icon size increase

.dockerignore

@@ -0,0 +1,28 @@
+.git
+.github
+.gitignore
+__pycache__/
+*.py[cod]
+*.pyo
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.venv/
+venv/
+dist/
+build/
+packaging/
+windows.py
+icon.ico
+*.spec
+*.spec.bak
+*.manifest
+*.log
+.vscode/
+.idea/
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+Desktop.ini

.github/workflows/build.yml

@@ -3,88 +3,331 @@ name: Build & Release
 on:
   workflow_dispatch:
     inputs:
+      make_release:
+        description: 'Create Github Release?'
+        type: boolean
+        required: true
+        default: false
       version:
         description: "Release version tag (e.g. v1.0.0)"
-        required: true
+        required: false
         default: "v1.0.0"
 
 permissions:
   contents: write
 
 jobs:
-  build:
+  build-windows:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
           cache: "pip"
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: pip install .
 
       - name: Install pyinstaller
-        run: pip install pyinstaller
+        run: pip install "pyinstaller==6.13.0"
 
       - name: Build EXE with PyInstaller
         run: pyinstaller packaging/windows.spec --noconfirm
 
+      - name: Rename artifact
+        run: mv dist/TgWsProxy.exe dist/TgWsProxy_windows.exe
+
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: TgWsProxy
-          path: |
-            dist/TgWsProxy.exe
+          path: dist/TgWsProxy_windows.exe
 
   build-win7:
     runs-on: windows-latest
+    strategy:
+      matrix:
+        include:
+          - arch: x64
+            suffix: 64bit
+          - arch: x86
+            suffix: 32bit
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - name: Setup Python 3.8 (last version supporting Win7)
-        uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.8"
+          architecture: ${{ matrix.arch }}
           cache: "pip"
           
-      - name: Install dependencies (Win7-compatible)
-        run: pip install -r requirements-win7.txt
+      - name: Install dependencies & pyinstaller
+        run: pip install . "pyinstaller==5.13.2"
 
-      - name: Install pyinstaller
-        run: pip install "pyinstaller==5.13.2"
-
-      - name: Build EXE with PyInstaller (Win7)
+      - name: Build EXE with PyInstaller
         run: pyinstaller packaging/windows.spec --noconfirm
 
       - name: Rename artifact
-        run: mv dist/TgWsProxy.exe dist/TgWsProxy-win7.exe
+        run: mv dist/TgWsProxy.exe dist/TgWsProxy_windows_7_${{ matrix.suffix }}.exe
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: TgWsProxy-win7
-          path: dist/TgWsProxy-win7.exe
+          name: TgWsProxy-win7-${{ matrix.suffix }}
+          path: dist/TgWsProxy_windows_7_${{ matrix.suffix }}.exe
 
-  release:
-    needs: [build, build-win7]
+  build-macos:
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install universal2 Python
+        run: |
+          set -euo pipefail
+          curl -LO https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg
+          sudo installer -pkg python-3.12.10-macos11.pkg -target /
+          echo "/Library/Frameworks/Python.framework/Versions/3.12/bin" >> "$GITHUB_PATH"
+
+      - name: Install dependencies
+        run: |
+          set -euo pipefail
+          python3.12 -m pip install --upgrade pip setuptools wheel
+          python3.12 -m pip install delocate==0.13.0
+
+          mkdir -p wheelhouse/arm64 wheelhouse/x86_64 wheelhouse/universal2
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_11_0_arm64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/arm64 \
+            'cffi>=2.0.0' \
+            Pillow==12.1.0 \
+            psutil==7.0.0
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_10_13_x86_64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/x86_64 \
+            'cffi>=2.0.0' \
+            Pillow==12.1.0
+
+          python3.12 -m pip download \
+            --only-binary=:all: \
+            --platform macosx_10_9_x86_64 \
+            --python-version 3.12 \
+            --implementation cp \
+            -d wheelhouse/x86_64 \
+            psutil==7.0.0
+
+          delocate-merge \
+            wheelhouse/arm64/cffi-*.whl \
+            wheelhouse/x86_64/cffi-*.whl \
+            -w wheelhouse/universal2
+
+          delocate-merge \
+            wheelhouse/arm64/pillow-12.1.0-*.whl \
+            wheelhouse/x86_64/pillow-12.1.0-*.whl \
+            -w wheelhouse/universal2
+
+          delocate-merge \
+            wheelhouse/arm64/psutil-7.0.0-*.whl \
+            wheelhouse/x86_64/psutil-7.0.0-*.whl \
+            -w wheelhouse/universal2
+
+          python3.12 -m pip install --no-deps wheelhouse/universal2/*.whl
+          python3.12 -m pip install .
+          python3.12 -m pip install pyinstaller==6.13.0
+
+      - name: Create macOS icon from ICO
+        run: |
+          set -euo pipefail
+          python3.12 - <<'PY'
+          from PIL import Image
+
+          image = Image.open('icon.ico')
+          image = image.resize((1024, 1024), Image.LANCZOS)
+          image.save('icon_1024.png', 'PNG')
+          PY
+
+          mkdir -p icon.iconset
+          sips -z 16 16 icon_1024.png --out icon.iconset/icon_16x16.png
+          sips -z 32 32 icon_1024.png --out icon.iconset/icon_16x16@2x.png
+          sips -z 32 32 icon_1024.png --out icon.iconset/icon_32x32.png
+          sips -z 64 64 icon_1024.png --out icon.iconset/icon_32x32@2x.png
+          sips -z 128 128 icon_1024.png --out icon.iconset/icon_128x128.png
+          sips -z 256 256 icon_1024.png --out icon.iconset/icon_128x128@2x.png
+          sips -z 256 256 icon_1024.png --out icon.iconset/icon_256x256.png
+          sips -z 512 512 icon_1024.png --out icon.iconset/icon_256x256@2x.png
+          sips -z 512 512 icon_1024.png --out icon.iconset/icon_512x512.png
+          sips -z 1024 1024 icon_1024.png --out icon.iconset/icon_512x512@2x.png
+          iconutil -c icns icon.iconset -o icon.icns
+          rm -rf icon.iconset icon_1024.png
+
+      - name: Build app with PyInstaller
+        run: python3.12 -m PyInstaller packaging/macos.spec --noconfirm
+
+      - name: Validate universal2 app bundle
+        run: |
+          set -euo pipefail
+          found=0
+          while IFS= read -r -d '' file; do
+            if file "$file" | grep -q "Mach-O"; then
+              found=1
+              archs="$(lipo -archs "$file" 2>/dev/null || true)"
+              case "$archs" in
+                *arm64*x86_64*|*x86_64*arm64*) ;;
+                *)
+                  echo "Missing universal2 slices in $file: ${archs:-unknown}" >&2
+                  exit 1
+                  ;;
+              esac
+            fi
+          done < <(find "dist/TG WS Proxy.app" -type f -print0)
+
+          if [ "$found" -eq 0 ]; then
+            echo "No Mach-O files found in app bundle" >&2
+            exit 1
+          fi
+
+      - name: Create DMG
+        run: |
+          set -euo pipefail
+          APP_NAME="TG WS Proxy"
+          DMG_TEMP="dist/dmg_temp"
+
+          rm -rf "$DMG_TEMP"
+          mkdir -p "$DMG_TEMP"
+          cp -R "dist/${APP_NAME}.app" "$DMG_TEMP/"
+          ln -s /Applications "$DMG_TEMP/Applications"
+
+          hdiutil create \
+            -volname "$APP_NAME" \
+            -srcfolder "$DMG_TEMP" \
+            -ov \
+            -format UDZO \
+            "dist/TgWsProxy_macos_universal.dmg"
+
+          rm -rf "$DMG_TEMP"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: TgWsProxy-macOS
+          path: dist/TgWsProxy_macos_universal.dmg
+
+  build-linux:
     runs-on: ubuntu-latest
     steps:
-      - name: Download main build
-        uses: actions/download-artifact@v4
-        with:
-          name: TgWsProxy
-          path: dist
+      - name: Checkout
+        uses: actions/checkout@v6
 
-      - name: Download Win7 build
-        uses: actions/download-artifact@v4
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            python3-venv \
+            python3-dev \
+            python3-gi \
+            gir1.2-ayatanaappindicator3-0.1 \
+            python3-tk
+
+      - name: Create venv with system site-packages
+        run: python3 -m venv --system-site-packages .venv
+
+      - name: Install dependencies
+        run: |
+          .venv/bin/pip install --upgrade pip
+          .venv/bin/pip install .
+          .venv/bin/pip install "pyinstaller==6.13.0"
+
+      - name: Build binary with PyInstaller
+        run: .venv/bin/pyinstaller packaging/linux.spec --noconfirm
+
+      - name: Rename binary artifact
+        run: mv dist/TgWsProxy dist/TgWsProxy_linux_amd64
+
+      - name: Create .deb package
+        run: |
+          set -euo pipefail
+          VERSION="${{ github.event.inputs.version }}"
+          VERSION="${VERSION#v}"
+          PKG_ROOT="pkg"
+
+          rm -rf "$PKG_ROOT"
+          mkdir -p \
+            "$PKG_ROOT/DEBIAN" \
+            "$PKG_ROOT/usr/bin" \
+            "$PKG_ROOT/usr/share/applications" \
+            "$PKG_ROOT/usr/share/icons/hicolor/256x256/apps"
+
+          install -m 755 dist/TgWsProxy_linux_amd64 "$PKG_ROOT/usr/bin/tg-ws-proxy"
+
+          .venv/bin/python - <<PY
+          from PIL import Image
+
+          Image.open("icon.ico").save(
+              "${PKG_ROOT}/usr/share/icons/hicolor/256x256/apps/tg-ws-proxy.png",
+              "PNG",
+          )
+          PY
+
+          cat > "$PKG_ROOT/usr/share/applications/tg-ws-proxy.desktop" <<EOF
+          [Desktop Entry]
+          Type=Application
+          Name=TG WS Proxy
+          GenericName=Telegram Proxy
+          Comment=Telegram Desktop WebSocket Bridge Proxy
+          Exec=tg-ws-proxy
+          Icon=tg-ws-proxy
+          Terminal=false
+          Categories=Network;
+          StartupNotify=true
+          Keywords=telegram;proxy;websocket;
+          EOF
+
+          cat > "$PKG_ROOT/DEBIAN/control" <<EOF
+          Package: tg-ws-proxy
+          Version: ${VERSION}
+          Section: net
+          Priority: optional
+          Architecture: amd64
+          Maintainer: Flowseal
+          Depends: libgtk-3-0, libayatana-appindicator3-1, python3-tk
+          Description: Telegram Desktop WebSocket Bridge Proxy
+           SOCKS5/WebSocket bridge proxy for Telegram Desktop with tray UI.
+          EOF
+
+          dpkg-deb --build --root-owner-group \
+            "$PKG_ROOT" \
+            "dist/TgWsProxy_linux_amd64.deb"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
         with:
-          name: TgWsProxy-win7
+          name: TgWsProxy-linux
+          path: |
+            dist/TgWsProxy_linux_amd64
+            dist/TgWsProxy_linux_amd64.deb
+
+  release:
+    needs: [build-windows, build-win7, build-macos, build-linux]
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.make_release == 'true' }}
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: TgWsProxy*
           path: dist
+          merge-multiple: true
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
@@ -94,8 +337,12 @@ jobs:
           body: |
             ## TG WS Proxy ${{ github.event.inputs.version }}
           files: |
-            dist/TgWsProxy.exe
-            dist/TgWsProxy-win7.exe
+            dist/TgWsProxy_windows.exe
+            dist/TgWsProxy_windows_7_64bit.exe
+            dist/TgWsProxy_windows_7_32bit.exe
+            dist/TgWsProxy_macos_universal.dmg
+            dist/TgWsProxy_linux_amd64
+            dist/TgWsProxy_linux_amd64.deb
           draft: false
           prerelease: false
         env:

.gitignore

@@ -27,3 +27,4 @@ scan_ips.py
 scan.txt
 AyuGramDesktop-dev/
 tweb-master/
+/icon.icns

Dockerfile

@@ -0,0 +1,45 @@
+# syntax=docker/dockerfile:1.7
+
+FROM python:3.12-slim AS builder
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    VIRTUAL_ENV=/opt/venv
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential cargo libffi-dev libssl-dev \
+    && python -m venv "$VIRTUAL_ENV" \
+    && "$VIRTUAL_ENV/bin/pip" install --upgrade pip setuptools wheel \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+RUN "$VIRTUAL_ENV/bin/pip" install cryptography==46.0.5
+
+FROM python:3.12-slim AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH=/opt/venv/bin:$PATH \
+    TG_WS_PROXY_HOST=0.0.0.0 \
+    TG_WS_PROXY_PORT=1080 \
+    TG_WS_PROXY_DC_IPS="2:149.154.167.220 4:149.154.167.220"
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends tini ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system app \
+    && useradd --system --gid app --create-home --home-dir /home/app app
+
+WORKDIR /app
+COPY --from=builder /opt/venv /opt/venv
+COPY proxy ./proxy
+COPY README.md LICENSE ./
+
+USER app
+
+EXPOSE 1080/tcp
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/bin/sh", "-lc", "set -eu; args=\"--host ${TG_WS_PROXY_HOST} --port ${TG_WS_PROXY_PORT}\"; for dc in ${TG_WS_PROXY_DC_IPS}; do args=\"$args --dc-ip $dc\"; done; exec python -u proxy/tg_ws_proxy.py $args \"$@\"", "--"]
+CMD []

README.md

@@ -1,8 +1,10 @@
 > [!CAUTION]
 >
 > ### Реакция антивирусов
+>
 > Windows Defender часто ошибочно помечает приложение как **Wacatac**.  
 > Если вы не можете скачать из-за блокировки, то:
+>
 > 1) Попробуйте скачать версию win7 (она ничем не отличается в плане функционала)
 > 2) Отключите антивирус на время скачивания, добавьте файл в исключения и включите обратно  
 >
@@ -10,54 +12,112 @@
 
 # TG WS Proxy
 
-Локальный SOCKS5-прокси для Telegram Desktop, который перенаправляет трафик через WebSocket-соединения к указанным серверам, помогая частично ускорить работу Telegram.  
-  
-**Ожидаемый результат аналогичен прокидыванию hosts для Web Telegram**: ускорение загрузки и скачивания файлов, загрузки сообщений и части медиа.
+**Локальный SOCKS5-прокси** для Telegram Desktop, который **ускоряет работу Telegram**, перенаправляя трафик через WebSocket-соединения. Данные передаются в том же зашифрованном виде, а для работы не нужны сторонние сервера.
 
 <img width="529" height="487" alt="image" src="https://github.com/user-attachments/assets/6a4cf683-0df8-43af-86c1-0e8f08682b62" />
 
 ## Как это работает
 
 ```
-Telegram Desktop → SOCKS5 (127.0.0.1:1080) → TG WS Proxy → WSS (kws*.web.telegram.org) → Telegram DC
+Telegram Desktop → SOCKS5 (127.0.0.1:1080) → TG WS Proxy → WSS → Telegram DC
 ```
 
 1. Приложение поднимает локальный SOCKS5-прокси на `127.0.0.1:1080`
 2. Перехватывает подключения к IP-адресам Telegram
 3. Извлекает DC ID из MTProto obfuscation init-пакета
-4. Устанавливает WebSocket (TLS) соединение к соответствующему DC через домены `kws{N}.web.telegram.org`
+4. Устанавливает WebSocket (TLS) соединение к соответствующему DC через домены Telegram
 5. Если WS недоступен (302 redirect) — автоматически переключается на прямое TCP-соединение
 
 ## 🚀 Быстрый старт
 
 ### Windows
-Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте **`TgWsProxy.exe`**. Он собирается автоматически через [Github Actions](https://github.com/Flowseal/tg-ws-proxy/actions) из открытого исходного кода.
+
+Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте **`TgWsProxy_windows.exe`**. Он собирается автоматически через [Github Actions](https://github.com/Flowseal/tg-ws-proxy/actions) из открытого исходного кода.
 
 При первом запуске откроется окно с инструкцией по подключению Telegram Desktop. Приложение сворачивается в системный трей.
 
 **Меню трея:**
+
 - **Открыть в Telegram** — автоматически настроить прокси через `tg://socks` ссылку
 - **Перезапустить прокси** — перезапуск без выхода из приложения
-- **Настройки...** — GUI-редактор конфигурации
+- **Настройки...** — GUI-редактор конфигурации (в т.ч. версия приложения, опциональная проверка обновлений с GitHub)
 - **Открыть логи** — открыть файл логов
 - **Выход** — остановить прокси и закрыть приложение
 
+При первом запуске после старта может появиться запрос об открытии страницы релиза, если на GitHub вышла новая версия (отключается в настройках).
+
+### macOS
+
+Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте **`TgWsProxy_macos_universal.dmg`** — универсальная сборка для Apple Silicon и Intel.
+
+1. Открыть образ
+2. Перенести **TG WS Proxy.app** в папку **Applications**
+3. При первом запуске macOS может попросить подтвердить открытие: **Системные настройки → Конфиденциальность и безопасность → Всё равно открыть**
+
+### Linux
+
+Для Debian/Ubuntu скачайте со [страницы релизов](https://github.com/Flowseal/tg-ws-proxy/releases) пакет **`TgWsProxy_linux_amd64.deb`**.
+
+Для Arch и Arch-Based дистрибутивов подготовлены пакеты в AUR: [tg-ws-proxy-bin](https://aur.archlinux.org/packages/tg-ws-proxy-bin), [tg-ws-proxy-git](https://aur.archlinux.org/packages/tg-ws-proxy-git), [tg-ws-proxy-cli](https://aur.archlinux.org/packages/tg-ws-proxy-cli)
+
+```shell
+# Установка без AUR-helper
+git clone https://aur.archlinux.org/tg-ws-proxy-bin.git
+cd tg-ws-proxy-bin
+makepkg -si
+
+# При помощи AUR-helper
+paru -S tg-ws-proxy-bin
+
+# Если вы установили -cli пакет, то запуск осуществляется через systemctl, где 8888 это номер порта прокси:
+sudo systemctl start tg-ws-proxy-cli@8888
+```
+
+Для остальных дистрибутивов можно использовать **`TgWsProxy_linux_amd64`** (бинарный файл для x86_64).
+
+```bash
+chmod +x TgWsProxy_linux_amd64
+./TgWsProxy_linux_amd64
+```
+
+При первом запуске откроется окно с инструкцией. Приложение работает в системном трее (требуется AppIndicator).
+
 ## Установка из исходников
 
+### Консольный proxy
+
+Для запуска только SOCKS5/WebSocket proxy без tray-интерфейса достаточно базовой установки:
+
 ```bash
-pip install -r requirements.txt
+pip install -e .
+tg-ws-proxy
 ```
 
-### Windows (Tray-приложение)
+### Windows 7/10+
 
 ```bash
-python windows.py
+pip install -e .
+tg-ws-proxy-tray-win
 ```
 
-### Консольный режим
+### macOS
 
 ```bash
-python proxy/tg_ws_proxy.py [--port PORT] [--dc-ip DC:IP ...] [-v]
+pip install -e .
+tg-ws-proxy-tray-macos
+```
+
+### Linux
+
+```bash
+pip install -e .
+tg-ws-proxy-tray-linux
+```
+
+### Консольный режим из исходников
+
+```bash
+tg-ws-proxy [--port PORT] [--host HOST] [--dc-ip DC:IP ...] [-v]
 ```
 
 **Аргументы:**
@@ -65,6 +125,7 @@ python proxy/tg_ws_proxy.py [--port PORT] [--dc-ip DC:IP ...] [-v]
 | Аргумент | По умолчанию | Описание |
 |---|---|---|
 | `--port` | `1080` | Порт SOCKS5-прокси |
+| `--host` | `127.0.0.1` | Хост SOCKS5-прокси |
 | `--dc-ip` | `2:149.154.167.220`, `4:149.154.167.220` | Целевой IP для DC (можно указать несколько раз) |
 | `-v`, `--verbose` | выкл. | Подробное логирование (DEBUG) |
 
@@ -72,13 +133,27 @@ python proxy/tg_ws_proxy.py [--port PORT] [--dc-ip DC:IP ...] [-v]
 
 ```bash
 # Стандартный запуск
-python proxy/tg_ws_proxy.py
+tg-ws-proxy
 
 # Другой порт и дополнительные DC
-python proxy/tg_ws_proxy.py --port 9050 --dc-ip 1:149.154.175.205 --dc-ip 2:149.154.167.220
+tg-ws-proxy --port 9050 --dc-ip 1:149.154.175.205 --dc-ip 2:149.154.167.220
 
 # С подробным логированием
-python proxy/tg_ws_proxy.py -v
+tg-ws-proxy -v
+```
+
+## CLI-скрипты (pyproject.toml)
+
+CLI команды объявляются в `pyproject.toml` в секции `[project.scripts]` и должны указывать на `module:function`.
+
+Пример:
+
+```toml
+[project.scripts]
+tg-ws-proxy = "proxy.tg_ws_proxy:main"
+tg-ws-proxy-tray-win = "windows:main"
+tg-ws-proxy-tray-macos = "macos:main"
+tg-ws-proxy-tray-linux = "linux:main"
 ```
 
 ## Настройка Telegram Desktop
@@ -98,27 +173,42 @@ python proxy/tg_ws_proxy.py -v
 
 ## Конфигурация
 
-Tray-приложение хранит данные в `%APPDATA%/TgWsProxy`:
+Tray-приложение хранит данные в:
+
+- **Windows:** `%APPDATA%/TgWsProxy`
+- **macOS:** `~/Library/Application Support/TgWsProxy`
+- **Linux:** `~/.config/TgWsProxy` (или `$XDG_CONFIG_HOME/TgWsProxy`)
 
 ```json
 {
+  "host": "127.0.0.1",
   "port": 1080,
   "dc_ip": [
     "2:149.154.167.220",
     "4:149.154.167.220"
   ],
-  "verbose": false
+  "verbose": false,
+  "buf_kb": 256,
+  "pool_size": 4,
+  "log_max_mb": 5.0,
+  "check_updates": true
 }
 ```
 
+Ключ **`check_updates`** — при `true` при запросе к GitHub сравнивается версия с последним релизом (только уведомление и ссылка на страницу загрузки). На Windows в конфиге может быть **`autostart`** (автозапуск при входе в систему).
+
 ## Автоматическая сборка
 
-Проект содержит спецификацию PyInstaller ([`windows.spec`](packaging/windows.spec)) и GitHub Actions workflow ([`.github/workflows/build.yml`](.github/workflows/build.yml)) для автоматической сборки.
+Проект содержит спецификации PyInstaller ([`packaging/windows.spec`](packaging/windows.spec), [`packaging/macos.spec`](packaging/macos.spec), [`packaging/linux.spec`](packaging/linux.spec)) и GitHub Actions workflow ([`.github/workflows/build.yml`](.github/workflows/build.yml)) для автоматической сборки.
 
-```bash
-pip install pyinstaller
-pyinstaller packaging/windows.spec
-```
+Минимально поддерживаемые версии ОС для текущих бинарных сборок:
+
+- Windows 10+ для `TgWsProxy_windows.exe`
+- Windows 7 (x64) для `TgWsProxy_windows_7_64bit.exe`
+- Windows 7 (x32) для `TgWsProxy_windows_7_32bit.exe`
+- Intel macOS 10.15+
+- Apple Silicon macOS 11.0+
+- Linux x86_64 (требуется AppIndicator для системного трея)
 
 ## Лицензия
 

linux.py

@@ -0,0 +1,690 @@
+from __future__ import annotations
+
+import asyncio as _asyncio
+import json
+import logging
+import logging.handlers
+import os
+import subprocess
+import sys
+import threading
+import webbrowser
+import time
+from pathlib import Path
+from typing import Dict, Optional
+
+import customtkinter as ctk
+import psutil
+import pyperclip
+import pystray
+from PIL import Image, ImageDraw, ImageFont
+
+import proxy.tg_ws_proxy as tg_ws_proxy
+from proxy import __version__
+from utils.default_config import default_tray_config
+from ui.ctk_tray_ui import (
+    install_tray_config_buttons,
+    install_tray_config_form,
+    populate_first_run_window,
+    tray_settings_scroll_and_footer,
+    validate_config_form,
+)
+from ui.ctk_theme import (
+    CONFIG_DIALOG_FRAME_PAD,
+    CONFIG_DIALOG_SIZE,
+    FIRST_RUN_SIZE,
+    create_ctk_root,
+    ctk_theme_for_platform,
+    main_content_frame,
+)
+
+APP_NAME = "TgWsProxy"
+APP_DIR = Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config")) / APP_NAME
+CONFIG_FILE = APP_DIR / "config.json"
+LOG_FILE = APP_DIR / "proxy.log"
+FIRST_RUN_MARKER = APP_DIR / ".first_run_done"
+IPV6_WARN_MARKER = APP_DIR / ".ipv6_warned"
+
+
+DEFAULT_CONFIG = default_tray_config()
+
+
+_proxy_thread: Optional[threading.Thread] = None
+_async_stop: Optional[object] = None
+_tray_icon: Optional[object] = None
+_config: dict = {}
+_exiting: bool = False
+_lock_file_path: Optional[Path] = None
+
+log = logging.getLogger("tg-ws-tray")
+
+
+def _same_process(lock_meta: dict, proc: psutil.Process) -> bool:
+    try:
+        lock_ct = float(lock_meta.get("create_time", 0.0))
+        proc_ct = float(proc.create_time())
+        if lock_ct > 0 and abs(lock_ct - proc_ct) > 1.0:
+            return False
+    except Exception:
+        return False
+
+    try:
+        cmdline = proc.cmdline()
+        for arg in cmdline:
+            if "linux.py" in arg:
+                return True
+    except Exception:
+        pass
+
+    frozen = bool(getattr(sys, "frozen", False))
+    if frozen:
+        return APP_NAME.lower() in proc.name().lower()
+
+    return False
+
+
+def _release_lock():
+    global _lock_file_path
+    if not _lock_file_path:
+        return
+    try:
+        _lock_file_path.unlink(missing_ok=True)
+    except Exception:
+        pass
+    _lock_file_path = None
+
+
+def _acquire_lock() -> bool:
+    global _lock_file_path
+    _ensure_dirs()
+    lock_files = list(APP_DIR.glob("*.lock"))
+
+    for f in lock_files:
+        pid = None
+        meta: dict = {}
+
+        try:
+            pid = int(f.stem)
+        except Exception:
+            f.unlink(missing_ok=True)
+            continue
+
+        try:
+            raw = f.read_text(encoding="utf-8").strip()
+            if raw:
+                meta = json.loads(raw)
+        except Exception:
+            meta = {}
+
+        try:
+            proc = psutil.Process(pid)
+            if _same_process(meta, proc):
+                return False
+        except Exception:
+            pass
+
+        f.unlink(missing_ok=True)
+
+    lock_file = APP_DIR / f"{os.getpid()}.lock"
+    try:
+        proc = psutil.Process(os.getpid())
+        payload = {
+            "create_time": proc.create_time(),
+        }
+        lock_file.write_text(json.dumps(payload, ensure_ascii=False), encoding="utf-8")
+    except Exception:
+        lock_file.touch()
+
+    _lock_file_path = lock_file
+    return True
+
+
+def _ensure_dirs():
+    APP_DIR.mkdir(parents=True, exist_ok=True)
+
+
+def load_config() -> dict:
+    _ensure_dirs()
+    if CONFIG_FILE.exists():
+        try:
+            with open(CONFIG_FILE, "r", encoding="utf-8") as f:
+                data = json.load(f)
+            for k, v in DEFAULT_CONFIG.items():
+                data.setdefault(k, v)
+            return data
+        except Exception as exc:
+            log.warning("Failed to load config: %s", exc)
+    return dict(DEFAULT_CONFIG)
+
+
+def save_config(cfg: dict):
+    _ensure_dirs()
+    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
+        json.dump(cfg, f, indent=2, ensure_ascii=False)
+
+
+def setup_logging(verbose: bool = False, log_max_mb: float = 5):
+    _ensure_dirs()
+    root = logging.getLogger()
+    root.setLevel(logging.DEBUG if verbose else logging.INFO)
+
+    fh = logging.handlers.RotatingFileHandler(
+        str(LOG_FILE),
+        maxBytes=max(32 * 1024, log_max_mb * 1024 * 1024),
+        backupCount=0,
+        encoding='utf-8',
+    )
+    fh.setLevel(logging.DEBUG)
+    fh.setFormatter(
+        logging.Formatter(
+            "%(asctime)s  %(levelname)-5s  %(name)s  %(message)s",
+            datefmt="%Y-%m-%d %H:%M:%S",
+        )
+    )
+    root.addHandler(fh)
+
+    if not getattr(sys, "frozen", False):
+        ch = logging.StreamHandler(sys.stdout)
+        ch.setLevel(logging.DEBUG if verbose else logging.INFO)
+        ch.setFormatter(
+            logging.Formatter(
+                "%(asctime)s  %(levelname)-5s  %(message)s", datefmt="%H:%M:%S"
+            )
+        )
+        root.addHandler(ch)
+
+
+def _make_icon_image(size: int = 64):
+    if Image is None:
+        raise RuntimeError("Pillow is required for tray icon")
+    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    draw = ImageDraw.Draw(img)
+
+    margin = 2
+    draw.ellipse(
+        [margin, margin, size - margin, size - margin], fill=(0, 136, 204, 255)
+    )
+
+    try:
+        font = ImageFont.truetype(
+            "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf",
+            size=int(size * 0.55),
+        )
+    except Exception:
+        try:
+            font = ImageFont.truetype(
+                "/usr/share/fonts/TTF/DejaVuSans-Bold.ttf", size=int(size * 0.55)
+            )
+        except Exception:
+            font = ImageFont.load_default()
+    bbox = draw.textbbox((0, 0), "T", font=font)
+    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
+    tx = (size - tw) // 2 - bbox[0]
+    ty = (size - th) // 2 - bbox[1]
+    draw.text((tx, ty), "T", fill=(255, 255, 255, 255), font=font)
+
+    return img
+
+
+def _load_icon():
+    icon_path = Path(__file__).parent / "icon.ico"
+    if icon_path.exists() and Image:
+        try:
+            return Image.open(str(icon_path))
+        except Exception:
+            pass
+    return _make_icon_image()
+
+
+def _apply_linux_ctk_window_icon(root) -> None:
+    """PhotoImage храним на root — иначе GC может убрать картинку до закрытия окна."""
+    icon_img = _load_icon()
+    if icon_img:
+        from PIL import ImageTk
+
+        root._ctk_icon_photo = ImageTk.PhotoImage(icon_img.resize((64, 64)))
+        root.iconphoto(False, root._ctk_icon_photo)
+
+
+def _run_proxy_thread(
+    port: int, dc_opt: Dict[int, str], verbose: bool, host: str = "127.0.0.1"
+):
+    global _async_stop
+    loop = _asyncio.new_event_loop()
+    _asyncio.set_event_loop(loop)
+    stop_ev = _asyncio.Event()
+    _async_stop = (loop, stop_ev)
+
+    try:
+        loop.run_until_complete(
+            tg_ws_proxy._run(port, dc_opt, stop_event=stop_ev, host=host)
+        )
+    except Exception as exc:
+        log.error("Proxy thread crashed: %s", exc)
+        if "Address already in use" in str(exc):
+            _show_error(
+                "Не удалось запустить прокси:\nПорт уже используется другим приложением.\n\nЗакройте приложение, использующее этот порт, или измените порт в настройках прокси и перезапустите."
+            )
+    finally:
+        loop.close()
+        _async_stop = None
+
+
+def start_proxy():
+    global _proxy_thread, _config
+    if _proxy_thread and _proxy_thread.is_alive():
+        log.info("Proxy already running")
+        return
+
+    cfg = _config
+    port = cfg.get("port", DEFAULT_CONFIG["port"])
+    host = cfg.get("host", DEFAULT_CONFIG["host"])
+    dc_ip_list = cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])
+    verbose = cfg.get("verbose", False)
+
+    try:
+        dc_opt = tg_ws_proxy.parse_dc_ip_list(dc_ip_list)
+    except ValueError as e:
+        log.error("Bad config dc_ip: %s", e)
+        _show_error(f"Ошибка конфигурации:\n{e}")
+        return
+
+    log.info("Starting proxy on %s:%d ...", host, port)
+
+    buf_kb = cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])
+    pool_size = cfg.get("pool_size", DEFAULT_CONFIG["pool_size"])
+    tg_ws_proxy._RECV_BUF = max(4, buf_kb) * 1024
+    tg_ws_proxy._SEND_BUF = tg_ws_proxy._RECV_BUF
+    tg_ws_proxy._WS_POOL_SIZE = max(0, pool_size)
+
+    _proxy_thread = threading.Thread(
+        target=_run_proxy_thread,
+        args=(port, dc_opt, verbose, host),
+        daemon=True,
+        name="proxy",
+    )
+    _proxy_thread.start()
+
+
+def stop_proxy():
+    global _proxy_thread, _async_stop
+    if _async_stop:
+        loop, stop_ev = _async_stop
+        loop.call_soon_threadsafe(stop_ev.set)
+        if _proxy_thread:
+            _proxy_thread.join(timeout=2)
+    _proxy_thread = None
+    log.info("Proxy stopped")
+
+
+def restart_proxy():
+    log.info("Restarting proxy...")
+    stop_proxy()
+    time.sleep(0.3)
+    start_proxy()
+
+
+def _show_error(text: str, title: str = "TG WS Proxy — Ошибка"):
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    root = _tk.Tk()
+    root.withdraw()
+    _mb.showerror(title, text, parent=root)
+    root.destroy()
+
+
+def _show_info(text: str, title: str = "TG WS Proxy"):
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    root = _tk.Tk()
+    root.withdraw()
+    _mb.showinfo(title, text, parent=root)
+    root.destroy()
+
+
+def _ask_yes_no_dialog(text: str, title: str = "TG WS Proxy") -> bool:
+    import tkinter as _tk
+    from tkinter import messagebox as _mb
+
+    root = _tk.Tk()
+    root.withdraw()
+    try:
+        root.attributes("-topmost", True)
+    except Exception:
+        pass
+    r = _mb.askyesno(title, text, parent=root)
+    root.destroy()
+    return bool(r)
+
+
+def _maybe_notify_update_async():
+    def _work():
+        time.sleep(1.5)
+        if _exiting:
+            return
+        if not _config.get("check_updates", True):
+            return
+        try:
+            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update"):
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            text = (
+                f"Доступна новая версия: {ver}\n\n"
+                f"Открыть страницу релиза в браузере?"
+            )
+            if _ask_yes_no_dialog(text, "TG WS Proxy — обновление"):
+                webbrowser.open(url)
+        except Exception as exc:
+            log.debug("Update check failed: %s", exc)
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
+
+
+def _on_open_in_telegram(icon=None, item=None):
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    url = f"tg://socks?server={host}&port={port}"
+    log.info("Copying %s", url)
+
+    try:
+        pyperclip.copy(url)
+        _show_info(
+            f"Ссылка скопирована в буфер обмена, отправьте её в Telegram и нажмите по ней ЛКМ:\n{url}",
+            "TG WS Proxy",
+        )
+    except Exception as exc:
+        log.error("Clipboard copy failed: %s", exc)
+        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_restart(icon=None, item=None):
+    threading.Thread(target=restart_proxy, daemon=True).start()
+
+
+def _on_edit_config(icon=None, item=None):
+    threading.Thread(target=_edit_config_dialog, daemon=True).start()
+
+
+def _edit_config_dialog():
+    if ctk is None:
+        _show_error("customtkinter не установлен.")
+        return
+
+    cfg = dict(_config)
+
+    theme = ctk_theme_for_platform()
+    w, h = CONFIG_DIALOG_SIZE
+
+    root = create_ctk_root(
+        ctk,
+        title="TG WS Proxy — Настройки",
+        width=w,
+        height=h,
+        theme=theme,
+        after_create=_apply_linux_ctk_window_icon,
+    )
+
+    fpx, fpy = CONFIG_DIALOG_FRAME_PAD
+    frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
+
+    scroll, footer = tray_settings_scroll_and_footer(ctk, frame, theme)
+
+    widgets = install_tray_config_form(
+        ctk, scroll, theme, cfg, DEFAULT_CONFIG,
+        show_autostart=False,
+    )
+
+    def on_save():
+        merged = validate_config_form(
+            widgets, DEFAULT_CONFIG, include_autostart=False)
+        if isinstance(merged, str):
+            _show_error(merged)
+            return
+
+        new_cfg = merged
+        save_config(new_cfg)
+        _config.update(new_cfg)
+        log.info("Config saved: %s", new_cfg)
+
+        _tray_icon.menu = _build_menu()
+
+        from tkinter import messagebox
+
+        if messagebox.askyesno(
+            "Перезапустить?",
+            "Настройки сохранены.\n\nПерезапустить прокси сейчас?",
+            parent=root,
+        ):
+            root.destroy()
+            restart_proxy()
+        else:
+            root.destroy()
+
+    def on_cancel():
+        root.destroy()
+
+    install_tray_config_buttons(
+        ctk, footer, theme, on_save=on_save, on_cancel=on_cancel)
+
+    try:
+        root.mainloop()
+    finally:
+        import tkinter as tk
+        try:
+            if root.winfo_exists():
+                root.destroy()
+        except tk.TclError:
+            pass
+
+
+def _on_open_logs(icon=None, item=None):
+    log.info("Opening log file: %s", LOG_FILE)
+    if LOG_FILE.exists():
+        env = os.environ.copy()
+        env.pop("VIRTUAL_ENV", None)
+        env.pop("PYTHONPATH", None)
+        env.pop("PYTHONHOME", None)
+
+        subprocess.Popen(
+            ["xdg-open", str(LOG_FILE)],
+            env=env,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            stdin=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+    else:
+        _show_info("Файл логов ещё не создан.", "TG WS Proxy")
+
+
+def _on_exit(icon=None, item=None):
+    global _exiting
+    if _exiting:
+        os._exit(0)
+        return
+    _exiting = True
+    log.info("User requested exit")
+
+    def _force_exit():
+        time.sleep(3)
+        os._exit(0)
+
+    threading.Thread(target=_force_exit, daemon=True, name="force-exit").start()
+
+    if icon:
+        icon.stop()
+
+
+def _show_first_run():
+    _ensure_dirs()
+    if FIRST_RUN_MARKER.exists():
+        return
+
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+
+    if ctk is None:
+        FIRST_RUN_MARKER.touch()
+        return
+
+    theme = ctk_theme_for_platform()
+    w, h = FIRST_RUN_SIZE
+
+    root = create_ctk_root(
+        ctk,
+        title="TG WS Proxy",
+        width=w,
+        height=h,
+        theme=theme,
+        after_create=_apply_linux_ctk_window_icon,
+    )
+
+    def on_done(open_tg: bool):
+        FIRST_RUN_MARKER.touch()
+        root.destroy()
+        if open_tg:
+            _on_open_in_telegram()
+
+    populate_first_run_window(
+        ctk, root, theme, host=host, port=port, on_done=on_done)
+
+    try:
+        root.mainloop()
+    finally:
+        import tkinter as tk
+        try:
+            if root.winfo_exists():
+                root.destroy()
+        except tk.TclError:
+            pass
+
+
+def _has_ipv6_enabled() -> bool:
+    import socket as _sock
+
+    try:
+        addrs = _sock.getaddrinfo(_sock.gethostname(), None, _sock.AF_INET6)
+        for addr in addrs:
+            ip = addr[4][0]
+            if ip and not ip.startswith("::1") and not ip.startswith("fe80::1"):
+                return True
+    except Exception:
+        pass
+    try:
+        s = _sock.socket(_sock.AF_INET6, _sock.SOCK_STREAM)
+        s.bind(("::1", 0))
+        s.close()
+        return True
+    except Exception:
+        return False
+
+
+def _check_ipv6_warning():
+    _ensure_dirs()
+    if IPV6_WARN_MARKER.exists():
+        return
+    if not _has_ipv6_enabled():
+        return
+
+    IPV6_WARN_MARKER.touch()
+
+    threading.Thread(target=_show_ipv6_dialog, daemon=True).start()
+
+
+def _show_ipv6_dialog():
+    _show_info(
+        "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
+        "Telegram может пытаться подключаться через IPv6, "
+        "что не поддерживается и может привести к ошибкам.\n\n"
+        "Если прокси не работает или в логах присутствуют ошибки, "
+        "связанные с попытками подключения по IPv6 - "
+        "попробуйте отключить в настройках прокси Telegram попытку соединения "
+        "по IPv6. Если данная мера не помогает, попробуйте отключить IPv6 "
+        "в системе.\n\n"
+        "Это предупреждение будет показано только один раз.",
+        "TG WS Proxy",
+    )
+
+
+def _build_menu():
+    if pystray is None:
+        return None
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    return pystray.Menu(
+        pystray.MenuItem(
+            f"Открыть в Telegram ({host}:{port})", _on_open_in_telegram, default=True
+        ),
+        pystray.Menu.SEPARATOR,
+        pystray.MenuItem("Перезапустить прокси", _on_restart),
+        pystray.MenuItem("Настройки...", _on_edit_config),
+        pystray.MenuItem("Открыть логи", _on_open_logs),
+        pystray.Menu.SEPARATOR,
+        pystray.MenuItem("Выход", _on_exit),
+    )
+
+
+def run_tray():
+    global _tray_icon, _config
+
+    _config = load_config()
+    save_config(_config)
+
+    if LOG_FILE.exists():
+        try:
+            LOG_FILE.unlink()
+        except Exception:
+            pass
+
+    setup_logging(_config.get("verbose", False),
+                  log_max_mb=_config.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]))
+    log.info("TG WS Proxy версия %s, tray app starting", __version__)
+    log.info("Config: %s", _config)
+    log.info("Log file: %s", LOG_FILE)
+
+    if pystray is None or Image is None:
+        log.error("pystray or Pillow not installed; running in console mode")
+        start_proxy()
+        try:
+            while True:
+                time.sleep(1)
+        except KeyboardInterrupt:
+            stop_proxy()
+        return
+
+    start_proxy()
+
+    _maybe_notify_update_async()
+
+    _show_first_run()
+    _check_ipv6_warning()
+
+    icon_image = _load_icon()
+    _tray_icon = pystray.Icon(APP_NAME, icon_image, "TG WS Proxy", menu=_build_menu())
+
+    log.info("Tray icon running")
+    _tray_icon.run()
+
+    stop_proxy()
+    log.info("Tray app exited")
+
+
+def main():
+    if not _acquire_lock():
+        _show_info("Приложение уже запущено.", os.path.basename(sys.argv[0]))
+        return
+
+    try:
+        run_tray()
+    finally:
+        _release_lock()
+
+
+if __name__ == "__main__":
+    main()

macos.py

@@ -0,0 +1,752 @@
+from __future__ import annotations
+
+import json
+import logging
+import logging.handlers
+import os
+import psutil
+import subprocess
+import sys
+import threading
+import time
+import webbrowser
+import asyncio as _asyncio
+from pathlib import Path
+from typing import Dict, Optional
+
+try:
+    import rumps
+except ImportError:
+    rumps = None
+
+try:
+    from PIL import Image, ImageDraw, ImageFont
+except ImportError:
+    Image = ImageDraw = ImageFont = None
+
+try:
+    import pyperclip
+except ImportError:
+    pyperclip = None
+
+import proxy.tg_ws_proxy as tg_ws_proxy
+from proxy import __version__
+from utils.default_config import default_tray_config
+
+APP_NAME = "TgWsProxy"
+APP_DIR = Path.home() / "Library" / "Application Support" / APP_NAME
+CONFIG_FILE = APP_DIR / "config.json"
+LOG_FILE = APP_DIR / "proxy.log"
+FIRST_RUN_MARKER = APP_DIR / ".first_run_done"
+IPV6_WARN_MARKER = APP_DIR / ".ipv6_warned"
+MENUBAR_ICON_PATH = APP_DIR / "menubar_icon.png"
+
+DEFAULT_CONFIG = default_tray_config()
+
+_proxy_thread: Optional[threading.Thread] = None
+_async_stop: Optional[object] = None
+_app: Optional[object] = None
+_config: dict = {}
+_exiting: bool = False
+_lock_file_path: Optional[Path] = None
+
+log = logging.getLogger("tg-ws-tray")
+
+
+# Single-instance lock
+
+def _same_process(lock_meta: dict, proc: psutil.Process) -> bool:
+    try:
+        lock_ct = float(lock_meta.get("create_time", 0.0))
+        proc_ct = float(proc.create_time())
+        if lock_ct > 0 and abs(lock_ct - proc_ct) > 1.0:
+            return False
+    except Exception:
+        return False
+
+    frozen = bool(getattr(sys, "frozen", False))
+    if frozen:
+        return APP_NAME.lower() in proc.name().lower()
+    return False
+
+
+def _release_lock():
+    global _lock_file_path
+    if not _lock_file_path:
+        return
+    try:
+        _lock_file_path.unlink(missing_ok=True)
+    except Exception:
+        pass
+    _lock_file_path = None
+
+
+def _acquire_lock() -> bool:
+    global _lock_file_path
+    _ensure_dirs()
+    lock_files = list(APP_DIR.glob("*.lock"))
+
+    for f in lock_files:
+        pid = None
+        meta: dict = {}
+
+        try:
+            pid = int(f.stem)
+        except Exception:
+            f.unlink(missing_ok=True)
+            continue
+
+        try:
+            raw = f.read_text(encoding="utf-8").strip()
+            if raw:
+                meta = json.loads(raw)
+        except Exception:
+            meta = {}
+
+        try:
+            proc = psutil.Process(pid)
+            if _same_process(meta, proc):
+                return False
+        except Exception:
+            pass
+
+        f.unlink(missing_ok=True)
+
+    lock_file = APP_DIR / f"{os.getpid()}.lock"
+    try:
+        proc = psutil.Process(os.getpid())
+        payload = {"create_time": proc.create_time()}
+        lock_file.write_text(json.dumps(payload, ensure_ascii=False),
+                             encoding="utf-8")
+    except Exception:
+        lock_file.touch()
+
+    _lock_file_path = lock_file
+    return True
+
+
+# Filesystem helpers
+
+def _ensure_dirs():
+    APP_DIR.mkdir(parents=True, exist_ok=True)
+
+
+def load_config() -> dict:
+    _ensure_dirs()
+    if CONFIG_FILE.exists():
+        try:
+            with open(CONFIG_FILE, "r", encoding="utf-8") as f:
+                data = json.load(f)
+            for k, v in DEFAULT_CONFIG.items():
+                data.setdefault(k, v)
+            return data
+        except Exception as exc:
+            log.warning("Failed to load config: %s", exc)
+    return dict(DEFAULT_CONFIG)
+
+
+def save_config(cfg: dict):
+    _ensure_dirs()
+    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
+        json.dump(cfg, f, indent=2, ensure_ascii=False)
+
+
+def setup_logging(verbose: bool = False, log_max_mb: float = 5):
+    _ensure_dirs()
+    root = logging.getLogger()
+    root.setLevel(logging.DEBUG if verbose else logging.INFO)
+
+    fh = logging.handlers.RotatingFileHandler(
+        str(LOG_FILE),
+        maxBytes=max(32 * 1024, log_max_mb * 1024 * 1024),
+        backupCount=0,
+        encoding='utf-8',
+    )
+    fh.setLevel(logging.DEBUG)
+    fh.setFormatter(logging.Formatter(
+        "%(asctime)s  %(levelname)-5s  %(name)s  %(message)s",
+        datefmt="%Y-%m-%d %H:%M:%S"))
+    root.addHandler(fh)
+
+    if not getattr(sys, "frozen", False):
+        ch = logging.StreamHandler(sys.stdout)
+        ch.setLevel(logging.DEBUG if verbose else logging.INFO)
+        ch.setFormatter(logging.Formatter(
+            "%(asctime)s  %(levelname)-5s  %(message)s",
+            datefmt="%H:%M:%S"))
+        root.addHandler(ch)
+
+
+# Menubar icon
+
+def _make_menubar_icon(size: int = 44):
+    if Image is None:
+        return None
+    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    draw = ImageDraw.Draw(img)
+
+    margin = size // 11
+    draw.ellipse([margin, margin, size - margin, size - margin],
+                 fill=(0, 0, 0, 255))
+
+    try:
+        font = ImageFont.truetype(
+            "/System/Library/Fonts/Helvetica.ttc",
+            size=int(size * 0.55))
+    except Exception:
+        font = ImageFont.load_default()
+
+    bbox = draw.textbbox((0, 0), "T", font=font)
+    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
+    tx = (size - tw) // 2 - bbox[0]
+    ty = (size - th) // 2 - bbox[1]
+    draw.text((tx, ty), "T", fill=(255, 255, 255, 255), font=font)
+    return img
+
+# Generate menubar icon PNG if it does not exist.
+def _ensure_menubar_icon():
+    if MENUBAR_ICON_PATH.exists():
+        return
+    _ensure_dirs()
+    img = _make_menubar_icon(44)
+    if img:
+        img.save(str(MENUBAR_ICON_PATH), "PNG")
+
+
+# Native macOS dialogs
+
+def _escape_osascript_text(text: str) -> str:
+    return text.replace('\\', '\\\\').replace('"', '\\"')
+
+
+def _osascript(script: str) -> str:
+    r = subprocess.run(
+        ['osascript', '-e', script],
+        capture_output=True, text=True)
+    return r.stdout.strip()
+
+
+def _show_error(text: str, title: str = "TG WS Proxy"):
+    text_esc = _escape_osascript_text(text)
+    title_esc = _escape_osascript_text(title)
+    _osascript(
+        f'display dialog "{text_esc}" with title "{title_esc}" '
+        f'buttons {{"OK"}} default button "OK" with icon stop')
+
+
+def _show_info(text: str, title: str = "TG WS Proxy"):
+    text_esc = _escape_osascript_text(text)
+    title_esc = _escape_osascript_text(title)
+    _osascript(
+        f'display dialog "{text_esc}" with title "{title_esc}" '
+        f'buttons {{"OK"}} default button "OK" with icon note')
+
+
+def _ask_yes_no(text: str, title: str = "TG WS Proxy") -> bool:
+    result = _ask_yes_no_close(text, title)
+    return result is True
+
+
+def _ask_yes_no_close(text: str,
+                      title: str = "TG WS Proxy") -> Optional[bool]:
+    text_esc = _escape_osascript_text(text)
+    title_esc = _escape_osascript_text(title)
+    r = subprocess.run(
+        ['osascript', '-e',
+         f'button returned of (display dialog "{text_esc}" '
+         f'with title "{title_esc}" '
+         f'buttons {{"Закрыть", "Нет", "Да"}} '
+         f'default button "Да" cancel button "Закрыть" with icon note)'],
+        capture_output=True, text=True)
+    if r.returncode != 0:
+        return None
+
+    result = r.stdout.strip()
+    if result == "Да":
+        return True
+    if result == "Нет":
+        return False
+    return None
+
+
+# Proxy lifecycle
+
+def _run_proxy_thread(port: int, dc_opt: Dict[int, str], verbose: bool,
+                      host: str = '127.0.0.1'):
+    global _async_stop
+    loop = _asyncio.new_event_loop()
+    _asyncio.set_event_loop(loop)
+    stop_ev = _asyncio.Event()
+    _async_stop = (loop, stop_ev)
+
+    try:
+        loop.run_until_complete(
+            tg_ws_proxy._run(port, dc_opt, stop_event=stop_ev, host=host))
+    except Exception as exc:
+        log.error("Proxy thread crashed: %s", exc)
+        if "Address already in use" in str(exc):
+            _show_error(
+                "Не удалось запустить прокси:\n"
+                "Порт уже используется другим приложением.\n\n"
+                "Закройте приложение, использующее этот порт, "
+                "или измените порт в настройках прокси и перезапустите.")
+    finally:
+        loop.close()
+        _async_stop = None
+
+
+def start_proxy():
+    global _proxy_thread, _config
+    if _proxy_thread and _proxy_thread.is_alive():
+        log.info("Proxy already running")
+        return
+
+    cfg = _config
+    port = cfg.get("port", DEFAULT_CONFIG["port"])
+    host = cfg.get("host", DEFAULT_CONFIG["host"])
+    dc_ip_list = cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])
+    verbose = cfg.get("verbose", False)
+
+    try:
+        dc_opt = tg_ws_proxy.parse_dc_ip_list(dc_ip_list)
+    except ValueError as e:
+        log.error("Bad config dc_ip: %s", e)
+        _show_error(f"Ошибка конфигурации:\n{e}")
+        return
+
+    log.info("Starting proxy on %s:%d ...", host, port)
+
+    buf_kb = cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])
+    pool_size = cfg.get("pool_size", DEFAULT_CONFIG["pool_size"])
+    tg_ws_proxy._RECV_BUF = max(4, buf_kb) * 1024
+    tg_ws_proxy._SEND_BUF = tg_ws_proxy._RECV_BUF
+    tg_ws_proxy._WS_POOL_SIZE = max(0, pool_size)
+
+    _proxy_thread = threading.Thread(
+        target=_run_proxy_thread,
+        args=(port, dc_opt, verbose, host),
+        daemon=True, name="proxy")
+    _proxy_thread.start()
+
+
+def stop_proxy():
+    global _proxy_thread, _async_stop
+    if _async_stop:
+        loop, stop_ev = _async_stop
+        loop.call_soon_threadsafe(stop_ev.set)
+        if _proxy_thread:
+            _proxy_thread.join(timeout=2)
+    _proxy_thread = None
+    log.info("Proxy stopped")
+
+
+def restart_proxy():
+    log.info("Restarting proxy...")
+    stop_proxy()
+    time.sleep(0.3)
+    start_proxy()
+
+
+# Menu callbacks
+
+def _on_open_in_telegram(_=None):
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    url = f"tg://socks?server={host}&port={port}"
+    log.info("Opening %s", url)
+    try:
+        result = subprocess.call(['open', url])
+        if result != 0:
+            raise RuntimeError("open command failed")
+    except Exception:
+        log.info("open command failed, trying webbrowser")
+        try:
+            if not webbrowser.open(url):
+                raise RuntimeError("webbrowser.open returned False")
+        except Exception:
+            log.info("Browser open failed, copying to clipboard")
+            try:
+                if pyperclip:
+                    pyperclip.copy(url)
+                else:
+                    subprocess.run(['pbcopy'], input=url.encode(),
+                                   check=True)
+                _show_info(
+                    "Не удалось открыть Telegram автоматически.\n\n"
+                    f"Ссылка скопирована в буфер обмена:\n{url}")
+            except Exception as exc:
+                log.error("Clipboard copy failed: %s", exc)
+                _show_error(f"Не удалось скопировать ссылку:\n{exc}")
+
+
+def _on_restart(_=None):
+    def _do_restart():
+        global _config
+        _config = load_config()
+        if _app:
+            _app.update_menu_title()
+        restart_proxy()
+
+    threading.Thread(target=_do_restart, daemon=True).start()
+
+
+def _on_open_logs(_=None):
+    log.info("Opening log file: %s", LOG_FILE)
+    if LOG_FILE.exists():
+        subprocess.call(['open', str(LOG_FILE)])
+    else:
+        _show_info("Файл логов ещё не создан.")
+
+# Show a native text input dialog. Returns None if cancelled.
+def _osascript_input(prompt: str, default: str,
+                     title: str = "TG WS Proxy") -> Optional[str]:
+    prompt_esc = _escape_osascript_text(prompt)
+    default_esc = _escape_osascript_text(default)
+    title_esc = _escape_osascript_text(title)
+    r = subprocess.run(
+        ['osascript', '-e',
+         f'text returned of (display dialog "{prompt_esc}" '
+         f'default answer "{default_esc}" '
+         f'with title "{title_esc}" '
+         f'buttons {{"Закрыть", "OK"}} '
+         f'default button "OK" cancel button "Закрыть")'],
+        capture_output=True, text=True)
+    if r.returncode != 0:
+        return None
+    return r.stdout.rstrip("\r\n")
+
+
+def _on_edit_config(_=None):
+    threading.Thread(target=_edit_config_dialog, daemon=True).start()
+
+
+def _check_updates_menu_title() -> str:
+    on = bool(_config.get("check_updates", True))
+    return (
+        "✓ Проверять обновления при запуске"
+        if on
+        else "Проверять обновления при запуске (выкл)"
+    )
+
+
+def _toggle_check_updates(_=None):
+    global _config
+    _config["check_updates"] = not bool(_config.get("check_updates", True))
+    save_config(_config)
+    if _app is not None:
+        _app._check_updates_item.title = _check_updates_menu_title()
+
+
+def _on_open_release_page(_=None):
+    from utils.update_check import RELEASES_PAGE_URL
+    webbrowser.open(RELEASES_PAGE_URL)
+
+
+def _maybe_notify_update_async():
+    def _work():
+        time.sleep(1.5)
+        if _exiting:
+            return
+        if not _config.get("check_updates", True):
+            return
+        try:
+            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update"):
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            if _ask_yes_no(
+                f"Доступна новая версия: {ver}\n\n"
+                f"Открыть страницу релиза в браузере?",
+                "TG WS Proxy — обновление",
+            ):
+                webbrowser.open(url)
+        except Exception as exc:
+            log.debug("Update check failed: %s", exc)
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
+
+
+# Settings via native macOS dialogs
+def _edit_config_dialog():
+    cfg = load_config()
+
+    # Host
+    host = _osascript_input(
+        "IP-адрес прокси:",
+        cfg.get("host", DEFAULT_CONFIG["host"]))
+    if host is None:
+        return
+    host = host.strip()
+
+    import socket as _sock
+    try:
+        _sock.inet_aton(host)
+    except OSError:
+        _show_error("Некорректный IP-адрес.")
+        return
+
+    # Port
+    port_str = _osascript_input(
+        "Порт прокси:",
+        str(cfg.get("port", DEFAULT_CONFIG["port"])))
+    if port_str is None:
+        return
+    try:
+        port = int(port_str.strip())
+        if not (1 <= port <= 65535):
+            raise ValueError
+    except ValueError:
+        _show_error("Порт должен быть числом 1-65535")
+        return
+
+    # DC-IP mappings
+    dc_default = ", ".join(cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"]))
+    dc_str = _osascript_input(
+        "DC → IP маппинги (через запятую, формат DC:IP):\n"
+        "Например: 2:149.154.167.220, 4:149.154.167.220",
+        dc_default)
+    if dc_str is None:
+        return
+    dc_lines = [s.strip() for s in dc_str.replace(',', '\n').splitlines()
+                if s.strip()]
+    try:
+        tg_ws_proxy.parse_dc_ip_list(dc_lines)
+    except ValueError as e:
+        _show_error(str(e))
+        return
+
+    # Verbose
+    verbose = _ask_yes_no_close("Включить подробное логирование (verbose)?")
+    if verbose is None:
+        return
+
+    # Advanced settings
+    adv_str = _osascript_input(
+        "Расширенные настройки (буфер KB, WS пул, лог MB):\n"
+        "Формат: buf_kb,pool_size,log_max_mb",
+        f"{cfg.get('buf_kb', DEFAULT_CONFIG['buf_kb'])},"
+        f"{cfg.get('pool_size', DEFAULT_CONFIG['pool_size'])},"
+        f"{cfg.get('log_max_mb', DEFAULT_CONFIG['log_max_mb'])}")
+    if adv_str is None:
+        return
+
+    adv = {}
+    if adv_str:
+        parts = [s.strip() for s in adv_str.split(',')]
+        keys = [("buf_kb", int), ("pool_size", int),
+                ("log_max_mb", float)]
+        for i, (k, typ) in enumerate(keys):
+            if i < len(parts):
+                try:
+                    adv[k] = typ(parts[i])
+                except ValueError:
+                    pass
+
+    new_cfg = {
+        "host": host,
+        "port": port,
+        "dc_ip": dc_lines,
+        "verbose": verbose,
+        "buf_kb": adv.get("buf_kb", cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])),
+        "pool_size": adv.get("pool_size", cfg.get("pool_size", DEFAULT_CONFIG["pool_size"])),
+        "log_max_mb": adv.get("log_max_mb", cfg.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"])),
+    }
+    save_config(new_cfg)
+    log.info("Config saved: %s", new_cfg)
+
+    global _config
+    _config = new_cfg
+    if _app:
+        _app.update_menu_title()
+
+    if _ask_yes_no_close(
+            "Настройки сохранены.\n\nПерезапустить прокси сейчас?"):
+        restart_proxy()
+
+
+# First-run & IPv6 dialogs
+
+def _show_first_run():
+    _ensure_dirs()
+    if FIRST_RUN_MARKER.exists():
+        return
+
+    host = _config.get("host", DEFAULT_CONFIG["host"])
+    port = _config.get("port", DEFAULT_CONFIG["port"])
+    tg_url = f"tg://socks?server={host}&port={port}"
+
+    text = (
+        f"Прокси запущен и работает в строке меню.\n\n"
+        f"Как подключить Telegram Desktop:\n\n"
+        f"Автоматически:\n"
+        f"  Нажмите «Открыть в Telegram» в меню\n"
+        f"  Или ссылка: {tg_url}\n\n"
+        f"Вручную:\n"
+        f"  Настройки → Продвинутые → Тип подключения → Прокси\n"
+        f"  SOCKS5 → {host} : {port} (без логина/пароля)\n\n"
+        f"Открыть прокси в Telegram сейчас?"
+    )
+
+    FIRST_RUN_MARKER.touch()
+
+    if _ask_yes_no(text, "TG WS Proxy"):
+        _on_open_in_telegram()
+
+
+def _has_ipv6_enabled() -> bool:
+    import socket as _sock
+    try:
+        addrs = _sock.getaddrinfo(_sock.gethostname(), None, _sock.AF_INET6)
+        for addr in addrs:
+            ip = addr[4][0]
+            if ip and not ip.startswith('::1') and not ip.startswith('fe80::1'):
+                return True
+    except Exception:
+        pass
+    try:
+        s = _sock.socket(_sock.AF_INET6, _sock.SOCK_STREAM)
+        s.bind(('::1', 0))
+        s.close()
+        return True
+    except Exception:
+        return False
+
+
+def _check_ipv6_warning():
+    _ensure_dirs()
+    if IPV6_WARN_MARKER.exists():
+        return
+    if not _has_ipv6_enabled():
+        return
+
+    IPV6_WARN_MARKER.touch()
+
+    _show_info(
+        "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
+        "Telegram может пытаться подключаться через IPv6, "
+        "что не поддерживается и может привести к ошибкам.\n\n"
+        "Если прокси не работает, попробуйте отключить "
+        "попытку соединения по IPv6 в настройках прокси Telegram.\n\n"
+        "Это предупреждение будет показано только один раз.")
+
+
+# rumps menubar app
+
+_TgWsProxyAppBase = rumps.App if rumps else object
+
+
+class TgWsProxyApp(_TgWsProxyAppBase):
+    def __init__(self):
+        _ensure_menubar_icon()
+        icon_path = (str(MENUBAR_ICON_PATH)
+                     if MENUBAR_ICON_PATH.exists() else None)
+
+        host = _config.get("host", DEFAULT_CONFIG["host"])
+        port = _config.get("port", DEFAULT_CONFIG["port"])
+
+        self._open_tg_item = rumps.MenuItem(
+            f"Открыть в Telegram ({host}:{port})",
+            callback=_on_open_in_telegram)
+        self._restart_item = rumps.MenuItem(
+            "Перезапустить прокси",
+            callback=_on_restart)
+        self._settings_item = rumps.MenuItem(
+            "Настройки...",
+            callback=_on_edit_config)
+        self._logs_item = rumps.MenuItem(
+            "Открыть логи",
+            callback=_on_open_logs)
+        self._release_page_item = rumps.MenuItem(
+            "Страница релиза на GitHub…",
+            callback=_on_open_release_page)
+        self._check_updates_item = rumps.MenuItem(
+            _check_updates_menu_title(),
+            callback=_toggle_check_updates)
+        self._version_item = rumps.MenuItem(
+            f"Версия {__version__}",
+            callback=lambda _: None)
+
+        super().__init__(
+            "TG WS Proxy",
+            icon=icon_path,
+            template=False,
+            quit_button="Выход",
+            menu=[
+                self._open_tg_item,
+                None,
+                self._restart_item,
+                self._settings_item,
+                self._logs_item,
+                None,
+                self._release_page_item,
+                self._check_updates_item,
+                None,
+                self._version_item,
+            ])
+
+    def update_menu_title(self):
+        host = _config.get("host", DEFAULT_CONFIG["host"])
+        port = _config.get("port", DEFAULT_CONFIG["port"])
+        self._open_tg_item.title = (
+            f"Открыть в Telegram ({host}:{port})")
+
+
+def run_menubar():
+    global _app, _config
+
+    _config = load_config()
+    save_config(_config)
+
+    if LOG_FILE.exists():
+        try:
+            LOG_FILE.unlink()
+        except Exception:
+            pass
+
+    setup_logging(_config.get("verbose", False),
+                  log_max_mb=_config.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]))
+    log.info("TG WS Proxy версия %s, menubar app starting", __version__)
+    log.info("Config: %s", _config)
+    log.info("Log file: %s", LOG_FILE)
+
+    if rumps is None or Image is None:
+        log.error("rumps or Pillow not installed; running in console mode")
+        start_proxy()
+        try:
+            while True:
+                time.sleep(1)
+        except KeyboardInterrupt:
+            stop_proxy()
+        return
+
+    start_proxy()
+
+    _maybe_notify_update_async()
+
+    _show_first_run()
+    _check_ipv6_warning()
+
+    _app = TgWsProxyApp()
+    log.info("Menubar app running")
+    _app.run()
+
+    stop_proxy()
+    log.info("Menubar app exited")
+
+
+def main():
+    if not _acquire_lock():
+        _show_info("Приложение уже запущено.")
+        return
+
+    try:
+        run_menubar()
+    finally:
+        _release_lock()
+
+
+if __name__ == "__main__":
+    main()

packaging/linux.spec

@@ -0,0 +1,80 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+import sys
+import os
+import glob
+
+from PyInstaller.utils.hooks import collect_submodules, collect_data_files
+
+block_cipher = None
+
+# customtkinter ships JSON themes + assets that must be bundled
+import customtkinter
+ctk_path = os.path.dirname(customtkinter.__file__)
+
+# Collect gi (PyGObject) submodules and data so pystray._appindicator works
+gi_hiddenimports = collect_submodules('gi')
+gi_datas = collect_data_files('gi')
+
+# Collect GObject typelib files from the system
+typelib_dirs = glob.glob('/usr/lib/*/girepository-1.0')
+typelib_datas = []
+for d in typelib_dirs:
+    typelib_datas.append((d, 'gi_typelibs'))
+
+a = Analysis(
+    [os.path.join(os.path.dirname(SPEC), os.pardir, 'linux.py')],
+    pathex=[],
+    binaries=[],
+    datas=[(ctk_path, 'customtkinter/')] + gi_datas + typelib_datas,
+    hiddenimports=[
+        'pystray._appindicator',
+        'PIL._tkinter_finder',
+        'customtkinter',
+        'cryptography.hazmat.primitives.ciphers',
+        'cryptography.hazmat.primitives.ciphers.algorithms',
+        'cryptography.hazmat.primitives.ciphers.modes',
+        'cryptography.hazmat.backends.openssl',
+        'gi',
+        '_gi',
+        'gi.repository.GLib',
+        'gi.repository.GObject',
+        'gi.repository.Gtk',
+        'gi.repository.Gdk',
+        'gi.repository.AyatanaAppIndicator3',
+    ] + gi_hiddenimports,
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    cipher=block_cipher,
+)
+
+icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.ico')
+if os.path.exists(icon_path):
+    a.datas += [('icon.ico', icon_path, 'DATA')]
+
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.zipfiles,
+    a.datas,
+    [],
+    name='TgWsProxy',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=True,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=False,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)

packaging/macos.spec

@@ -0,0 +1,83 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+import sys
+import os
+
+block_cipher = None
+
+a = Analysis(
+    [os.path.join(os.path.dirname(SPEC), os.pardir, 'macos.py')],
+    pathex=[],
+    binaries=[],
+    datas=[],
+    hiddenimports=[
+        'rumps',
+        'objc',
+        'Foundation',
+        'AppKit',
+        'PyObjCTools',
+        'PyObjCTools.AppHelper',
+        'cryptography.hazmat.primitives.ciphers',
+        'cryptography.hazmat.primitives.ciphers.algorithms',
+        'cryptography.hazmat.primitives.ciphers.modes',
+        'cryptography.hazmat.backends.openssl',
+    ],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    cipher=block_cipher,
+)
+
+icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.icns')
+if not os.path.exists(icon_path):
+    icon_path = None
+
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    [],
+    exclude_binaries=True,
+    name='TgWsProxy',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=False,
+    console=False,
+    argv_emulation=False,
+    target_arch='universal2',
+    codesign_identity=None,
+    entitlements_file=None,
+)
+
+coll = COLLECT(
+    exe,
+    a.binaries,
+    a.zipfiles,
+    a.datas,
+    strip=False,
+    upx=False,
+    upx_exclude=[],
+    name='TgWsProxy',
+)
+
+app = BUNDLE(
+    coll,
+    name='TG WS Proxy.app',
+    icon=icon_path,
+    bundle_identifier='com.tgwsproxy.app',
+    info_plist={
+        'CFBundleName': 'TG WS Proxy',
+        'CFBundleDisplayName': 'TG WS Proxy',
+        'CFBundleShortVersionString': '1.0.0',
+        'CFBundleVersion': '1.0.0',
+        'LSMinimumSystemVersion': '10.15',
+        'LSUIElement': True,
+        'NSHighResolutionCapable': True,
+        'NSAppleEventsUsageDescription':
+            'TG WS Proxy needs to display dialogs.',
+    },
+)

proxy/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.3.0"

proxy/tg_ws_proxy.py

@@ -4,6 +4,7 @@ import argparse
 import asyncio
 import base64
 import logging
+import logging.handlers
 import os
 import socket as _socket
 import ssl
@@ -18,8 +19,8 @@ DEFAULT_PORT = 1080
 log = logging.getLogger('tg-ws-proxy')
 
 _TCP_NODELAY = True
-_RECV_BUF = 65536
-_SEND_BUF = 65536
+_RECV_BUF = 256 * 1024
+_SEND_BUF = 256 * 1024
 _WS_POOL_SIZE = 4
 _WS_POOL_MAX_AGE = 120.0
 
@@ -64,6 +65,13 @@ _IP_TO_DC: Dict[str, Tuple[int, bool]] = {
     '149.154.171.5':  (5, False),
     '91.108.56.102': (5, True), '91.108.56.128': (5, True),
     '91.108.56.151': (5, True),
+    # DC203
+    '91.105.192.100': (203, False),
+}
+
+# This case might work but not actually sure
+_DC_OVERRIDES: Dict[int, int] = {
+    203: 2
 }
 
 _dc_opt: Dict[int, Optional[str]] = {}
@@ -75,7 +83,10 @@ _ws_blacklist: Set[Tuple[int, bool]] = set()
 
 # Rate-limit re-attempts per (dc, is_media)
 _dc_fail_until: Dict[Tuple[int, bool], float] = {}
-_DC_FAIL_COOLDOWN = 60.0  # seconds
+_DC_FAIL_COOLDOWN = 30.0   # seconds to keep reduced WS timeout after failure
+_WS_FAIL_TIMEOUT = 2.0    # quick-retry timeout after a recent WS failure
+
+_ZERO_64 = b'\x00' * 64
 
 
 _ssl_ctx = ssl.create_default_context()
@@ -121,6 +132,28 @@ def _xor_mask(data: bytes, mask: bytes) -> bytes:
     return (int.from_bytes(data, 'big') ^ int.from_bytes(mask_rep, 'big')).to_bytes(n, 'big')
 
 
+# Pre-compiled struct formats
+_st_BB = struct.Struct('>BB')
+_st_BBH = struct.Struct('>BBH')
+_st_BBQ = struct.Struct('>BBQ')
+_st_BB4s = struct.Struct('>BB4s')
+_st_BBH4s = struct.Struct('>BBH4s')
+_st_BBQ4s = struct.Struct('>BBQ4s')
+_st_H = struct.Struct('>H')
+_st_Q = struct.Struct('>Q')
+_st_I_net = struct.Struct('!I')
+_st_Ih = struct.Struct('<Ih')
+_st_I_le = struct.Struct('<I')
+_PROTO_ABRIDGED = 0xEFEFEFEF
+_PROTO_INTERMEDIATE = 0xEEEEEEEE
+_PROTO_PADDED_INTERMEDIATE = 0xDDDDDDDD
+_VALID_PROTOS = frozenset((
+    _PROTO_ABRIDGED,
+    _PROTO_INTERMEDIATE,
+    _PROTO_PADDED_INTERMEDIATE,
+))
+
+
 class RawWebSocket:
     """
     Lightweight WebSocket client over asyncio reader/writer streams.
@@ -129,6 +162,7 @@ class RawWebSocket:
     proxy), performs the HTTP Upgrade handshake, and provides send/recv
     for binary frames with proper masking, ping/pong, and close handling.
     """
+    __slots__ = ('reader', 'writer', '_closed')
 
     OP_CONTINUATION = 0x0
     OP_TEXT = 0x1
@@ -294,40 +328,37 @@ class RawWebSocket:
     @staticmethod
     def _build_frame(opcode: int, data: bytes,
                      mask: bool = False) -> bytes:
-        header = bytearray()
-        header.append(0x80 | opcode)  # FIN=1 + opcode
         length = len(data)
-        mask_bit = 0x80 if mask else 0x00
+        fb = 0x80 | opcode
 
+        if not mask:
+            if length < 126:
+                return _st_BB.pack(fb, length) + data
+            if length < 65536:
+                return _st_BBH.pack(fb, 126, length) + data
+            return _st_BBQ.pack(fb, 127, length) + data
+
+        mask_key = os.urandom(4)
+        masked = _xor_mask(data, mask_key)
         if length < 126:
-            header.append(mask_bit | length)
-        elif length < 65536:
-            header.append(mask_bit | 126)
-            header.extend(struct.pack('>H', length))
-        else:
-            header.append(mask_bit | 127)
-            header.extend(struct.pack('>Q', length))
-
-        if mask:
-            mask_key = os.urandom(4)
-            header.extend(mask_key)
-            return bytes(header) + _xor_mask(data, mask_key)
-        return bytes(header) + data
+            return _st_BB4s.pack(fb, 0x80 | length, mask_key) + masked
+        if length < 65536:
+            return _st_BBH4s.pack(fb, 0x80 | 126, length, mask_key) + masked
+        return _st_BBQ4s.pack(fb, 0x80 | 127, length, mask_key) + masked
 
     async def _read_frame(self) -> Tuple[int, bytes]:
         hdr = await self.reader.readexactly(2)
         opcode = hdr[0] & 0x0F
-        is_masked = bool(hdr[1] & 0x80)
         length = hdr[1] & 0x7F
 
         if length == 126:
-            length = struct.unpack('>H',
-                                   await self.reader.readexactly(2))[0]
+            length = _st_H.unpack(
+                await self.reader.readexactly(2))[0]
         elif length == 127:
-            length = struct.unpack('>Q',
-                                   await self.reader.readexactly(8))[0]
+            length = _st_Q.unpack(
+                await self.reader.readexactly(8))[0]
 
-        if is_masked:
+        if hdr[1] & 0x80:
             mask_key = await self.reader.readexactly(4)
             payload = await self.reader.readexactly(length)
             return opcode, _xor_mask(payload, mask_key)
@@ -346,7 +377,7 @@ def _human_bytes(n: int) -> str:
 
 def _is_telegram_ip(ip: str) -> bool:
     try:
-        n = struct.unpack('!I', _socket.inet_aton(ip))[0]
+        n = _st_I_net.unpack(_socket.inet_aton(ip))[0]
         return any(lo <= n <= hi for lo, hi in _TG_RANGES)
     except OSError:
         return False
@@ -357,30 +388,31 @@ def _is_http_transport(data: bytes) -> bool:
             data[:5] == b'HEAD ' or data[:8] == b'OPTIONS ')
 
 
-def _dc_from_init(data: bytes) -> Tuple[Optional[int], bool]:
-    """
-    Extract DC ID from the 64-byte MTProto obfuscation init packet.
-    Returns (dc_id, is_media).
-    """
+def _dc_from_init(data: bytes):
     try:
-        key = bytes(data[8:40])
-        iv = bytes(data[40:56])
-        cipher = Cipher(algorithms.AES(key), modes.CTR(iv))
+        cipher = Cipher(algorithms.AES(data[8:40]), modes.CTR(data[40:56]))
         encryptor = cipher.encryptor()
-        keystream = encryptor.update(b'\x00' * 64) + encryptor.finalize()
-        plain = bytes(a ^ b for a, b in zip(data[56:64], keystream[56:64]))
-        proto = struct.unpack('<I', plain[0:4])[0]
-        dc_raw = struct.unpack('<h', plain[4:6])[0]
+        keystream = encryptor.update(_ZERO_64)
+        plain = (int.from_bytes(data[56:64], 'big') ^
+                 int.from_bytes(keystream[56:64], 'big')).to_bytes(8, 'big')
+        
+        proto, dc_raw = _st_Ih.unpack(plain[:6])
+        
         log.debug("dc_from_init: proto=0x%08X dc_raw=%d plain=%s",
                   proto, dc_raw, plain.hex())
-        if proto in (0xEFEFEFEF, 0xEEEEEEEE, 0xDDDDDDDD):
+        
+        if proto in _VALID_PROTOS:
             dc = abs(dc_raw)
-            if 1 <= dc <= 5:
-                return dc, (dc_raw < 0)
+            if 1 <= dc <= 5 or dc == 203:
+                return dc, (dc_raw < 0), proto
+            # IMPORTANT: If the protocol is valid, but dc_id is invalid (Android),
+            # we must return the proto so that the Splitter knows the protocol type
+            # and can split packets correctly, even if DC extraction failed.
+            return None, False, proto
     except Exception as exc:
         log.debug("DC extraction failed: %s", exc)
-    return None, False
         
+    return None, False, None
 
 def _patch_init_dc(data: bytes, dc: int) -> bytes:
     """
@@ -394,11 +426,9 @@ def _patch_init_dc(data: bytes, dc: int) -> bytes:
 
     new_dc = struct.pack('<h', dc)
     try:
-        key_raw = bytes(data[8:40])
-        iv = bytes(data[40:56])
-        cipher = Cipher(algorithms.AES(key_raw), modes.CTR(iv))
+        cipher = Cipher(algorithms.AES(data[8:40]), modes.CTR(data[40:56]))
         enc = cipher.encryptor()
-        ks = enc.update(b'\x00' * 64) + enc.finalize()
+        ks = enc.update(_ZERO_64)
         patched = bytearray(data[:64])
         patched[60] = ks[60] ^ new_dc[0]
         patched[61] = ks[61] ^ new_dc[1]
@@ -412,56 +442,104 @@ def _patch_init_dc(data: bytes, dc: int) -> bytes:
 
 class _MsgSplitter:
     """
-    Splits client TCP data into individual MTProto abridged-protocol
-    messages so each can be sent as a separate WebSocket frame.
+    Splits client TCP data into individual MTProto transport packets so
+    each can be sent as a separate WebSocket frame.
 
-    The Telegram WS relay processes one MTProto message per WS frame.
-    Mobile clients batches multiple messages in a single TCP write (e.g.
-    msgs_ack + req_DH_params).  If sent as one WS frame, the relay
-    only processes the first message — DH handshake never completes.
+    Some mobile clients coalesce multiple MTProto packets into one TCP
+    write, and TCP reads may also cut a packet in half.  Keep a rolling
+    buffer so incomplete packets are not forwarded as standalone frames.
     """
 
-    def __init__(self, init_data: bytes):
-        key_raw = bytes(init_data[8:40])
-        iv = bytes(init_data[40:56])
-        cipher = Cipher(algorithms.AES(key_raw), modes.CTR(iv))
+    __slots__ = ('_dec', '_proto', '_cipher_buf', '_plain_buf', '_disabled')
+
+    def __init__(self, init_data: bytes, proto: int):
+        cipher = Cipher(algorithms.AES(init_data[8:40]),
+                        modes.CTR(init_data[40:56]))
         self._dec = cipher.encryptor()
-        self._dec.update(b'\x00' * 64)  # skip init packet
+        self._dec.update(_ZERO_64)  # skip init packet
+        self._proto = proto
+        self._cipher_buf = bytearray()
+        self._plain_buf = bytearray()
+        self._disabled = False
 
     def split(self, chunk: bytes) -> List[bytes]:
-        """Decrypt to find message boundaries, return split ciphertext."""
-        plain = self._dec.update(chunk)
-        boundaries = []
-        pos = 0
-        while pos < len(plain):
-            first = plain[pos]
-            if first == 0x7f:
-                if pos + 4 > len(plain):
-                    break
-                msg_len = (
-                    struct.unpack_from('<I', plain, pos + 1)[0] & 0xFFFFFF
-                ) * 4
-                pos += 4
-            else:
-                msg_len = first * 4
-                pos += 1
-            if msg_len == 0 or pos + msg_len > len(plain):
-                break
-            pos += msg_len
-            boundaries.append(pos)
-        if len(boundaries) <= 1:
+        """Decrypt to find packet boundaries, return complete ciphertext packets."""
+        if not chunk:
+            return []
+        if self._disabled:
             return [chunk]
+
+        self._cipher_buf.extend(chunk)
+        self._plain_buf.extend(self._dec.update(chunk))
+
         parts = []
-        prev = 0
-        for b in boundaries:
-            parts.append(chunk[prev:b])
-            prev = b
-        if prev < len(chunk):
-            parts.append(chunk[prev:])
+        while self._cipher_buf:
+            packet_len = self._next_packet_len()
+            if packet_len is None:
+                break
+            if packet_len <= 0:
+                parts.append(bytes(self._cipher_buf))
+                self._cipher_buf.clear()
+                self._plain_buf.clear()
+                self._disabled = True
+                break
+            parts.append(bytes(self._cipher_buf[:packet_len]))
+            del self._cipher_buf[:packet_len]
+            del self._plain_buf[:packet_len]
         return parts
 
+    def flush(self) -> List[bytes]:
+        if not self._cipher_buf:
+            return []
+        tail = bytes(self._cipher_buf)
+        self._cipher_buf.clear()
+        self._plain_buf.clear()
+        return [tail]
+
+    def _next_packet_len(self) -> Optional[int]:
+        if not self._plain_buf:
+            return None
+        if self._proto == _PROTO_ABRIDGED:
+            return self._next_abridged_len()
+        if self._proto in (_PROTO_INTERMEDIATE, _PROTO_PADDED_INTERMEDIATE):
+            return self._next_intermediate_len()
+        return 0
+
+    def _next_abridged_len(self) -> Optional[int]:
+        first = self._plain_buf[0]
+        if first in (0x7F, 0xFF):
+            if len(self._plain_buf) < 4:
+                return None
+            payload_len = int.from_bytes(self._plain_buf[1:4], 'little') * 4
+            header_len = 4
+        else:
+            payload_len = (first & 0x7F) * 4
+            header_len = 1
+
+        if payload_len <= 0:
+            return 0
+
+        packet_len = header_len + payload_len
+        if len(self._plain_buf) < packet_len:
+            return None
+        return packet_len
+
+    def _next_intermediate_len(self) -> Optional[int]:
+        if len(self._plain_buf) < 4:
+            return None
+
+        payload_len = _st_I_le.unpack_from(self._plain_buf, 0)[0] & 0x7FFFFFFF
+        if payload_len <= 0:
+            return 0
+
+        packet_len = 4 + payload_len
+        if len(self._plain_buf) < packet_len:
+            return None
+        return packet_len
+
 
 def _ws_domains(dc: int, is_media) -> List[str]:
+    dc = _DC_OVERRIDES.get(dc, dc)
     if is_media is None or is_media:
         return [f'kws{dc}-1.web.telegram.org', f'kws{dc}.web.telegram.org']
     return [f'kws{dc}.web.telegram.org', f'kws{dc}-1.web.telegram.org']
@@ -607,12 +685,19 @@ async def _bridge_ws(reader, writer, ws: RawWebSocket, label,
             while True:
                 chunk = await reader.read(65536)
                 if not chunk:
+                    if splitter:
+                        tail = splitter.flush()
+                        if tail:
+                            await ws.send(tail[0])
                     break
-                _stats.bytes_up += len(chunk)
-                up_bytes += len(chunk)
+                n = len(chunk)
+                _stats.bytes_up += n
+                up_bytes += n
                 up_packets += 1
                 if splitter:
                     parts = splitter.split(chunk)
+                    if not parts:
+                        continue
                     if len(parts) > 1:
                         await ws.send_batch(parts)
                     else:
@@ -631,14 +716,12 @@ async def _bridge_ws(reader, writer, ws: RawWebSocket, label,
                 data = await ws.recv()
                 if data is None:
                     break
-                _stats.bytes_down += len(data)
-                down_bytes += len(data)
+                n = len(data)
+                _stats.bytes_down += n
+                down_bytes += n
                 down_packets += 1
                 writer.write(data)
-                # drain only when kernel buffer is filling up
-                buf = writer.transport.get_write_buffer_size()
-                if buf > _SEND_BUF:
-                    await writer.drain()
+                await writer.drain()
         except (asyncio.CancelledError, ConnectionError, OSError):
             return
         except Exception as e:
@@ -678,26 +761,27 @@ async def _bridge_tcp(reader, writer, remote_reader, remote_writer,
                       label, dc=None, dst=None, port=None,
                       is_media=False):
     """Bidirectional TCP <-> TCP forwarding (for fallback)."""
-    async def forward(src, dst_w, tag):
+    async def forward(src, dst_w, is_up):
         try:
             while True:
                 data = await src.read(65536)
                 if not data:
                     break
-                if 'up' in tag:
-                    _stats.bytes_up += len(data)
+                n = len(data)
+                if is_up:
+                    _stats.bytes_up += n
                 else:
-                    _stats.bytes_down += len(data)
+                    _stats.bytes_down += n
                 dst_w.write(data)
                 await dst_w.drain()
         except asyncio.CancelledError:
             pass
         except Exception as e:
-            log.debug("[%s] %s ended: %s", label, tag, e)
+            log.debug("[%s] forward ended: %s", label, e)
 
     tasks = [
-        asyncio.create_task(forward(reader, remote_writer, 'up')),
-        asyncio.create_task(forward(remote_reader, writer, 'down')),
+        asyncio.create_task(forward(reader, remote_writer, True)),
+        asyncio.create_task(forward(remote_reader, writer, False)),
     ]
     try:
         await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
@@ -738,8 +822,12 @@ async def _pipe(r, w):
             pass
 
 
+_SOCKS5_REPLIES = {s: bytes([0x05, s, 0x00, 0x01, 0, 0, 0, 0, 0, 0])
+                   for s in (0x00, 0x05, 0x07, 0x08)}
+
+
 def _socks5_reply(status):
-    return bytes([0x05, status, 0x00, 0x01]) + b'\x00' * 6
+    return _SOCKS5_REPLIES[status]
 
 
 async def _tcp_fallback(reader, writer, dst, port, init, label,
@@ -807,7 +895,7 @@ async def _handle_client(reader, writer):
             writer.close()
             return
 
-        port = struct.unpack('!H', await reader.readexactly(2))[0]
+        port = _st_H.unpack(await reader.readexactly(2))[0]
 
         if ':' in dst:
             log.error(
@@ -870,14 +958,14 @@ async def _handle_client(reader, writer):
             return
 
         # -- Extract DC ID --
-        dc, is_media = _dc_from_init(init)
-        init_patched = False
+        dc, is_media, proto = _dc_from_init(init)
         
+        init_patched = False
         # Android (may be ios too) with useSecret=0 has random dc_id bytes — patch it
         if dc is None and dst in _IP_TO_DC:
             dc, is_media = _IP_TO_DC.get(dst)
             if dc in _dc_opt:
-                init = _patch_init_dc(init, dc if is_media else -dc)
+                init = _patch_init_dc(init, -dc if is_media else dc)
                 init_patched = True
 
         if dc is None or dc not in _dc_opt:
@@ -902,20 +990,10 @@ async def _handle_client(reader, writer):
                          label, dc, media_tag)
             return
 
-        # -- Cooldown check --
-        fail_until = _dc_fail_until.get(dc_key, 0)
-        if now < fail_until:
-            remaining = fail_until - now
-            log.debug("[%s] DC%d%s WS cooldown (%.0fs) -> TCP",
-                      label, dc, media_tag, remaining)
-            ok = await _tcp_fallback(reader, writer, dst, port, init,
-                                     label, dc=dc, is_media=is_media)
-            if ok:
-                log.info("[%s] DC%d%s TCP fallback closed",
-                         label, dc, media_tag)
-            return
-
         # -- Try WebSocket via direct connection --
+        fail_until = _dc_fail_until.get(dc_key, 0)
+        ws_timeout = _WS_FAIL_TIMEOUT if now < fail_until else 10.0
+
         domains = _ws_domains(dc, is_media)
         target = _dc_opt[dc]
         ws = None
@@ -933,7 +1011,7 @@ async def _handle_client(reader, writer):
                          label, dc, media_tag, dst, port, url, target)
                 try:
                     ws = await RawWebSocket.connect(target, domain,
-                                                    timeout=10)
+                                                    timeout=ws_timeout)
                     all_redirects = False
                     break
                 except WsHandshakeError as exc:
@@ -989,9 +1067,12 @@ async def _handle_client(reader, writer):
         _stats.connections_ws += 1
 
         splitter = None
-        if init_patched:
+
+        # Turning splitter on for mobile clients or media-connections, so as the big files don't get fragmented by the TCP socket.
+        if proto is not None and (init_patched or is_media or proto != _PROTO_INTERMEDIATE):
             try:
-                splitter = _MsgSplitter(init)
+                splitter = _MsgSplitter(init, proto)
+                log.debug("[%s] MsgSplitter activated for proto 0x%08X", label, proto)
             except Exception:
                 pass
 
@@ -1011,6 +1092,11 @@ async def _handle_client(reader, writer):
         log.debug("[%s] cancelled", label)
     except ConnectionResetError:
         log.debug("[%s] connection reset", label)
+    except OSError as exc:
+        if getattr(exc, 'winerror', None) == 1236:
+            log.debug("[%s] connection aborted by local system", label)
+        else:
+            log.error("[%s] unexpected os error: %s", label, exc)
     except Exception as exc:
         log.error("[%s] unexpected: %s", label, exc)
     finally:
@@ -1118,24 +1204,56 @@ def main():
     ap.add_argument('--host', type=str, default='127.0.0.1',
                     help='Listen host (default 127.0.0.1)')
     ap.add_argument('--dc-ip', metavar='DC:IP', action='append',
-                    default=['2:149.154.167.220', '4:149.154.167.220'],
+                    default=[],
                     help='Target IP for a DC, e.g. --dc-ip 1:149.154.175.205'
                          ' --dc-ip 2:149.154.167.220')
     ap.add_argument('-v', '--verbose', action='store_true',
                     help='Debug logging')
+    ap.add_argument('--log-file', type=str, default=None, metavar='PATH',
+                    help='Log to file with rotation (default: stderr only)')
+    ap.add_argument('--log-max-mb', type=float, default=5, metavar='MB',
+                    help='Max log file size in MB before rotation (default 5)')
+    ap.add_argument('--log-backups', type=int, default=0, metavar='N',
+                    help='Number of rotated log files to keep (default 0)')
+    ap.add_argument('--buf-kb', type=int, default=256, metavar='KB',
+                    help='Socket send/recv buffer size in KB (default 256)')
+    ap.add_argument('--pool-size', type=int, default=4, metavar='N',
+                    help='WS connection pool size per DC (default 4, min 0)')
     args = ap.parse_args()
 
+    if not args.dc_ip:
+        args.dc_ip = ['2:149.154.167.220', '4:149.154.167.220']
+
     try:
         dc_opt = parse_dc_ip_list(args.dc_ip)
     except ValueError as e:
         log.error(str(e))
         sys.exit(1)
 
-    logging.basicConfig(
-        level=logging.DEBUG if args.verbose else logging.INFO,
-        format='%(asctime)s  %(levelname)-5s  %(message)s',
-        datefmt='%H:%M:%S',
-    )
+    log_level = logging.DEBUG if args.verbose else logging.INFO
+    log_fmt = logging.Formatter('%(asctime)s  %(levelname)-5s  %(message)s',
+                                datefmt='%H:%M:%S')
+    root = logging.getLogger()
+    root.setLevel(log_level)
+
+    console = logging.StreamHandler()
+    console.setFormatter(log_fmt)
+    root.addHandler(console)
+
+    if args.log_file:
+        fh = logging.handlers.RotatingFileHandler(
+            args.log_file,
+            maxBytes=max(32 * 1024, args.log_max_mb * 1024 * 1024),
+            backupCount=max(0, args.log_backups),
+            encoding='utf-8',
+        )
+        fh.setFormatter(log_fmt)
+        root.addHandler(fh)
+
+    global _RECV_BUF, _SEND_BUF, _WS_POOL_SIZE
+    _RECV_BUF = max(4, args.buf_kb) * 1024
+    _SEND_BUF = _RECV_BUF
+    _WS_POOL_SIZE = max(0, args.pool_size)
 
     try:
         asyncio.run(_run(args.port, dc_opt, host=args.host))

pyproject.toml

@@ -0,0 +1,73 @@
+[build-system]
+requires = ["hatchling>=1.25.0"]
+build-backend = "hatchling.build"
+
+[project]
+name = "tg-ws-proxy"
+dynamic=["version"]
+
+description = "Telegram Desktop WebSocket Bridge Proxy"
+readme = "README.md"
+requires-python = ">=3.8"
+
+license = { name = "MIT", file = "LICENSE" }
+
+authors = [
+    { name = "Flowseal" }
+]
+
+keywords = [
+    "telegram",
+    "tdesktop",
+    "proxy",
+    "bypass",
+    "websocket",
+    "socks5",
+]
+classifiers = [
+  "Development Status :: 5 - Production/Stable",
+  "Environment :: Console",
+  "Intended Audience :: Customer Service",
+  "Programming Language :: Python :: 3",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Topic :: System :: Networking :: Firewalls",
+]
+
+dependencies = [
+    "pyperclip==1.9.0",
+
+    "psutil==5.9.8; platform_system == 'Windows' and python_version < '3.9'",
+    "cryptography==41.0.7; platform_system == 'Windows' and python_version < '3.9'",
+    "Pillow==10.4.0; platform_system == 'Windows' and python_version < '3.9'",
+
+    "psutil==7.0.0; platform_system != 'Windows' or python_version >= '3.9'",
+    "cryptography==46.0.5; platform_system != 'Windows' or python_version >= '3.9'",
+    "Pillow==12.1.1; (platform_system != 'Windows' or python_version >= '3.9') and platform_system != 'Darwin'",
+
+    "customtkinter==5.2.2; platform_system != 'Darwin'",
+    "pystray==0.19.5; platform_system != 'Darwin'",
+    "rumps==0.4.0; platform_system == 'Darwin'",
+    "Pillow==12.1.0; platform_system == 'Darwin'",
+]
+
+[project.scripts]
+tg-ws-proxy = "proxy.tg_ws_proxy:main"
+tg-ws-proxy-tray-win = "windows:main"
+tg-ws-proxy-tray-macos = "macos:main"
+tg-ws-proxy-tray-linux = "linux:main"
+
+[project.urls]
+Source = "https://github.com/Flowseal/tg-ws-proxy"
+Issues = "https://github.com/Flowseal/tg-ws-proxy/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["proxy", "ui", "utils"]
+
+[tool.hatch.build.force-include]
+"windows.py" = "windows.py"
+"macos.py" = "macos.py"
+"linux.py" = "linux.py"
+
+[tool.hatch.version]
+path = "proxy/__init__.py"

requirements-win7.txt

@@ -1,6 +0,0 @@
-cryptography==41.0.7
-customtkinter==5.2.2
-Pillow==10.4.0
-psutil==5.9.8
-pystray==0.19.5
-pyperclip==1.9.0

requirements.txt

@@ -1,6 +0,0 @@
-cryptography==46.0.5
-customtkinter==5.2.2
-Pillow==12.1.1
-psutil==7.0.0
-pystray==0.19.5
-pyperclip==1.9.0

ui/__init__.py

@@ -0,0 +1,4 @@
+"""
+Интерфейс tray (CustomTkinter): тема, диалоги настроек, подсказки.
+Ядро прокси — пакет `proxy`.
+"""

ui/ctk_theme.py

@@ -0,0 +1,112 @@
+"""
+Общая светлая тема и фабрика окон CustomTkinter для tray-приложений (Windows / Linux).
+Цвета и отступы задаются в одном месте — правки темы не дублируются по платформам.
+"""
+
+from __future__ import annotations
+
+import sys
+import tkinter
+from dataclasses import dataclass
+from typing import Any, Callable, Optional, Tuple
+
+_tk_variable_del_guard_installed = False
+
+
+def _install_tkinter_variable_del_guard() -> None:
+    """
+    Убирает «Exception ignored» при выходе процесса: Tcl уже разрушен, а GC ещё
+    вызывает Variable.__del__ (StringVar и т.д.) — напр. окно CTk в фоновом потоке.
+    """
+    global _tk_variable_del_guard_installed
+    if _tk_variable_del_guard_installed:
+        return
+    _orig = tkinter.Variable.__del__
+
+    def _safe_variable_del(self: Any, _orig: Any = _orig) -> None:
+        try:
+            _orig(self)
+        except (RuntimeError, tkinter.TclError):
+            pass
+
+    tkinter.Variable.__del__ = _safe_variable_del  # type: ignore[assignment]
+    _tk_variable_del_guard_installed = True
+
+# Размеры и отступы (единые для диалогов настроек и первого запуска)
+CONFIG_DIALOG_SIZE: Tuple[int, int] = (460, 560)
+CONFIG_DIALOG_FRAME_PAD: Tuple[int, int] = (20, 14)
+FIRST_RUN_SIZE: Tuple[int, int] = (520, 440)
+FIRST_RUN_FRAME_PAD: Tuple[int, int] = (28, 24)
+
+
+@dataclass(frozen=True)
+class CtkTheme:
+    """Палитра Telegram-style и семейства шрифтов для UI и моноширинного текста."""
+
+    tg_blue: str = "#3390ec"
+    tg_blue_hover: str = "#2b7cd4"
+    bg: str = "#ffffff"
+    field_bg: str = "#f0f2f5"
+    field_border: str = "#d6d9dc"
+    text_primary: str = "#000000"
+    text_secondary: str = "#707579"
+    ui_font_family: str = "Sans"
+    mono_font_family: str = "Monospace"
+
+
+def ctk_theme_for_platform() -> CtkTheme:
+    if sys.platform == "win32":
+        return CtkTheme(ui_font_family="Segoe UI", mono_font_family="Consolas")
+    return CtkTheme()
+
+
+def apply_ctk_appearance(ctk: Any) -> None:
+    ctk.set_appearance_mode("light")
+    ctk.set_default_color_theme("blue")
+
+
+def center_ctk_geometry(root: Any, width: int, height: int) -> None:
+    sw = root.winfo_screenwidth()
+    sh = root.winfo_screenheight()
+    root.geometry(f"{width}x{height}+{(sw - width) // 2}+{(sh - height) // 2}")
+
+
+def create_ctk_root(
+    ctk: Any,
+    *,
+    title: str,
+    width: int,
+    height: int,
+    theme: CtkTheme,
+    topmost: bool = True,
+    after_create: Optional[Callable[[Any], None]] = None,
+) -> Any:
+    """
+    Создаёт CTk: глобальная тема, заголовок, без ресайза, по центру экрана, фон из палитры.
+    after_create — опционально: установка иконки окна (различается по ОС).
+    """
+    _install_tkinter_variable_del_guard()
+    apply_ctk_appearance(ctk)
+    root = ctk.CTk()
+    root.title(title)
+    root.resizable(False, False)
+    if topmost:
+        root.attributes("-topmost", True)
+    center_ctk_geometry(root, width, height)
+    root.configure(fg_color=theme.bg)
+    if after_create:
+        after_create(root)
+    return root
+
+
+def main_content_frame(
+    ctk: Any,
+    root: Any,
+    theme: CtkTheme,
+    *,
+    padx: int,
+    pady: int,
+) -> Any:
+    frame = ctk.CTkFrame(root, fg_color=theme.bg, corner_radius=0)
+    frame.pack(fill="both", expand=True, padx=padx, pady=pady)
+    return frame

ui/ctk_tooltip.py

@@ -0,0 +1,114 @@
+"""
+Всплывающие подсказки для CustomTkinter / tk: задержка, Toplevel без рамки, wrap.
+"""
+
+from __future__ import annotations
+
+import tkinter as tk
+from typing import Any, List, Optional
+
+
+class CtkTooltip:
+    """Показ текста при наведении на виджет."""
+
+    def __init__(
+        self,
+        widget: Any,
+        text: str,
+        *,
+        delay_ms: int = 450,
+        wraplength: int = 320,
+    ) -> None:
+        self.widget = widget
+        self.text = text
+        self.delay_ms = delay_ms
+        self.wraplength = wraplength
+        self._after_id: Optional[str] = None
+        self._tip: Optional[tk.Toplevel] = None
+        widget.bind("<Enter>", self._schedule, add="+")
+        widget.bind("<Leave>", self._hide, add="+")
+        widget.bind("<Button>", self._hide, add="+")
+        widget.bind("<Destroy>", self._on_destroy, add="+")
+
+    def _schedule(self, _event: Any = None) -> None:
+        self._cancel_after()
+        self._after_id = self.widget.after(self.delay_ms, self._show)
+
+    def _cancel_after(self) -> None:
+        if self._after_id is not None:
+            try:
+                self.widget.after_cancel(self._after_id)
+            except Exception:
+                pass
+            self._after_id = None
+
+    def _show(self) -> None:
+        self._after_id = None
+        if self._tip is not None:
+            return
+        try:
+            if not self.widget.winfo_exists():
+                return
+        except Exception:
+            return
+
+        tw = tk.Toplevel(self.widget.winfo_toplevel())
+        tw.wm_overrideredirect(True)
+        try:
+            tw.wm_attributes("-topmost", True)
+        except Exception:
+            pass
+        tw.configure(bg="#2b2b2b")
+        lbl = tk.Label(
+            tw,
+            text=self.text,
+            justify="left",
+            wraplength=self.wraplength,
+            background="#2b2b2b",
+            foreground="#f0f0f0",
+            relief="flat",
+            borderwidth=0,
+            padx=10,
+            pady=8,
+            font=("Segoe UI", 10) if _is_windows() else None,
+        )
+        lbl.pack()
+        x = self.widget.winfo_rootx() + 12
+        y = self.widget.winfo_rooty() + self.widget.winfo_height() + 4
+        tw.wm_geometry(f"+{x}+{y}")
+        self._tip = tw
+
+    def _hide(self, _event: Any = None) -> None:
+        self._cancel_after()
+        if self._tip is not None:
+            try:
+                self._tip.destroy()
+            except Exception:
+                pass
+            self._tip = None
+
+    def _on_destroy(self, _event: Any = None) -> None:
+        self._hide()
+
+
+def _is_windows() -> bool:
+    import sys
+
+    return sys.platform == "win32"
+
+
+def attach_ctk_tooltip(
+    widget: Any,
+    text: str,
+    *,
+    delay_ms: int = 450,
+    wraplength: int = 320,
+) -> None:
+    """Повесить подсказку на виджет (CTk или tk)."""
+    CtkTooltip(widget, text, delay_ms=delay_ms, wraplength=wraplength)
+
+
+def attach_tooltip_to_widgets(widgets: List[Any], text: str, **kwargs: Any) -> None:
+    """Одна и та же подсказка на несколько виджетов (подпись + поле)."""
+    for w in widgets:
+        attach_ctk_tooltip(w, text, **kwargs)

ui/ctk_tray_ui.py

@@ -0,0 +1,579 @@
+"""
+Общая разметка CustomTkinter для tray (Windows / Linux): настройки и первый запуск.
+Логика сохранения и колбэки остаются в платформенных модулях.
+"""
+
+from __future__ import annotations
+
+import webbrowser
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, List, Optional, Tuple, Union
+
+import proxy.tg_ws_proxy as tg_ws_proxy
+from proxy import __version__
+from utils.update_check import RELEASES_PAGE_URL, get_status
+
+from ui.ctk_theme import (
+    FIRST_RUN_FRAME_PAD,
+    CtkTheme,
+    main_content_frame,
+)
+from ui.ctk_tooltip import attach_ctk_tooltip, attach_tooltip_to_widgets
+
+# Подсказки для формы настроек (новые пользователи)
+_TIP_HOST = (
+    "Адрес, на котором прокси принимает SOCKS5-подключения.\n"
+    "Обычно 127.0.0.1 — локальная сеть, 0.0.0.0 - все интерфейсы"
+)
+_TIP_PORT = (
+    "Порт SOCKS5. В Telegram Desktop в настройках прокси должен быть "
+    "указан тот же порт"
+)
+_TIP_DC = (
+    "Соответствие номера датацентра Telegram (DC) и IP-адреса сервера.\n"
+    "Каждая строка: «номер:IP», например 2:149.154.167.220. "
+    "Прокси по этим правилам направляет трафик к нужным серверам Telegram"
+)
+_TIP_VERBOSE = (
+    "Если включено, в файл логов пишется больше подробностей — "
+    "необходимо при поиске неполадок"
+)
+_TIP_BUF_KB = (
+    "Размер буфера приёма/передачи в килобайтах.\n"
+    "Больше значение — больше выделение памяти на сокет"
+)
+_TIP_POOL = (
+    "Сколько параллельных WebSocket-сессий к одному датацентру можно держать.\n"
+    "Увеличение может помочь при высокой нагрузке"
+)
+_TIP_LOG_MB = (
+    "Максимальный размер файла лога; при достижении лимита файл перезаписывается"
+)
+_TIP_AUTOSTART = (
+    "Запускать TG WS Proxy при входе в Windows. "
+    "Если вы переместите программу в другую папку, автозапуска сбросится"
+)
+_TIP_CHECK_UPDATES = (
+    "При запуске проверять наличие обновлений"
+)
+_TIP_SAVE = "Сохранить настройки"
+_TIP_CANCEL = "Закрыть окно без сохранения изменений"
+
+# Внутренняя ширина полей относительно ширины окна настроек (см. CONFIG_DIALOG_SIZE)
+_CONFIG_FORM_INNER_WIDTH = 396
+
+
+def tray_settings_scroll_and_footer(
+    ctk: Any,
+    content_parent: Any,
+    theme: CtkTheme,
+) -> Tuple[Any, Any]:
+    """
+    Нижняя панель под кнопки и прокручиваемая область для формы (форма не обрезает кнопки).
+    Возвращает (scroll_frame, footer_frame).
+    """
+    footer = ctk.CTkFrame(content_parent, fg_color=theme.bg)
+    footer.pack(side="bottom", fill="x")
+    scroll = ctk.CTkScrollableFrame(
+        content_parent,
+        fg_color=theme.bg,
+        corner_radius=0,
+        scrollbar_button_color=theme.field_border,
+        scrollbar_button_hover_color=theme.text_secondary,
+    )
+    scroll.pack(fill="both", expand=True)
+    return scroll, footer
+
+
+def _config_section(
+    ctk: Any,
+    parent: Any,
+    theme: CtkTheme,
+    title: str,
+    *,
+    bottom_spacer: int = 6,
+) -> Any:
+    """Заголовок секции и карточка с рамкой для группировки полей."""
+    wrap = ctk.CTkFrame(parent, fg_color="transparent")
+    wrap.pack(fill="x", pady=(0, bottom_spacer))
+    ctk.CTkLabel(
+        wrap,
+        text=title,
+        font=(theme.ui_font_family, 12, "bold"),
+        text_color=theme.text_primary,
+        anchor="w",
+    ).pack(anchor="w", pady=(0, 2))
+    card = ctk.CTkFrame(
+        wrap,
+        fg_color=theme.field_bg,
+        corner_radius=10,
+        border_width=1,
+        border_color=theme.field_border,
+    )
+    card.pack(fill="x")
+    inner = ctk.CTkFrame(card, fg_color="transparent")
+    inner.pack(fill="x", padx=10, pady=8)
+    return inner
+
+
+@dataclass
+class TrayConfigFormWidgets:
+    host_var: Any
+    port_var: Any
+    dc_textbox: Any
+    verbose_var: Any
+    adv_entries: List[Any]
+    adv_keys: Tuple[str, ...]
+    autostart_var: Optional[Any]
+    check_updates_var: Optional[Any]
+
+
+def install_tray_config_form(
+    ctk: Any,
+    frame: Any,
+    theme: CtkTheme,
+    cfg: dict,
+    default_config: dict,
+    *,
+    show_autostart: bool = False,
+    autostart_value: bool = False,
+) -> TrayConfigFormWidgets:
+    """Поля настроек прокси внутри уже созданного `frame`."""
+    header = ctk.CTkFrame(frame, fg_color="transparent")
+    header.pack(fill="x", pady=(0, 2))
+    ctk.CTkLabel(
+        header,
+        text="Настройки прокси",
+        font=(theme.ui_font_family, 17, "bold"),
+        text_color=theme.text_primary,
+        anchor="w",
+    ).pack(side="left")
+    ctk.CTkLabel(
+        header,
+        text=f"v{__version__}",
+        font=(theme.ui_font_family, 12),
+        text_color=theme.text_secondary,
+        anchor="e",
+    ).pack(side="right")
+
+    inner_w = _CONFIG_FORM_INNER_WIDTH
+
+    conn = _config_section(ctk, frame, theme, "Подключение SOCKS5")
+
+    host_row = ctk.CTkFrame(conn, fg_color="transparent")
+    host_row.pack(fill="x")
+
+    host_col = ctk.CTkFrame(host_row, fg_color="transparent")
+    host_col.pack(side="left", fill="x", expand=True, padx=(0, 10))
+    host_lbl = ctk.CTkLabel(
+        host_col,
+        text="IP-адрес",
+        font=(theme.ui_font_family, 12),
+        text_color=theme.text_secondary,
+        anchor="w",
+    )
+    host_lbl.pack(anchor="w", pady=(0, 2))
+    host_var = ctk.StringVar(value=cfg.get("host", default_config["host"]))
+    host_entry = ctk.CTkEntry(
+        host_col,
+        textvariable=host_var,
+        width=160,
+        height=36,
+        font=(theme.ui_font_family, 13),
+        corner_radius=10,
+        fg_color=theme.bg,
+        border_color=theme.field_border,
+        border_width=1,
+        text_color=theme.text_primary,
+    )
+    host_entry.pack(fill="x", pady=(0, 0))
+    attach_tooltip_to_widgets([host_lbl, host_entry, host_col], _TIP_HOST)
+
+    port_col = ctk.CTkFrame(host_row, fg_color="transparent")
+    port_col.pack(side="left")
+    port_lbl = ctk.CTkLabel(
+        port_col,
+        text="Порт",
+        font=(theme.ui_font_family, 12),
+        text_color=theme.text_secondary,
+        anchor="w",
+    )
+    port_lbl.pack(anchor="w", pady=(0, 2))
+    port_var = ctk.StringVar(value=str(cfg.get("port", default_config["port"])))
+    port_entry = ctk.CTkEntry(
+        port_col,
+        textvariable=port_var,
+        width=100,
+        height=36,
+        font=(theme.ui_font_family, 13),
+        corner_radius=10,
+        fg_color=theme.bg,
+        border_color=theme.field_border,
+        border_width=1,
+        text_color=theme.text_primary,
+    )
+    port_entry.pack(anchor="w")
+    attach_tooltip_to_widgets([port_lbl, port_entry, port_col], _TIP_PORT)
+
+    dc_inner = _config_section(ctk, frame, theme, "Датацентры Telegram (DC → IP)")
+    dc_lbl = ctk.CTkLabel(
+        dc_inner,
+        text="По одному правилу на строку, формат: номер:IP",
+        font=(theme.ui_font_family, 11),
+        text_color=theme.text_secondary,
+        anchor="w",
+    )
+    dc_lbl.pack(anchor="w", pady=(0, 4))
+    dc_textbox = ctk.CTkTextbox(
+        dc_inner,
+        width=inner_w,
+        height=88,
+        font=(theme.mono_font_family, 12),
+        corner_radius=10,
+        fg_color=theme.bg,
+        border_color=theme.field_border,
+        border_width=1,
+        text_color=theme.text_primary,
+    )
+    dc_textbox.pack(fill="x")
+    dc_textbox.insert("1.0", "\n".join(cfg.get("dc_ip", default_config["dc_ip"])))
+    attach_tooltip_to_widgets([dc_lbl, dc_textbox], _TIP_DC)
+
+    log_inner = _config_section(ctk, frame, theme, "Логи и производительность")
+
+    verbose_var = ctk.BooleanVar(value=cfg.get("verbose", False))
+    verbose_cb = ctk.CTkCheckBox(
+        log_inner,
+        text="Подробное логирование (verbose)",
+        variable=verbose_var,
+        font=(theme.ui_font_family, 13),
+        text_color=theme.text_primary,
+        fg_color=theme.tg_blue,
+        hover_color=theme.tg_blue_hover,
+        corner_radius=6,
+        border_width=2,
+        border_color=theme.field_border,
+    )
+    verbose_cb.pack(anchor="w", pady=(0, 6))
+    attach_ctk_tooltip(verbose_cb, _TIP_VERBOSE)
+
+    adv_frame = ctk.CTkFrame(log_inner, fg_color="transparent")
+    adv_frame.pack(fill="x")
+
+    adv_rows = [
+        ("Буфер, КБ (по умолчанию 256)", "buf_kb", _TIP_BUF_KB),
+        ("Пул WebSocket-сессий (по умолчанию 4)", "pool_size", _TIP_POOL),
+        ("Макс. размер лога, МБ (по умолчанию 5)", "log_max_mb", _TIP_LOG_MB),
+    ]
+    for lbl, key, tip in adv_rows:
+        col_frame = ctk.CTkFrame(adv_frame, fg_color="transparent")
+        col_frame.pack(fill="x", pady=(0, 0 if key == "log_max_mb" else 5))
+        adv_l = ctk.CTkLabel(
+            col_frame,
+            text=lbl,
+            font=(theme.ui_font_family, 11),
+            text_color=theme.text_secondary,
+            anchor="w",
+        )
+        adv_l.pack(anchor="w", pady=(0, 2))
+        adv_e = ctk.CTkEntry(
+            col_frame,
+            width=inner_w,
+            height=32,
+            font=(theme.ui_font_family, 13),
+            corner_radius=8,
+            fg_color=theme.bg,
+            border_color=theme.field_border,
+            border_width=1,
+            text_color=theme.text_primary,
+            textvariable=ctk.StringVar(
+                value=str(cfg.get(key, default_config[key]))
+            ),
+        )
+        adv_e.pack(fill="x")
+        attach_tooltip_to_widgets([adv_l, adv_e, col_frame], tip)
+
+    adv_entries = list(adv_frame.winfo_children())
+    adv_keys = ("buf_kb", "pool_size", "log_max_mb")
+
+    upd_inner = _config_section(ctk, frame, theme, "Обновления")
+    st = get_status()
+    check_updates_var = ctk.BooleanVar(
+        value=bool(
+            cfg.get("check_updates", default_config.get("check_updates", True))
+        )
+    )
+    upd_cb = ctk.CTkCheckBox(
+        upd_inner,
+        text="Проверять обновления при запуске",
+        variable=check_updates_var,
+        font=(theme.ui_font_family, 13),
+        text_color=theme.text_primary,
+        fg_color=theme.tg_blue,
+        hover_color=theme.tg_blue_hover,
+        corner_radius=6,
+        border_width=2,
+        border_color=theme.field_border,
+    )
+    upd_cb.pack(anchor="w", pady=(0, 6))
+    attach_ctk_tooltip(upd_cb, _TIP_CHECK_UPDATES)
+
+    if st.get("error"):
+        upd_status = "Не удалось связаться с GitHub. Проверьте сеть."
+    elif not st.get("checked"):
+        upd_status = "Статус появится после фоновой проверки при запуске."
+    elif st.get("has_update") and st.get("latest"):
+        upd_status = (
+            f"На GitHub доступна версия {st['latest']} "
+            f"(у вас {__version__})."
+        )
+    elif st.get("ahead_of_release") and st.get("latest"):
+        upd_status = (
+            f"У вас {__version__} — новее последнего релиза на GitHub "
+            f"({st['latest']})."
+        )
+    else:
+        upd_status = "Установлена последняя известная версия с GitHub."
+
+    ctk.CTkLabel(
+        upd_inner,
+        text=upd_status,
+        font=(theme.ui_font_family, 11),
+        text_color=theme.text_secondary,
+        anchor="w",
+        justify="left",
+        wraplength=inner_w,
+    ).pack(anchor="w", pady=(0, 8))
+
+    rel_url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+    open_rel_btn = ctk.CTkButton(
+        upd_inner,
+        text="Открыть страницу релиза",
+        height=32,
+        font=(theme.ui_font_family, 13),
+        corner_radius=8,
+        fg_color=theme.field_bg,
+        hover_color=theme.field_border,
+        text_color=theme.text_primary,
+        border_width=1,
+        border_color=theme.field_border,
+        command=lambda u=rel_url: webbrowser.open(u),
+    )
+    open_rel_btn.pack(anchor="w")
+
+    autostart_var = None
+    if show_autostart:
+        sys_inner = _config_section(
+            ctk, frame, theme, "Запуск Windows", bottom_spacer=4
+        )
+        autostart_var = ctk.BooleanVar(value=autostart_value)
+        as_cb = ctk.CTkCheckBox(
+            sys_inner,
+            text="Автозапуск при включении компьютера",
+            variable=autostart_var,
+            font=(theme.ui_font_family, 13),
+            text_color=theme.text_primary,
+            fg_color=theme.tg_blue,
+            hover_color=theme.tg_blue_hover,
+            corner_radius=6,
+            border_width=2,
+            border_color=theme.field_border,
+        )
+        as_cb.pack(anchor="w", pady=(0, 4))
+        as_hint = ctk.CTkLabel(
+            sys_inner,
+            text="Если переместить программу в другую папку, запись автозапуска может сброситься.",
+            font=(theme.ui_font_family, 11),
+            text_color=theme.text_secondary,
+            anchor="w",
+            justify="left",
+            wraplength=inner_w,
+        )
+        as_hint.pack(anchor="w")
+        attach_tooltip_to_widgets([as_cb, as_hint], _TIP_AUTOSTART)
+
+    return TrayConfigFormWidgets(
+        host_var=host_var,
+        port_var=port_var,
+        dc_textbox=dc_textbox,
+        verbose_var=verbose_var,
+        adv_entries=adv_entries,
+        adv_keys=adv_keys,
+        autostart_var=autostart_var,
+        check_updates_var=check_updates_var,
+    )
+
+
+def merge_adv_from_form(
+    widgets: TrayConfigFormWidgets,
+    base: Dict[str, Any],
+    default_config: dict,
+) -> None:
+    """Дополняет base значениями buf_kb / pool_size / log_max_mb (in-place)."""
+    for i, key in enumerate(widgets.adv_keys):
+        col_frame = widgets.adv_entries[i]
+        entry = col_frame.winfo_children()[1]
+        try:
+            val = float(entry.get().strip())
+            if key in ("buf_kb", "pool_size"):
+                val = int(val)
+            base[key] = val
+        except ValueError:
+            base[key] = default_config[key]
+
+
+def validate_config_form(
+    widgets: TrayConfigFormWidgets,
+    default_config: dict,
+    *,
+    include_autostart: bool,
+) -> Union[dict, str]:
+    """
+    Возвращает словарь полей конфига или строку ошибки для показа пользователю.
+    """
+    import socket as _sock
+
+    host_val = widgets.host_var.get().strip()
+    try:
+        _sock.inet_aton(host_val)
+    except OSError:
+        return "Некорректный IP-адрес."
+
+    try:
+        port_val = int(widgets.port_var.get().strip())
+        if not (1 <= port_val <= 65535):
+            raise ValueError
+    except ValueError:
+        return "Порт должен быть числом 1-65535"
+
+    lines = [
+        l.strip()
+        for l in widgets.dc_textbox.get("1.0", "end").strip().splitlines()
+        if l.strip()
+    ]
+    try:
+        tg_ws_proxy.parse_dc_ip_list(lines)
+    except ValueError as e:
+        return str(e)
+
+    new_cfg: Dict[str, Any] = {
+        "host": host_val,
+        "port": port_val,
+        "dc_ip": lines,
+        "verbose": widgets.verbose_var.get(),
+    }
+    if include_autostart:
+        new_cfg["autostart"] = (
+            widgets.autostart_var.get()
+            if widgets.autostart_var is not None
+            else False
+        )
+
+    merge_adv_from_form(widgets, new_cfg, default_config)
+    if widgets.check_updates_var is not None:
+        new_cfg["check_updates"] = bool(widgets.check_updates_var.get())
+    return new_cfg
+
+
+def install_tray_config_buttons(
+    ctk: Any,
+    frame: Any,
+    theme: CtkTheme,
+    *,
+    on_save: Callable[[], None],
+    on_cancel: Callable[[], None],
+) -> None:
+    ctk.CTkFrame(
+        frame,
+        fg_color=theme.field_border,
+        height=1,
+        corner_radius=0,
+    ).pack(fill="x", pady=(4, 10))
+    btn_frame = ctk.CTkFrame(frame, fg_color="transparent")
+    btn_frame.pack(fill="x", pady=(0, 0))
+    save_btn = ctk.CTkButton(
+        btn_frame, text="Сохранить", height=38,
+        font=(theme.ui_font_family, 14, "bold"), corner_radius=10,
+        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+        text_color="#ffffff",
+        command=on_save)
+    save_btn.pack(side="left", fill="x", expand=True, padx=(0, 8))
+    attach_ctk_tooltip(save_btn, _TIP_SAVE)
+    cancel_btn = ctk.CTkButton(
+        btn_frame, text="Отмена", height=38,
+        font=(theme.ui_font_family, 14), corner_radius=10,
+        fg_color=theme.field_bg, hover_color=theme.field_border,
+        text_color=theme.text_primary, border_width=1,
+        border_color=theme.field_border,
+        command=on_cancel)
+    cancel_btn.pack(side="right", fill="x", expand=True)
+    attach_ctk_tooltip(cancel_btn, _TIP_CANCEL)
+
+
+def populate_first_run_window(
+    ctk: Any,
+    root: Any,
+    theme: CtkTheme,
+    *,
+    host: str,
+    port: int,
+    on_done: Callable[[bool], None],
+) -> None:
+    """
+    Содержимое окна первого запуска. on_done(open_in_telegram) — по «Начать» и по закрытию окна.
+    """
+    tg_url = f"tg://socks?server={host}&port={port}"
+    fpx, fpy = FIRST_RUN_FRAME_PAD
+    frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
+
+    title_frame = ctk.CTkFrame(frame, fg_color="transparent")
+    title_frame.pack(anchor="w", pady=(0, 16), fill="x")
+
+    accent_bar = ctk.CTkFrame(title_frame, fg_color=theme.tg_blue,
+                              width=4, height=32, corner_radius=2)
+    accent_bar.pack(side="left", padx=(0, 12))
+
+    ctk.CTkLabel(title_frame, text="Прокси запущен и работает в системном трее",
+                 font=(theme.ui_font_family, 17, "bold"),
+                 text_color=theme.text_primary).pack(side="left")
+
+    sections = [
+        ("Как подключить Telegram Desktop:", True),
+        ("  Автоматически:", True),
+        ("  ПКМ по иконке в трее → «Открыть в Telegram»", False),
+        (f"  Или ссылка: {tg_url}", False),
+        ("\n  Вручную:", True),
+        ("  Настройки → Продвинутые → Тип подключения → Прокси", False),
+        (f"  SOCKS5 → {host} : {port} (без логина/пароля)", False),
+    ]
+
+    for text, bold in sections:
+        weight = "bold" if bold else "normal"
+        ctk.CTkLabel(frame, text=text,
+                     font=(theme.ui_font_family, 13, weight),
+                     text_color=theme.text_primary,
+                     anchor="w", justify="left").pack(anchor="w", pady=1)
+
+    ctk.CTkFrame(frame, fg_color="transparent", height=16).pack()
+
+    ctk.CTkFrame(frame, fg_color=theme.field_border, height=1,
+                 corner_radius=0).pack(fill="x", pady=(0, 12))
+
+    auto_var = ctk.BooleanVar(value=True)
+    ctk.CTkCheckBox(frame, text="Открыть прокси в Telegram сейчас",
+                    variable=auto_var, font=(theme.ui_font_family, 13),
+                    text_color=theme.text_primary,
+                    fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+                    corner_radius=6, border_width=2,
+                    border_color=theme.field_border).pack(anchor="w", pady=(0, 16))
+
+    def on_ok():
+        on_done(auto_var.get())
+
+    ctk.CTkButton(frame, text="Начать", width=180, height=42,
+                  font=(theme.ui_font_family, 15, "bold"), corner_radius=10,
+                  fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
+                  text_color="#ffffff",
+                  command=on_ok).pack(pady=(0, 0))
+
+    root.protocol("WM_DELETE_WINDOW", on_ok)

utils/__init__.py

@@ -0,0 +1,5 @@
+"""Вспомогательные утилиты (проверка релизов и т.п.)."""
+
+from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+
+__all__ = ["RELEASES_PAGE_URL", "get_status", "run_check"]

utils/default_config.py

@@ -0,0 +1,27 @@
+"""
+Общие значения по умолчанию для tray-приложений (Windows / Linux / macOS).
+Единственное отличие по платформе — ключ autostart только на Windows.
+"""
+from __future__ import annotations
+
+import sys
+from typing import Any, Dict
+
+_TRAY_DEFAULTS_COMMON: Dict[str, Any] = {
+    "port": 1080,
+    "host": "127.0.0.1",
+    "dc_ip": ["2:149.154.167.220", "4:149.154.167.220"],
+    "verbose": False,
+    "check_updates": True,
+    "log_max_mb": 5,
+    "buf_kb": 256,
+    "pool_size": 4,
+}
+
+
+def default_tray_config() -> Dict[str, Any]:
+    """Новая копия конфига по умолчанию для текущей ОС."""
+    cfg = dict(_TRAY_DEFAULTS_COMMON)
+    if sys.platform == "win32":
+        cfg["autostart"] = False
+    return cfg

utils/update_check.py

@@ -0,0 +1,102 @@
+"""
+Минимальная проверка новой версии через GitHub Releases API (без сторонних зависимостей).
+"""
+from __future__ import annotations
+
+import json
+from itertools import zip_longest
+from typing import Any, Dict, Optional
+from urllib.error import HTTPError, URLError
+from urllib.request import Request, urlopen
+
+REPO = "Flowseal/tg-ws-proxy"
+RELEASES_LATEST_API = f"https://api.github.com/repos/{REPO}/releases/latest"
+RELEASES_PAGE_URL = f"https://github.com/{REPO}/releases/latest"
+
+_state: Dict[str, Any] = {
+    "checked": False,
+    "has_update": False,
+    "ahead_of_release": False,
+    "latest": None,
+    "html_url": None,
+    "error": None,
+}
+
+
+def _parse_version_tuple(s: str) -> tuple:
+    s = (s or "").strip().lstrip("vV")
+    if not s:
+        return (0,)
+    parts = []
+    for seg in s.split("."):
+        digits = "".join(c for c in seg if c.isdigit())
+        if digits:
+            try:
+                parts.append(int(digits))
+            except ValueError:
+                parts.append(0)
+        else:
+            parts.append(0)
+    return tuple(parts) if parts else (0,)
+
+
+def _version_gt(a: str, b: str) -> bool:
+    """True, если версия a новее b (простое сравнение по сегментам)."""
+    ta = _parse_version_tuple(a)
+    tb = _parse_version_tuple(b)
+    for x, y in zip_longest(ta, tb, fillvalue=0):
+        if x > y:
+            return True
+        if x < y:
+            return False
+    return False
+
+
+def fetch_latest_release(timeout: float = 12.0) -> Optional[dict]:
+    req = Request(
+        RELEASES_LATEST_API,
+        headers={
+            "Accept": "application/vnd.github+json",
+            "User-Agent": "tg-ws-proxy-update-check",
+        },
+        method="GET",
+    )
+    with urlopen(req, timeout=timeout) as resp:
+        raw = resp.read().decode("utf-8", errors="replace")
+    return json.loads(raw)
+
+
+def run_check(current_version: str) -> None:
+    """Запрашивает последний релиз и обновляет внутреннее состояние."""
+    global _state
+    _state["checked"] = True
+    _state["error"] = None
+    try:
+        data = fetch_latest_release()
+        tag = (data.get("tag_name") or "").strip()
+        html_url = (data.get("html_url") or "").strip() or RELEASES_PAGE_URL
+        if not tag:
+            _state["has_update"] = False
+            _state["ahead_of_release"] = False
+            _state["latest"] = None
+            _state["html_url"] = html_url
+            return
+        latest_clean = tag.lstrip("vV")
+        cur = (current_version or "").strip().lstrip("vV")
+        _state["latest"] = latest_clean
+        _state["html_url"] = html_url
+        _state["has_update"] = _version_gt(latest_clean, cur)
+        _state["ahead_of_release"] = bool(latest_clean) and _version_gt(
+            cur, latest_clean
+        )
+    except (HTTPError, URLError, OSError, TimeoutError, ValueError, json.JSONDecodeError) as e:
+        _state["error"] = str(e)
+        _state["has_update"] = False
+        _state["ahead_of_release"] = False
+        _state["latest"] = None
+        _state["html_url"] = RELEASES_PAGE_URL
+
+
+def get_status() -> Dict[str, Any]:
+    """Снимок состояния после run_check (для подписей в настройках)."""
+    return dict(_state)

windows.py

@@ -1,25 +1,63 @@
 from __future__ import annotations
 
 import ctypes
+import ipaddress
 import json
 import logging
+import logging.handlers
 import os
+import winreg
 import psutil
 import sys
 import threading
 import time
 import webbrowser
-import pystray
-import pyperclip
 import asyncio as _asyncio
-import customtkinter as ctk
 from pathlib import Path
 from typing import Dict, Optional
-from PIL import Image, ImageDraw, ImageFont
+
+try:
+    import pyperclip
+except ImportError:
+    pyperclip = None
+
+try:
+    import pystray
+except ImportError:
+    pystray = None
+
+try:
+    import customtkinter as ctk
+except ImportError:
+    ctk = None
+
+try:
+    from PIL import Image, ImageDraw, ImageFont
+except ImportError:
+    Image = ImageDraw = ImageFont = None
 
 import proxy.tg_ws_proxy as tg_ws_proxy
+from proxy import __version__
+from utils.default_config import default_tray_config
+from ui.ctk_tray_ui import (
+    install_tray_config_buttons,
+    install_tray_config_form,
+    populate_first_run_window,
+    tray_settings_scroll_and_footer,
+    validate_config_form,
+)
+from ui.ctk_theme import (
+    CONFIG_DIALOG_FRAME_PAD,
+    CONFIG_DIALOG_SIZE,
+    FIRST_RUN_SIZE,
+    create_ctk_root,
+    ctk_theme_for_platform,
+    main_content_frame,
+)
 
 
+IS_FROZEN = bool(getattr(sys, "frozen", False))
+
 APP_NAME = "TgWsProxy"
 APP_DIR = Path(os.environ.get("APPDATA", Path.home())) / APP_NAME
 CONFIG_FILE = APP_DIR / "config.json"
@@ -28,12 +66,7 @@ FIRST_RUN_MARKER = APP_DIR / ".first_run_done"
 IPV6_WARN_MARKER = APP_DIR / ".ipv6_warned"
 
 
-DEFAULT_CONFIG = {
-    "port": 1080,
-    "host": "127.0.0.1",
-    "dc_ip": ["2:149.154.167.220", "4:149.154.167.220"],
-    "verbose": False,
-}
+DEFAULT_CONFIG = default_tray_config()
 
 
 _proxy_thread: Optional[threading.Thread] = None
@@ -45,6 +78,15 @@ _lock_file_path: Optional[Path] = None
 
 log = logging.getLogger("tg-ws-tray")
 
+_user32 = ctypes.windll.user32
+_user32.MessageBoxW.argtypes = [
+    ctypes.c_void_p,
+    ctypes.c_wchar_p,
+    ctypes.c_wchar_p,
+    ctypes.c_uint,
+]
+_user32.MessageBoxW.restype = ctypes.c_int
+
 
 def _same_process(lock_meta: dict, proc: psutil.Process) -> bool:
     try:
@@ -55,9 +97,18 @@ def _same_process(lock_meta: dict, proc: psutil.Process) -> bool:
     except Exception:
         return False
 
+    try:
+        for arg in proc.cmdline():
+            if "windows.py" in arg:
+                return True
+    except Exception:
+        pass
+
     frozen = bool(getattr(sys, "frozen", False))
     if frozen:
-        return os.path.basename(sys.executable) == proc.name()
+        return (
+            os.path.basename(sys.executable).lower() == proc.name().lower()
+        )
 
     return False
 
@@ -143,12 +194,17 @@ def save_config(cfg: dict):
         json.dump(cfg, f, indent=2, ensure_ascii=False)
 
 
-def setup_logging(verbose: bool = False):
+def setup_logging(verbose: bool = False, log_max_mb: float = 5):
     _ensure_dirs()
     root = logging.getLogger()
     root.setLevel(logging.DEBUG if verbose else logging.INFO)
 
-    fh = logging.FileHandler(str(LOG_FILE), encoding="utf-8")
+    fh = logging.handlers.RotatingFileHandler(
+        str(LOG_FILE),
+        maxBytes=max(32 * 1024, log_max_mb * 1024 * 1024),
+        backupCount=0,
+        encoding='utf-8',
+    )
     fh.setLevel(logging.DEBUG)
     fh.setFormatter(logging.Formatter(
         "%(asctime)s  %(levelname)-5s  %(name)s  %(message)s",
@@ -164,6 +220,64 @@ def setup_logging(verbose: bool = False):
         root.addHandler(ch)
 
 
+def _autostart_reg_name() -> str:
+    return APP_NAME
+
+
+def _supports_autostart() -> bool:
+    return IS_FROZEN
+
+
+def _autostart_command() -> str:
+    return f'"{sys.executable}"'
+
+
+def is_autostart_enabled() -> bool:
+    try:
+        with winreg.OpenKey(
+            winreg.HKEY_CURRENT_USER,
+            r"Software\Microsoft\Windows\CurrentVersion\Run",
+            0,
+            winreg.KEY_READ,
+        ) as k:
+            val, _ = winreg.QueryValueEx(k, _autostart_reg_name())
+        stored = str(val).strip()
+        expected = _autostart_command().strip()
+        return stored == expected
+    except FileNotFoundError:
+        return False
+    except OSError:
+        return False
+
+
+def set_autostart_enabled(enabled: bool) -> None:
+    try:
+        with winreg.CreateKey(
+            winreg.HKEY_CURRENT_USER,
+            r"Software\Microsoft\Windows\CurrentVersion\Run",
+        ) as k:
+            if enabled:
+                winreg.SetValueEx(
+                    k,
+                    _autostart_reg_name(),
+                    0,
+                    winreg.REG_SZ,
+                    _autostart_command(),
+                )
+            else:
+                try:
+                    winreg.DeleteValue(k, _autostart_reg_name())
+                except FileNotFoundError:
+                    pass
+    except OSError as exc:
+        log.error("Failed to update autostart: %s", exc)
+        _show_error(
+            "Не удалось изменить автозапуск.\n\n"
+            "Попробуйте запустить приложение от имени пользователя с правами на реестр.\n\n"
+            f"Ошибка: {exc}"
+        )
+
+
 def _make_icon_image(size: int = 64):
     if Image is None:
         raise RuntimeError("Pillow is required for tray icon")
@@ -238,6 +352,13 @@ def start_proxy():
         return
 
     log.info("Starting proxy on %s:%d ...", host, port)
+
+    buf_kb = cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])
+    pool_size = cfg.get("pool_size", DEFAULT_CONFIG["pool_size"])
+    tg_ws_proxy._RECV_BUF = max(4, buf_kb) * 1024
+    tg_ws_proxy._SEND_BUF = tg_ws_proxy._RECV_BUF
+    tg_ws_proxy._WS_POOL_SIZE = max(0, pool_size)
+
     _proxy_thread = threading.Thread(
         target=_run_proxy_thread,
         args=(port, dc_opt, verbose, host),
@@ -251,7 +372,11 @@ def stop_proxy():
         loop, stop_ev = _async_stop
         loop.call_soon_threadsafe(stop_ev.set)
         if _proxy_thread:
-            _proxy_thread.join(timeout=2)
+            _proxy_thread.join(timeout=5)
+            if _proxy_thread.is_alive():
+                log.warning(
+                    "Proxy thread did not finish within timeout; "
+                    "the process may still exit shortly")
     _proxy_thread = None
     log.info("Proxy stopped")
 
@@ -264,16 +389,61 @@ def restart_proxy():
 
 
 def _show_error(text: str, title: str = "TG WS Proxy — Ошибка"):
-    ctypes.windll.user32.MessageBoxW(0, text, title, 0x10)
+    _user32.MessageBoxW(None, text, title, 0x10)
 
 
 def _show_info(text: str, title: str = "TG WS Proxy"):
-    ctypes.windll.user32.MessageBoxW(0, text, title, 0x40)
+    _user32.MessageBoxW(None, text, title, 0x40)
+
+
+def _ask_open_release_page(latest_version: str, url: str) -> bool:
+    """Win32 Yes/No: открыть страницу релиза."""
+    MB_YESNO = 0x4
+    MB_ICONQUESTION = 0x20
+    IDYES = 6
+    text = (
+        f"Доступна новая версия: {latest_version}\n\n"
+        f"Открыть страницу релиза в браузере?"
+    )
+    r = _user32.MessageBoxW(
+        None,
+        text,
+        "TG WS Proxy — обновление",
+        MB_YESNO | MB_ICONQUESTION,
+    )
+    return r == IDYES
+
+
+def _maybe_notify_update_async():
+    """
+    Фоновая проверка GitHub Releases и уведомление (не блокирует трей).
+    """
+    def _work():
+        time.sleep(1.5)
+        if _exiting:
+            return
+        if not _config.get("check_updates", True):
+            return
+        try:
+            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
+            run_check(__version__)
+            st = get_status()
+            if not st.get("has_update"):
+                return
+            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
+            ver = st.get("latest") or "?"
+            if _ask_open_release_page(str(ver), url):
+                webbrowser.open(url)
+        except Exception as exc:
+            log.debug("Update check failed: %s", exc)
+
+    threading.Thread(target=_work, daemon=True, name="update-check").start()
 
 
 def _on_open_in_telegram(icon=None, item=None):
+    host = _config.get("host", DEFAULT_CONFIG["host"])
     port = _config.get("port", DEFAULT_CONFIG["port"])
-    url = f"tg://socks?server=127.0.0.1&port={port}"
+    url = f"tg://socks?server={host}&port={port}"
     log.info("Opening %s", url)
     try:
         result = webbrowser.open(url)
@@ -281,6 +451,11 @@ def _on_open_in_telegram(icon=None, item=None):
             raise RuntimeError("webbrowser.open returned False")
     except Exception:
         log.info("Browser open failed, copying to clipboard")
+        if pyperclip is None:
+            _show_error(
+                "Не удалось открыть Telegram автоматически.\n\n"
+                f"Установите пакет pyperclip для копирования в буфер или откройте вручную:\n{url}")
+            return
         try:
             pyperclip.copy(url)
             _show_info(
@@ -306,117 +481,66 @@ def _edit_config_dialog():
         return
 
     cfg = dict(_config)
+    cfg["autostart"] = is_autostart_enabled()
 
-    ctk.set_appearance_mode("light")
-    ctk.set_default_color_theme("blue")
+    # Make sure that the autostart key is removed if autostart
+    # is disabled, even if the executable file is moved.
+    if _supports_autostart() and not cfg["autostart"]:
+        set_autostart_enabled(False)
 
-    root = ctk.CTk()
-    root.title("TG WS Proxy — Настройки")
-    root.resizable(False, False)
-    root.attributes("-topmost", True)
+    theme = ctk_theme_for_platform()
+    w, h = CONFIG_DIALOG_SIZE
+    if _supports_autostart():
+        h += 100
 
-    TG_BLUE = "#3390ec"
-    TG_BLUE_HOVER = "#2b7cd4"
-    BG = "#ffffff"
-    FIELD_BG = "#f0f2f5"
-    FIELD_BORDER = "#d6d9dc"
-    TEXT_PRIMARY = "#000000"
-    TEXT_SECONDARY = "#707579"
-    FONT_FAMILY = "Segoe UI"
+    icon_path = str(Path(__file__).parent / "icon.ico")
 
-    w, h = 420, 480
-    sw = root.winfo_screenwidth()
-    sh = root.winfo_screenheight()
-    root.geometry(f"{w}x{h}+{(sw-w)//2}+{(sh-h)//2}")
-    root.configure(fg_color=BG)
+    root = create_ctk_root(
+        ctk,
+        title="TG WS Proxy — Настройки",
+        width=w,
+        height=h,
+        theme=theme,
+        after_create=lambda r: r.iconbitmap(icon_path),
+    )
 
-    frame = ctk.CTkFrame(root, fg_color=BG, corner_radius=0)
-    frame.pack(fill="both", expand=True, padx=24, pady=20)
+    fpx, fpy = CONFIG_DIALOG_FRAME_PAD
+    frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
 
-    # Host
-    ctk.CTkLabel(frame, text="IP-адрес прокси",
-                 font=(FONT_FAMILY, 13), text_color=TEXT_PRIMARY,
-                 anchor="w").pack(anchor="w", pady=(0, 4))
-    host_var = ctk.StringVar(value=cfg.get("host", "127.0.0.1"))
-    host_entry = ctk.CTkEntry(frame, textvariable=host_var, width=200, height=36,
-                              font=(FONT_FAMILY, 13), corner_radius=10,
-                              fg_color=FIELD_BG, border_color=FIELD_BORDER,
-                              border_width=1, text_color=TEXT_PRIMARY)
-    host_entry.pack(anchor="w", pady=(0, 12))
+    scroll, footer = tray_settings_scroll_and_footer(ctk, frame, theme)
 
-    # Port
-    ctk.CTkLabel(frame, text="Порт прокси",
-                 font=(FONT_FAMILY, 13), text_color=TEXT_PRIMARY,
-                 anchor="w").pack(anchor="w", pady=(0, 4))
-    port_var = ctk.StringVar(value=str(cfg.get("port", 1080)))
-    port_entry = ctk.CTkEntry(frame, textvariable=port_var, width=120, height=36,
-                              font=(FONT_FAMILY, 13), corner_radius=10,
-                              fg_color=FIELD_BG, border_color=FIELD_BORDER,
-                              border_width=1, text_color=TEXT_PRIMARY)
-    port_entry.pack(anchor="w", pady=(0, 12))
-
-    # DC-IP mappings
-    ctk.CTkLabel(frame, text="DC → IP маппинги (по одному на строку, формат DC:IP)",
-                 font=(FONT_FAMILY, 13), text_color=TEXT_PRIMARY,
-                 anchor="w").pack(anchor="w", pady=(0, 4))
-    dc_textbox = ctk.CTkTextbox(frame, width=370, height=120,
-                                font=("Consolas", 12), corner_radius=10,
-                                fg_color=FIELD_BG, border_color=FIELD_BORDER,
-                                border_width=1, text_color=TEXT_PRIMARY)
-    dc_textbox.pack(anchor="w", pady=(0, 12))
-    dc_textbox.insert("1.0", "\n".join(cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])))
-
-    # Verbose
-    verbose_var = ctk.BooleanVar(value=cfg.get("verbose", False))
-    ctk.CTkCheckBox(frame, text="Подробное логирование (verbose)",
-                    variable=verbose_var, font=(FONT_FAMILY, 13),
-                    text_color=TEXT_PRIMARY,
-                    fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                    corner_radius=6, border_width=2,
-                    border_color=FIELD_BORDER).pack(anchor="w", pady=(0, 8))
-
-    # Info label
-    ctk.CTkLabel(frame, text="Изменения вступят в силу после перезапуска прокси.",
-                 font=(FONT_FAMILY, 11), text_color=TEXT_SECONDARY,
-                 anchor="w").pack(anchor="w", pady=(0, 16))
+    widgets = install_tray_config_form(
+        ctk,
+        scroll,
+        theme,
+        cfg,
+        DEFAULT_CONFIG,
+        show_autostart=_supports_autostart(),
+        autostart_value=cfg.get("autostart", False),
+    )
 
     def on_save():
-        import socket as _sock
-        host_val = host_var.get().strip()
-        try:
-            _sock.inet_aton(host_val)
-        except OSError:
-            _show_error("Некорректный IP-адрес.")
+        merged = validate_config_form(
+            widgets,
+            DEFAULT_CONFIG,
+            include_autostart=_supports_autostart(),
+        )
+        if isinstance(merged, str):
+            _show_error(merged)
             return
 
-        try:
-            port_val = int(port_var.get().strip())
-            if not (1 <= port_val <= 65535):
-                raise ValueError
-        except ValueError:
-            _show_error("Порт должен быть числом 1-65535")
-            return
-
-        lines = [l.strip() for l in dc_textbox.get("1.0", "end").strip().splitlines()
-                 if l.strip()]
-        try:
-            tg_ws_proxy.parse_dc_ip_list(lines)
-        except ValueError as e:
-            _show_error(str(e))
-            return
-
-        new_cfg = {
-            "host": host_val,
-            "port": port_val,
-            "dc_ip": lines,
-            "verbose": verbose_var.get(),
-        }
+        new_cfg = merged
         save_config(new_cfg)
         _config.update(new_cfg)
         log.info("Config saved: %s", new_cfg)
 
+        if _supports_autostart():
+            set_autostart_enabled(bool(new_cfg.get("autostart", False)))
+
         _tray_icon.menu = _build_menu()
 
+        # Win32 MessageBox из того же потока, что и mainloop CTk, блокирует обработку Tcl/Tk
+        # и даёт зависание; tkinter.messagebox согласован с циклом окна.
         from tkinter import messagebox
         if messagebox.askyesno("Перезапустить?",
                                "Настройки сохранены.\n\n"
@@ -430,21 +554,18 @@ def _edit_config_dialog():
     def on_cancel():
         root.destroy()
 
-    btn_frame = ctk.CTkFrame(frame, fg_color="transparent")
-    btn_frame.pack(fill="x")
-    ctk.CTkButton(btn_frame, text="Сохранить", width=140, height=38,
-                  font=(FONT_FAMILY, 14, "bold"), corner_radius=10,
-                  fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                  text_color="#ffffff",
-                  command=on_save).pack(side="left", padx=(0, 10))
-    ctk.CTkButton(btn_frame, text="Отмена", width=140, height=38,
-                  font=(FONT_FAMILY, 14), corner_radius=10,
-                  fg_color=FIELD_BG, hover_color=FIELD_BORDER,
-                  text_color=TEXT_PRIMARY, border_width=1,
-                  border_color=FIELD_BORDER,
-                  command=on_cancel).pack(side="left")
+    install_tray_config_buttons(
+        ctk, footer, theme, on_save=on_save, on_cancel=on_cancel)
 
-    root.mainloop()
+    try:
+        root.mainloop()
+    finally:
+        import tkinter as tk
+        try:
+            if root.winfo_exists():
+                root.destroy()
+        except tk.TclError:
+            pass
 
 
 def _on_open_logs(icon=None, item=None):
@@ -480,99 +601,41 @@ def _show_first_run():
 
     host = _config.get("host", DEFAULT_CONFIG["host"])
     port = _config.get("port", DEFAULT_CONFIG["port"])
-    tg_url = f"tg://socks?server={host}&port={port}"
 
     if ctk is None:
         FIRST_RUN_MARKER.touch()
         return
 
-    ctk.set_appearance_mode("light")
-    ctk.set_default_color_theme("blue")
+    theme = ctk_theme_for_platform()
+    icon_path = str(Path(__file__).parent / "icon.ico")
+    w, h = FIRST_RUN_SIZE
+    root = create_ctk_root(
+        ctk,
+        title="TG WS Proxy",
+        width=w,
+        height=h,
+        theme=theme,
+        after_create=lambda r: r.iconbitmap(icon_path),
+    )
 
-    TG_BLUE = "#3390ec"
-    TG_BLUE_HOVER = "#2b7cd4"
-    BG = "#ffffff"
-    FIELD_BG = "#f0f2f5"
-    FIELD_BORDER = "#d6d9dc"
-    TEXT_PRIMARY = "#000000"
-    TEXT_SECONDARY = "#707579"
-    FONT_FAMILY = "Segoe UI"
-
-    root = ctk.CTk()
-    root.title("TG WS Proxy")
-    root.resizable(False, False)
-    root.attributes("-topmost", True)
-
-    w, h = 520, 440
-    sw = root.winfo_screenwidth()
-    sh = root.winfo_screenheight()
-    root.geometry(f"{w}x{h}+{(sw-w)//2}+{(sh-h)//2}")
-    root.configure(fg_color=BG)
-
-    frame = ctk.CTkFrame(root, fg_color=BG, corner_radius=0)
-    frame.pack(fill="both", expand=True, padx=28, pady=24)
-
-    title_frame = ctk.CTkFrame(frame, fg_color="transparent")
-    title_frame.pack(anchor="w", pady=(0, 16), fill="x")
-
-    # Blue accent bar
-    accent_bar = ctk.CTkFrame(title_frame, fg_color=TG_BLUE,
-                              width=4, height=32, corner_radius=2)
-    accent_bar.pack(side="left", padx=(0, 12))
-
-    ctk.CTkLabel(title_frame, text="Прокси запущен и работает в системном трее",
-                 font=(FONT_FAMILY, 17, "bold"),
-                 text_color=TEXT_PRIMARY).pack(side="left")
-
-    # Info sections
-    sections = [
-        ("Как подключить Telegram Desktop:", True),
-        ("  Автоматически:", True),
-        (f"  ПКМ по иконке в трее → «Открыть в Telegram»", False),
-        (f"  Или ссылка: {tg_url}", False),
-        ("\n  Вручную:", True),
-        ("  Настройки → Продвинутые → Тип подключения → Прокси", False),
-        (f"  SOCKS5 → {host} : {port} (без логина/пароля)", False),
-    ]
-
-    for text, bold in sections:
-        weight = "bold" if bold else "normal"
-        ctk.CTkLabel(frame, text=text,
-                     font=(FONT_FAMILY, 13, weight),
-                     text_color=TEXT_PRIMARY,
-                     anchor="w", justify="left").pack(anchor="w", pady=1)
-
-    # Spacer
-    ctk.CTkFrame(frame, fg_color="transparent", height=16).pack()
-
-    # Separator
-    ctk.CTkFrame(frame, fg_color=FIELD_BORDER, height=1,
-                 corner_radius=0).pack(fill="x", pady=(0, 12))
-
-    # Checkbox
-    auto_var = ctk.BooleanVar(value=True)
-    ctk.CTkCheckBox(frame, text="Открыть прокси в Telegram сейчас",
-                    variable=auto_var, font=(FONT_FAMILY, 13),
-                    text_color=TEXT_PRIMARY,
-                    fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                    corner_radius=6, border_width=2,
-                    border_color=FIELD_BORDER).pack(anchor="w", pady=(0, 16))
-
-    def on_ok():
+    def on_done(open_tg: bool):
         FIRST_RUN_MARKER.touch()
-        open_tg = auto_var.get()
         root.destroy()
         if open_tg:
             _on_open_in_telegram()
 
-    ctk.CTkButton(frame, text="Начать", width=180, height=42,
-                  font=(FONT_FAMILY, 15, "bold"), corner_radius=10,
-                  fg_color=TG_BLUE, hover_color=TG_BLUE_HOVER,
-                  text_color="#ffffff",
-                  command=on_ok).pack(pady=(0, 0))
+    populate_first_run_window(
+        ctk, root, theme, host=host, port=port, on_done=on_done)
 
-    root.protocol("WM_DELETE_WINDOW", on_ok)
-    root.mainloop()
+    try:
+        root.mainloop()
+    finally:
+        import tkinter as tk
+        try:
+            if root.winfo_exists():
+                root.destroy()
+        except tk.TclError:
+            pass
 
 
 def _has_ipv6_enabled() -> bool:
@@ -581,8 +644,15 @@ def _has_ipv6_enabled() -> bool:
         addrs = _sock.getaddrinfo(_sock.gethostname(), None, _sock.AF_INET6)
         for addr in addrs:
             ip = addr[4][0]
-            if ip and not ip.startswith('::1') and not ip.startswith('fe80::1'):
-                return True
+            if not ip or ip.startswith("::1"):
+                continue
+            try:
+                if ipaddress.IPv6Address(ip).is_link_local:
+                    continue
+            except ValueError:
+                if ip.startswith("fe80:"):
+                    continue
+            return True
     except Exception:
         pass
     try:
@@ -651,14 +721,16 @@ def run_tray():
         except Exception:
             pass
 
-    setup_logging(_config.get("verbose", False))
-    log.info("TG WS Proxy tray app starting")
+    setup_logging(_config.get("verbose", False),
+                  log_max_mb=_config.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]))
+    log.info("TG WS Proxy версия %s, tray app starting", __version__)
     log.info("Config: %s", _config)
     log.info("Log file: %s", LOG_FILE)
 
-    if pystray is None or Image is None:
-        log.error("pystray or Pillow not installed; "
-                  "running in console mode")
+    if pystray is None or Image is None or ctk is None:
+        log.error(
+            "pystray, Pillow or customtkinter not installed; "
+            "running in console mode")
         start_proxy()
         try:
             while True:
@@ -669,6 +741,8 @@ def run_tray():
 
     start_proxy()
 
+    _maybe_notify_update_async()
+
     _show_first_run()
     _check_ipv6_warning()