_page(str(ver), url):
+                webbrowser.open(url)
+        except Exception as exc:
+            log.debug("Update check failed: %s", exc)
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
 
 
 def _on_open_in_telegram(icon=None, item=None):
@@ -230,11 +360,16 @@ def _on_open_in_telegram(icon=None, item=None):
             raise RuntimeError("webbrowser.open returned False")
     except Exception:
         log.info("Browser open failed, copying to clipboard")
+        if pyperclip is None:
+            _show_error(
+                "Не удалось открыть Telegram автоматически.\n\n"
+                f"Установите пакет pyperclip для копирования в буфер или откройте вручную:\n{url}")
+            return
         try:
             pyperclip.copy(url)
             _show_info(
                 f"Не удалось открыть Telegram автоматически.\n\n"
-                f"Ссылка скопирована в буфер обмена, отправьте её в телеграмм и нажмите по ней ЛКМ:\n{url}",
+                f"Ссылка скопирована в буфер обмена, отправьте её в Telegram и нажмите по ней ЛКМ:\n{url}",
                 "TG WS Proxy")
         except Exception as exc:
             log.error("Clipboard copy failed: %s", exc)
@@ -255,117 +390,66 @@ def _edit_config_dialog():
         return
 
     cfg = dict(_config)
+    cfg["autostart"] = is_autostart_enabled()
 
-    ctk.set_appearance_mode("light")
-    ctk.set_default_color_theme("blue")
+    # Make sure that the autostart key is removed if autostart
+    # is disabled, even if the executable file is moved.
+    if _supports_autostart() and not cfg["autostart"]:
+        set_autostart_enabled(False)
 
-    root = ctk.CTk()
-    root.title("TG WS Proxy — Настройки")
-    root.resizable(False, False)
-    root.attributes("-topmost", True)
+    theme = ctk_theme_for_platform()
+    w, h = CONFIG_DIALOG_SIZE
+    if _supports_autostart():
+        h += 100
 
-    TG_BLUE = "#3390ec"
-    TG_BLUE_HOVER = "#2b7cd4"
-    BG = "#ffffff"
-    FIELD_BG = "#f0f2f5"
-    FIELD_BORDER = "#d6d9dc"
-    TEXT_PRIMARY = "#000000"
-    TEXT_SECONDARY = "#707579"
-    FONT_FAMILY = "Segoe UI"
+    icon_path = str(Path(__file__).parent / "icon.ico")
 
-    w, h = 420, 480
-    sw = root.winfo_screenwidth()
-    sh = root.winfo_screenheight()
-    root.geometry(f"{w}x{h}+{(sw-w)//2}+{(sh-h)//2}")
-    root.configure(fg_color=BG)
+    root = create_ctk_root(
+        ctk,
+        title="TG WS Proxy — Настройки",
+        width=w,
+        height=h,
+        theme=theme,
+        after_create=lambda r: r.iconbitmap(icon_path),
+    )
 
-    frame = ctk.CTkFrame(root, fg_color=BG, corner_radius=0)
-    frame.pack(fill="both", expand=True, padx=24, pady=20)
+    fpx, fpy = CONFIG_DIALOG_FRAME_PAD
+    frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
 
-    # Host
-    ctk.CTkLabel(frame, text="IP-адрес прокси",
-                 font=(FONT_FAMILY, 13), text_color=TEXT_PRIMARY,
-                 anchor="w").pack(anchor="w", pady=(0, 4))
-    host_var = ctk.StringVar(value=cfg.get("host", "127.0.0.1"))
-    host_entry = ctk.CTkEntry(frame, textvariable=host_var, width=200, height=36,
-                              font=(FONT_FAMILY, 13), corner_radius=10,
-                              fg_color=FIELD_BG, border_color=FIELD_BORDER,
-                              border_width=1, text_color=TEXT_PRIMARY)
-    host_entry.pack(anchor="w", pady=(0, 12))
+    scroll, footer = tray_settings_scroll_and_footer(ctk, frame, theme)
 
-    # Port
-    ctk.CTkLabel(frame, text="Порт прокси",
-                 font=(FONT_FAMILY, 13), text_color=TEXT_PRIMARY,
-                 anchor="w").pack(anchor="w", pady=(0, 4))
-    port_var = ctk.StringVar(value=str(cfg.get("port", 1080)))
-    port_entry = ctk.CTkEntry(frame, textvariable=port_var, width=120, height=36,
-                              font=(FONT_FAMILY, 13), corner_radius=10,
-                              fg_color=FIELD_BG, border_color=FIELD_BORDER,
-                              border_width=1, text_color=TEXT_PRIMARY)
-    port_entry.pack(anchor="w", pady=(0, 12))
-
-    # DC-IP mappings
-    ctk.CTkLabel(frame, text="DC → IP маппинги (по одному на строку, формат DC:IP)",
-                 font=(FONT_FAMILY, 13), text_color=TEXT_PRIMARY,
-                 anchor="w").pack(anchor="w", pady=(0, 4))
-    dc_textbox = ctk.CTkTextbox(frame, width=370, height=120,
-                                font=("Consolas", 12), corner_radius=10,
-                                fg_color=FIELD_BG, border_color=FIELD_BORDER,
-                                border_width=1, text_color=TEXT_PRIMARY)
-    dc_textbox.pack(anchor="w", pady=(0, 12))
-    dc_textbox.insert("1.0", "\n".join(cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])))
-
-    # Verbose
-    verbose_var = ctk.BooleanVar(value=cfg.get("verbose", False))
-    ctk.CTkCheckBox(frame, text="Подробное логирование (verbose)",
-                    variable=verbose_var, font=(FONT_FAMILY, 13),
-                    text_color=TEXT_PRIMARY,
-                    fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                    corner_radius=6, border_width=2,
-                    border_color=FIELD_BORDER).pack(anchor="w", pady=(0, 8))
-
-    # Info label
-    ctk.CTkLabel(frame, text="Изменения вступят в силу после перезапуска прокси.",
-                 font=(FONT_FAMILY, 11), text_color=TEXT_SECONDARY,
-                 anchor="w").pack(anchor="w", pady=(0, 16))
+    widgets = install_tray_config_form(
+        ctk,
+        scroll,
+        theme,
+        cfg,
+        DEFAULT_CONFIG,
+        show_autostart=_supports_autostart(),
+        autostart_value=cfg.get("autostart", False),
+    )
 
     def on_save():
-        import socket as _sock
-        host_val = host_var.get().strip()
-        try:
-            _sock.inet_aton(host_val)
-        except OSError:
-            _show_error("Некорректный IP-адрес.")
+        merged = validate_config_form(
+            widgets,
+            DEFAULT_CONFIG,
+            include_autostart=_supports_autostart(),
+        )
+        if isinstance(merged, str):
+            _show_error(merged)
             return
 
-        try:
-            port_val = int(port_var.get().strip())
-            if not (1 <= port_val <= 65535):
-                raise ValueError
-        except ValueError:
-            _show_error("Порт должен быть числом 1-65535")
-            return
-
-        lines = [l.strip() for l in dc_textbox.get("1.0", "end").strip().splitlines()
-                 if l.strip()]
-        try:
-            tg_ws_proxy.parse_dc_ip_list(lines)
-        except ValueError as e:
-            _show_error(str(e))
-            return
-
-        new_cfg = {
-            "host": host_val,
-            "port": port_val,
-            "dc_ip": lines,
-            "verbose": verbose_var.get(),
-        }
+        new_cfg = merged
         save_config(new_cfg)
         _config.update(new_cfg)
         log.info("Config saved: %s", new_cfg)
 
+        if _supports_autostart():
+            set_autostart_enabled(bool(new_cfg.get("autostart", False)))
+
         _tray_icon.menu = _build_menu()
 
+        # Win32 MessageBox из того же потока, что и mainloop CTk, блокирует обработку Tcl/Tk
+        # и даёт зависание; tkinter.messagebox согласован с циклом окна.
         from tkinter import messagebox
         if messagebox.askyesno("Перезапустить?",
                                "Настройки сохранены.\n\n"
@@ -379,21 +463,18 @@ def _edit_config_dialog():
     def on_cancel():
         root.destroy()
 
-    btn_frame = ctk.CTkFrame(frame, fg_color="transparent")
-    btn_frame.pack(fill="x")
-    ctk.CTkButton(btn_frame, text="Сохранить", width=140, height=38,
-                  font=(FONT_FAMILY, 14, "bold"), corner_radius=10,
-                  fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                  text_color="#ffffff",
-                  command=on_save).pack(side="left", padx=(0, 10))
-    ctk.CTkButton(btn_frame, text="Отмена", width=140, height=38,
-                  font=(FONT_FAMILY, 14), corner_radius=10,
-                  fg_color=FIELD_BG, hover_color=FIELD_BORDER,
-                  text_color=TEXT_PRIMARY, border_width=1,
-                  border_color=FIELD_BORDER,
-                  command=on_cancel).pack(side="left")
+    install_tray_config_buttons(
+        ctk, footer, theme, on_save=on_save, on_cancel=on_cancel)
 
-    root.mainloop()
+    try:
+        root.mainloop()
+    finally:
+        import tkinter as tk
+        try:
+            if root.winfo_exists():
+                root.destroy()
+        except tk.TclError:
+            pass
 
 
 def _on_open_logs(icon=None, item=None):
@@ -429,99 +510,93 @@ def _show_first_run():
 
     host = _config.get("host", DEFAULT_CONFIG["host"])
     port = _config.get("port", DEFAULT_CONFIG["port"])
-    tg_url = f"tg://socks?server={host}&port={port}"
 
     if ctk is None:
         FIRST_RUN_MARKER.touch()
         return
 
-    ctk.set_appearance_mode("light")
-    ctk.set_default_color_theme("blue")
+    theme = ctk_theme_for_platform()
+    icon_path = str(Path(__file__).parent / "icon.ico")
+    w, h = FIRST_RUN_SIZE
+    root = create_ctk_root(
+        ctk,
+        title="TG WS Proxy",
+        width=w,
+        height=h,
+        theme=theme,
+        after_create=lambda r: r.iconbitmap(icon_path),
+    )
 
-    TG_BLUE = "#3390ec"
-    TG_BLUE_HOVER = "#2b7cd4"
-    BG = "#ffffff"
-    FIELD_BG = "#f0f2f5"
-    FIELD_BORDER = "#d6d9dc"
-    TEXT_PRIMARY = "#000000"
-    TEXT_SECONDARY = "#707579"
-    FONT_FAMILY = "Segoe UI"
-
-    root = ctk.CTk()
-    root.title("TG WS Proxy")
-    root.resizable(False, False)
-    root.attributes("-topmost", True)
-
-    w, h = 520, 440
-    sw = root.winfo_screenwidth()
-    sh = root.winfo_screenheight()
-    root.geometry(f"{w}x{h}+{(sw-w)//2}+{(sh-h)//2}")
-    root.configure(fg_color=BG)
-
-    frame = ctk.CTkFrame(root, fg_color=BG, corner_radius=0)
-    frame.pack(fill="both", expand=True, padx=28, pady=24)
-
-    title_frame = ctk.CTkFrame(frame, fg_color="transparent")
-    title_frame.pack(anchor="w", pady=(0, 16), fill="x")
-
-    # Blue accent bar
-    accent_bar = ctk.CTkFrame(title_frame, fg_color=TG_BLUE,
-                              width=4, height=32, corner_radius=2)
-    accent_bar.pack(side="left", padx=(0, 12))
-
-    ctk.CTkLabel(title_frame, text="Прокси запущен и работает в системном трее",
-                 font=(FONT_FAMILY, 17, "bold"),
-                 text_color=TEXT_PRIMARY).pack(side="left")
-
-    # Info sections
-    sections = [
-        ("Как подключить Telegram Desktop:", True),
-        ("  Автоматически:", True),
-        (f"  ПКМ по иконке в трее → «Открыть в Telegram»", False),
-        (f"  Или ссылка: {tg_url}", False),
-        ("\n  Вручную:", True),
-        ("  Настройки → Продвинутые → Тип подключения → Прокси", False),
-        (f"  SOCKS5 → {host} : {port} (без логина/пароля)", False),
-    ]
-
-    for text, bold in sections:
-        weight = "bold" if bold else "normal"
-        ctk.CTkLabel(frame, text=text,
-                     font=(FONT_FAMILY, 13, weight),
-                     text_color=TEXT_PRIMARY,
-                     anchor="w", justify="left").pack(anchor="w", pady=1)
-
-    # Spacer
-    ctk.CTkFrame(frame, fg_color="transparent", height=16).pack()
-
-    # Separator
-    ctk.CTkFrame(frame, fg_color=FIELD_BORDER, height=1,
-                 corner_radius=0).pack(fill="x", pady=(0, 12))
-
-    # Checkbox
-    auto_var = ctk.BooleanVar(value=True)
-    ctk.CTkCheckBox(frame, text="Открыть прокси в Telegram сейчас",
-                    variable=auto_var, font=(FONT_FAMILY, 13),
-                    text_color=TEXT_PRIMARY,
-                    fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                    corner_radius=6, border_width=2,
-                    border_color=FIELD_BORDER).pack(anchor="w", pady=(0, 16))
-
-    def on_ok():
+    def on_done(open_tg: bool):
         FIRST_RUN_MARKER.touch()
-        open_tg = auto_var.get()
         root.destroy()
         if open_tg:
             _on_open_in_telegram()
 
-    ctk.CTkButton(frame, text="Начать", width=180, height=42,
-                  font=(FONT_FAMILY, 15, "bold"), corner_radius=10,
-                  fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                  text_color="#ffffff",
-                  command=on_ok).pack(pady=(0, 0))
+    populate_first_run_window(
+        ctk, root, theme, host=host, port=port, on_done=on_done)
 
-    root.protocol("WM_DELETE_WINDOW", on_ok)
-    root.mainloop()
+    try:
+        root.mainloop()
+    finally:
+        import tkinter as tk
+        try:
+            if root.winfo_exists():
+                root.destroy()
+        except tk.TclError:
+            pass
+
+
+def _has_ipv6_enabled() -> bool:
+    import socket as _sock
+    try:
+        addrs = _sock.getaddrinfo(_sock.gethostname(), None, _sock.AF_INET6)
+        for addr in addrs:
+            ip = addr[4][0]
+            if not ip or ip.startswith("::1"):
+                continue
+            try:
+                if ipaddress.IPv6Address(ip).is_link_local:
+                    continue
+            except ValueError:
+                if ip.startswith("fe80:"):
+                    continue
+            return True
+    except Exception:
+        pass
+    try:
+        s = _sock.socket(_sock.AF_INET6, _sock.SOCK_STREAM)
+        s.bind(('::1', 0))
+        s.close()
+        return True
+    except Exception:
+        return False
+
+
+def _check_ipv6_warning():
+    _ensure_dirs()
+    if IPV6_WARN_MARKER.exists():
+        return
+    if not _has_ipv6_enabled():
+        return
+
+    IPV6_WARN_MARKER.touch()
+
+    threading.Thread(target=_show_ipv6_dialog, daemon=True).start()
+
+
+def _show_ipv6_dialog():
+    _show_info(
+        "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
+        "Telegram может пытаться подключаться через IPv6, "
+        "что не поддерживается и может привести к ошибкам.\n\n"
+        "Если прокси не работает или в логах присутствуют ошибки, "
+        "связанные с попытками подключения по IPv6 - "
+        "попробуйте отключить в настройках прокси Telegram попытку соединения "
+        "по IPv6. Если данная мера не помогает, попробуйте отключить IPv6 "
+        "в системе.\n\n"
+        "Это предупреждение будет показано только один раз.",
+        "TG WS Proxy")
 
 
 def _build_menu():
@@ -546,23 +621,19 @@ def _build_menu():
 def run_tray():
     global _tray_icon, _config
 
-    _config = load_config()
-    save_config(_config)
+    _config = _runtime.prepare()
+    _runtime.reset_log_file()
 
-    if LOG_FILE.exists():
-        try:
-            LOG_FILE.unlink()
-        except Exception:
-            pass
-
-    setup_logging(_config.get("verbose", False))
-    log.info("TG WS Proxy tray app starting")
+    setup_logging(_config.get("verbose", False),
+                  log_max_mb=_config.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]))
+    log.info("TG WS Proxy версия %s, tray app starting", __version__)
     log.info("Config: %s", _config)
     log.info("Log file: %s", LOG_FILE)
 
-    if pystray is None or Image is None:
-        log.error("pystray or Pillow not installed; "
-                  "running in console mode")
+    if pystray is None or Image is None or ctk is None:
+        log.error(
+            "pystray, Pillow or customtkinter not installed; "
+            "running in console mode")
         start_proxy()
         try:
             while True:
@@ -573,7 +644,10 @@ def run_tray():
 
     start_proxy()
 
+    _maybe_notify_update_async()
+
     _show_first_run()
+    _check_ipv6_warning()
 
     icon_image = _load_icon()
     _tray_icon = pystray.Icon(
@@ -594,7 +668,10 @@ def main():
         _show_info("Приложение уже запущено.", os.path.basename(sys.argv[0]))
         return
 
-    run_tray()
+    try:
+        run_tray()
+    finally:
+        _release_lock()
 
 
 if __name__ == "__main__":