Initial commit

.dockerignore

@@ -1,28 +0,0 @@
-.git
-.github
-.gitignore
-__pycache__/
-*.py[cod]
-*.pyo
-*.egg-info/
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.venv/
-venv/
-dist/
-build/
-packaging/
-windows.py
-icon.ico
-*.spec
-*.spec.bak
-*.manifest
-*.log
-.vscode/
-.idea/
-*.swp
-*.swo
-.DS_Store
-Thumbs.db
-Desktop.ini

.gitattributes

@@ -1,9 +0,0 @@
-* text=auto eol=lf
-
-*.py text diff=python
-*.spec text linguist-language=Python
-
-*.toml text
-*.txt text
-
-*.ico binary

.github/CODEOWNERS

@@ -1,11 +0,0 @@
-# Default owners
-* @Flowseal
-
-# Automation and repository settings
-.github/** @Flowseal
-
-# Documentation
-docs/** @Flowseal
-
-# Core proxy implementation
-proxy/** @Flowseal

.github/FUNDING.yml

@@ -1 +0,0 @@
-custom: ['https://nowpayments.io/donation/flowseal']

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,23 +0,0 @@
-name: 🐛 Проблема
-title: '[Проблема] '
-description: Сообщить о проблеме
-labels: ['bug']
-
-body:
-  - type: input
-    id: app_version
-    attributes:
-      label: Версия TG WS Proxy
-      description: Укажите версию приложения (например, v1.2.3)
-      placeholder: vX.Y.Z
-    validations:
-      required: true
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Опишите вашу проблему
-      description: Чётко опишите проблему, с которой вы столкнулись
-      placeholder: Описание проблемы
-    validations:
-      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,6 +0,0 @@
-blank_issues_enabled: false
-
-contact_links:
-  - name: 📚 Документация
-    url: https://github.com/Flowseal/tg-ws-proxy/tree/main/docs
-    about: Ознакомьтесь с документацией перед созданием issue

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,37 +0,0 @@
-name: 🚀 Предложение
-title: '[Предложение] '
-description: Предложить улучшение или новую функциональность
-labels: ['enhancement']
-
-body:
-  - type: textarea
-    id: solution
-    attributes:
-      label: Предлагаемое решение
-      description: Опишите, как именно вы предлагаете улучшить проект
-      placeholder: |
-        Предлагаю добавить ...
-        Это позволит ...
-    validations:
-      required: true
-
-  - type: dropdown
-    id: platform
-    attributes:
-      label: Для какой платформы актуально?
-      description: Выберите платформу, если предложение связано с конкретной ОС
-      options:
-        - Все платформы
-        - Windows
-        - macOS
-        - Linux
-        - Другое
-    validations:
-      required: true
-
-  - type: textarea
-    id: context
-    attributes:
-      label: Дополнительный контекст
-      description: Добавьте примеры, ссылки, скриншоты или другие детали
-      placeholder: Любые дополнительные материалы по предложению

.github/cfproxy-domains.txt

@@ -1,10 +0,0 @@
-virkgj.com
-vmmzovy.com
-mkuosckvso.com
-zaewayzmplad.com
-twdmbzcm.com
-awzwsldi.com
-clngqrflngqin.com
-tjacxbqtj.com
-bxaxtxmrw.com
-dmohrsgmohcrwb.com

.github/workflows/build.yml

@@ -1,475 +1,167 @@
-name: Build & Release
+name: Build tg-ws-proxy
 
 on:
-  workflow_dispatch:
-    inputs:
-      make_release:
-        description: 'Create Github Release?'
-        type: boolean
-        required: true
-        default: false
-      version:
-        description: "Release version tag (e.g. v1.0.0)"
-        required: false
-        default: "v1.0.0"
+  push:
 
 permissions:
   contents: write
 
 jobs:
-  build-windows:
-    runs-on: windows-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-          cache: "pip"
-
-      - name: Setup MSVC 14.40 toolset
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          toolset: 14.40
-
-      - name: Install dependencies
-        run: pip install .
-
-      - name: Build PyInstaller bootloader from source
-        env:
-          PYINSTALLER_COMPILE_BOOTLOADER: "1"
-        run: |
-          pip download --no-binary pyinstaller --no-deps --no-cache-dir -d pyinstaller_src "pyinstaller==6.10.0"
-          pip install (Get-ChildItem pyinstaller_src\*.tar.gz).FullName
-
-      - name: Build EXE with PyInstaller
-        run: pyinstaller packaging/windows.spec --noconfirm
-
-      - name: Strip Rich PE header
-        shell: bash
-        run: |
-          python -c "
-          import struct, pathlib
-          exe = pathlib.Path('dist/TgWsProxy.exe')
-          data = bytearray(exe.read_bytes())
-          rich = data.find(b'Rich')
-          if rich == -1:
-              raise SystemExit('Rich header not found')
-          ck = struct.unpack_from('<I', data, rich + 4)[0]
-          dans = struct.pack('<I', 0x536E6144 ^ ck)
-          ds = data.find(dans)
-          if ds == -1:
-              raise SystemExit('DanS marker not found')
-          data[ds:rich + 8] = b'\x00' * (rich + 8 - ds)
-          exe.write_bytes(data)
-          print(f'Stripped Rich header: offset {ds}..{rich+8}')
-          "
-
-      - name: Rename artifact
-        run: mv dist/TgWsProxy.exe dist/TgWsProxy_windows.exe
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: TgWsProxy
-          path: dist/TgWsProxy_windows.exe
-
-  build-win7:
-    runs-on: windows-latest
+  build:
+    runs-on: ubuntu-22.04
     strategy:
+      fail-fast: false
       matrix:
         include:
           - arch: x64
-            suffix: 64bit
-          - arch: x86
-            suffix: 32bit
-    steps:
-      - uses: actions/checkout@v6
+            pkg_arch: x64
+            goarch: amd64
+            goarm: ""
+            gomips: ""
+          - arch: aarch64
+            pkg_arch: aarch64-3.10
+            goarch: arm64
+            goarm: ""
+            gomips: ""
+          - arch: armv7
+            pkg_arch: armv7-3.2
+            goarch: arm
+            goarm: "7"
+            gomips: ""
+          - arch: mipsel
+            pkg_arch: mipsel-3.4
+            goarch: mipsle
+            goarm: ""
+            gomips: softfloat
+          - arch: mips
+            pkg_arch: mips-3.4
+            goarch: mips
+            goarm: ""
+            gomips: softfloat
 
-      - uses: actions/setup-python@v6
-        with:
-          python-version: "3.8"
-          architecture: ${{ matrix.arch }}
-          cache: "pip"
-          
-      - name: Install dependencies & pyinstaller
-        run: pip install . "pyinstaller==5.13.2"
-
-      - name: Build EXE with PyInstaller
-        run: pyinstaller packaging/windows.spec --noconfirm
-
-      - name: Strip Rich PE header
-        shell: bash
-        run: |
-          python -c "
-          import struct, pathlib
-          exe = pathlib.Path('dist/TgWsProxy.exe')
-          data = bytearray(exe.read_bytes())
-          rich = data.find(b'Rich')
-          if rich == -1:
-              raise SystemExit('Rich header not found')
-          ck = struct.unpack_from('<I', data, rich + 4)[0]
-          dans = struct.pack('<I', 0x536E6144 ^ ck)
-          ds = data.find(dans)
-          if ds == -1:
-              raise SystemExit('DanS marker not found')
-          data[ds:rich + 8] = b'\x00' * (rich + 8 - ds)
-          exe.write_bytes(data)
-          print(f'Stripped Rich header: offset {ds}..{rich+8}')
-          "
-
-      - name: Rename artifact
-        run: mv dist/TgWsProxy.exe dist/TgWsProxy_windows_7_${{ matrix.suffix }}.exe
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: TgWsProxy-win7-${{ matrix.suffix }}
-          path: dist/TgWsProxy_windows_7_${{ matrix.suffix }}.exe
-
-  build-macos:
-    runs-on: macos-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Install universal2 Python
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: src/go.mod
+          cache: true
+          cache-dependency-path: src/go.sum
+
+      - name: Install build tools
         run: |
-          set -euo pipefail
-          curl -LO https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg
-          sudo installer -pkg python-3.12.10-macos11.pkg -target /
-          echo "/Library/Frameworks/Python.framework/Versions/3.12/bin" >> "$GITHUB_PATH"
+          sudo apt-get update
+          sudo apt-get install -y dos2unix
 
-      - name: Install dependencies
+      - name: Resolve project directory
+        id: project-dir
         run: |
-          set -euo pipefail
-          python3.12 -m pip install --upgrade pip setuptools wheel
-          python3.12 -m pip install delocate==0.13.0
-
-          mkdir -p wheelhouse/arm64 wheelhouse/x86_64 wheelhouse/universal2
-
-          python3.12 -m pip download \
-            --only-binary=:all: \
-            --platform macosx_11_0_arm64 \
-            --python-version 3.12 \
-            --implementation cp \
-            -d wheelhouse/arm64 \
-            'cffi>=2.0.0' \
-            Pillow==12.1.0 \
-            psutil==7.0.0
-
-          python3.12 -m pip download \
-            --only-binary=:all: \
-            --platform macosx_10_13_x86_64 \
-            --python-version 3.12 \
-            --implementation cp \
-            -d wheelhouse/x86_64 \
-            'cffi>=2.0.0' \
-            Pillow==12.1.0
-
-          python3.12 -m pip download \
-            --only-binary=:all: \
-            --platform macosx_10_9_x86_64 \
-            --python-version 3.12 \
-            --implementation cp \
-            -d wheelhouse/x86_64 \
-            psutil==7.0.0
-
-          delocate-merge \
-            wheelhouse/arm64/cffi-*.whl \
-            wheelhouse/x86_64/cffi-*.whl \
-            -w wheelhouse/universal2
-
-          delocate-merge \
-            wheelhouse/arm64/pillow-12.1.0-*.whl \
-            wheelhouse/x86_64/pillow-12.1.0-*.whl \
-            -w wheelhouse/universal2
-
-          delocate-merge \
-            wheelhouse/arm64/psutil-7.0.0-*.whl \
-            wheelhouse/x86_64/psutil-7.0.0-*.whl \
-            -w wheelhouse/universal2
-
-          python3.12 -m pip install --no-deps wheelhouse/universal2/*.whl
-          python3.12 -m pip install .
-          python3.12 -m pip install pyinstaller==6.13.0
-
-      - name: Create macOS icon from ICO
-        run: |
-          set -euo pipefail
-          python3.12 - <<'PY'
-          from PIL import Image
-
-          image = Image.open('icon.ico')
-          image = image.resize((1024, 1024), Image.LANCZOS)
-          image.save('icon_1024.png', 'PNG')
-          PY
-
-          mkdir -p icon.iconset
-          sips -z 16 16 icon_1024.png --out icon.iconset/icon_16x16.png
-          sips -z 32 32 icon_1024.png --out icon.iconset/icon_16x16@2x.png
-          sips -z 32 32 icon_1024.png --out icon.iconset/icon_32x32.png
-          sips -z 64 64 icon_1024.png --out icon.iconset/icon_32x32@2x.png
-          sips -z 128 128 icon_1024.png --out icon.iconset/icon_128x128.png
-          sips -z 256 256 icon_1024.png --out icon.iconset/icon_128x128@2x.png
-          sips -z 256 256 icon_1024.png --out icon.iconset/icon_256x256.png
-          sips -z 512 512 icon_1024.png --out icon.iconset/icon_256x256@2x.png
-          sips -z 512 512 icon_1024.png --out icon.iconset/icon_512x512.png
-          sips -z 1024 1024 icon_1024.png --out icon.iconset/icon_512x512@2x.png
-          iconutil -c icns icon.iconset -o icon.icns
-          rm -rf icon.iconset icon_1024.png
-
-      - name: Build app with PyInstaller
-        run: python3.12 -m PyInstaller packaging/macos.spec --noconfirm
-
-      - name: Validate universal2 app bundle
-        run: |
-          set -euo pipefail
-          found=0
-          while IFS= read -r -d '' file; do
-            if file "$file" | grep -q "Mach-O"; then
-              found=1
-              archs="$(lipo -archs "$file" 2>/dev/null || true)"
-              case "$archs" in
-                *arm64*x86_64*|*x86_64*arm64*) ;;
-                *)
-                  echo "Missing universal2 slices in $file: ${archs:-unknown}" >&2
-                  exit 1
-                  ;;
-              esac
-            fi
-          done < <(find "dist/TG WS Proxy.app" -type f -print0)
-
-          if [ "$found" -eq 0 ]; then
-            echo "No Mach-O files found in app bundle" >&2
+          if [ -f tg-ws-proxy/Makefile ]; then
+            echo "dir=tg-ws-proxy" >> "$GITHUB_OUTPUT"
+          elif [ -f Makefile ] && [ -d common ] && [ -d .github/workflows ]; then
+            echo "dir=." >> "$GITHUB_OUTPUT"
+          else
+            echo "Could not find tg-ws-proxy project directory"
+            echo "Repository root content:"
+            ls -la
             exit 1
           fi
 
-      - name: Create DMG
+      - name: Build package
         run: |
-          set -euo pipefail
-          APP_NAME="TG WS Proxy"
-          DMG_TEMP="dist/dmg_temp"
-
-          rm -rf "$DMG_TEMP"
-          mkdir -p "$DMG_TEMP"
-          cp -R "dist/${APP_NAME}.app" "$DMG_TEMP/"
-          ln -s /Applications "$DMG_TEMP/Applications"
-
-          hdiutil create \
-            -volname "$APP_NAME" \
-            -srcfolder "$DMG_TEMP" \
-            -ov \
-            -format UDZO \
-            "dist/TgWsProxy_macos_universal.dmg"
-
-          rm -rf "$DMG_TEMP"
+          GOARCH_INPUT="${{ matrix.goarch }}"
+          GOARM_INPUT="${{ matrix.goarm }}"
+          GOMIPS_INPUT="${{ matrix.gomips }}"
+          PKG_ARCH_INPUT="${{ matrix.pkg_arch }}"
+          PROJECT_DIR="${{ steps.project-dir.outputs.dir }}"
+          GO_PROXY_PATH="src"
+          VERSION_INPUT="$(cat "$PROJECT_DIR/VERSION")"
+          if [ -z "$VERSION_INPUT" ]; then
+            echo "VERSION file is empty: $PROJECT_DIR/VERSION"
+            exit 1
+          fi
+          if [ ! -d "$PROJECT_DIR/$GO_PROXY_PATH" ]; then
+            echo "src directory not found in project root"
+            echo "Expected: $PROJECT_DIR/$GO_PROXY_PATH"
+            ls -la "$PROJECT_DIR"
+            exit 1
+          fi
+          make -C "$PROJECT_DIR" tg-ws-proxy-ipk PKG_ARCH="$PKG_ARCH_INPUT" GO_PROXY_DIR="$GO_PROXY_PATH" GOARCH="$GOARCH_INPUT" GOARM="$GOARM_INPUT" GOMIPS="$GOMIPS_INPUT"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v7
         with:
-          name: TgWsProxy-macOS
-          path: dist/TgWsProxy_macos_universal.dmg
+          name: tg-ws-proxy-${{ matrix.arch }}
+          path: ${{ steps.project-dir.outputs.dir }}/out/tg-ws-proxy_*_${{ matrix.pkg_arch }}.ipk
+          if-no-files-found: error
 
-  build-linux:
+  publish-latest-release:
     runs-on: ubuntu-latest
+    needs: [ build ]
+    env:
+      GH_REPO: ${{ github.repository }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            python3-venv \
-            python3-dev \
-            python3-gi \
-            gir1.2-ayatanaappindicator3-0.1 \
-            python3-tk
-
-      - name: Create venv with system site-packages
-        run: python3 -m venv --system-site-packages .venv
-
-      - name: Install dependencies
-        run: |
-          .venv/bin/pip install --upgrade pip
-          .venv/bin/pip install .
-          .venv/bin/pip install "pyinstaller==6.13.0"
-
-      - name: Build binary with PyInstaller
-        run: .venv/bin/pyinstaller packaging/linux.spec --noconfirm
-
-      - name: Rename binary artifact
-        run: mv dist/TgWsProxy dist/TgWsProxy_linux_amd64
-
-      - name: Create .deb package
-        run: |
-          set -euo pipefail
-          VERSION="${{ github.event.inputs.version }}"
-          VERSION="${VERSION#v}"
-          PKG_ROOT="pkg"
-
-          rm -rf "$PKG_ROOT"
-          mkdir -p \
-            "$PKG_ROOT/DEBIAN" \
-            "$PKG_ROOT/usr/bin" \
-            "$PKG_ROOT/usr/share/applications" \
-            "$PKG_ROOT/usr/share/icons/hicolor/256x256/apps"
-
-          install -m 755 dist/TgWsProxy_linux_amd64 "$PKG_ROOT/usr/bin/tg-ws-proxy"
-
-          .venv/bin/python - <<PY
-          from PIL import Image
-
-          Image.open("icon.ico").save(
-              "${PKG_ROOT}/usr/share/icons/hicolor/256x256/apps/tg-ws-proxy.png",
-              "PNG",
-          )
-          PY
-
-          cat > "$PKG_ROOT/usr/share/applications/tg-ws-proxy.desktop" <<EOF
-          [Desktop Entry]
-          Type=Application
-          Name=TG WS Proxy
-          GenericName=Telegram Proxy
-          Comment=Telegram Desktop WebSocket Bridge Proxy
-          Exec=tg-ws-proxy
-          Icon=tg-ws-proxy
-          Terminal=false
-          Categories=Network;
-          StartupNotify=true
-          Keywords=telegram;proxy;websocket;
-          EOF
-
-          cat > "$PKG_ROOT/DEBIAN/control" <<EOF
-          Package: tg-ws-proxy
-          Version: ${VERSION}
-          Section: net
-          Priority: optional
-          Architecture: amd64
-          Maintainer: Flowseal
-          Depends: libgtk-3-0, libayatana-appindicator3-1, python3-tk
-          Description: Telegram Desktop WebSocket Bridge Proxy
-           MTProto/WebSocket bridge proxy for Telegram Desktop with tray UI.
-          EOF
-
-          dpkg-deb --build --root-owner-group \
-            "$PKG_ROOT" \
-            "dist/TgWsProxy_linux_amd64.deb"
-            
-      - name: Create .rpm package with fpm
-        run: |
-          set -euo pipefail
-          VERSION="${{ github.event.inputs.version }}"
-          VERSION="${VERSION#v}"
-          
-          sudo gem install fpm -v 1.17.0
-          
-          mkdir -p rpm_package/usr/bin
-          mkdir -p rpm_package/usr/share/applications
-          mkdir -p rpm_package/usr/share/icons/hicolor/256x256/apps
-          
-          cp dist/TgWsProxy_linux_amd64 rpm_package/usr/bin/tg-ws-proxy
-          chmod 755 rpm_package/usr/bin/tg-ws-proxy
-          
-          .venv/bin/python - <<PY
-          from PIL import Image
-          Image.open("icon.ico").save(
-              "rpm_package/usr/share/icons/hicolor/256x256/apps/tg-ws-proxy.png",
-              "PNG",
-          )
-          PY
-          
-          cat > rpm_package/usr/share/applications/tg-ws-proxy.desktop <<EOF
-          [Desktop Entry]
-          Type=Application
-          Name=TG WS Proxy
-          GenericName=Telegram Proxy
-          Comment=Telegram Desktop WebSocket Bridge Proxy
-          Exec=tg-ws-proxy
-          Icon=tg-ws-proxy
-          Terminal=false
-          Categories=Network;
-          StartupNotify=true
-          Keywords=telegram;proxy;websocket;
-          EOF
-          
-          cat > post_install.sh <<EOF
-          #!/bin/bash
-          if [ -x /usr/bin/update-desktop-database ]; then
-            /usr/bin/update-desktop-database &> /dev/null || :
-          fi
-          if [ -x /usr/bin/gtk-update-icon-cache ]; then
-            /usr/bin/gtk-update-icon-cache -q /usr/share/icons/hicolor &> /dev/null || :
-          fi
-          EOF
-          
-          chmod +x post_install.sh
-          
-          fpm -s dir \
-              -t rpm \
-              -n tg-ws-proxy \
-              -v ${VERSION} \
-              --iteration 1 \
-              --architecture x86_64 \
-              --license "MIT" \
-              --vendor "Flowseal" \
-              --maintainer "Flowseal" \
-              --url "https://github.com/Flowseal/tg-ws-proxy" \
-              --description "MTProto/WebSocket bridge proxy for Telegram Desktop with tray UI." \
-              --depends "libgtk-3.so.0()(64bit)" \
-              --depends "libayatana-appindicator3.so.1()(64bit)" \
-              --depends "python3-tkinter" \
-              --after-install post_install.sh \
-              --after-remove post_install.sh \
-              -C rpm_package \
-              .
-          
-          mv tg-ws-proxy-${VERSION}-1.x86_64.rpm dist/TgWsProxy_linux_amd64.rpm
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v7
+      - name: Download build artifacts
+        uses: actions/download-artifact@v8
         with:
-          name: TgWsProxy-linux
-          path: |
-            dist/TgWsProxy_linux_amd64
-            dist/TgWsProxy_linux_amd64.deb
-            dist/TgWsProxy_linux_amd64.rpm
-
-  release:
-    needs: [build-windows, build-win7, build-macos, build-linux]
-    runs-on: ubuntu-latest
-    if: ${{ github.event.inputs.make_release == 'true' }}
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          pattern: TgWsProxy*
-          path: dist
+          path: out
           merge-multiple: true
 
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+      - name: Resolve latest target release
+        id: target-release
+        uses: actions/github-script@v8
         with:
-          tag_name: ${{ github.event.inputs.version }}
-          name: "TG WS Proxy ${{ github.event.inputs.version }}"
-          body: |
-            ## 
-            ### [❤️ Поддержать развитие проекта](https://github.com/Flowseal/tg-ws-proxy/blob/main/docs/Funding.md)
+          script: |
+            const { owner, repo } = context.repo;
+            const releases = await github.paginate(github.rest.repos.listReleases, {
+              owner,
+              repo,
+              per_page: 100,
+            });
 
-            > [!TIP]
-            > Не можете скачать?
-            > Добавьте `185.199.109.133 release-assets.githubusercontent.com` в hosts или воспользуйтесь зеркалом: https://sourceforge.net/projects/tg-ws-proxy.mirror/files/
-          files: |
-            dist/TgWsProxy_windows.exe
-            dist/TgWsProxy_windows_7_64bit.exe
-            dist/TgWsProxy_windows_7_32bit.exe
-            dist/TgWsProxy_macos_universal.dmg
-            dist/TgWsProxy_linux_amd64
-            dist/TgWsProxy_linux_amd64.deb
-            dist/TgWsProxy_linux_amd64.rpm
-          draft: false
-          prerelease: false
+            const picked = releases.find((rel) => !rel.draft && !rel.prerelease);
+            if (!picked) {
+              core.setFailed('No release found to update');
+              return;
+            }
+
+            core.setOutput('id', String(picked.id));
+            core.setOutput('tag', picked.tag_name);
+
+      - name: Remove previous ipk assets
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_ID: ${{ steps.target-release.outputs.id }}
+        run: |
+          gh api "repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
+            --jq '.[] | select(.name | test("^tg-ws-proxy.*\\.ipk$")) | .id' \
+            | while read -r asset_id; do
+                [ -n "$asset_id" ] || continue
+                gh api -X DELETE "repos/${{ github.repository }}/releases/assets/${asset_id}"
+              done
+
+      - name: Upload new ipk assets to latest release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.target-release.outputs.tag }}
+        run: |
+          mapfile -t files < <(find out -type f -name 'tg-ws-proxy_*.ipk' | sort)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "No ipk files found"
+            exit 1
+          fi
+
+          printf '%s\n' "${files[@]}"
+          gh release upload "$TAG" "${files[@]}" --clobber
+
+      - name: Dispatch to feedly
+        if: success()
+        run: |
+          curl -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: token ${{ secrets.AGGREGATOR_PAT }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/spatiumstas/feedly/dispatches \
+            -d '{"event_type":"package-built","client_payload":{"package":"'"${{ github.repository }}"'","channel":"release","tag":"'"${{ steps.target-release.outputs.tag }}"'"}}'

.github/workflows/issue-triage.yml

@@ -1,42 +0,0 @@
-name: Auto comment on new issues
-
-on:
-  issues:
-    types: [opened]
-
-permissions:
-  issues: write
-
-jobs:
-  comment:
-    if: contains(github.event.issue.labels.*.name, 'bug')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Comment on new issue
-        uses: peter-evans/create-or-update-comment@v5
-        with:
-          issue-number: ${{ github.event.issue.number }}
-          body: |
-            ### Проверьте две вещи:
-            - вы на последней версии: [Releases](https://github.com/Flowseal/tg-ws-proxy/releases)
-            - запускали по инструкции для своей ОС: [Быстрый старт](https://github.com/Flowseal/tg-ws-proxy#навигация)
-
-            ## Решение частых проблем:
-
-            **Q**: Не запускается, падает с ошибкой, не работает как раньше после обновления?  
-            **A**:
-            1. Удалите всё в папке Temp (или хотя бы всё, что начинается с _MEI) 
-            2. Запускайте от имени админа
-            3. Попробуйте Win7 версию (если вы пользователь Windows)
-            4. Попробуйте отключить антивирус (если помогло, то добавьте exe в исключения). Не забудьте включить антивирус обратно.
-
-            ###
-
-            **Q**: Не грузит медиа? (фото/видео/стикеры)  
-            **A**: Удалите в настройках прокси в поле **DC → IP** всё, кроме `4:149.154.167.220`. Если это не помогло, полностью очистите это поле.
-
-
-            #### Если проблема решена, то закройте Issue
-
-            ### Если проблема осталась, пожалуйста, приложите по возможности логи.
-            Сделать это можно через иконку в трее -> Пкм -> Открыть логи. Сохраните логи в файл и приложите его сюда.

.gitignore

@@ -1,27 +0,0 @@
-# Python
-__pycache__/
-*.py[cod]
-*.pyo
-*.egg-info/
-dist/
-build/
-*.spec.bak
-venv/
-.venv/
-
-# PyInstaller
-*.manifest
-*.log
-
-# IDE
-.vscode/
-.idea/
-*.swp
-*.swo
-
-# OS
-Thumbs.db
-Desktop.ini
-.DS_Store
-
-/icon.icns

CONTRIBUTING.md

@@ -1,48 +0,0 @@
-# CONTRIBUTING
-
-Спасибо за желание помочь проекту `tg-ws-proxy`.
-
-## Перед созданием issue
-
-1. Проверьте документацию в `docs/README.md`.
-2. Убедитесь, что похожий issue еще не открыт.
-3. Для корректной работы triage используйте стандартные лейблы из `.github/labels.md`.
-
-## Как сообщать о проблемах
-
-- Используйте шаблон `Проблема`.
-- По возможности укажите:
-  - версию приложения,
-  - ОС,
-  - шаги воспроизведения,
-  - ожидаемое и фактическое поведение,
-  - лог-файл или текст ошибки.
-
-Чем точнее описание, тем быстрее можно помочь.
-
-## Локальный запуск из исходников
-
-Требуется Python `>=3.8`.
-
-```bash
-pip install -e .
-```
-
-Запуск:
-
-- консольный режим: `tg-ws-proxy`
-- Windows tray: `tg-ws-proxy-tray-win`
-- macOS tray: `tg-ws-proxy-tray-macos`
-- Linux tray: `tg-ws-proxy-tray-linux`
-
-Подробности: `docs/BuildFromSource.md`.
-
-## Pull Request
-
-Перед открытием PR:
-
-1. Убедитесь, что изменение решает конкретную проблему.
-2. Проверьте, что не сломаны существующие сценарии.
-3. Обновите документацию, если меняется поведение или настройка.
-
-Небольшие и сфокусированные PR проверяются и принимаются быстрее.

Dockerfile

@@ -1,46 +0,0 @@
-# syntax=docker/dockerfile:1.7
-
-FROM python:3.12-slim AS builder
-
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PIP_DISABLE_PIP_VERSION_CHECK=1 \
-    PIP_NO_CACHE_DIR=1 \
-    VIRTUAL_ENV=/opt/venv
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends build-essential cargo libffi-dev libssl-dev \
-    && python -m venv "$VIRTUAL_ENV" \
-    && "$VIRTUAL_ENV/bin/pip" install --upgrade pip setuptools wheel \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-RUN "$VIRTUAL_ENV/bin/pip" install cryptography==46.0.5
-
-FROM python:3.12-slim AS runtime
-
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PATH=/opt/venv/bin:$PATH \
-    TG_WS_PROXY_HOST=0.0.0.0 \
-    TG_WS_PROXY_PORT=1443 \
-    TG_WS_PROXY_SECRET=""  \
-    TG_WS_PROXY_DC_IPS="2:149.154.167.220 4:149.154.167.220"
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends tini ca-certificates \
-    && rm -rf /var/lib/apt/lists/* \
-    && groupadd --system app \
-    && useradd --system --gid app --create-home --home-dir /home/app app
-
-WORKDIR /app
-COPY --from=builder /opt/venv /opt/venv
-COPY proxy ./proxy
-COPY docs/README.md LICENSE ./
-
-USER app
-
-EXPOSE 1443/tcp
-
-ENTRYPOINT ["/usr/bin/tini", "--", "/bin/sh", "-lc", "set -eu; args=\"--host ${TG_WS_PROXY_HOST} --port ${TG_WS_PROXY_PORT}\"; for dc in ${TG_WS_PROXY_DC_IPS}; do args=\"$args --dc-ip $dc\"; done; if [ -n \"${TG_WS_PROXY_SECRET}\" ]; then args=\"$args --secret ${TG_WS_PROXY_SECRET}\"; fi; exec /opt/venv/bin/python -u proxy/tg_ws_proxy.py $args \"$@\"", "--"]
-CMD []

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Flowseal
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

Makefile

@@ -0,0 +1,90 @@
+SHELL := /bin/bash
+PACKAGE := tg-ws-proxy
+ROOT_DIR := /opt
+DEPENDENCIES := ca-certificates xxd
+GOOS ?= linux
+GOARCH ?= arm64
+GOARM ?=
+GOMIPS ?=
+CGO_ENABLED ?= 0
+GO_PROXY_DIR ?= src
+GO_BIN_NAME ?= tg-ws-proxy
+GO_BIN ?= out/$(GO_BIN_NAME)-$(GOARCH)
+
+DEFAULT_PKG_ARCH := $(GOARCH)
+ifeq ($(GOARCH),amd64)
+DEFAULT_PKG_ARCH := x64
+endif
+ifeq ($(GOARCH),arm64)
+DEFAULT_PKG_ARCH := aarch64
+endif
+ifeq ($(GOARCH),arm)
+ifeq ($(GOARM),7)
+DEFAULT_PKG_ARCH := armv7
+else
+DEFAULT_PKG_ARCH := arm
+endif
+endif
+ifeq ($(GOARCH),mipsle)
+DEFAULT_PKG_ARCH := mipsel
+endif
+
+PKG_ARCH ?= $(DEFAULT_PKG_ARCH)
+VERSION := $(shell cat VERSION)
+
+.PHONY: clean _build-go _pkg-clean _pkg-control _pkg-scripts _pkg-data _pkg-ipk tg-ws-proxy-ipk
+
+clean:
+	rm -rf out
+
+_build-go:
+	mkdir -p out
+	cd "$(GO_PROXY_DIR)" && \
+		GOOS=$(GOOS) GOARCH=$(GOARCH) GOARM=$(GOARM) GOMIPS=$(GOMIPS) CGO_ENABLED=$(CGO_ENABLED) \
+		go build -o "$(abspath $(GO_BIN))" .
+	echo "$(VERSION)" > out/VERSION
+
+_pkg-clean:
+	rm -rf out/pkg
+	mkdir -p out/pkg/control
+	mkdir -p out/pkg/data
+
+_pkg-control:
+	version="$$(cat out/VERSION)"; \
+	echo "Package: $(PACKAGE)" > out/pkg/control/control; \
+	echo "Version: $$version-1" >> out/pkg/control/control; \
+	echo "Depends: $(DEPENDENCIES)" >> out/pkg/control/control; \
+	echo "Section: net" >> out/pkg/control/control; \
+	echo "Architecture: $(PKG_ARCH)" >> out/pkg/control/control; \
+	echo "License: MIT" >> out/pkg/control/control; \
+	echo "Description: Telegram MTProto WS bridge proxy (Go binary)" >> out/pkg/control/control
+
+_pkg-scripts:
+	cp common/ipk/prerm out/pkg/control/prerm
+	cp common/ipk/postinst out/pkg/control/postinst
+	cp common/ipk/postrm out/pkg/control/postrm
+	cp common/ipk/conffiles out/pkg/control/conffiles
+	find out/pkg/control -type f -print0 | xargs -0 dos2unix
+	chmod +x out/pkg/control/prerm out/pkg/control/postinst out/pkg/control/postrm
+
+_pkg-data:
+	mkdir -p out/pkg/data$(ROOT_DIR)/etc/init.d
+	mkdir -p out/pkg/data$(ROOT_DIR)/etc
+	mkdir -p out/pkg/data$(ROOT_DIR)/bin
+	cp "$(GO_BIN)" out/pkg/data$(ROOT_DIR)/bin/tg-ws-proxy
+	cat common/tg-ws-proxy-common.sh > out/pkg/data$(ROOT_DIR)/etc/init.d/S61tg-ws-proxy
+	awk '/^start\(\)/{p=1} p{print}' common/S61tg-ws-proxy >> out/pkg/data$(ROOT_DIR)/etc/init.d/S61tg-ws-proxy
+	cp common/tg-ws-proxy.conf out/pkg/data$(ROOT_DIR)/etc/tg-ws-proxy.conf
+	find out/pkg/data -type f -print0 | xargs -0 dos2unix
+	chmod +x out/pkg/data$(ROOT_DIR)/bin/tg-ws-proxy
+	chmod +x out/pkg/data$(ROOT_DIR)/etc/init.d/S61tg-ws-proxy
+
+_pkg-ipk: _pkg-clean _pkg-control _pkg-scripts _pkg-data
+	cd out/pkg/control; tar czf ../control.tar.gz .; cd ../../..
+	cd out/pkg/data; tar czf ../data.tar.gz .; cd ../../..
+	echo 2.0 > out/pkg/debian-binary
+	version="$$(cat out/VERSION)"; \
+	cd out/pkg; tar czf ../$(PACKAGE)_$$version-1_$(PKG_ARCH).ipk control.tar.gz data.tar.gz debian-binary; cd ../..
+
+tg-ws-proxy-ipk: _build-go _pkg-ipk
+	@echo "Built: out/$(PACKAGE)_$$(cat out/VERSION)-1_$(PKG_ARCH).ipk"

README.md

@@ -0,0 +1,76 @@
+# TG WS Proxy Go
+
+### Install
+
+Repository:
+```shell
+curl -fsSL https://raw.githubusercontent.com/spatiumstas/feedly/main/add-repo.sh | sh
+```
+Package:
+```shell
+opkg install tg-ws-proxy
+```
+
+### Config
+
+Main config file:
+
+```shell
+/opt/etc/tg-ws-proxy.conf
+```
+
+Minimal config example:
+
+```conf
+HOST=0.0.0.0
+PORT=1443
+SECRET=
+LOG_LEVEL=0
+DC_IP_DEFAULT=149.154.167.220
+DC_IP_DEFAULT_POOL=""
+EXTRA_ARGS=""
+```
+
+> Notes:
+
+1. `SECRET` must be 32 hex chars. If empty, it is auto-generated during install.
+2. `DC_IP_DEFAULT` and `DC_IP_DEFAULT_POOL` are global defaults for implicit DC map (`1,2,3,4,5,203`).
+3. `EXTRA_ARGS` is for per-DC overrides and extra runtime flags.
+
+Override examples:
+
+```conf
+# Per-DC pool override (DC1)
+EXTRA_ARGS="--dc-ip-pool 1:149.154.175.50,149.154.167.220"
+
+# Per-DC single IP override (DC203) + verbose logs
+EXTRA_ARGS="--dc-ip 203:91.105.192.100 -v"
+```
+
+### Run
+
+```shell
+/opt/etc/init.d/S61tg-ws-proxy start
+/opt/etc/init.d/S61tg-ws-proxy status
+/opt/etc/init.d/S61tg-ws-proxy restart
+/opt/etc/init.d/S61tg-ws-proxy stop
+```
+
+### Logs
+
+If `LOG_LEVEL=1`, service logs are written to:
+
+```shell
+/opt/var/log/tg-ws-proxy.log
+```
+
+### Remove
+
+```shell
+opkg remove tg-ws-proxy
+```
+
+### Remove repository
+```shell
+rm /opt/etc/opkg/feedly.conf
+```

VERSION

@@ -0,0 +1 @@
+0.1

common/S61tg-ws-proxy

@@ -0,0 +1,99 @@
+#!/bin/sh
+
+COMMON_FILE=/opt/etc/init.d/tg-ws-proxy-common.sh
+
+if [ ! -f "$COMMON_FILE" ]; then
+  echo "Missing common script: $COMMON_FILE" >&2
+  exit 1
+fi
+
+. "$COMMON_FILE"
+
+start() {
+  [ -x "$BIN" ] || return 1
+  mkdir -p /opt/var/run /opt/var/log
+  if [ -z "$SECRET" ]; then
+    echo "SECRET is empty in $CONFFILE" >&2
+    return 1
+  fi
+  cleanup_stale_pid
+  if is_running; then
+    echo "tg-ws-proxy already running"
+    return 0
+  fi
+  if [ "$LOG_LEVEL" = "1" ]; then
+	"$BIN" --host "$HOST" --port "$PORT" --secret "$SECRET" --dc-ip-default "$DC_IP_DEFAULT" --dc-ip-default-pool "$DC_IP_DEFAULT_POOL" $EXTRA_ARGS >>"$LOGFILE" 2>&1 &
+  else
+	"$BIN" --host "$HOST" --port "$PORT" --secret "$SECRET" --dc-ip-default "$DC_IP_DEFAULT" --dc-ip-default-pool "$DC_IP_DEFAULT_POOL" $EXTRA_ARGS >/dev/null 2>&1 &
+  fi
+  echo $! > "$PIDFILE"
+
+  i=0
+  while [ "$i" -lt 5 ]; do
+    if is_running; then
+      echo "tg-ws-proxy started"
+      print_connect_link || true
+      return 0
+    fi
+    i=$((i + 1))
+    sleep 1
+  done
+
+  echo "tg-ws-proxy failed to start" >&2
+  cleanup_stale_pid
+  if [ -f "$LOGFILE" ]; then
+    tail -n 20 "$LOGFILE" >&2 || true
+  fi
+  return 1
+}
+
+stop() {
+  cleanup_stale_pid
+  if ! is_running; then
+    echo "tg-ws-proxy is not running"
+    return 0
+  fi
+
+  pid="$(get_pid)"
+  kill "$pid" 2>/dev/null || true
+
+  i=0
+  while [ "$i" -lt 5 ]; do
+    if ! kill -0 "$pid" 2>/dev/null; then
+      rm -f "$PIDFILE"
+      echo "tg-ws-proxy stopped"
+      return 0
+    fi
+    i=$((i + 1))
+    sleep 1
+  done
+
+  kill -9 "$pid" 2>/dev/null || true
+  rm -f "$PIDFILE"
+  echo "tg-ws-proxy force stopped"
+  return 0
+}
+
+status() {
+  cleanup_stale_pid
+  if is_running; then
+    echo "tg-ws-proxy is running (pid $(get_pid))"
+    print_connect_link || true
+    return 0
+  fi
+  echo "tg-ws-proxy is not running"
+  return 1
+}
+
+restart() {
+  stop
+  start
+}
+
+case "$1" in
+  start) start ;;
+  stop) stop ;;
+  restart) restart ;;
+  status) status ;;
+  *) echo "Usage: $0 {start|stop|restart|status}"; exit 1 ;;
+esac

common/ipk/conffiles

@@ -0,0 +1 @@
+/opt/etc/tg-ws-proxy.conf

common/ipk/postinst

@@ -0,0 +1,27 @@
+#!/bin/sh
+set -e
+
+chmod +x /opt/bin/tg-ws-proxy || true
+chmod +x /opt/etc/init.d/S61tg-ws-proxy || true
+
+CONFFILE=/opt/etc/tg-ws-proxy.conf
+INIT_SCRIPT=/opt/etc/init.d/S61tg-ws-proxy
+
+if [ -f "$CONFFILE" ]; then
+	. "$CONFFILE" || true
+	if [ -z "${SECRET:-}" ]; then
+		secret="$(head -c 16 /dev/urandom | xxd -ps 2>/dev/null | tr -d ' \r\n')"
+		if [ "${#secret}" -eq 32 ]; then
+			if grep -Eq '^[[:space:]]*SECRET=' "$CONFFILE"; then
+				sed -i "s|^[[:space:]]*SECRET=.*$|SECRET=$secret|" "$CONFFILE"
+			else
+				printf '\nSECRET=%s\n' "$secret" >> "$CONFFILE"
+			fi
+			echo "Generated SECRET in $CONFFILE"
+		else
+			echo "WARNING: failed to generate SECRET automatically" >&2
+		fi
+	fi
+fi
+
+"$INIT_SCRIPT" restart || true

common/ipk/postrm

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -e
+
+[ "${PKG_UPGRADE}" = "1" ] && exit 0
+
+rm -f /opt/bin/tg-ws-proxy
+rm -f /opt/etc/init.d/S61tg-ws-proxy
+
+echo "tg-ws-proxy removed"

common/ipk/prerm

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+INIT_SCRIPT="/opt/etc/init.d/S61tg-ws-proxy"
+
+stop_func() {
+  if [ -f "$INIT_SCRIPT" ]; then
+    "$INIT_SCRIPT" stop
+  fi
+}
+
+stop_func
+
+exit 0

common/tg-ws-proxy-common.sh

@@ -0,0 +1,106 @@
+#!/bin/sh
+
+PATH=/opt/sbin:/opt/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+PIDFILE=/opt/var/run/tg-ws-proxy.pid
+LOGFILE=/opt/var/log/tg-ws-proxy.log
+BIN=/opt/bin/tg-ws-proxy
+CONFFILE=/opt/etc/tg-ws-proxy.conf
+DC_IP_DEFAULT=149.154.167.220
+DC_IP_DEFAULT_POOL=
+
+if [ -f "$CONFFILE" ]; then
+  . "$CONFFILE"
+fi
+
+get_pid() {
+  [ -f "$PIDFILE" ] || return 1
+  pid="$(cat "$PIDFILE" 2>/dev/null)"
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  echo "$pid"
+}
+
+is_running() {
+  pid_saved="$(get_pid)" || return 1
+  if ! kill -0 "$pid_saved" 2>/dev/null; then
+    return 1
+  fi
+
+  cmdline_file="/proc/$pid_saved/cmdline"
+  [ -r "$cmdline_file" ] || return 1
+  cmdline="$(tr '\000' ' ' < "$cmdline_file")"
+
+  case "$cmdline" in
+    *"$BIN"*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+cleanup_stale_pid() {
+  if [ -f "$PIDFILE" ] && ! is_running; then
+    rm -f "$PIDFILE"
+  fi
+}
+
+load_runtime_args_from_pid() {
+  pid="$(get_pid)" || return 1
+  cmdline_file="/proc/$pid/cmdline"
+  [ -r "$cmdline_file" ] || return 1
+
+  rt_host=""
+  rt_port=""
+  rt_secret=""
+
+  set -- $(tr '\000' ' ' < "$cmdline_file")
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --host)
+        rt_host="$2"
+        shift 2
+        ;;
+      --port)
+        rt_port="$2"
+        shift 2
+        ;;
+      --secret)
+        rt_secret="$2"
+        shift 2
+        ;;
+      *)
+        shift
+        ;;
+    esac
+  done
+
+  RT_HOST="$rt_host"
+  RT_PORT="$rt_port"
+  RT_SECRET="$rt_secret"
+  return 0
+}
+
+print_connect_link() {
+  link_host="$HOST"
+  link_port="$PORT"
+  link_secret="$SECRET"
+
+  if is_running && load_runtime_args_from_pid; then
+    [ -n "$RT_HOST" ] && link_host="$RT_HOST"
+    [ -n "$RT_PORT" ] && link_port="$RT_PORT"
+    [ -n "$RT_SECRET" ] && link_secret="$RT_SECRET"
+  fi
+
+  if [ -z "$link_secret" ]; then
+    echo "SECRET is empty in $CONFFILE" >&2
+    return 1
+  fi
+
+  if [ "$link_host" = "0.0.0.0" ]; then
+    br0_ip="$(ip -f inet addr show dev br0 2>/dev/null | sed -n 's/.*inet \([0-9.]\+\)\/.*/\1/p' | head -n 1)"
+    [ -n "$br0_ip" ] && link_host="$br0_ip"
+  fi
+
+  echo "Connect link:"
+  echo "  tg://proxy?server=$link_host&port=$link_port&secret=dd$link_secret"
+}

common/tg-ws-proxy.conf

@@ -0,0 +1,16 @@
+HOST=0.0.0.0
+PORT=1443
+# 32 hex chars
+SECRET=
+# Proxy verbosity: 0 = no service log file, 1 = write /opt/var/log/tg-ws-proxy.log
+LOG_LEVEL=0
+# Default target IP used for implicit DC map (1,2,3,4,5,203) when no --dc-ip is provided
+DC_IP_DEFAULT=149.154.167.220
+# Optional default target IP pool for implicit DC map, comma-separated
+# Example: DC_IP_DEFAULT_POOL="149.154.167.220,149.154.175.50"
+# Applies to all implicit DCs (1,2,3,4,5,203) unless overridden via --dc-ip/--dc-ip-pool in EXTRA_ARGS.
+DC_IP_DEFAULT_POOL=""
+# Optional per-DC overrides and extra runtime flags.
+# Keep defaults in DC_IP_DEFAULT / DC_IP_DEFAULT_POOL, and use EXTRA_ARGS only for exceptions.
+# Example: EXTRA_ARGS="--dc-ip-pool 1:149.154.175.50,149.154.167.220 --dc-ip 203:91.105.192.100 -v"
+EXTRA_ARGS=""

docs/BuildFromSource.md

@@ -1,75 +0,0 @@
-# Установка из исходников
-
-## Консольный прокси
-
-Для запуска только прокси без интерфейса системного трея достаточно базовой установки:
-
-```bash
-pip install -e .
-tg-ws-proxy
-```
-
-## Tray-приложение по ОС
-
-### Windows 7/10+
-
-```bash
-pip install -e .
-tg-ws-proxy-tray-win
-```
-
-### macOS
-
-```bash
-pip install -e .
-tg-ws-proxy-tray-macos
-```
-
-### Linux
-
-```bash
-pip install -e .
-tg-ws-proxy-tray-linux
-```
-
-## Консольный режим из исходников
-
-```bash
-tg-ws-proxy [--port PORT] [--host HOST] [--dc-ip DC:IP ...] [-v]
-```
-
-**Аргументы:**
-
-| Аргумент | По умолчанию | Описание |
-|---|---|---|
-| `--port` | `1443` | Порт прокси |
-| `--host` | `127.0.0.1` | Хост прокси |
-| `--secret` | `random` | 32-значный hex-ключ для авторизации клиентов |
-| `--dc-ip` | `2:149.154.167.220`, `4:149.154.167.220` | Целевой IP для DC (параметр можно указывать несколько раз) |
-| `--no-cfproxy` | `false` | Отключить попытку [проксирования через Cloudflare](./CfProxy.md) |
-| `--cfproxy-domain` | | Указать свой домен для проксирования через Cloudflare. [Подробнее](./CfProxy.md) |
-| `--cfproxy-priority` | `true` | Пробовать проксировать через Cloudflare перед прямым TCP подключением |
-| `--fake-tls-domain` | | Включить маскировку Fake TLS (ee-secret) с указанным SNI-доменом |
-| `--proxy-protocol` | выкл. | Принимать HAProxy PROXY protocol v1 (для работы за nginx/haproxy с `proxy_protocol on`) |
-| `--buf-kb` | `256` | Размер буфера в КБ |
-| `--pool-size` | `4` | Количество заготовленных соединений на каждый DC |
-| `--log-file` | выкл. | Путь к файлу, в который будут сохраняться логи |
-| `--log-max-mb` | `5` | Максимальный размер файла логов в МБ (после этого начинается перезапись) |
-| `--log-backups` | `0` | Количество сохранений логов после перезаписи |
-| `-v`, `--verbose` | выкл. | Подробное логирование (DEBUG) |
-
-**Примеры:**
-
-```bash
-# Стандартный запуск
-tg-ws-proxy
-
-# Другой порт и дополнительные DC
-tg-ws-proxy --port 9050 --dc-ip 1:149.154.175.205 --dc-ip 2:149.154.167.220
-
-# С подробным логированием
-tg-ws-proxy -v
-
-# Fake TLS маскировка (ee-secret)
-tg-ws-proxy --fake-tls-domain example.com
-```

docs/CfProxy.md

@@ -1,32 +0,0 @@
-# Cloudflare-прокси
-
-Для недоступных дата-центров можно использовать альтернативный бесплатный способ подключения — проксирование через Cloudflare. **Для работы нужен только домен**. В приложении есть домен по умолчанию, но его можно (и желательно) заменить на свой.
-  
-Прокси возвращает доступ к тому, что раньше не загружалось (реакции, некоторые стикеры). Если на аккаунте без Premium не загружаются фото/видео, оставьте в блоке `DC → IP` только `4:149.154.167.220`. Если CF-прокси работает, медиа снова начнет загружаться.
-
-## Зачем мне настраивать свой домен?
-
-Cloudflare имеет лимиты на одновременное количество WS-подключений. Домен по умолчанию может перестать работать в любой момент.
-
-## Настройка своего домена
-
-1. Добавьте свой домен в Cloudflare (либо купив его напрямую у Cloudflare, либо изменив NS-серверы: https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/). Домены стоят примерно 150 рублей в год, подойдёт любой.
-
-2. В `SSL/TLS` → `Overview` выставьте режим **Flexible**.
-
-3. В `DNS` → `Records` добавьте следующие `A`-записи через `+ Add Record`:
-- Name=`kws1`   IPv4=`149.154.175.50`
-- Name=`kws2`   IPv4=`149.154.167.51`
-- Name=`kws3`   IPv4=`149.154.175.100`
-- Name=`kws4`   IPv4=`149.154.167.91`
-- Name=`kws5`   IPv4=`149.154.171.5`
-- Name=`kws203` IPv4=`91.105.192.100`
-
-4. **Добавьте домен в [zapret](https://github.com/Flowseal/zapret-discord-youtube/) или в любое другое ПО, так как подсеть Cloudflare может быть заблокирована (например, в России).**
-
-5. В настройках `TgWsProxy` замените домен на свой.
-
-## Благодарности
-
-- Идея: https://github.com/Nekogram/WSProxy
-- Спасибо [@UjuiUjuMandan](https://github.com/UjuiUjuMandan) за информацию.

docs/FakeTlsNginx.md

@@ -1,52 +0,0 @@
-# Fake TLS + upstream в nginx
-
-Домен в параметре `--fake-tls-domain` должен указывать на тот же IP, на котором запущен прокси.
-
-## Пример `nginx.conf` для stream-модуля
-
-```nginx
-upstream mtproto {
-    server 127.0.0.1:8446;
-}
-
-map $ssl_preread_server_name $sni_name {
-    hostnames;
-    example.com mtproto;
-    # if you have xray with selfsni running:
-    # sub.example.com  www;
-    # default xray;
-}
-
-# upstream xray {
-#     server 127.0.0.1:8443;
-# }
-#
-# upstream www {
-#     server 127.0.0.1:7443;
-# }
-
-server {
-    proxy_protocol on;
-    set_real_ip_from unix:;
-    listen          443;
-    proxy_pass      $sni_name;
-    ssl_preread     on;
-}
-```
-
-## Запуск прокси за Nginx
-
-```bash
-python3 proxy/tg_ws_proxy.py \
-  --port 8446 \
-  --host 127.0.0.1 \
-  --fake-tls-domain example.com \
-  --proxy-protocol \
-  --secret <32-hex-chars>
-```
-
-Ссылка для подключения будет в формате `ee`-секрета:
-
-```text
-tg://proxy?server=your.domain.com&port=443&secret=ee<secret><domain_hex>
-```

docs/Funding.md

@@ -1,12 +0,0 @@
-> [!TIP]
->
-> ### 🎉 Поддержать меня
->
-> **USDT (TRC20)**: `TXPnKs2Ww1RD8JN6nChFUVmi5r2hqrWjuu`  
-> **BTC**: `bc1qr8vd6jelkyyry3m4mq6z5txdx4pl856fu6ss0w`  
-> **ETH**: `0x1417878fdc5047E670a77748B34819b9A49C72F1`  
-> **Другие монеты**: https://nowpayments.io/donation/flowseal
-
-Проект полностью бесплатен для всех.  
-Однако его развитие и стабильная работа при росте числа пользователей требуют вложений.  
-Буду благодарен за любую форму поддержки! Спасибо ❤️

docs/README.linux.md

@@ -1,51 +0,0 @@
-# TG WS Proxy для Linux
-
-## Готовые сборки
-
-Для Debian/Ubuntu скачайте со [страницы релизов](https://github.com/Flowseal/tg-ws-proxy/releases) пакет `TgWsProxy_linux_amd64.deb`.
-
-Для Arch и основанных на Arch дистрибутивов подготовлены пакеты в AUR:
-
-- [tg-ws-proxy-bin](https://aur.archlinux.org/packages/tg-ws-proxy-bin)
-- [tg-ws-proxy-git](https://aur.archlinux.org/packages/tg-ws-proxy-git)
-- [tg-ws-proxy-cli](https://aur.archlinux.org/packages/tg-ws-proxy-cli)
-
-```shell
-# Установка без AUR-helper
-git clone https://aur.archlinux.org/tg-ws-proxy-bin.git
-cd tg-ws-proxy-bin
-makepkg -si
-
-# При помощи AUR-helper
-paru -S tg-ws-proxy-bin
-
-# Для пакета -cli запуск через systemd (8888 — номер порта; secret можно сгенерировать командой openssl rand -hex 16)
-sudo systemctl start tg-ws-proxy@8888:3075abe65830f0325116bb0416cadf9f
-```
-
-Для остальных дистрибутивов можно использовать `TgWsProxy_linux_amd64` (бинарный файл для x86_64).
-
-```bash
-chmod +x TgWsProxy_linux_amd64
-./TgWsProxy_linux_amd64
-```
-
-При первом запуске откроется окно с инструкцией. Приложение работает в системном трее (требуется AppIndicator).
-
-## Настройка Telegram Desktop
-
-1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
-2. Добавьте прокси:
-   - **Тип:** MTProto
-   - **Сервер:** `127.0.0.1` (или переопределенный вами)
-   - **Порт:** `1443` (или переопределенный вами)
-   - **Secret:** из настроек или логов
-
-## Установка из исходников
-
-Подробная инструкция: [BuildFromSource.md](./BuildFromSource.md)
-
-```bash
-pip install -e .
-tg-ws-proxy-tray-linux
-```

docs/README.macos.md

@@ -1,30 +0,0 @@
-# TG WS Proxy для macOS
-
-Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте `TgWsProxy_macos_universal.dmg` (универсальная сборка для Apple Silicon и Intel).
-
-1. Откройте образ
-2. Перенесите `TG WS Proxy.app` в папку `Applications`
-3. При первом запуске macOS может попросить подтвердить открытие: **Системные настройки → Конфиденциальность и безопасность → Всё равно открыть**
-
-Минимально поддерживаемые версии:
-
-- Intel macOS 10.15+
-- Apple Silicon macOS 11.0+
-
-## Настройка Telegram Desktop
-
-1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
-2. Добавьте прокси:
-   - **Тип:** MTProto
-   - **Сервер:** `127.0.0.1` (или переопределенный вами)
-   - **Порт:** `1443` (или переопределенный вами)
-   - **Secret:** из настроек или логов
-
-## Установка из исходников
-
-Подробная инструкция: [BuildFromSource.md](./BuildFromSource.md)
-
-```bash
-pip install -e .
-tg-ws-proxy-tray-macos
-```

docs/README.md

@@ -1,125 +0,0 @@
-> [!TIP]
->
-> ### [🎉 Поддержать меня](./Funding.md)
->
-> **USDT (TRC20)**: `TXPnKs2Ww1RD8JN6nChFUVmi5r2hqrWjuu`  
-> **BTC**: `bc1qr8vd6jelkyyry3m4mq6z5txdx4pl856fu6ss0w`  
-> **ETH**: `0x1417878fdc5047E670a77748B34819b9A49C72F1`  
-> **Другие монеты**: https://nowpayments.io/donation/flowseal
-
-> [!CAUTION]
->
-> ### Реакция антивирусов
->
-> Антивирусы часто ошибочно помечают приложение как вирус из-за упаковщика.  
-> Если вы не можете скачать из-за блокировки антивирусом, то:
->
-> 1) **Попробуйте скачать версию для Windows 7 (по функциональности она не отличается)**
-> 2) Отключите антивирус на время скачивания, добавьте файл в исключения и включите обратно  
->
-> Всегда проверяйте, что скачиваете из интернета, тем более из непроверенных источников. Всегда лучше смотреть на детекты широко известных антивирусов на VirusTotal
-
-# TG WS Proxy
-
-**Локальный MTProto-прокси** для Telegram Desktop, который **ускоряет работу Telegram**, перенаправляя трафик через WebSocket-соединения. Данные передаются в том же зашифрованном виде, а для работы не нужны сторонние серверы.
-
-<picture>
-  <source srcset="https://github.com/user-attachments/assets/17f1d15e-e1c2-41ea-a452-220d13359262" media="(prefers-color-scheme: dark)">
-  <img src="https://github.com/user-attachments/assets/8d595468-83a1-4e4f-bac4-9ce4a07027bd">
-</picture>
-
-## Навигация
-
-- **🚀 Быстрый старт**
-  - **[Windows](./README.windows.md)**
-  - **[macOS](./README.macos.md)**
-  - **[Linux](./README.linux.md)**
-- [Настройка Cloudflare-домена (CF-прокси)](./CfProxy.md)
-- [Fake TLS + upstream в Nginx](./FakeTlsNginx.md)
-- [Файлы конфигурации Tray-приложения](./TrayConfig.md)
-- [Установка из исходников](./BuildFromSource.md)
-- [Руководство для контрибьюторов](../CONTRIBUTING.md)
-
-## Windows: быстрый вход
-
-Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте:
-
-- `TgWsProxy_windows.exe` (Windows 10+)
-- `TgWsProxy_windows_7_64bit.exe` (Windows 7 x64)
-- `TgWsProxy_windows_7_32bit.exe` (Windows 7 x32)
-
-При первом запуске откроется окно с инструкцией по подключению Telegram Desktop. **Приложение сворачивается в системный трей.**
-
-### Меню трея
-
-- **Открыть в Telegram** — автоматически настроить прокси через ссылку `tg://proxy`
-- **Скопировать ссылку** — скопировать ссылку для подключения
-- **Перезапустить прокси** — перезапуск без выхода из приложения
-- **Настройки...** — GUI-редактор конфигурации (версия приложения, опциональная проверка обновлений с GitHub)
-- **Открыть логи** — открыть файл логов
-- **Выход** — остановить прокси и закрыть приложение
-
-### Настройка Telegram Desktop
-
-**Автоматическая настройка**
-
-Щелкните правой кнопкой мыши по значку в трее и выберите **«Открыть в Telegram»**.
-
-Если не сработало (Telegram не открылся с подключением), выполните шаги ниже:
-
-1. Щелкните правой кнопкой мыши по значку в трее и выберите **«Скопировать ссылку»**
-2. Отправьте ссылку в «Избранное» в Telegram и нажмите по ней левой кнопкой мыши
-3. Подключитесь
-
-**Ручная настройка**
-
-1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
-2. Добавьте прокси:
-   - **Тип:** MTProto
-   - **Сервер:** `127.0.0.1` (или переопределенный вами)
-   - **Порт:** `1443` (или переопределенный вами)
-   - **Secret:** из настроек или логов
-
-## Как это работает
-
-```
-Telegram Desktop → MTProto Proxy (127.0.0.1:1443) → WebSocket → Telegram DC
-```
-
-1. Приложение поднимает MTProto прокси на `127.0.0.1:1443`
-2. Перехватывает подключения к IP-адресам Telegram
-3. Извлекает DC ID из MTProto obfuscation init-пакета
-4. Устанавливает WebSocket-соединение (TLS) к соответствующему DC через домены Telegram
-5. Если WS недоступен (302 redirect) — автоматически переключается на CfProxy / прямое TCP-соединение
-
-> [!IMPORTANT] 
-> ### Не грузит фото/видео?
-> **Удалите в настройках прокси в DC → IP всё, кроме `4:149.154.167.220`**  
-> **Если это не помогло, полностью очистите это поле**  
-> Подобная проблема встречается на аккаунтах без Premium  
-> Если это не помогло, настройте собственный домен по инструкции: [CfProxy.md](./CfProxy.md)
-
-## Автоматическая сборка
-
-Проект содержит спецификации PyInstaller ([`packaging/windows.spec`](../packaging/windows.spec), [`packaging/macos.spec`](../packaging/macos.spec), [`packaging/linux.spec`](../packaging/linux.spec)) и GitHub Actions workflow ([`.github/workflows/build.yml`](../.github/workflows/build.yml)) для автоматической сборки.
-
-Минимально поддерживаемые версии ОС для текущих бинарных сборок:
-
-- Windows 10+ для `TgWsProxy_windows.exe`
-- Windows 7 (x64) для `TgWsProxy_windows_7_64bit.exe`
-- Windows 7 (x32) для `TgWsProxy_windows_7_32bit.exe`
-- Intel macOS 10.15+
-- Apple Silicon macOS 11.0+
-- Linux x86_64 (требуется AppIndicator для системного трея)
-
-## Контрибьюторы
-
-Спасибо всем, кто помогает развивать проект ❤️
-
-<a href="https://github.com/Flowseal/tg-ws-proxy/graphs/contributors">
-  <img src="https://contrib.rocks/image?repo=Flowseal/tg-ws-proxy" />
-</a>
-
-## Лицензия
-
-[MIT License](../LICENSE)

docs/README.windows.md

@@ -1,52 +0,0 @@
-# TG WS Proxy для Windows
-
-Перейдите на [страницу релизов](https://github.com/Flowseal/tg-ws-proxy/releases) и скачайте:
-
-- `TgWsProxy_windows.exe` (Windows 10+)
-- `TgWsProxy_windows_7_64bit.exe` (Windows 7 x64)
-- `TgWsProxy_windows_7_32bit.exe` (Windows 7 x32)
-
-Сборки публикуются автоматически через [GitHub Actions](https://github.com/Flowseal/tg-ws-proxy/actions) из открытого исходного кода.
-
-При первом запуске откроется окно с инструкцией по подключению Telegram Desktop. **Приложение сворачивается в системный трей.**
-
-## Меню трея
-
-- **Открыть в Telegram** — автоматически настроить прокси через ссылку `tg://proxy`
-- **Скопировать ссылку** — скопировать ссылку для подключения
-- **Перезапустить прокси** — перезапуск без выхода из приложения
-- **Настройки...** — GUI-редактор конфигурации (версия приложения, опциональная проверка обновлений с GitHub)
-- **Открыть логи** — открыть файл логов
-- **Выход** — остановить прокси и закрыть приложение
-
-При первом запуске после старта может появиться запрос об открытии страницы релиза, если на GitHub вышла новая версия (эту проверку можно отключить в настройках).
-
-## Настройка Telegram Desktop
-
-### Автоматическая настройка
-
-Щелкните правой кнопкой мыши по значку в трее и выберите **«Открыть в Telegram»**.
-
-Если не сработало (Telegram не открылся с подключением), выполните шаги ниже:
-
-1. Щелкните правой кнопкой мыши по значку в трее и выберите **«Скопировать ссылку»**
-2. Отправьте ссылку в «Избранное» в Telegram и нажмите по ней левой кнопкой мыши
-3. Подключитесь
-
-### Ручная настройка
-
-1. Telegram → **Настройки** → **Продвинутые настройки** → **Тип подключения** → **Прокси**
-2. Добавьте прокси:
-   - **Тип:** MTProto
-   - **Сервер:** `127.0.0.1` (или переопределенный вами)
-   - **Порт:** `1443` (или переопределенный вами)
-   - **Secret:** из настроек или логов
-
-## Установка из исходников
-
-Подробная инструкция: [BuildFromSource.md](./BuildFromSource.md)
-
-```bash
-pip install -e .
-tg-ws-proxy-tray-win
-```

docs/TrayConfig.md

@@ -1,31 +0,0 @@
-# Файлы конфигурации Tray-приложения
-
-Tray-приложение хранит данные в:
-
-- **Windows:** `%APPDATA%/TgWsProxy`
-- **macOS:** `~/Library/Application Support/TgWsProxy`
-- **Linux:** `~/.config/TgWsProxy` (или `$XDG_CONFIG_HOME/TgWsProxy`)
-
-```json
-{
-  "host": "127.0.0.1",
-  "port": 1443,
-  "secret": "...",
-  "dc_ip": [
-    "2:149.154.167.220",
-    "4:149.154.167.220"
-  ],
-  "verbose": false,
-  "buf_kb": 256,
-  "pool_size": 4,
-  "log_max_mb": 5.0,
-  "check_updates": true,
-  "cfproxy": true,
-  "cfproxy_priority": true,
-  "cfproxy_user_domain": "",
-  "appearance": "auto"
-}
-```
-
-Ключ `check_updates`: при `true` выполняется запрос к GitHub и сравнение текущей версии с последним релизом (только уведомление и ссылка на страницу загрузки).  
-На Windows в конфиге может быть `autostart` (автозапуск при входе в систему).

linux.py

@@ -1,305 +0,0 @@
-from __future__ import annotations
-
-import os
-import subprocess
-import sys
-import threading
-import time
-from typing import Optional
-
-import customtkinter as ctk
-import pyperclip
-import pystray
-from PIL import Image, ImageTk
-
-from proxy import get_link_host
-
-from utils.tray_common import (
-    APP_NAME, DEFAULT_CONFIG, FIRST_RUN_MARKER, LOG_FILE,
-    acquire_lock, bootstrap, check_ipv6_warning, ctk_run_dialog,
-    ensure_ctk_thread, ensure_dirs, load_config, load_icon, log,
-    maybe_notify_update, quit_ctk, release_lock, restart_proxy,
-    save_config, start_proxy, stop_proxy, tg_proxy_url,
-)
-from ui.ctk_tray_ui import (
-    install_tray_config_buttons, install_tray_config_form,
-    populate_first_run_window, tray_settings_scroll_and_footer,
-    validate_config_form,
-)
-from ui.ctk_theme import (
-    CONFIG_DIALOG_FRAME_PAD, CONFIG_DIALOG_SIZE, FIRST_RUN_SIZE,
-    create_ctk_toplevel, ctk_theme_for_platform, main_content_frame,
-)
-
-_tray_icon: Optional[object] = None
-_config: dict = {}
-_exiting = False
-
-# dialogs (tkinter messagebox)
-
-
-def _msgbox(kind: str, text: str, title: str, **kw):
-    import tkinter as _tk
-    from tkinter import messagebox as _mb
-
-    root = _tk.Tk()
-    root.withdraw()
-    try:
-        root.attributes("-topmost", True)
-    except Exception:
-        pass
-    result = getattr(_mb, kind)(title, text, parent=root, **kw)
-    root.destroy()
-    return result
-
-
-def _show_error(text: str, title: str = "TG WS Proxy — Ошибка") -> None:
-    _msgbox("showerror", text, title)
-
-
-def _show_info(text: str, title: str = "TG WS Proxy") -> None:
-    _msgbox("showinfo", text, title)
-
-
-def _ask_yes_no(text: str, title: str = "TG WS Proxy") -> bool:
-    return bool(_msgbox("askyesno", text, title))
-
-
-def _apply_window_icon(root) -> None:
-    icon_img = load_icon()
-    if icon_img:
-        root._ctk_icon_photo = ImageTk.PhotoImage(icon_img.resize((64, 64)))
-        root.iconphoto(False, root._ctk_icon_photo)
-
-
-# tray callbacks
-
-
-def _on_open_in_telegram(icon=None, item=None) -> None:
-    url = tg_proxy_url(_config)
-    log.info("Copying %s", url)
-    try:
-        pyperclip.copy(url)
-        _show_info(
-            f"Ссылка скопирована в буфер обмена, отправьте её в Telegram и нажмите по ней ЛКМ:\n{url}"
-        )
-    except Exception as exc:
-        log.error("Clipboard copy failed: %s", exc)
-        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
-
-
-def _on_copy_link(icon=None, item=None) -> None:
-    url = tg_proxy_url(_config)
-    log.info("Copying link: %s", url)
-    try:
-        pyperclip.copy(url)
-    except Exception as exc:
-        log.error("Clipboard copy failed: %s", exc)
-        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
-
-
-def _on_restart(icon=None, item=None) -> None:
-    threading.Thread(
-        target=lambda: restart_proxy(_config, _show_error), daemon=True
-    ).start()
-
-
-def _on_edit_config(icon=None, item=None) -> None:
-    threading.Thread(target=_edit_config_dialog, daemon=True).start()
-
-
-def _on_open_logs(icon=None, item=None) -> None:
-    log.info("Opening log file: %s", LOG_FILE)
-    if LOG_FILE.exists():
-        env = {k: v for k, v in os.environ.items() if k not in ("VIRTUAL_ENV", "PYTHONPATH", "PYTHONHOME")}
-        subprocess.Popen(
-            ["xdg-open", str(LOG_FILE)], env=env,
-            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-            stdin=subprocess.DEVNULL, start_new_session=True,
-        )
-    else:
-        _show_info("Файл логов ещё не создан.")
-
-
-def _on_exit(icon=None, item=None) -> None:
-    global _exiting
-    if _exiting:
-        os._exit(0)
-        return
-    _exiting = True
-    log.info("User requested exit")
-    quit_ctk()
-    threading.Thread(target=lambda: (time.sleep(3), os._exit(0)), daemon=True, name="force-exit").start()
-    if icon:
-        icon.stop()
-
-
-# settings dialog
-
-
-def _edit_config_dialog() -> None:
-    if not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
-        _show_error("customtkinter не установлен.")
-        return
-
-    cfg = dict(_config)
-
-    def _build(done: threading.Event) -> None:
-        theme = ctk_theme_for_platform()
-        w, h = CONFIG_DIALOG_SIZE
-        root = create_ctk_toplevel(
-            ctk, title="TG WS Proxy — Настройки", width=w, height=h, theme=theme,
-            after_create=_apply_window_icon,
-        )
-        fpx, fpy = CONFIG_DIALOG_FRAME_PAD
-        frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
-        scroll, footer = tray_settings_scroll_and_footer(ctk, frame, theme)
-        widgets = install_tray_config_form(ctk, scroll, theme, cfg, DEFAULT_CONFIG, show_autostart=False)
-
-        _original_appearance = ctk.get_appearance_mode()
-
-        def _finish() -> None:
-            root.destroy()
-            done.set()
-
-        def _cancel() -> None:
-            ctk.set_appearance_mode(_original_appearance)
-            _finish()
-
-        def on_save() -> None:
-            from tkinter import messagebox
-            merged = validate_config_form(widgets, DEFAULT_CONFIG, include_autostart=False)
-            if isinstance(merged, str):
-                messagebox.showerror("TG WS Proxy — Ошибка", merged, parent=root)
-                return
-
-            _ui_only_keys = {"appearance", "check_updates"}
-            config_changed = any(merged.get(k) != cfg.get(k) for k in merged)
-            proxy_changed = any(merged.get(k) != cfg.get(k) for k in merged if k not in _ui_only_keys)
-
-            if not config_changed:
-                _finish()
-                return
-
-            save_config(merged)
-            _config.update(merged)
-            log.info("Config saved: %s", merged)
-            _tray_icon.menu = _build_menu()
-
-            if not proxy_changed:
-                _finish()
-                return
-
-            do_restart = messagebox.askyesno(
-                "Перезапустить?",
-                "Настройки сохранены.\n\nПерезапустить прокси сейчас?",
-                parent=root,
-            )
-            _finish()
-            if do_restart:
-                threading.Thread(target=lambda: restart_proxy(_config, _show_error), daemon=True).start()
-
-        root.protocol("WM_DELETE_WINDOW", _cancel)
-        install_tray_config_buttons(ctk, footer, theme, on_save=on_save, on_cancel=_cancel)
-
-    ctk_run_dialog(_build)
-
-
-# first run
-
-
-def _show_first_run() -> None:
-    ensure_dirs()
-    if FIRST_RUN_MARKER.exists():
-        return
-    if not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
-        FIRST_RUN_MARKER.touch()
-        return
-
-    host = _config.get("host", DEFAULT_CONFIG["host"])
-    port = _config.get("port", DEFAULT_CONFIG["port"])
-    secret = _config.get("secret", DEFAULT_CONFIG["secret"])
-
-    def _build(done: threading.Event) -> None:
-        theme = ctk_theme_for_platform()
-        w, h = FIRST_RUN_SIZE
-        root = create_ctk_toplevel(
-            ctk, title="TG WS Proxy", width=w, height=h, theme=theme,
-            after_create=_apply_window_icon,
-        )
-
-        def on_done(open_tg: bool) -> None:
-            FIRST_RUN_MARKER.touch()
-            root.destroy()
-            done.set()
-            if open_tg:
-                _on_open_in_telegram()
-
-        populate_first_run_window(ctk, root, theme, host=host, port=port, secret=secret, on_done=on_done)
-
-    ctk_run_dialog(_build)
-
-
-# tray menu
-
-
-def _build_menu():
-    host = _config.get("host", DEFAULT_CONFIG["host"])
-    port = _config.get("port", DEFAULT_CONFIG["port"])
-    link_host = get_link_host(host)
-    return pystray.Menu(
-        pystray.MenuItem(f"Открыть в Telegram ({link_host}:{port})", _on_open_in_telegram, default=True),
-        pystray.MenuItem("Скопировать ссылку", _on_copy_link),
-        pystray.Menu.SEPARATOR,
-        pystray.MenuItem("Перезапустить прокси", _on_restart),
-        pystray.MenuItem("Настройки...", _on_edit_config),
-        pystray.MenuItem("Открыть логи", _on_open_logs),
-        pystray.Menu.SEPARATOR,
-        pystray.MenuItem("Выход", _on_exit),
-    )
-
-
-# entry point
-
-
-def run_tray() -> None:
-    global _tray_icon, _config
-
-    _config = load_config()
-    bootstrap(_config)
-
-    if pystray is None or Image is None:
-        log.error("pystray or Pillow not installed; running in console mode")
-        start_proxy(_config, _show_error)
-        try:
-            while True:
-                time.sleep(1)
-        except KeyboardInterrupt:
-            stop_proxy()
-        return
-
-    start_proxy(_config, _show_error)
-    maybe_notify_update(_config, lambda: _exiting, _ask_yes_no)
-    _show_first_run()
-    check_ipv6_warning(_show_info)
-
-    _tray_icon = pystray.Icon(APP_NAME, load_icon(), "TG WS Proxy", menu=_build_menu())
-    log.info("Tray icon running")
-    _tray_icon.run()
-
-    stop_proxy()
-    log.info("Tray app exited")
-
-
-def main() -> None:
-    if not acquire_lock():
-        _show_info("Приложение уже запущено.", os.path.basename(sys.argv[0]))
-        return
-    try:
-        run_tray()
-    finally:
-        release_lock()
-
-
-if __name__ == "__main__":
-    main()

macos.py

@@ -1,623 +0,0 @@
-from __future__ import annotations
-
-import os
-import subprocess
-import sys
-import threading
-import time
-import webbrowser
-from pathlib import Path
-from typing import Optional
-
-try:
-    import rumps
-except ImportError:
-    rumps = None
-
-try:
-    from PIL import Image, ImageDraw, ImageFont
-except ImportError:
-    Image = ImageDraw = ImageFont = None
-
-try:
-    import pyperclip
-except ImportError:
-    pyperclip = None
-
-from proxy import __version__, get_link_host, parse_dc_ip_list, proxy_config
-from proxy.tg_ws_proxy import _run
-
-from utils.tray_common import (
-    APP_DIR, APP_NAME, DEFAULT_CONFIG, FIRST_RUN_MARKER, IPV6_WARN_MARKER,
-    LOG_FILE, acquire_lock, apply_proxy_config, ensure_dirs, load_config,
-    log, release_lock, save_config, setup_logging, stop_proxy, tg_proxy_url,
-)
-
-MENUBAR_ICON_PATH = APP_DIR / "menubar_icon.png"
-
-_proxy_thread: Optional[threading.Thread] = None
-_async_stop: Optional[object] = None
-_app: Optional[object] = None
-_config: dict = {}
-_exiting: bool = False
-
-# osascript dialogs
-
-
-def _esc(text: str) -> str:
-    return text.replace("\\", "\\\\").replace('"', '\\"')
-
-
-def _osascript(script: str) -> str:
-    r = subprocess.run(["osascript", "-e", script], capture_output=True, text=True)
-    return r.stdout.strip()
-
-
-def _show_error(text: str, title: str = "TG WS Proxy") -> None:
-    _osascript(
-        f'display dialog "{_esc(text)}" with title "{_esc(title)}" '
-        f'buttons {{"OK"}} default button "OK" with icon stop'
-    )
-
-
-def _show_info(text: str, title: str = "TG WS Proxy") -> None:
-    _osascript(
-        f'display dialog "{_esc(text)}" with title "{_esc(title)}" '
-        f'buttons {{"OK"}} default button "OK" with icon note'
-    )
-
-
-def _ask_yes_no(text: str, title: str = "TG WS Proxy") -> bool:
-    return _ask_yes_no_close(text, title) is True
-
-
-def _ask_yes_no_close(text: str, title: str = "TG WS Proxy") -> Optional[bool]:
-    r = subprocess.run(
-        [
-            "osascript", "-e",
-            f'button returned of (display dialog "{_esc(text)}" '
-            f'with title "{_esc(title)}" '
-            f'buttons {{"Закрыть", "Нет", "Да"}} '
-            f'default button "Да" cancel button "Закрыть" with icon note)',
-        ],
-        capture_output=True, text=True,
-    )
-    if r.returncode != 0:
-        return None
-    btn = r.stdout.strip()
-    if btn == "Да":
-        return True
-    if btn == "Нет":
-        return False
-    return None
-
-
-def _osascript_input(prompt: str, default: str, title: str = "TG WS Proxy") -> Optional[str]:
-    r = subprocess.run(
-        [
-            "osascript", "-e",
-            f'text returned of (display dialog "{_esc(prompt)}" '
-            f'default answer "{_esc(default)}" '
-            f'with title "{_esc(title)}" '
-            f'buttons {{"Закрыть", "OK"}} '
-            f'default button "OK" cancel button "Закрыть")',
-        ],
-        capture_output=True, text=True,
-    )
-    if r.returncode != 0:
-        return None
-    return r.stdout.rstrip("\r\n")
-
-
-# menubar icon
-
-
-def _make_menubar_icon(size: int = 44):
-    if Image is None:
-        return None
-    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
-    draw = ImageDraw.Draw(img)
-    margin = size // 11
-    draw.ellipse([margin, margin, size - margin, size - margin], fill=(0, 0, 0, 255))
-    try:
-        font = ImageFont.truetype("/System/Library/Fonts/Helvetica.ttc", size=int(size * 0.55))
-    except Exception:
-        font = ImageFont.load_default()
-    bbox = draw.textbbox((0, 0), "T", font=font)
-    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
-    draw.text(
-        ((size - tw) // 2 - bbox[0], (size - th) // 2 - bbox[1]),
-        "T", fill=(255, 255, 255, 255), font=font,
-    )
-    return img
-
-
-def _ensure_menubar_icon() -> None:
-    if MENUBAR_ICON_PATH.exists():
-        return
-    ensure_dirs()
-    img = _make_menubar_icon(44)
-    if img:
-        img.save(str(MENUBAR_ICON_PATH), "PNG")
-
-
-# proxy lifecycle (macOS-local)
-
-import asyncio as _asyncio
-
-
-def _run_proxy_thread() -> None:
-    global _async_stop
-    loop = _asyncio.new_event_loop()
-    _asyncio.set_event_loop(loop)
-    stop_ev = _asyncio.Event()
-    _async_stop = (loop, stop_ev)
-    try:
-        loop.run_until_complete(_run(stop_event=stop_ev))
-    except Exception as exc:
-        log.error("Proxy thread crashed: %s", exc)
-        if "Address already in use" in str(exc):
-            _show_error(
-                "Не удалось запустить прокси:\n"
-                "Порт уже используется другим приложением.\n\n"
-                "Закройте приложение, использующее этот порт, "
-                "или измените порт в настройках прокси и перезапустите."
-            )
-    finally:
-        loop.close()
-        _async_stop = None
-
-
-def _start_proxy() -> None:
-    global _proxy_thread
-    if _proxy_thread and _proxy_thread.is_alive():
-        log.info("Proxy already running")
-        return
-    if not apply_proxy_config(_config):
-        _show_error("Ошибка конфигурации DC → IP.")
-        return
-    pc = proxy_config
-    log.info("Starting proxy on %s:%d ...", pc.host, pc.port)
-    _proxy_thread = threading.Thread(target=_run_proxy_thread, daemon=True, name="proxy")
-    _proxy_thread.start()
-
-
-def _stop_proxy() -> None:
-    global _proxy_thread, _async_stop
-    if _async_stop:
-        loop, stop_ev = _async_stop
-        loop.call_soon_threadsafe(stop_ev.set)
-        if _proxy_thread:
-            _proxy_thread.join(timeout=2)
-    _proxy_thread = None
-    log.info("Proxy stopped")
-
-
-def _restart_proxy() -> None:
-    log.info("Restarting proxy...")
-    _stop_proxy()
-    time.sleep(0.3)
-    _start_proxy()
-
-
-# menu callbacks
-
-
-def _on_open_in_telegram(_=None) -> None:
-    url = tg_proxy_url(_config)
-    log.info("Opening %s", url)
-    try:
-        result = subprocess.call(["open", url])
-        if result != 0:
-            raise RuntimeError("open command failed")
-    except Exception:
-        log.info("open command failed, trying webbrowser")
-        try:
-            if not webbrowser.open(url):
-                raise RuntimeError("webbrowser.open returned False")
-        except Exception:
-            log.info("Browser open failed, copying to clipboard")
-            try:
-                if pyperclip:
-                    pyperclip.copy(url)
-                else:
-                    subprocess.run(["pbcopy"], input=url.encode(), check=True)
-                _show_info(
-                    "Не удалось открыть Telegram автоматически.\n\n"
-                    f"Ссылка скопирована в буфер обмена:\n{url}"
-                )
-            except Exception as exc:
-                log.error("Clipboard copy failed: %s", exc)
-                _show_error(f"Не удалось скопировать ссылку:\n{exc}")
-
-
-def _on_copy_link(_=None) -> None:
-    url = tg_proxy_url(_config)
-    log.info("Copying link: %s", url)
-    try:
-        if pyperclip:
-            pyperclip.copy(url)
-        else:
-            subprocess.run(["pbcopy"], input=url.encode(), check=True)
-    except Exception as exc:
-        log.error("Clipboard copy failed: %s", exc)
-        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
-
-
-def _on_restart(_=None) -> None:
-    def _do():
-        global _config
-        _config = load_config()
-        if _app:
-            _app.update_menu_title()
-        _restart_proxy()
-
-    threading.Thread(target=_do, daemon=True).start()
-
-
-def _on_open_logs(_=None) -> None:
-    log.info("Opening log file: %s", LOG_FILE)
-    if LOG_FILE.exists():
-        subprocess.call(["open", str(LOG_FILE)])
-    else:
-        _show_info("Файл логов ещё не создан.")
-
-
-def _on_edit_config(_=None) -> None:
-    threading.Thread(target=_edit_config_dialog, daemon=True).start()
-
-
-def _check_updates_menu_title() -> str:
-    on = bool(_config.get("check_updates", True))
-    return "✓ Проверять обновления при запуске" if on else "Проверять обновления при запуске (выкл)"
-
-
-def _toggle_check_updates(_=None) -> None:
-    global _config
-    _config["check_updates"] = not bool(_config.get("check_updates", True))
-    save_config(_config)
-    if _app is not None:
-        _app._check_updates_item.title = _check_updates_menu_title()
-
-
-def _on_open_release_page(_=None) -> None:
-    from utils.update_check import RELEASES_PAGE_URL
-    webbrowser.open(RELEASES_PAGE_URL)
-
-
-# update check
-
-
-def _maybe_notify_update_async() -> None:
-    def _work():
-        time.sleep(1.5)
-        if _exiting:
-            return
-        if not _config.get("check_updates", True):
-            return
-        try:
-            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
-            run_check(__version__)
-            st = get_status()
-            if not st.get("has_update"):
-                return
-            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
-            ver = st.get("latest") or "?"
-            if _ask_yes_no(
-                f"Доступна новая версия: {ver}\n\nОткрыть страницу релиза в браузере?",
-                "TG WS Proxy — обновление",
-            ):
-                webbrowser.open(url)
-        except Exception as exc:
-            log.warning("Update check failed: %s", exc)
-
-    threading.Thread(target=_work, daemon=True, name="update-check").start()
-
-
-# settings dialog
-
-
-def _edit_config_dialog() -> None:
-    cfg = load_config()
-
-    host = _osascript_input("IP-адрес прокси:", cfg.get("host", DEFAULT_CONFIG["host"]))
-    if host is None:
-        return
-    host = host.strip()
-    import socket as _sock
-    try:
-        _sock.inet_aton(host)
-    except OSError:
-        _show_error("Некорректный IP-адрес.")
-        return
-
-    port_str = _osascript_input("Порт прокси:", str(cfg.get("port", DEFAULT_CONFIG["port"])))
-    if port_str is None:
-        return
-    try:
-        port = int(port_str.strip())
-        if not (1 <= port <= 65535):
-            raise ValueError
-    except ValueError:
-        _show_error("Порт должен быть числом 1-65535")
-        return
-
-    secret_str = _osascript_input(
-        "MTProto Secret (32 hex символа):", cfg.get("secret", DEFAULT_CONFIG["secret"])
-    )
-    if secret_str is None:
-        return
-    secret_str = secret_str.strip().lower()
-    if len(secret_str) != 32 or not all(c in "0123456789abcdef" for c in secret_str):
-        _show_error("Secret должен быть строкой из 32 шестнадцатеричных символов.")
-        return
-
-    dc_default = ", ".join(cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"]))
-    dc_str = _osascript_input(
-        "DC → IP маппинги (через запятую, формат DC:IP):\n"
-        "Например: 2:149.154.167.220, 4:149.154.167.220",
-        dc_default,
-    )
-    if dc_str is None:
-        return
-    dc_lines = [s.strip() for s in dc_str.replace(",", "\n").splitlines() if s.strip()]
-    try:
-        parse_dc_ip_list(dc_lines)
-    except ValueError as e:
-        _show_error(str(e))
-        return
-
-    verbose = _ask_yes_no_close("Включить подробное логирование (verbose)?")
-    if verbose is None:
-        return
-
-    adv_str = _osascript_input(
-        "Расширенные настройки (буфер KB, WS пул, лог MB):\n"
-        "Формат: buf_kb,pool_size,log_max_mb",
-        f"{cfg.get('buf_kb', DEFAULT_CONFIG['buf_kb'])},"
-        f"{cfg.get('pool_size', DEFAULT_CONFIG['pool_size'])},"
-        f"{cfg.get('log_max_mb', DEFAULT_CONFIG['log_max_mb'])}",
-    )
-    if adv_str is None:
-        return
-
-    adv = {}
-    if adv_str:
-        parts = [s.strip() for s in adv_str.split(",")]
-        keys = [("buf_kb", int), ("pool_size", int), ("log_max_mb", float)]
-        for i, (k, typ) in enumerate(keys):
-            if i < len(parts):
-                try:
-                    adv[k] = typ(parts[i])
-                except ValueError:
-                    pass
-
-    cfproxy = _ask_yes_no_close("Включить Cloudflare Proxy (CfProxy)?")
-    if cfproxy is None:
-        return
-
-    cfproxy_priority = True
-    if cfproxy:
-        cfproxy_priority_result = _ask_yes_no_close("Приоритет CfProxy (пробовать раньше прямого TCP)?")
-        if cfproxy_priority_result is None:
-            return
-        cfproxy_priority = cfproxy_priority_result
-
-    cfproxy_domain = _osascript_input(
-        "Свой CF-домен (оставьте пустым для автоматического выбора):\n"
-        "DNS записи kws1-kws5,kws203 должны указывать на IP датацентров Telegram через Cloudflare.",
-        cfg.get("cfproxy_user_domain", DEFAULT_CONFIG.get("cfproxy_user_domain", "")),
-    )
-    if cfproxy_domain is None:
-        return
-    cfproxy_domain = cfproxy_domain.strip()
-
-    new_cfg = {
-        "host": host,
-        "port": port,
-        "secret": secret_str,
-        "dc_ip": dc_lines,
-        "verbose": verbose,
-        "buf_kb": adv.get("buf_kb", cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])),
-        "pool_size": adv.get("pool_size", cfg.get("pool_size", DEFAULT_CONFIG["pool_size"])),
-        "log_max_mb": adv.get("log_max_mb", cfg.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"])),
-        "check_updates": cfg.get("check_updates", True),
-        "cfproxy": cfproxy,
-        "cfproxy_priority": cfproxy_priority,
-        "cfproxy_user_domain": cfproxy_domain,
-    }
-    save_config(new_cfg)
-    log.info("Config saved: %s", new_cfg)
-
-    global _config
-    _config = new_cfg
-    if _app:
-        _app.update_menu_title()
-
-    if _ask_yes_no_close("Настройки сохранены.\n\nПерезапустить прокси сейчас?"):
-        _restart_proxy()
-
-
-# first run & ipv6
-
-
-def _show_first_run() -> None:
-    ensure_dirs()
-    if FIRST_RUN_MARKER.exists():
-        return
-
-    host = _config.get("host", DEFAULT_CONFIG["host"])
-    port = _config.get("port", DEFAULT_CONFIG["port"])
-    secret = _config.get("secret", DEFAULT_CONFIG["secret"])
-    tg_url = tg_proxy_url(_config)
-    link_host = get_link_host(host)
-
-    text = (
-        f"Прокси запущен и работает в строке меню.\n\n"
-        f"Как подключить Telegram Desktop:\n\n"
-        f"Автоматически:\n"
-        f"  Нажмите «Открыть в Telegram» в меню\n"
-        f"  Или ссылка: {tg_url}\n\n"
-        f"Вручную:\n"
-        f"  Настройки → Продвинутые → Тип подключения → Прокси\n"
-        f"  MTProto → {link_host} : {port} \n"
-        f"  Secret: dd{secret} \n\n"
-        f"Открыть прокси в Telegram сейчас?"
-    )
-
-    FIRST_RUN_MARKER.touch()
-    if _ask_yes_no(text, "TG WS Proxy"):
-        _on_open_in_telegram()
-
-
-def _check_ipv6_warning() -> None:
-    ensure_dirs()
-    if IPV6_WARN_MARKER.exists():
-        return
-
-    import socket as _sock
-    has = False
-    try:
-        for addr in _sock.getaddrinfo(_sock.gethostname(), None, _sock.AF_INET6):
-            ip = addr[4][0]
-            if ip and not ip.startswith("::1") and not ip.startswith("fe80::1"):
-                has = True
-                break
-    except Exception:
-        pass
-    if not has:
-        try:
-            s = _sock.socket(_sock.AF_INET6, _sock.SOCK_STREAM)
-            s.bind(("::1", 0))
-            s.close()
-            has = True
-        except Exception:
-            pass
-    if not has:
-        return
-
-    IPV6_WARN_MARKER.touch()
-    _show_info(
-        "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
-        "Telegram может пытаться подключаться через IPv6, "
-        "что не поддерживается и может привести к ошибкам.\n\n"
-        "Если прокси не работает, попробуйте отключить "
-        "попытку соединения по IPv6 в настройках прокси Telegram.\n\n"
-        "Это предупреждение будет показано только один раз."
-    )
-
-
-# rumps app
-
-_TgWsProxyAppBase = rumps.App if rumps else object
-
-
-class TgWsProxyApp(_TgWsProxyAppBase):
-    def __init__(self):
-        _ensure_menubar_icon()
-        icon_path = str(MENUBAR_ICON_PATH) if MENUBAR_ICON_PATH.exists() else None
-
-        host = _config.get("host", DEFAULT_CONFIG["host"])
-        port = _config.get("port", DEFAULT_CONFIG["port"])
-        link_host = get_link_host(host)
-
-        self._open_tg_item = rumps.MenuItem(
-            f"Открыть в Telegram ({link_host}:{port})", callback=_on_open_in_telegram
-        )
-        self._copy_link_item = rumps.MenuItem("Скопировать ссылку", callback=_on_copy_link)
-        self._restart_item = rumps.MenuItem("Перезапустить прокси", callback=_on_restart)
-        self._settings_item = rumps.MenuItem("Настройки...", callback=_on_edit_config)
-        self._logs_item = rumps.MenuItem("Открыть логи", callback=_on_open_logs)
-        self._release_page_item = rumps.MenuItem(
-            "Страница релиза на GitHub…", callback=_on_open_release_page
-        )
-        self._check_updates_item = rumps.MenuItem(
-            _check_updates_menu_title(), callback=_toggle_check_updates
-        )
-        self._version_item = rumps.MenuItem(f"Версия {__version__}", callback=lambda _: None)
-
-        super().__init__(
-            "TG WS Proxy",
-            icon=icon_path,
-            template=False,
-            quit_button="Выход",
-            menu=[
-                self._open_tg_item,
-                self._copy_link_item,
-                None,
-                self._restart_item,
-                self._settings_item,
-                self._logs_item,
-                None,
-                self._release_page_item,
-                self._check_updates_item,
-                None,
-                self._version_item,
-            ],
-        )
-
-    def update_menu_title(self) -> None:
-        host = _config.get("host", DEFAULT_CONFIG["host"])
-        port = _config.get("port", DEFAULT_CONFIG["port"])
-        link_host = get_link_host(host)
-        self._open_tg_item.title = f"Открыть в Telegram ({link_host}:{port})"
-
-
-# entry point
-
-
-def run_menubar() -> None:
-    global _app, _config
-
-    _config = load_config()
-    save_config(_config)
-
-    if LOG_FILE.exists():
-        try:
-            LOG_FILE.unlink()
-        except Exception:
-            pass
-
-    setup_logging(
-        _config.get("verbose", False),
-        log_max_mb=_config.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]),
-    )
-    log.info("TG WS Proxy версия %s, menubar app starting", __version__)
-    log.info("Config: %s", _config)
-    log.info("Log file: %s", LOG_FILE)
-
-    if rumps is None or Image is None:
-        log.error("rumps or Pillow not installed; running in console mode")
-        _start_proxy()
-        try:
-            while True:
-                time.sleep(1)
-        except KeyboardInterrupt:
-            _stop_proxy()
-        return
-
-    _start_proxy()
-    _maybe_notify_update_async()
-    _show_first_run()
-    _check_ipv6_warning()
-
-    _app = TgWsProxyApp()
-    log.info("Menubar app running")
-    _app.run()
-
-    _stop_proxy()
-    log.info("Menubar app exited")
-
-
-def main() -> None:
-    if not acquire_lock():
-        _show_info("Приложение уже запущено.")
-        return
-    try:
-        run_menubar()
-    finally:
-        release_lock()
-
-
-if __name__ == "__main__":
-    main()

packaging/linux.spec

@@ -1,94 +0,0 @@
-# -*- mode: python ; coding: utf-8 -*-
-
-import sys
-import os
-import glob
-
-from PyInstaller.utils.hooks import collect_submodules, collect_data_files
-
-block_cipher = None
-
-# customtkinter ships JSON themes + assets that must be bundled
-import customtkinter
-ctk_path = os.path.dirname(customtkinter.__file__)
-
-# Collect gi (PyGObject) submodules and data so pystray._appindicator works
-gi_hiddenimports = collect_submodules('gi')
-gi_datas = collect_data_files('gi')
-
-# Collect GObject typelib files from the system
-typelib_dirs = glob.glob('/usr/lib/*/girepository-1.0')
-typelib_datas = []
-for d in typelib_dirs:
-    typelib_datas.append((d, 'gi_typelibs'))
-
-a = Analysis(
-    [os.path.join(os.path.dirname(SPEC), os.pardir, 'linux.py')],
-    pathex=[],
-    binaries=[],
-    datas=[(ctk_path, 'customtkinter/')] + gi_datas + typelib_datas,
-    hiddenimports=[
-        'pystray._appindicator',
-        'PIL._tkinter_finder',
-        'customtkinter',
-        'cryptography.hazmat.primitives.ciphers',
-        'cryptography.hazmat.primitives.ciphers.algorithms',
-        'cryptography.hazmat.primitives.ciphers.modes',
-        'cryptography.hazmat.backends.openssl',
-        'gi',
-        '_gi',
-        'gi.repository.GLib',
-        'gi.repository.GObject',
-        'gi.repository.Gtk',
-        'gi.repository.Gdk',
-        'gi.repository.AyatanaAppIndicator3',
-    ] + gi_hiddenimports,
-    hookspath=[],
-    hooksconfig={},
-    runtime_hooks=[],
-    excludes=[
-        'PIL._avif',
-        'PIL._webp',
-        'PIL._imagingtk',
-    ],
-    noarchive=False,
-    cipher=block_cipher,
-)
-
-_PIL_EXCLUDE_PYDS = {
-    '_avif', '_webp', '_imagingtk',
-    'FpxImagePlugin', 'MicImagePlugin',
-}
-a.binaries = [
-    (name, path, typ)
-    for name, path, typ in a.binaries
-    if not any(ex in name for ex in _PIL_EXCLUDE_PYDS)
-]
-
-icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.ico')
-if os.path.exists(icon_path):
-    a.datas += [('icon.ico', icon_path, 'DATA')]
-
-pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
-
-exe = EXE(
-    pyz,
-    a.scripts,
-    a.binaries,
-    a.zipfiles,
-    a.datas,
-    [],
-    name='TgWsProxy',
-    debug=False,
-    bootloader_ignore_signals=False,
-    strip=True,
-    upx=True,
-    upx_exclude=[],
-    runtime_tmpdir=None,
-    console=False,
-    disable_windowed_traceback=False,
-    argv_emulation=False,
-    target_arch=None,
-    codesign_identity=None,
-    entitlements_file=None,
-)

packaging/macos.spec

@@ -1,97 +0,0 @@
-# -*- mode: python ; coding: utf-8 -*-
-
-import sys
-import os
-
-block_cipher = None
-
-a = Analysis(
-    [os.path.join(os.path.dirname(SPEC), os.pardir, 'macos.py')],
-    pathex=[],
-    binaries=[],
-    datas=[],
-    hiddenimports=[
-        'rumps',
-        'objc',
-        'Foundation',
-        'AppKit',
-        'PyObjCTools',
-        'PyObjCTools.AppHelper',
-        'cryptography.hazmat.primitives.ciphers',
-        'cryptography.hazmat.primitives.ciphers.algorithms',
-        'cryptography.hazmat.primitives.ciphers.modes',
-        'cryptography.hazmat.backends.openssl',
-    ],
-    hookspath=[],
-    hooksconfig={},
-    runtime_hooks=[],
-    excludes=[
-        'PIL._avif',
-        'PIL._webp',
-        'PIL._imagingtk',
-    ],
-    noarchive=False,
-    cipher=block_cipher,
-)
-
-_PIL_EXCLUDE_PYDS = {
-    '_avif', '_webp', '_imagingtk',
-    'FpxImagePlugin', 'MicImagePlugin',
-}
-a.binaries = [
-    (name, path, typ)
-    for name, path, typ in a.binaries
-    if not any(ex in name for ex in _PIL_EXCLUDE_PYDS)
-]
-
-icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.icns')
-if not os.path.exists(icon_path):
-    icon_path = None
-
-pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
-
-exe = EXE(
-    pyz,
-    a.scripts,
-    [],
-    exclude_binaries=True,
-    name='TgWsProxy',
-    debug=False,
-    bootloader_ignore_signals=False,
-    strip=False,
-    upx=False,
-    console=False,
-    argv_emulation=False,
-    target_arch='universal2',
-    codesign_identity=None,
-    entitlements_file=None,
-)
-
-coll = COLLECT(
-    exe,
-    a.binaries,
-    a.zipfiles,
-    a.datas,
-    strip=False,
-    upx=False,
-    upx_exclude=[],
-    name='TgWsProxy',
-)
-
-app = BUNDLE(
-    coll,
-    name='TG WS Proxy.app',
-    icon=icon_path,
-    bundle_identifier='com.tgwsproxy.app',
-    info_plist={
-        'CFBundleName': 'TG WS Proxy',
-        'CFBundleDisplayName': 'TG WS Proxy',
-        'CFBundleShortVersionString': '1.0.0',
-        'CFBundleVersion': '1.0.0',
-        'LSMinimumSystemVersion': '10.15',
-        'LSUIElement': True,
-        'NSHighResolutionCapable': True,
-        'NSAppleEventsUsageDescription':
-            'TG WS Proxy needs to display dialogs.',
-    },
-)

packaging/version_info.txt

@@ -1,36 +0,0 @@
-# UTF-8
-#
-# For more details about fixed file info 'ffi' see:
-# http://msdn.microsoft.com/en-us/library/ms646997.aspx
-VSVersionInfo(
-  ffi=FixedFileInfo(
-    filevers=(1, 6, 5, 0),
-    prodvers=(1, 6, 5, 0),
-    mask=0x3f,
-    flags=0x0,
-    OS=0x40004,
-    fileType=0x1,
-    subtype=0x0,
-    date=(0, 0)
-  ),
-  kids=[
-    StringFileInfo(
-      [
-        StringTable(
-          u'040904B0',
-          [
-            StringStruct(u'CompanyName', u'Flowseal'),
-            StringStruct(u'FileDescription', u'Telegram Desktop WebSocket Bridge Proxy'),
-            StringStruct(u'FileVersion', u'1.6.6.0'),
-            StringStruct(u'InternalName', u'TgWsProxy'),
-            StringStruct(u'LegalCopyright', u'Copyright (c) Flowseal. MIT License.'),
-            StringStruct(u'OriginalFilename', u'TgWsProxy.exe'),
-            StringStruct(u'ProductName', u'TG WS Proxy'),
-            StringStruct(u'ProductVersion', u'1.6.6.0'),
-          ]
-        )
-      ]
-    ),
-    VarFileInfo([VarStruct(u'Translation', [1033, 1200])])
-  ]
-)

packaging/windows.spec

@@ -1,79 +0,0 @@
-# -*- mode: python ; coding: utf-8 -*-
-
-import sys
-import os
-
-block_cipher = None
-
-# customtkinter ships JSON themes + assets that must be bundled
-import customtkinter
-ctk_path = os.path.dirname(customtkinter.__file__)
-
-a = Analysis(
-    [os.path.join(os.path.dirname(SPEC), os.pardir, 'windows.py')],
-    pathex=[],
-    binaries=[],
-    datas=[(ctk_path, 'customtkinter/')],
-    hiddenimports=[
-        'pystray._win32',
-        'PIL._tkinter_finder',
-        'customtkinter',
-        'cryptography.hazmat.primitives.ciphers',
-        'cryptography.hazmat.primitives.ciphers.algorithms',
-        'cryptography.hazmat.primitives.ciphers.modes',
-        'cryptography.hazmat.backends.openssl',
-    ],
-    hookspath=[],
-    hooksconfig={},
-    runtime_hooks=[],
-    excludes=[
-        'PIL._avif',
-        'PIL._webp',
-        'PIL._imagingtk',
-    ],
-    win_no_prefer_redirects=False,
-    win_private_assemblies=False,
-    cipher=block_cipher,
-    noarchive=False,
-)
-
-_PIL_EXCLUDE_PYDS = {
-    '_avif', '_webp', '_imagingtk',
-    'FpxImagePlugin', 'MicImagePlugin',
-}
-a.binaries = [
-    (name, path, typ)
-    for name, path, typ in a.binaries
-    if not any(ex in name for ex in _PIL_EXCLUDE_PYDS)
-]
-
-icon_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'icon.ico')
-version_path = os.path.join(os.path.dirname(SPEC), 'version_info.txt')
-if os.path.exists(icon_path):
-    a.datas += [('icon.ico', icon_path, 'DATA')]
-
-pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
-
-exe = EXE(
-    pyz,
-    a.scripts,
-    a.binaries,
-    a.zipfiles,
-    a.datas,
-    [],
-    name='TgWsProxy',
-    debug=False,
-    bootloader_ignore_signals=False,
-    strip=False,
-    upx=False,
-    upx_exclude=[],
-    runtime_tmpdir=None,
-    console=False,
-    disable_windowed_traceback=False,
-    argv_emulation=False,
-    target_arch=None,
-    codesign_identity=None,
-    entitlements_file=None,
-    icon=icon_path if os.path.exists(icon_path) else None,
-    version=version_path if os.path.exists(version_path) else None,
-)

proxy/__init__.py

@@ -1,6 +0,0 @@
-from .config import parse_dc_ip_list, proxy_config
-from .utils import get_link_host, build_github_opener
-
-__version__ = "1.6.6"
-
-__all__ = ["__version__", "get_link_host", "proxy_config", "parse_dc_ip_list", "build_github_opener"]

proxy/balancer.py

@@ -1,43 +0,0 @@
-import random
-from collections import Counter
-
-from typing import Dict, List, Iterator 
-
-
-class _Balancer:
-    def __init__(self):
-        self.domains: List[str] = []
-        self._dc_to_domain: Dict[int, str] = {}
-    
-    def update_domains_list(self, domains_list: List[str]) -> None:
-        if Counter(self.domains) == Counter(domains_list):
-            return
-        
-        self.domains = domains_list[:]
-
-        self._dc_to_domain = {
-            dc_id: random.choice(self.domains)
-            for dc_id in (1, 2, 3, 4, 5, 203)
-        }
-
-    def update_domain_for_dc(self, dc_id: int, domain: str) -> bool:
-        if self._dc_to_domain.get(dc_id) == domain:
-            return False
-        
-        self._dc_to_domain[dc_id] = domain
-        return True
-
-    def get_domains_for_dc(self, dc_id: int) -> Iterator[str]:
-        current_domain = self._dc_to_domain.get(dc_id)
-        if current_domain is not None:
-            yield current_domain
-
-        shuffled_domains = self.domains[:]
-        random.shuffle(shuffled_domains)
-
-        for domain in shuffled_domains:
-            if domain != current_domain:
-                yield domain
-
-
-balancer = _Balancer()

proxy/bridge.py

@@ -1,355 +0,0 @@
-import asyncio
-import logging
-import struct
-
-from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-from typing import Dict, List, Optional
-
-from .utils import *
-from .stats import stats
-from .balancer import balancer
-from .config import proxy_config
-from .raw_websocket import RawWebSocket
-
-
-log = logging.getLogger('tg-mtproto-proxy')
-_st_I_le = struct.Struct('<I')
-
-ZERO_64 = b'\x00' * 64
-DC_DEFAULT_IPS: Dict[int, str] = {
-    1: '149.154.175.50',
-    2: '149.154.167.51',
-    3: '149.154.175.100',
-    4: '149.154.167.91',
-    5: '149.154.171.5',
-    203: '91.105.192.100'
-}
-
-
-class CryptoCtx:
-    __slots__ = ('clt_dec', 'clt_enc', 'tg_enc', 'tg_dec')
-
-    def __init__(self, clt_dec, clt_enc, tg_enc, tg_dec):
-        self.clt_dec = clt_dec  # decrypt from client
-        self.clt_enc = clt_enc  # encrypt to client
-        self.tg_enc = tg_enc    # encrypt to telegram
-        self.tg_dec = tg_dec    # decrypt from telegram
-
-
-class MsgSplitter:
-    """
-    Splits TCP stream data into individual MTProto transport packets
-    so each can be sent as a separate WS frame.
-    """
-    __slots__ = ('_dec', '_proto', '_cipher_buf', '_plain_buf', '_disabled')
-
-    def __init__(self, relay_init: bytes, proto_int: int):
-        cipher = Cipher(algorithms.AES(relay_init[8:40]),
-                        modes.CTR(relay_init[40:56]))
-        self._dec = cipher.encryptor()
-        self._dec.update(ZERO_64)
-        self._proto = proto_int
-        self._cipher_buf = bytearray()
-        self._plain_buf = bytearray()
-        self._disabled = False
-
-    def split(self, chunk: bytes) -> List[bytes]:
-        if not chunk:
-            return []
-        if self._disabled:
-            return [chunk]
-
-        self._cipher_buf.extend(chunk)
-        self._plain_buf.extend(self._dec.update(chunk))
-
-        parts = []
-        while self._cipher_buf:
-            packet_len = self._next_packet_len()
-            if packet_len is None:
-                break
-            if packet_len <= 0:
-                parts.append(bytes(self._cipher_buf))
-                self._cipher_buf.clear()
-                self._plain_buf.clear()
-                self._disabled = True
-                break
-            parts.append(bytes(self._cipher_buf[:packet_len]))
-            del self._cipher_buf[:packet_len]
-            del self._plain_buf[:packet_len]
-        return parts
-
-    def flush(self) -> List[bytes]:
-        if not self._cipher_buf:
-            return []
-        tail = bytes(self._cipher_buf)
-        self._cipher_buf.clear()
-        self._plain_buf.clear()
-        return [tail]
-
-    def _next_packet_len(self) -> Optional[int]:
-        if not self._plain_buf:
-            return None
-        if self._proto == PROTO_ABRIDGED_INT:
-            return self._next_abridged_len()
-        if self._proto in (PROTO_INTERMEDIATE_INT,
-                           PROTO_PADDED_INTERMEDIATE_INT):
-            return self._next_intermediate_len()
-        return 0
-
-    def _next_abridged_len(self) -> Optional[int]:
-        first = self._plain_buf[0]
-        if first in (0x7F, 0xFF):
-            if len(self._plain_buf) < 4:
-                return None
-            payload_len = int.from_bytes(self._plain_buf[1:4], 'little') * 4
-            header_len = 4
-        else:
-            payload_len = (first & 0x7F) * 4
-            header_len = 1
-        if payload_len <= 0:
-            return 0
-        packet_len = header_len + payload_len
-        if len(self._plain_buf) < packet_len:
-            return None
-        return packet_len
-
-    def _next_intermediate_len(self) -> Optional[int]:
-        if len(self._plain_buf) < 4:
-            return None
-        payload_len = _st_I_le.unpack_from(self._plain_buf, 0)[0] & 0x7FFFFFFF
-        if payload_len <= 0:
-            return 0
-        packet_len = 4 + payload_len
-        if len(self._plain_buf) < packet_len:
-            return None
-        return packet_len
-
-
-
-async def do_fallback(reader, writer, relay_init, label,
-                       dc: int, is_media: bool, media_tag: str,
-                       ctx: CryptoCtx, splitter=None):
-    fallback_dst = DC_DEFAULT_IPS.get(dc)
-    use_cf = proxy_config.fallback_cfproxy
-    cf_first = proxy_config.fallback_cfproxy_priority
-
-    methods: List[str] = ['tcp']
-
-    if use_cf:
-        methods.insert(0 if cf_first else 1, 'cf')
-
-    for method in methods:
-        if method == 'cf':
-            ok = await _cfproxy_fallback(
-                reader, writer, relay_init, label, ctx,
-                dc=dc, is_media=is_media,
-                splitter=splitter)
-            if ok:
-                return True
-        elif method == 'tcp' and fallback_dst:
-            log.info("[%s] DC%d%s -> TCP fallback to %s:443",
-                     label, dc, media_tag, fallback_dst)
-            ok = await _tcp_fallback(
-                reader, writer, fallback_dst, 443,
-                relay_init, label, ctx)
-            if ok:
-                return True
-    return False
-
-
-async def _cfproxy_fallback(reader, writer, relay_init, label,
-                            ctx: CryptoCtx,
-                            dc: int, is_media: bool,
-                            splitter=None):
-    media_tag = ' media' if is_media else ''
-    ws = None
-    chosen_domain = None
-
-    log.info("[%s] DC%d%s -> trying CF proxy",
-            label, dc, media_tag)
-
-    for base_domain in balancer.get_domains_for_dc(dc):
-        domain = f'kws{dc}.{base_domain}'
-        try:
-            ws = await RawWebSocket.connect(domain, domain, timeout=10.0)
-            chosen_domain = base_domain
-            break
-        except Exception as exc:
-            log.warning("[%s] DC%d%s CF proxy failed: %s",
-                        label, dc, media_tag, repr(exc))
-
-    if ws is None:
-        return False
-
-    if chosen_domain and balancer.update_domain_for_dc(dc, chosen_domain):
-        log.info("[%s] Switched active CF domain", label)
-
-    stats.connections_cfproxy += 1
-    await ws.send(relay_init)
-    await bridge_ws_reencrypt(reader, writer, ws, label, ctx,
-                               dc=dc, is_media=is_media,
-                               splitter=splitter)
-    return True
-
-
-async def _tcp_fallback(reader, writer, dst, port, relay_init, label, ctx: CryptoCtx):
-    try:
-        rr, rw = await asyncio.wait_for(
-            asyncio.open_connection(dst, port), timeout=10)
-    except Exception as exc:
-        log.warning("[%s] TCP fallback to %s:%d failed: %s",
-                    label, dst, port, repr(exc))
-        return False
-
-    stats.connections_tcp_fallback += 1
-    rw.write(relay_init)
-    await rw.drain()
-    await _bridge_tcp_reencrypt(reader, writer, rr, rw, label, ctx)
-    return True
-
-
-async def bridge_ws_reencrypt(reader, writer, ws: RawWebSocket, label,
-                               ctx: CryptoCtx,
-                               dc=None, is_media=False,
-                               splitter: Optional[MsgSplitter] = None):
-    """
-    Bidirectional TCP(client) <-> WS(telegram) with re-encryption.
-    client ciphertext → decrypt(clt_key) → encrypt(tg_key) → WS
-    WS data → decrypt(tg_key) → encrypt(clt_key) → client TCP
-    """
-    dc_tag = f"DC{dc}{'m' if is_media else ''}" if dc else "DC?"
-
-    up_bytes = 0
-    down_bytes = 0
-    up_packets = 0
-    down_packets = 0
-    start_time = asyncio.get_running_loop().time()
-
-    async def tcp_to_ws():
-        nonlocal up_bytes, up_packets
-        try:
-            while True:
-                chunk = await reader.read(65536)
-                if not chunk:
-                    if splitter:
-                        tail = splitter.flush()
-                        if tail:
-                            await ws.send(tail[0])
-                    break
-                n = len(chunk)
-                stats.bytes_up += n
-                up_bytes += n
-                up_packets += 1
-                plain = ctx.clt_dec.update(chunk)
-                chunk = ctx.tg_enc.update(plain)
-                if splitter:
-                    parts = splitter.split(chunk)
-                    if not parts:
-                        continue
-                    if len(parts) > 1:
-                        await ws.send_batch(parts)
-                    else:
-                        await ws.send(parts[0])
-                else:
-                    await ws.send(chunk)
-        except (asyncio.CancelledError, ConnectionError, OSError):
-            return
-        except Exception as e:
-            log.debug("[%s] tcp->ws ended: %s", label, e)
-
-    async def ws_to_tcp():
-        nonlocal down_bytes, down_packets
-        try:
-            while True:
-                data = await ws.recv()
-                if data is None:
-                    break
-                n = len(data)
-                stats.bytes_down += n
-                down_bytes += n
-                down_packets += 1
-                plain = ctx.tg_dec.update(data)
-                data = ctx.clt_enc.update(plain)
-                writer.write(data)
-                await writer.drain()
-        except (asyncio.CancelledError, ConnectionError, OSError):
-            return
-        except Exception as e:
-            log.debug("[%s] ws->tcp ended: %s", label, e)
-
-    tasks = [asyncio.create_task(tcp_to_ws()),
-             asyncio.create_task(ws_to_tcp())]
-    try:
-        await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
-    finally:
-        for t in tasks:
-            t.cancel()
-        for t in tasks:
-            try:
-                await t
-            except BaseException:
-                pass
-        elapsed = asyncio.get_running_loop().time() - start_time
-        log.info("[%s] %s WS session closed: "
-                 "^%s (%d pkts) v%s (%d pkts) in %.1fs",
-                 label, dc_tag,
-                 human_bytes(up_bytes), up_packets,
-                 human_bytes(down_bytes), down_packets,
-                 elapsed)
-        try:
-            await ws.close()
-        except BaseException:
-            pass
-        try:
-            writer.close()
-            await writer.wait_closed()
-        except BaseException:
-            pass
-
-
-async def _bridge_tcp_reencrypt(reader, writer, remote_reader, remote_writer,
-                                label, ctx: CryptoCtx):
-    """Bidirectional TCP <-> TCP with re-encryption."""
-
-    async def forward(src, dst_w, is_up):
-        try:
-            while True:
-                data = await src.read(65536)
-                if not data:
-                    break
-                n = len(data)
-                if is_up:
-                    stats.bytes_up += n
-                    plain = ctx.clt_dec.update(data)
-                    data = ctx.tg_enc.update(plain)
-                else:
-                    stats.bytes_down += n
-                    plain = ctx.tg_dec.update(data)
-                    data = ctx.clt_enc.update(plain)
-                dst_w.write(data)
-                await dst_w.drain()
-        except asyncio.CancelledError:
-            pass
-        except Exception as e:
-            log.debug("[%s] forward ended: %s", label, e)
-
-    tasks = [
-        asyncio.create_task(forward(reader, remote_writer, True)),
-        asyncio.create_task(forward(remote_reader, writer, False)),
-    ]
-    try:
-        await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
-    finally:
-        for t in tasks:
-            t.cancel()
-        for t in tasks:
-            try:
-                await t
-            except BaseException:
-                pass
-        for w in (writer, remote_writer):
-            try:
-                w.close()
-                await w.wait_closed()
-            except BaseException:
-                pass

proxy/config.py

@@ -1,178 +0,0 @@
-import logging
-import os
-import string
-import random
-import socket as _socket
-import threading
-
-from dataclasses import dataclass, field
-from typing import Dict, List
-from urllib.request import Request
-
-from .balancer import balancer
-from .utils import build_github_opener
-
-log = logging.getLogger('tg-mtproto-proxy')
-
-CFPROXY_DOMAINS_URL = (
-    "https://uralgit.ru/ural/tg-ws-proxy-go/raw/branch/main"
-    "/.github/cfproxy-domains.txt"
-)
-
-_CFPROXY_ENC: List[str] = [
-    'virkgj.com', 
-    'vmmzovy.com', 
-    'mkuosckvso.com', 
-    'zaewayzmplad.com', 
-    'twdmbzcm.com',
-    'awzwsldi.com',
-    'clngqrflngqin.com',
-    'tjacxbqtj.com',
-    'bxaxtxmrw.com',
-    'dmohrsgmohcrwb.com'
-]
-_S = ''.join(chr(c) for c in (46, 99, 111, 46, 117, 107))
-
-
-def _dd(s: str) -> str:
-    """Only for decoding CF proxy domains"""
-    if not s[-4:] == '.com':
-        return s
-    p, n = s[:-4], sum(c.isalpha() for c in s[:-4])
-    return ''.join(
-        chr((ord(c) - (97 if c > '`' else 65) - n) % 26 + (97 if c > '`' else 65))
-        if c.isalpha() else c for c in p
-    ) + _S
-
-
-CFPROXY_DEFAULT_DOMAINS: List[str] = [_dd(d) for d in _CFPROXY_ENC]
-_CFPROXY_MIN_VALID_DOMAINS = 3
-
-
-@dataclass
-class ProxyConfig:
-    port: int = 1443
-    host: str = '127.0.0.1'
-    secret: str = field(default_factory=lambda: os.urandom(16).hex())
-    dc_redirects: Dict[int, str] = field(default_factory=lambda: {2: '149.154.167.220', 4: '149.154.167.220'})
-    buffer_size: int = 256 * 1024
-    pool_size: int = 4
-    fallback_cfproxy: bool = True
-    fallback_cfproxy_priority: bool = True
-    cfproxy_user_domain: str = ''
-    fake_tls_domain: str = ''
-    proxy_protocol: bool = False
-
-
-proxy_config = ProxyConfig()
-
-
-def _fetch_cfproxy_domain_list() -> List[str]:
-    try:
-        req = Request(CFPROXY_DOMAINS_URL + "?" + "".join(random.choices(string.ascii_letters, k=7)),
-                       headers={'User-Agent': 'tg-ws-proxy'})
-        with build_github_opener().open(req, timeout=10) as resp:
-            text = resp.read().decode('utf-8', errors='replace')
-        encoded = [
-            line.strip() for line in text.splitlines()
-            if line.strip() and not line.startswith('#')
-        ]
-        return [_dd(d) for d in encoded]
-    except Exception as exc:
-        log.warning("Failed to fetch CF proxy domain list: %s", repr(exc))
-        return []
-
-
-def _is_valid_domain(domain: str) -> bool:
-    if not domain or len(domain) > 253:
-        return False
-    if domain.startswith('.') or domain.endswith('.'):
-        return False
-    labels = domain.split('.')
-    if len(labels) < 2:
-        return False
-    for label in labels:
-        if not label or len(label) > 63:
-            return False
-        if label[0] == '-' or label[-1] == '-':
-            return False
-        if not all(ch.isalnum() or ch == '-' for ch in label):
-            return False
-    # TLD should contain letters and be at least 2 chars.
-    tld = labels[-1]
-    if len(tld) < 2 or not any(ch.isalpha() for ch in tld):
-        return False
-    return True
-
-
-def _normalize_domain_pool(domains: List[str]) -> List[str]:
-    seen = set()
-    normalized: List[str] = []
-    for domain in domains:
-        item = domain.strip().lower()
-        if not _is_valid_domain(item):
-            continue
-        if item in seen:
-            continue
-        seen.add(item)
-        normalized.append(item)
-    return normalized
-
-
-def refresh_cfproxy_domains() -> None:
-    if proxy_config.cfproxy_user_domain:
-        return
-
-    fetched = _fetch_cfproxy_domain_list()
-    pool = _normalize_domain_pool(fetched)
-    if len(pool) >= _CFPROXY_MIN_VALID_DOMAINS:
-        balancer.update_domains_list(pool)
-        log.info("CF proxy domain pool updated from GitHub (%d domains)", len(pool))
-        return
-
-    if fetched:
-        log.warning(
-            "Ignoring fetched CF proxy domains due to low-quality payload "
-            "(total=%d, valid=%d, required>=%d); keeping current domain pool",
-            len(fetched), len(pool), _CFPROXY_MIN_VALID_DOMAINS,
-        )
-    else:
-        log.warning(
-            "CF proxy domain refresh failed or empty response; "
-            "keeping current domain pool",
-        )
-
-
-_refresh_stop: threading.Event = threading.Event()
-
-
-def start_cfproxy_domain_refresh() -> None:
-    global _refresh_stop
-    _refresh_stop.set()
-    _refresh_stop = threading.Event()
-    stop = _refresh_stop
-
-    balancer.update_domains_list(CFPROXY_DEFAULT_DOMAINS)
-
-    def _loop():
-        refresh_cfproxy_domains()
-        while not stop.wait(timeout=3600):
-            refresh_cfproxy_domains()
-
-    threading.Thread(target=_loop, daemon=True, name='cfproxy-domains-refresh').start()
-
-
-def parse_dc_ip_list(dc_ip_list: List[str]) -> Dict[int, str]:
-    dc_redirects: Dict[int, str] = {}
-    for entry in dc_ip_list:
-        if ':' not in entry:
-            raise ValueError(
-                f"Invalid --dc-ip format {entry!r}, expected DC:IP")
-        dc_s, ip_s = entry.split(':', 1)
-        try:
-            dc_n = int(dc_s)
-            _socket.inet_aton(ip_s)
-        except (ValueError, OSError):
-            raise ValueError(f"Invalid --dc-ip {entry!r}")
-        dc_redirects[dc_n] = ip_s
-    return dc_redirects

proxy/fake_tls.py

@@ -1,256 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import hmac
-import hashlib
-import os
-import random
-import struct
-import time
-import logging
-
-from typing import Optional, Tuple
-from .stats import stats
-
-
-log = logging.getLogger('tg-mtproto-proxy')
-
-TLS_RECORD_HANDSHAKE = 0x16
-TLS_RECORD_CCS = 0x14
-TLS_RECORD_APPDATA = 0x17
-
-TLS_VERSION_10 = b'\x03\x01'
-TLS_VERSION_12 = b'\x03\x03'
-TLS_VERSION_13 = b'\x03\x04'
-
-CLIENT_RANDOM_OFFSET = 11
-CLIENT_RANDOM_LEN = 32
-SESSION_ID_OFFSET = 44
-SESSION_ID_LEN = 32
-
-TIMESTAMP_TOLERANCE = 120
-
-TLS_APPDATA_MAX = 16384
-
-
-_CCS_FRAME = b'\x14\x03\x03\x00\x01\x01'
-
-_SERVER_HELLO_TEMPLATE = bytearray(
-    b'\x16\x03\x03\x00\x7a'
-    b'\x02\x00\x00\x76'
-    b'\x03\x03'
-    + b'\x00' * 32
-    + b'\x20'
-    + b'\x00' * 32
-    + b'\x13\x01\x00'
-    + b'\x00\x2e'
-    + b'\x00\x33\x00\x24\x00\x1d\x00\x20'
-    + b'\x00' * 32
-    + b'\x00\x2b\x00\x02\x03\x04'
-)
-
-_SH_RANDOM_OFF = 11
-_SH_SESSID_OFF = 44
-_SH_PUBKEY_OFF = 89
-
-
-def verify_client_hello(data: bytes, secret: bytes) -> Optional[Tuple[bytes, bytes, int]]:
-    n = len(data)
-    # 5 (record hdr) + 6 (hs type+len+version) + 32 (random) = 43
-    if n < 43:
-        return None
-    if data[0] != TLS_RECORD_HANDSHAKE:
-        return None
-    if data[5] != 0x01:
-        return None
-
-    client_random = bytes(data[CLIENT_RANDOM_OFFSET:CLIENT_RANDOM_OFFSET + CLIENT_RANDOM_LEN])
-
-    zeroed = bytearray(data)
-    zeroed[CLIENT_RANDOM_OFFSET:CLIENT_RANDOM_OFFSET + CLIENT_RANDOM_LEN] = b'\x00' * CLIENT_RANDOM_LEN
-
-    expected = hmac.new(secret, bytes(zeroed), hashlib.sha256).digest()
-
-    if not hmac.compare_digest(expected[:28], client_random[:28]):
-        return None
-
-    ts_xor = bytes(client_random[28 + i] ^ expected[28 + i] for i in range(4))
-    timestamp = struct.unpack('<I', ts_xor)[0]
-
-    now = int(time.time())
-    if abs(now - timestamp) > TIMESTAMP_TOLERANCE:
-        return None
-
-    session_id = b'\x00' * SESSION_ID_LEN
-    if n >= SESSION_ID_OFFSET + SESSION_ID_LEN and data[43] == 0x20:
-        session_id = bytes(data[SESSION_ID_OFFSET:SESSION_ID_OFFSET + SESSION_ID_LEN])
-
-    return client_random, session_id, timestamp
-
-
-def build_server_hello(secret: bytes, client_random: bytes, session_id: bytes) -> bytes:
-    sh = bytearray(_SERVER_HELLO_TEMPLATE)
-    sh[_SH_SESSID_OFF:_SH_SESSID_OFF + 32] = session_id
-    sh[_SH_PUBKEY_OFF:_SH_PUBKEY_OFF + 32] = os.urandom(32)
-
-    ccs = _CCS_FRAME
-    encrypted_size = random.randint(1900, 2100)
-    encrypted_data = os.urandom(encrypted_size)
-    app_record = b'\x17\x03\x03' + struct.pack('>H', encrypted_size) + encrypted_data
-
-    response = bytes(sh) + ccs + app_record
-
-    hmac_input = client_random + response
-    server_random = hmac.new(secret, hmac_input, hashlib.sha256).digest()
-
-    final = bytearray(response)
-    final[_SH_RANDOM_OFF:_SH_RANDOM_OFF + 32] = server_random
-
-    return bytes(final)
-
-
-def wrap_tls_record(data: bytes) -> bytes:
-    parts = []
-    offset = 0
-    while offset < len(data):
-        chunk = data[offset:offset + TLS_APPDATA_MAX]
-        parts.append(
-            b'\x17\x03\x03'
-            + struct.pack('>H', len(chunk))
-            + chunk
-        )
-        offset += len(chunk)
-    return b''.join(parts)
-
-
-class FakeTlsStream:
-    __slots__ = ('_reader', '_writer', '_read_buf', '_read_left')
-
-    def __init__(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter):
-        self._reader = reader
-        self._writer = writer
-        self._read_buf = bytearray()
-        self._read_left = 0
-
-    async def readexactly(self, n: int) -> bytes:
-        while len(self._read_buf) < n:
-            payload = await self._read_tls_payload()
-            if not payload:
-                raise asyncio.IncompleteReadError(bytes(self._read_buf), n)
-            self._read_buf.extend(payload)
-        result = bytes(self._read_buf[:n])
-        del self._read_buf[:n]
-        return result
-
-    async def read(self, n: int) -> bytes:
-        if self._read_buf:
-            chunk = bytes(self._read_buf[:n])
-            del self._read_buf[:n]
-            return chunk
-        payload = await self._read_tls_payload()
-        if not payload:
-            return b''
-        if len(payload) > n:
-            self._read_buf.extend(payload[n:])
-            return payload[:n]
-        return payload
-
-    async def _read_tls_payload(self) -> bytes:
-        if self._read_left > 0:
-            data = await self._reader.read(self._read_left)
-            if not data:
-                return b''
-            self._read_left -= len(data)
-            return data
-
-        while True:
-            hdr = await self._reader.readexactly(5)
-            rtype = hdr[0]
-            rec_len = struct.unpack('>H', hdr[3:5])[0]
-
-            if rtype == TLS_RECORD_CCS:
-                if rec_len > 0:
-                    await self._reader.readexactly(rec_len)
-                continue
-
-            if rtype != TLS_RECORD_APPDATA:
-                return b''
-
-            data = await self._reader.read(min(rec_len, 65536))
-            if not data:
-                return b''
-            remaining = rec_len - len(data)
-            if remaining > 0:
-                self._read_left = remaining
-            return data
-
-    def write(self, data: bytes) -> None:
-        self._writer.write(wrap_tls_record(data))
-
-    async def drain(self) -> None:
-        await self._writer.drain()
-
-    def close(self) -> None:
-        self._writer.close()
-
-    async def wait_closed(self) -> None:
-        await self._writer.wait_closed()
-
-    def get_extra_info(self, name, default=None):
-        return self._writer.get_extra_info(name, default)
-
-    @property
-    def transport(self):
-        return self._writer.transport
-
-    def is_closing(self):
-        return self._writer.is_closing()
-
-
-async def proxy_to_masking_domain(reader, writer, initial_data: bytes,
-                                    domain: str, label: str) -> None:
-    try:
-        up_reader, up_writer = await asyncio.wait_for(
-            asyncio.open_connection(domain, 443), timeout=10)
-    except Exception as exc:
-        log.warning("[%s] masking: cannot connect to %s:443: %s",
-                  label, domain, repr(exc))
-        return
-
-    log.debug("[%s] masking -> %s:443", label, domain)
-    stats.connections_masked += 1
-
-    try:
-        if initial_data:
-            up_writer.write(initial_data)
-            await up_writer.drain()
-
-        async def _relay(src, dst):
-            try:
-                while True:
-                    chunk = await src.read(16384)
-                    if not chunk:
-                        break
-                    dst.write(chunk)
-                    await dst.drain()
-            except (ConnectionResetError, BrokenPipeError, OSError,
-                    asyncio.CancelledError):
-                pass
-            finally:
-                try:
-                    dst.close()
-                    await dst.wait_closed()
-                except Exception:
-                    pass
-
-        await asyncio.gather(
-            _relay(reader, up_writer),
-            _relay(up_reader, writer),
-        )
-    except Exception:
-        pass
-    finally:
-        try:
-            up_writer.close()
-        except Exception:
-            pass

proxy/raw_websocket.py

@@ -1,236 +0,0 @@
-import os
-import ssl
-import base64
-import struct
-import asyncio
-import socket as _socket
-
-from typing import List, Optional, Tuple
-from .config import proxy_config
-
-
-_st_BB = struct.Struct('>BB')
-_st_BBH = struct.Struct('>BBH')
-_st_BBQ = struct.Struct('>BBQ')
-_st_BB4s = struct.Struct('>BB4s')
-_st_BBH4s = struct.Struct('>BBH4s')
-_st_BBQ4s = struct.Struct('>BBQ4s')
-_st_H = struct.Struct('>H')
-_st_Q = struct.Struct('>Q')
-
-_ssl_ctx = ssl.create_default_context()
-_ssl_ctx.check_hostname = False
-_ssl_ctx.verify_mode = ssl.CERT_NONE
-
-
-class WsHandshakeError(Exception):
-    def __init__(self, status_code: int, status_line: str,
-                 headers: Optional[dict] = None, location: Optional[str] = None):
-        self.status_code = status_code
-        self.status_line = status_line
-        self.headers = headers or {}
-        self.location = location
-        super().__init__(f"HTTP {status_code}: {status_line}")
-
-    @property
-    def is_redirect(self) -> bool:
-        return self.status_code in (301, 302, 303, 307, 308)
-
-
-def _xor_mask(data: bytes, mask: bytes) -> bytes:
-    if not data:
-        return data
-    n = len(data)
-    mask_rep = (mask * (n // 4 + 1))[:n]
-    return (int.from_bytes(data, 'big') ^
-            int.from_bytes(mask_rep, 'big')).to_bytes(n, 'big')
-
-
-def set_sock_opts(transport, buffer_size):
-    sock = transport.get_extra_info('socket')
-    if sock is None:
-        return
-    
-    try:
-        sock.setsockopt(_socket.IPPROTO_TCP, _socket.TCP_NODELAY, 1)
-    except (OSError, AttributeError):
-        pass
-    
-    try:
-        sock.setsockopt(_socket.SOL_SOCKET, _socket.SO_RCVBUF, buffer_size)
-        sock.setsockopt(_socket.SOL_SOCKET, _socket.SO_SNDBUF, buffer_size)
-    except OSError:
-        pass
-
-
-class RawWebSocket:
-    __slots__ = ('reader', 'writer', '_closed')
-
-    OP_BINARY = 0x2
-    OP_CLOSE = 0x8
-    OP_PING = 0x9
-    OP_PONG = 0xA
-
-    def __init__(self, reader: asyncio.StreamReader,
-                 writer: asyncio.StreamWriter):
-        self.reader = reader
-        self.writer = writer
-        self._closed = False
-
-    @staticmethod
-    async def connect(host: str, domain: str, timeout: float = 10.0) -> 'RawWebSocket':
-        reader, writer = await asyncio.wait_for(
-            asyncio.open_connection(host, 443, ssl=_ssl_ctx,
-                                    server_hostname=domain),
-            timeout=min(timeout, 10))
-        
-        set_sock_opts(writer.transport, proxy_config.buffer_size)
-
-        ws_key = base64.b64encode(os.urandom(16)).decode()
-
-        req = (
-            f'GET /apiws HTTP/1.1\r\n'
-            f'Host: {domain}\r\n'
-            f'Upgrade: websocket\r\n'
-            f'Connection: Upgrade\r\n'
-            f'Sec-WebSocket-Key: {ws_key}\r\n'
-            f'Sec-WebSocket-Version: 13\r\n'
-            f'Sec-WebSocket-Protocol: binary\r\n'
-            f'\r\n'
-        )
-        writer.write(req.encode())
-        await writer.drain()
-
-        response_lines: list[str] = []
-        try:
-            while True:
-                line = await asyncio.wait_for(reader.readline(),
-                                              timeout=timeout)
-                if line in (b'\r\n', b'\n', b''):
-                    break
-                response_lines.append(
-                    line.decode('utf-8', errors='replace').strip())
-        except asyncio.TimeoutError:
-            writer.close()
-            raise
-
-        if not response_lines:
-            writer.close()
-            raise WsHandshakeError(0, 'empty response')
-
-        first_line = response_lines[0]
-        parts = first_line.split(' ', 2)
-        try:
-            status_code = int(parts[1]) if len(parts) >= 2 else 0
-        except ValueError:
-            status_code = 0
-
-        if status_code == 101:
-            return RawWebSocket(reader, writer)
-
-        headers: dict[str, str] = {}
-        for hl in response_lines[1:]:
-            if ':' in hl:
-                k, v = hl.split(':', 1)
-                headers[k.strip().lower()] = v.strip()
-
-        writer.close()
-        raise WsHandshakeError(status_code, first_line, headers,
-                                location=headers.get('location'))
-
-    async def send(self, data: bytes):
-        if self._closed:
-            raise ConnectionError("WebSocket closed")
-        frame = self._build_frame(self.OP_BINARY, data, mask=True)
-        self.writer.write(frame)
-        await self.writer.drain()
-
-    async def send_batch(self, parts: List[bytes]):
-        if self._closed:
-            raise ConnectionError("WebSocket closed")
-        for part in parts:
-            self.writer.write(
-                self._build_frame(self.OP_BINARY, part, mask=True))
-        await self.writer.drain()
-
-    async def recv(self) -> Optional[bytes]:
-        while not self._closed:
-            opcode, payload = await self._read_frame()
-
-            if opcode == self.OP_CLOSE:
-                self._closed = True
-                try:
-                    self.writer.write(self._build_frame(
-                        self.OP_CLOSE,
-                        payload[:2] if payload else b'', mask=True))
-                    await self.writer.drain()
-                except Exception:
-                    pass
-                return None
-
-            if opcode == self.OP_PING:
-                try:
-                    self.writer.write(
-                        self._build_frame(self.OP_PONG, payload, mask=True))
-                    await self.writer.drain()
-                except Exception:
-                    pass
-                continue
-
-            if opcode == self.OP_PONG:
-                continue
-
-            if opcode in (0x1, 0x2):
-                return payload
-            continue
-        return None
-
-    async def close(self):
-        if self._closed:
-            return
-        self._closed = True
-        try:
-            self.writer.write(
-                self._build_frame(self.OP_CLOSE, b'', mask=True))
-            await self.writer.drain()
-        except Exception:
-            pass
-        try:
-            self.writer.close()
-            await self.writer.wait_closed()
-        except Exception:
-            pass
-
-    @staticmethod
-    def _build_frame(opcode: int, data: bytes,
-                     mask: bool = False) -> bytes:
-        length = len(data)
-        fb = 0x80 | opcode
-        if not mask:
-            if length < 126:
-                return _st_BB.pack(fb, length) + data
-            if length < 65536:
-                return _st_BBH.pack(fb, 126, length) + data
-            return _st_BBQ.pack(fb, 127, length) + data
-        mask_key = os.urandom(4)
-        masked = _xor_mask(data, mask_key)
-        if length < 126:
-            return _st_BB4s.pack(fb, 0x80 | length, mask_key) + masked
-        if length < 65536:
-            return _st_BBH4s.pack(fb, 0x80 | 126, length, mask_key) + masked
-        return _st_BBQ4s.pack(fb, 0x80 | 127, length, mask_key) + masked
-
-    async def _read_frame(self) -> Tuple[int, bytes]:
-        hdr = await self.reader.readexactly(2)
-        opcode = hdr[0] & 0x0F
-        length = hdr[1] & 0x7F
-        if length == 126:
-            length = _st_H.unpack(await self.reader.readexactly(2))[0]
-        elif length == 127:
-            length = _st_Q.unpack(await self.reader.readexactly(8))[0]
-        if hdr[1] & 0x80:
-            mask_key = await self.reader.readexactly(4)
-            payload = await self.reader.readexactly(length)
-            return opcode, _xor_mask(payload, mask_key)
-        payload = await self.reader.readexactly(length)
-        return opcode, payload

proxy/stats.py

@@ -1,35 +0,0 @@
-from .utils import human_bytes
-
-class _Stats:
-    def __init__(self):
-        self.connections_total = 0
-        self.connections_active = 0
-        self.connections_ws = 0
-        self.connections_tcp_fallback = 0
-        self.connections_cfproxy = 0
-        self.connections_bad = 0
-        self.connections_masked = 0
-        self.ws_errors = 0
-        self.bytes_up = 0
-        self.bytes_down = 0
-        self.pool_hits = 0
-        self.pool_misses = 0
-
-    def summary(self) -> str:
-        pool_total = self.pool_hits + self.pool_misses
-        pool_s = (f"{self.pool_hits}/{pool_total}"
-                  if pool_total else "n/a")
-        return (f"total={self.connections_total} "
-                f"active={self.connections_active} "
-                f"ws={self.connections_ws} "
-                f"tcp_fb={self.connections_tcp_fallback} "
-                f"cf={self.connections_cfproxy} "
-                f"bad={self.connections_bad} "
-                f"masked={self.connections_masked} "
-                f"err={self.ws_errors} "
-                f"pool={pool_s} "
-                f"up={human_bytes(self.bytes_up)} "
-                f"down={human_bytes(self.bytes_down)}")
-
-
-stats = _Stats()

proxy/tg_ws_proxy.py

@@ -1,767 +0,0 @@
-from __future__ import annotations
-
-import os
-import sys
-import time
-import struct
-import asyncio
-import hashlib
-import argparse
-import logging
-import logging.handlers
-import socket as _socket
-
-from collections import deque
-from typing import Dict, List, Optional, Set, Tuple
-
-from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-
-if __name__ == '__main__' and (__package__ is None or __package__ == ''):
-    _repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-    if _repo_root not in sys.path:
-        sys.path.insert(0, _repo_root)
-    __package__ = 'proxy'
-
-from .utils import *
-from .stats import stats
-from .config import proxy_config, parse_dc_ip_list, start_cfproxy_domain_refresh
-from .bridge import MsgSplitter, CryptoCtx, do_fallback, bridge_ws_reencrypt
-from .raw_websocket import RawWebSocket, WsHandshakeError, set_sock_opts
-from .fake_tls import proxy_to_masking_domain, verify_client_hello, build_server_hello, FakeTlsStream, TLS_RECORD_HANDSHAKE
-from .balancer import balancer
-
-
-log = logging.getLogger('tg-mtproto-proxy')
-
-DC_FAIL_COOLDOWN = 30.0
-WS_FAIL_TIMEOUT = 2.0
-ws_blacklist: Set[str] = set()
-dc_fail_until: Dict[str, float] = {}
-
-
-def _try_handshake(handshake: bytes, secret: bytes) -> Optional[Tuple[int, bool, bytes, bytes]]:
-    dec_prekey_and_iv = handshake[SKIP_LEN:SKIP_LEN + PREKEY_LEN + IV_LEN]
-    dec_prekey = dec_prekey_and_iv[:PREKEY_LEN]
-    dec_iv = dec_prekey_and_iv[PREKEY_LEN:]
-
-    dec_key = hashlib.sha256(dec_prekey + secret).digest()
-
-    dec_iv_int = int.from_bytes(dec_iv, 'big')
-    decryptor = Cipher(
-        algorithms.AES(dec_key), modes.CTR(dec_iv_int.to_bytes(16, 'big'))
-    ).encryptor()
-    decrypted = decryptor.update(handshake)
-
-    proto_tag = decrypted[PROTO_TAG_POS:PROTO_TAG_POS + 4]
-    if proto_tag not in (PROTO_TAG_ABRIDGED, PROTO_TAG_INTERMEDIATE,
-                         PROTO_TAG_SECURE):
-        return None
-
-    dc_idx = int.from_bytes(
-        decrypted[DC_IDX_POS:DC_IDX_POS + 2], 'little', signed=True)
-
-    dc_id = abs(dc_idx)
-    is_media = dc_idx < 0
-
-    return dc_id, is_media, proto_tag, dec_prekey_and_iv
-
-
-def _generate_relay_init(proto_tag: bytes, dc_idx: int) -> bytes:
-    while True:
-        rnd = bytearray(os.urandom(HANDSHAKE_LEN))
-        if rnd[0] in RESERVED_FIRST_BYTES:
-            continue
-        if bytes(rnd[:4]) in RESERVED_STARTS:
-            continue
-        if rnd[4:8] == RESERVED_CONTINUE:
-            continue
-        break
-
-    rnd_bytes = bytes(rnd)
-
-    enc_key = rnd_bytes[SKIP_LEN:SKIP_LEN + PREKEY_LEN]
-    enc_iv = rnd_bytes[SKIP_LEN + PREKEY_LEN:SKIP_LEN + PREKEY_LEN + IV_LEN]
-
-    encryptor = Cipher(
-        algorithms.AES(enc_key), modes.CTR(enc_iv)
-    ).encryptor()
-
-    dc_bytes = struct.pack('<h', dc_idx)
-    tail_plain = proto_tag + dc_bytes + os.urandom(2)
-
-    encrypted_full = encryptor.update(rnd_bytes)
-    keystream_tail = bytes(
-        encrypted_full[i] ^ rnd_bytes[i] for i in range(56, 64))
-    encrypted_tail = bytes(
-        tail_plain[i] ^ keystream_tail[i] for i in range(8))
-
-    result = bytearray(rnd_bytes)
-    result[PROTO_TAG_POS:HANDSHAKE_LEN] = encrypted_tail
-    return bytes(result)
-
-
-def _ws_domains(dc: int, is_media) -> List[str]:
-    if dc == 203:
-        dc = 2
-    if is_media is None or is_media:
-        return [f'kws{dc}-1.web.telegram.org', f'kws{dc}.web.telegram.org']
-    return [f'kws{dc}.web.telegram.org', f'kws{dc}-1.web.telegram.org']
-
-
-class _WsPool:
-    WS_POOL_MAX_AGE = 120.0
-    
-    def __init__(self):
-        self._idle: Dict[Tuple[int, bool], deque] = {}
-        self._refilling: Set[Tuple[int, bool]] = set()
-
-    async def get(self, dc: int, is_media: bool,
-                  target_ip: str, domains: List[str]
-                  ) -> Optional[RawWebSocket]:
-        key = (dc, is_media)
-        now = time.monotonic()
-
-        bucket = self._idle.get(key)
-        if bucket is None:
-            bucket = deque()
-            self._idle[key] = bucket
-        while bucket:
-            ws, created = bucket.popleft()
-            age = now - created
-            if (age > self.WS_POOL_MAX_AGE or ws._closed
-                    or ws.writer.transport.is_closing()):
-                asyncio.create_task(self._quiet_close(ws))
-                continue
-            stats.pool_hits += 1
-            log.debug("WS pool hit DC%d%s (age=%.1fs, left=%d)",
-                      dc, 'm' if is_media else '', age, len(bucket))
-            self._schedule_refill(key, target_ip, domains)
-            return ws
-
-        stats.pool_misses += 1
-        self._schedule_refill(key, target_ip, domains)
-        return None
-
-    def _schedule_refill(self, key, target_ip, domains):
-        if key in self._refilling:
-            return
-        self._refilling.add(key)
-        asyncio.create_task(self._refill(key, target_ip, domains))
-
-    async def _refill(self, key, target_ip, domains):
-        dc, is_media = key
-        try:
-            bucket = self._idle.setdefault(key, deque())
-            needed = proxy_config.pool_size - len(bucket)
-            if needed <= 0:
-                return
-            tasks = [asyncio.create_task(
-                self._connect_one(target_ip, domains))
-                for _ in range(needed)]
-            for t in tasks:
-                try:
-                    ws = await t
-                    if ws:
-                        bucket.append((ws, time.monotonic()))
-                except Exception:
-                    pass
-            log.debug("WS pool refilled DC%d%s: %d ready",
-                      dc, 'm' if is_media else '', len(bucket))
-        finally:
-            self._refilling.discard(key)
-
-    @staticmethod
-    async def _connect_one(target_ip, domains) -> Optional[RawWebSocket]:
-        for domain in domains:
-            try:
-                return await RawWebSocket.connect(
-                    target_ip, domain, timeout=8)
-            except WsHandshakeError as exc:
-                if exc.is_redirect:
-                    continue
-                return None
-            except Exception:
-                return None
-        return None
-
-    @staticmethod
-    async def _quiet_close(ws):
-        try:
-            await ws.close()
-        except Exception:
-            pass
-
-    async def warmup(self, dc_redirects: Dict[int, str]):
-        for dc, target_ip in dc_redirects.items():
-            if target_ip is None:
-                continue
-            for is_media in (False, True):
-                domains = _ws_domains(dc, is_media)
-                self._schedule_refill((dc, is_media), target_ip, domains)
-        log.info("WS pool warmup started for %d DC(s)", len(dc_redirects))
-
-    def reset(self):
-        self._idle.clear()
-        self._refilling.clear()
-
-_ws_pool = _WsPool()
-
-
-async def _read_client_init(reader, writer, secret, label, masking):
-    if proxy_config.proxy_protocol:
-        try:
-            pp_line = await asyncio.wait_for(
-                reader.readline(), timeout=10)
-        except asyncio.IncompleteReadError:
-            log.debug("[%s] disconnected during PROXY header", label)
-            return None
-        pp_text = pp_line.decode('ascii', errors='replace').strip()
-        if pp_text.startswith('PROXY '):
-            parts = pp_text.split()
-            if len(parts) >= 6:
-                label = f"{parts[2]}:{parts[4]}"
-            log.debug("[%s] PROXY protocol: %s", label, pp_text)
-        else:
-            log.debug("[%s] expected PROXY header, got: %r", label,
-                      pp_text[:60])
-
-    try:
-        first_byte = await asyncio.wait_for(
-            reader.readexactly(1), timeout=10)
-    except asyncio.IncompleteReadError:
-        log.debug("[%s] client disconnected before handshake", label)
-        return None
-
-    if first_byte[0] == TLS_RECORD_HANDSHAKE and masking:
-        try:
-            hdr_rest = await asyncio.wait_for(
-                reader.readexactly(4), timeout=10)
-        except asyncio.IncompleteReadError:
-            log.debug("[%s] incomplete TLS record header", label)
-            return None
-
-        tls_header = first_byte + hdr_rest
-        record_len = struct.unpack('>H', tls_header[3:5])[0]
-
-        try:
-            record_body = await asyncio.wait_for(
-                reader.readexactly(record_len), timeout=10)
-        except asyncio.IncompleteReadError:
-            log.debug("[%s] incomplete TLS record body", label)
-            return None
-
-        client_hello = tls_header + record_body
-
-        tls_result = verify_client_hello(client_hello, secret)
-
-        if tls_result is None:
-            log.debug("[%s] Fake TLS verify failed (size=%d rec=%d) "
-                      "-> masking",
-                      label, len(client_hello), record_len)
-            await proxy_to_masking_domain(
-                reader, writer, client_hello, masking, label)
-            return None
-
-        client_random, session_id, ts = tls_result
-        log.debug("[%s] Fake TLS handshake ok (ts=%d)", label, ts)
-
-        server_hello = build_server_hello(secret, client_random, session_id)
-        writer.write(server_hello)
-        await writer.drain()
-
-        tls_stream = FakeTlsStream(reader, writer)
-
-        try:
-            handshake = await asyncio.wait_for(
-                tls_stream.readexactly(HANDSHAKE_LEN), timeout=10)
-        except asyncio.IncompleteReadError:
-            log.debug("[%s] incomplete obfs2 init inside TLS", label)
-            return None
-
-        return handshake, tls_stream, tls_stream, label
-
-    elif masking:
-        log.debug("[%s] non-TLS byte 0x%02X -> HTTP redirect", label,
-                  first_byte[0])
-        redirect = (
-            f"HTTP/1.1 301 Moved Permanently\r\n"
-            f"Location: https://{masking}/\r\n"
-            f"Content-Length: 0\r\n"
-            f"Connection: close\r\n\r\n"
-        ).encode()
-        writer.write(redirect)
-        await writer.drain()
-        return None
-
-    else:
-        try:
-            rest = await asyncio.wait_for(
-                reader.readexactly(HANDSHAKE_LEN - 1), timeout=10)
-        except asyncio.IncompleteReadError:
-            log.debug("[%s] client disconnected before handshake", label)
-            return None
-        return first_byte + rest, reader, writer, label
-
-
-def _build_crypto_ctx(client_dec_prekey_iv, secret, relay_init):
-    # key = SHA256(prekey + secret), iv from handshake
-    # "dec" = decrypt data from client; "enc" = encrypt data to client
-    clt_dec_prekey = client_dec_prekey_iv[:PREKEY_LEN]
-    clt_dec_iv = client_dec_prekey_iv[PREKEY_LEN:]
-    clt_dec_key = hashlib.sha256(clt_dec_prekey + secret).digest()
-
-    clt_enc_prekey_iv = client_dec_prekey_iv[::-1]
-    clt_enc_key = hashlib.sha256(
-        clt_enc_prekey_iv[:PREKEY_LEN] + secret).digest()
-    clt_enc_iv = clt_enc_prekey_iv[PREKEY_LEN:]
-
-    clt_decryptor = Cipher(
-        algorithms.AES(clt_dec_key), modes.CTR(clt_dec_iv)
-    ).encryptor()
-    clt_encryptor = Cipher(
-        algorithms.AES(clt_enc_key), modes.CTR(clt_enc_iv)
-    ).encryptor()
-
-    # fast-forward client decryptor past the 64-byte init
-    clt_decryptor.update(ZERO_64)
-
-    # relay side: standard obfuscation (no secret hash, raw key)
-    relay_enc_key = relay_init[SKIP_LEN:SKIP_LEN + PREKEY_LEN]
-    relay_enc_iv = relay_init[SKIP_LEN + PREKEY_LEN:
-                              SKIP_LEN + PREKEY_LEN + IV_LEN]
-
-    relay_dec_prekey_iv = relay_init[SKIP_LEN:
-                                     SKIP_LEN + PREKEY_LEN + IV_LEN][::-1]
-    relay_dec_key = relay_dec_prekey_iv[:KEY_LEN]
-    relay_dec_iv = relay_dec_prekey_iv[KEY_LEN:]
-
-    tg_encryptor = Cipher(
-        algorithms.AES(relay_enc_key), modes.CTR(relay_enc_iv)
-    ).encryptor()
-    tg_decryptor = Cipher(
-        algorithms.AES(relay_dec_key), modes.CTR(relay_dec_iv)
-    ).encryptor()
-
-    tg_encryptor.update(ZERO_64)
-
-    return CryptoCtx(clt_decryptor, clt_encryptor, tg_encryptor, tg_decryptor)
-
-
-async def _handle_client(reader, writer, secret: bytes):
-    stats.connections_total += 1
-    stats.connections_active += 1
-    peer = writer.get_extra_info('peername')
-    label = f"{peer[0]}:{peer[1]}" if peer else "?"
-
-    set_sock_opts(writer.transport, proxy_config.buffer_size)
-
-    try:
-        init = await _read_client_init(
-            reader, writer, secret, label, proxy_config.fake_tls_domain)
-        if init is None:
-            return
-
-        handshake, clt_reader, clt_writer, label = init
-
-        result = _try_handshake(handshake, secret)
-        if result is None:
-            stats.connections_bad += 1
-            log.warning("[%s] bad handshake (wrong secret or proto)", label)
-            try:
-                while await clt_reader.read(4096):
-                    pass
-            except Exception:
-                pass
-            return
-
-        dc, is_media, proto_tag, client_dec_prekey_iv = result
-
-        if proto_tag == PROTO_TAG_ABRIDGED:
-            proto_int = PROTO_ABRIDGED_INT
-        elif proto_tag == PROTO_TAG_INTERMEDIATE:
-            proto_int = PROTO_INTERMEDIATE_INT
-        else:
-            proto_int = PROTO_PADDED_INTERMEDIATE_INT
-
-        dc_idx = -dc if is_media else dc
-
-        log.debug("[%s] handshake ok: DC%d%s proto=0x%08X",
-                  label, dc, ' media' if is_media else '', proto_int)
-
-        relay_init = _generate_relay_init(proto_tag, dc_idx)
-        ctx = _build_crypto_ctx(client_dec_prekey_iv, secret, relay_init)
-
-        dc_key = f'{dc}{"m" if is_media else ""}'
-        media_tag = " media" if is_media else ""
-
-        # Fallback if DC not in config or WS blacklisted for this DC/is_media
-        if dc not in proxy_config.dc_redirects or dc_key in ws_blacklist:
-            if dc not in proxy_config.dc_redirects:
-                log.info("[%s] DC%d not in config -> fallback",
-                         label, dc)
-            else:
-                log.info("[%s] DC%d%s WS blacklisted -> fallback",
-                         label, dc, media_tag)
-            splitter = None
-            try:
-                splitter = MsgSplitter(relay_init, proto_int)
-            except Exception:
-                pass
-            ok = await do_fallback(
-                clt_reader, clt_writer, relay_init, label,
-                dc, is_media, media_tag,
-                ctx, splitter=splitter)
-            if not ok:
-                log.warning("[%s] DC%d%s no fallback available",
-                            label, dc, media_tag)
-            return
-
-        now = time.monotonic()
-        fail_until = dc_fail_until.get(dc_key, 0)
-        ws_timeout = WS_FAIL_TIMEOUT if now < fail_until else 10.0
-
-        domains = _ws_domains(dc, is_media)
-        target = proxy_config.dc_redirects[dc]
-        ws = None
-        ws_failed_redirect = False
-        all_redirects = True
-
-        ws = await _ws_pool.get(dc, is_media, target, domains)
-        if ws:
-            log.info("[%s] DC%d%s -> pool hit via %s",
-                     label, dc, media_tag, target)
-        else:
-            for domain in domains:
-                url = f'wss://{domain}/apiws'
-                log.info("[%s] DC%d%s -> %s via %s",
-                         label, dc, media_tag, url, target)
-                try:
-                    ws = await RawWebSocket.connect(target, domain,
-                                                    timeout=ws_timeout)
-                    all_redirects = False
-                    break
-                except WsHandshakeError as exc:
-                    stats.ws_errors += 1
-                    if exc.is_redirect:
-                        ws_failed_redirect = True
-                        log.warning("[%s] DC%d%s got %d from %s -> %s",
-                                    label, dc, media_tag,
-                                    exc.status_code, domain,
-                                    exc.location or '?')
-                        continue
-                    else:
-                        all_redirects = False
-                        log.warning("[%s] DC%d%s WS handshake: %s",
-                                    label, dc, media_tag, exc.status_line)
-                except Exception as exc:
-                    stats.ws_errors += 1
-                    all_redirects = False
-                    log.warning("[%s] DC%d%s WS connect failed: %s",
-                                label, dc, media_tag, repr(exc))
-
-        # WS failed -> fallback
-        if ws is None:
-            if ws_failed_redirect and all_redirects:
-                ws_blacklist.add(dc_key)
-                log.warning("[%s] DC%d%s blacklisted for WS (all 302)",
-                            label, dc, media_tag)
-            elif ws_failed_redirect:
-                dc_fail_until[dc_key] = now + DC_FAIL_COOLDOWN
-            else:
-                dc_fail_until[dc_key] = now + DC_FAIL_COOLDOWN
-                log.info("[%s] DC%d%s WS cooldown for %ds",
-                         label, dc, media_tag, int(DC_FAIL_COOLDOWN))
-
-            splitter_fb = None
-            try:
-                splitter_fb = MsgSplitter(relay_init, proto_int)
-            except Exception:
-                pass
-            ok = await do_fallback(
-                clt_reader, clt_writer, relay_init, label,
-                dc, is_media, media_tag,
-                ctx, splitter=splitter_fb)
-            if ok:
-                log.info("[%s] DC%d%s fallback closed",
-                         label, dc, media_tag)
-            return
-
-        dc_fail_until.pop(dc_key, None)
-        stats.connections_ws += 1
-
-        splitter = None
-        try:
-            splitter = MsgSplitter(relay_init, proto_int)
-            log.debug("[%s] MsgSplitter activated for proto 0x%08X",
-                      label, proto_int)
-        except Exception:
-            pass
-
-        await ws.send(relay_init)
-
-        await bridge_ws_reencrypt(clt_reader, clt_writer, ws, label, ctx,
-                                   dc=dc, is_media=is_media,
-                                   splitter=splitter)
-
-    except asyncio.TimeoutError:
-        log.warning("[%s] timeout during handshake", label)
-    except asyncio.IncompleteReadError:
-        log.debug("[%s] client disconnected", label)
-    except asyncio.CancelledError:
-        log.debug("[%s] cancelled", label)
-    except ConnectionResetError:
-        log.debug("[%s] connection reset", label)
-    except OSError as exc:
-        if getattr(exc, 'winerror', None) == 1236:
-            log.debug("[%s] connection aborted by local system", label)
-        else:
-            log.error("[%s] unexpected OS error: %s", label, repr(exc))
-    except Exception as exc:
-        log.error("[%s] unexpected: %s", label, exc, exc_info=True)
-    finally:
-        stats.connections_active -= 1
-        try:
-            writer.close()
-            await writer.wait_closed()
-        except BaseException:
-            pass
-
-
-_server_instance = None
-_server_stop_event = None
-_client_tasks: Set[asyncio.Task] = set()
-
-
-async def _run(stop_event: Optional[asyncio.Event] = None):
-    global _server_instance, _server_stop_event
-    _server_stop_event = stop_event
-
-    _ws_pool.reset()
-    ws_blacklist.clear()
-    dc_fail_until.clear()
-    _client_tasks.clear()
-
-    if proxy_config.fallback_cfproxy:
-        user = proxy_config.cfproxy_user_domain
-        if user:
-            balancer.update_domains_list([user])
-        else:
-            start_cfproxy_domain_refresh()
-
-    secret_bytes = bytes.fromhex(proxy_config.secret)
-
-    def client_cb(r, w):
-        task = asyncio.create_task(_handle_client(r, w, secret_bytes))
-        _client_tasks.add(task)
-        task.add_done_callback(_client_tasks.discard)
-
-    server = await asyncio.start_server(client_cb, proxy_config.host, proxy_config.port)
-    _server_instance = server
-
-    for sock in server.sockets:
-        try:
-            sock.setsockopt(_socket.IPPROTO_TCP, _socket.TCP_NODELAY, 1)
-        except (OSError, AttributeError):
-            pass
-
-    link_host = get_link_host(proxy_config.host)
-    ftls = proxy_config.fake_tls_domain
-    dd_link = (f"tg://proxy?server={link_host}"
-               f"&port={proxy_config.port}"
-               f"&secret=dd{proxy_config.secret}")
-    ee_link = ""
-    if ftls:
-        domain_hex = ftls.encode('ascii').hex()
-        ee_link = (f"tg://proxy?server={link_host}"
-                   f"&port={proxy_config.port}"
-                   f"&secret=ee{proxy_config.secret}{domain_hex}")
-
-    log.info("=" * 60)
-    log.info("  Telegram MTProto WS Bridge Proxy")
-    log.info("  Listening on   %s:%d", proxy_config.host, proxy_config.port)
-    log.info("  Secret:        %s", proxy_config.secret)
-    if ftls:
-        log.info("  Fake TLS:      %s", ftls)
-    log.info("  Target DC IPs:")
-    for dc in sorted(proxy_config.dc_redirects.keys()):
-        ip = proxy_config.dc_redirects.get(dc)
-        log.info("    DC%d: %s", dc, ip)
-    if proxy_config.fallback_cfproxy:
-        prio = 'CF first' if proxy_config.fallback_cfproxy_priority else 'TCP first'
-        user_domain = "user" if proxy_config.cfproxy_user_domain else "auto"
-        log.info("  CF proxy:      enabled (%s | %s)", prio, user_domain)
-    log.info("=" * 60)
-    log.info("  Connect:")
-    if ftls:
-        log.info("    %s", ee_link)
-    else:
-        log.info("    %s", dd_link)
-    log.info("=" * 60)
-
-    async def log_stats():
-        try:
-            while True:
-                await asyncio.sleep(60)
-                bl = ', '.join(f'DC{k}' for k in sorted(ws_blacklist)) or 'none'
-                log.info("stats: %s | ws_bl: %s", stats.summary(), bl)
-        except asyncio.CancelledError:
-            raise
-
-    log_stats_task = asyncio.create_task(log_stats())
-
-    await _ws_pool.warmup(proxy_config.dc_redirects)
-
-    try:
-        async with server:
-            if stop_event:
-                serve_task = asyncio.create_task(server.serve_forever())
-                stop_task = asyncio.create_task(stop_event.wait())
-                done, _ = await asyncio.wait(
-                    (serve_task, stop_task),
-                    return_when=asyncio.FIRST_COMPLETED,
-                )
-                if stop_task in done:
-                    server.close()
-                    await server.wait_closed()
-                    if not serve_task.done():
-                        serve_task.cancel()
-                        try:
-                            await serve_task
-                        except asyncio.CancelledError:
-                            pass
-                else:
-                    stop_task.cancel()
-                    try:
-                        await stop_task
-                    except asyncio.CancelledError:
-                        pass
-            else:
-                await server.serve_forever()
-    finally:
-        log_stats_task.cancel()
-        try:
-            await log_stats_task
-        except asyncio.CancelledError:
-            pass
-    _server_instance = None
-
-
-def run_proxy(stop_event: Optional[asyncio.Event] = None):
-    asyncio.run(_run(stop_event,))
-
-
-def main():
-    def _parse_bool(value: str) -> bool:
-        lowered = value.strip().lower()
-        if lowered == 'true':
-            return True
-        if lowered == 'false':
-            return False
-        raise argparse.ArgumentTypeError(
-            "Expected boolean value: true or false",
-        )
-
-    ap = argparse.ArgumentParser(
-        description='Telegram MTProto WebSocket Bridge Proxy')
-    ap.add_argument('--port', type=int, default=1443,
-                    help='Listen port (default 1443)')
-    ap.add_argument('--host', type=str, default='127.0.0.1',
-                    help='Listen host (default 127.0.0.1)')
-    ap.add_argument('--secret', type=str, default=None,
-                    help='MTProto proxy secret (32 hex chars). '
-                         'Auto-generated if not provided.')
-    ap.add_argument('--dc-ip', metavar='DC:IP', action='append',
-                    help='Target IP for a DC, e.g. --dc-ip 2:149.154.167.220')
-    ap.add_argument('-v', '--verbose', action='store_true',
-                    help='Debug logging')
-    ap.add_argument('--log-file', type=str, default=None, metavar='PATH',
-                    help='Log to file with rotation (default: stderr only)')
-    ap.add_argument('--log-max-mb', type=float, default=5, metavar='MB',
-                    help='Max log file size in MB before rotation (default 5)')
-    ap.add_argument('--log-backups', type=int, default=0, metavar='N',
-                    help='Number of rotated log files to keep (default 0)')
-    ap.add_argument('--buf-kb', type=int, default=256, metavar='KB',
-                    help='Socket send/recv buffer size in KB (default 256)')
-    ap.add_argument('--pool-size', type=int, default=4, metavar='N',
-                    help='WS connection pool size per DC (default 4, min 0)')
-    ap.add_argument('--cfproxy-domain', type=str, default='',
-                    metavar='DOMAIN',
-                    help='User defined Cloudflare-proxied domain for WS fallback')
-    ap.add_argument('--no-cfproxy', action='store_true',
-                    help='Disable Cloudflare proxy fallback')
-    ap.add_argument('--cfproxy-priority', type=_parse_bool, default=True,
-                    help='Try cfproxy before tcp fallback (default: true)')
-    ap.add_argument('--fake-tls-domain', type=str, default='',
-                    metavar='DOMAIN',
-                    help='Enable Fake TLS (ee-secret) masking with the given '
-                         'SNI domain, e.g. example.com')
-    ap.add_argument('--proxy-protocol', action='store_true',
-                    help='Accept PROXY protocol v1 header '
-                         '(for use behind nginx/haproxy with proxy_protocol on)')
-    args = ap.parse_args()
-
-    if not args.dc_ip:
-        args.dc_ip = ['2:149.154.167.220', '4:149.154.167.220']
-
-    try:
-        dc_redirects = parse_dc_ip_list(args.dc_ip)
-    except ValueError as e:
-        log.error(str(e))
-        sys.exit(1)
-
-    if args.secret:
-        secret_hex = args.secret.strip()
-        if len(secret_hex) != 32:
-            log.error("Secret must be exactly 32 hex characters")
-            sys.exit(1)
-        try:
-            bytes.fromhex(secret_hex)
-        except ValueError:
-            log.error("Secret must be valid hex")
-            sys.exit(1)
-    else:
-        secret_hex = os.urandom(16).hex()
-        log.info("Generated secret: %s", secret_hex)
-
-    proxy_config.port = args.port
-    proxy_config.host = args.host
-    proxy_config.secret = secret_hex
-    proxy_config.dc_redirects = dc_redirects
-    proxy_config.buffer_size = max(4, args.buf_kb) * 1024
-    proxy_config.pool_size = max(0, args.pool_size)
-    proxy_config.fallback_cfproxy = not args.no_cfproxy
-    proxy_config.fallback_cfproxy_priority = args.cfproxy_priority
-    proxy_config.cfproxy_user_domain = args.cfproxy_domain.strip()
-    proxy_config.fake_tls_domain = args.fake_tls_domain.strip()
-    proxy_config.proxy_protocol = args.proxy_protocol
-
-    log_level = logging.DEBUG if args.verbose else logging.INFO
-    log_fmt = logging.Formatter('%(asctime)s  %(levelname)-5s  %(message)s',
-                                datefmt='%H:%M:%S')
-    root = logging.getLogger()
-    root.setLevel(log_level)
-
-    console = logging.StreamHandler()
-    console.setFormatter(log_fmt)
-    root.addHandler(console)
-
-    if args.log_file:
-        fh = logging.handlers.RotatingFileHandler(
-            args.log_file,
-            maxBytes=max(32 * 1024, int(args.log_max_mb * 1024 * 1024)),
-            backupCount=max(0, args.log_backups),
-            encoding='utf-8',
-        )
-        fh.setFormatter(log_fmt)
-        root.addHandler(fh)
-
-    logging.getLogger('asyncio').setLevel(logging.WARNING)
-
-    try:
-        asyncio.run(_run())
-    except KeyboardInterrupt:
-        log.info("Shutting down. Final stats: %s", stats.summary())
-
-
-if __name__ == '__main__':
-    main()

proxy/utils.py

@@ -1,87 +0,0 @@
-import socket as _socket
-import urllib.request
-import http.client
-
-from typing import Optional, Dict
-from urllib.request import Request
-
-
-ZERO_64 = b'\x00' * 64
-HANDSHAKE_LEN = 64
-SKIP_LEN = 8
-PREKEY_LEN = 32
-KEY_LEN = 32
-IV_LEN = 16
-PROTO_TAG_POS = 56
-DC_IDX_POS = 60
-
-PROTO_TAG_ABRIDGED = b'\xef\xef\xef\xef'
-PROTO_TAG_INTERMEDIATE = b'\xee\xee\xee\xee'
-PROTO_TAG_SECURE = b'\xdd\xdd\xdd\xdd'
-
-PROTO_ABRIDGED_INT = 0xEFEFEFEF
-PROTO_INTERMEDIATE_INT = 0xEEEEEEEE
-PROTO_PADDED_INTERMEDIATE_INT = 0xDDDDDDDD
-
-RESERVED_FIRST_BYTES = {0xEF}
-RESERVED_STARTS = {b'\x48\x45\x41\x44', b'\x50\x4F\x53\x54',
-                    b'\x47\x45\x54\x20', b'\xee\xee\xee\xee',
-                    b'\xdd\xdd\xdd\xdd', b'\x16\x03\x01\x02'}
-RESERVED_CONTINUE = b'\x00\x00\x00\x00'
-
-_GITHUB_IPS: Dict[str, str] = {
-    "release-assets.githubusercontent.com": "185.199.109.133",
-    "uralgit.ru": "185.199.109.133",
-}
-
-
-def human_bytes(n: int) -> str:
-    for unit in ('B', 'KB', 'MB', 'GB'):
-        if abs(n) < 1024:
-            return f"{n:.1f}{unit}"
-        n /= 1024  # type: ignore
-    return f"{n:.1f}TB"
-
-
-def get_link_host(host: str) -> Optional[str]:
-    if host == '0.0.0.0':
-        try:
-            with _socket.socket(_socket.AF_INET, _socket.SOCK_DGRAM) as _s:
-                _s.connect(('8.8.8.8', 80))
-                link_host = _s.getsockname()[0]
-        except OSError:
-            link_host = '127.0.0.1'
-        return link_host
-    else:
-        return host
-
-
-class _PinnedHTTPSHandler(urllib.request.HTTPSHandler):
-    def https_open(self, req: Request):
-        host = req.host.split(":")[0]
-        ip = _GITHUB_IPS.get(host)
-        if not ip:
-            return super().https_open(req)
-        pinned = ip
-
-        class _Conn(http.client.HTTPSConnection):
-            def connect(self):
-                self.sock = _socket.create_connection(
-                    (pinned, self.port or 443),
-                    self.timeout,
-                    self.source_address,
-                )
-                if self._tunnel_host:
-                    self._tunnel()
-                self.sock = self._context.wrap_socket(
-                    self.sock, server_hostname=self._tunnel_host or self.host
-                )
-
-        try:
-            return self.do_open(_Conn, req)
-        except Exception:
-            return super().https_open(req)
-
-
-def build_github_opener() -> urllib.request.OpenerDirector:
-    return urllib.request.build_opener(_PinnedHTTPSHandler())

pyproject.toml

@@ -1,76 +0,0 @@
-[build-system]
-requires = ["hatchling>=1.25.0"]
-build-backend = "hatchling.build"
-
-[project]
-name = "tg-ws-proxy"
-dynamic=["version"]
-
-description = "Telegram Desktop WebSocket Bridge Proxy"
-readme = "docs/README.md"
-requires-python = ">=3.8"
-
-license = { name = "MIT", file = "LICENSE" }
-
-authors = [
-    { name = "Flowseal" }
-]
-
-keywords = [
-    "telegram",
-    "tdesktop",
-    "proxy",
-    "bypass",
-    "websocket",
-    "mtproto",
-]
-classifiers = [
-  "Development Status :: 5 - Production/Stable",
-  "Environment :: Console",
-  "Intended Audience :: Customer Service",
-  "Programming Language :: Python :: 3",
-  "License :: OSI Approved :: MIT License",
-  "Operating System :: OS Independent",
-  "Topic :: System :: Networking :: Firewalls",
-]
-
-dependencies = [
-    "pyperclip==1.9.0",
-
-    "psutil==5.9.8; platform_system == 'Windows' and python_version < '3.9'",
-    "cryptography==41.0.7; platform_system == 'Windows' and python_version < '3.9'",
-    "Pillow==10.4.0; platform_system == 'Windows' and python_version < '3.9'",
-
-    "psutil==7.0.0; platform_system != 'Windows' or python_version >= '3.9'",
-    "cryptography==46.0.5; platform_system != 'Windows' or python_version >= '3.9'",
-    "Pillow==12.1.1; (platform_system != 'Windows' or python_version >= '3.9') and platform_system != 'Darwin'",
-
-    "customtkinter==5.2.2; platform_system != 'Darwin'",
-    "pystray==0.19.5; platform_system != 'Darwin'",
-    "rumps==0.4.0; platform_system == 'Darwin'",
-    "Pillow==12.1.0; platform_system == 'Darwin'",
-]
-
-[project.scripts]
-tg-ws-proxy = "proxy.tg_ws_proxy:main"
-tg-ws-proxy-tray-win = "windows:main"
-tg-ws-proxy-tray-macos = "macos:main"
-tg-ws-proxy-tray-linux = "linux:main"
-
-[project.urls]
-Source = "https://uralgit.ru/ural/tg-ws-proxy-go"
-Issues = "https://uralgit.ru/ural/tg-ws-proxy-go/issues"
-
-[tool.hatch.build.targets.wheel]
-packages = ["proxy", "ui", "utils"]
-
-[tool.hatch.build.force-include]
-"windows.py" = "windows.py"
-"macos.py" = "macos.py"
-"linux.py" = "linux.py"
-
-[tool.hatch.version]
-path = "proxy/__init__.py"
-
-[tool.ruff.lint]
-ignore = ["F403", "F405"]

src/config.go

@@ -0,0 +1,162 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"net"
+	"strconv"
+	"strings"
+)
+
+func parseFlags() (*Config, error) {
+	host := flag.String("host", "127.0.0.1", "Listen host")
+	port := flag.Int("port", 1443, "Listen port")
+	secret := flag.String("secret", "", "MTProto secret (32 hex chars)")
+	verbose := flag.Bool("v", false, "Verbose logs")
+	logFile := flag.String("log-file", "", "Log file path")
+	logMaxMB := flag.Float64("log-max-mb", 5, "Max log file size before rotate")
+	logBackups := flag.Int("log-backups", 0, "Number of rotated backups")
+	bufKB := flag.Int("buf-kb", 256, "Socket buffer size in KB")
+	poolSize := flag.Int("pool-size", 4, "WS pool size per DC")
+	dcIPDefault := flag.String("dc-ip-default", "149.154.167.220", "Default target IP for all implicit DCs when --dc-ip is not provided")
+	dcIPDefaultPool := flag.String("dc-ip-default-pool", "", "Default target IP pool for implicit DCs, comma-separated")
+	pprofListen := flag.String("pprof-listen", "", "Optional pprof listen address (e.g. 127.0.0.1:6060)")
+
+	var dcIPs multiFlag
+	var dcIPPools multiFlag
+	flag.Var(&dcIPs, "dc-ip", "Target DC IP as DC:IP; repeatable")
+	flag.Var(&dcIPPools, "dc-ip-pool", "Target pool as DC:IP1,IP2,...; repeatable")
+	flag.Parse()
+
+	if *secret == "" {
+		b := make([]byte, 16)
+		if _, err := rand.Read(b); err != nil {
+			return nil, err
+		}
+		*secret = hex.EncodeToString(b)
+		log.Printf("INFO   Generated secret: %s", *secret)
+	}
+	if len(*secret) != 32 {
+		return nil, errors.New("secret must be exactly 32 hex chars")
+	}
+	if _, err := hex.DecodeString(*secret); err != nil {
+		return nil, errors.New("secret must be valid hex")
+	}
+
+	defaultTargetIP := strings.TrimSpace(*dcIPDefault)
+	if net.ParseIP(defaultTargetIP) == nil {
+		return nil, fmt.Errorf("invalid --dc-ip-default: %s", defaultTargetIP)
+	}
+
+	defaultPool := []string{defaultTargetIP}
+	if strings.TrimSpace(*dcIPDefaultPool) != "" {
+		poolIPs, err := parseIPCSV(*dcIPDefaultPool)
+		if err != nil {
+			return nil, fmt.Errorf("invalid --dc-ip-default-pool: %w", err)
+		}
+		defaultPool = poolIPs
+	}
+
+	dcMap := map[int]string{}
+	dcPool := map[int][]string{}
+	for _, dc := range []int{1, 2, 3, 4, 5, 203} {
+		dcPool[dc] = append([]string(nil), defaultPool...)
+		dcMap[dc] = defaultPool[0]
+	}
+
+	for _, item := range dcIPs {
+		parts := strings.SplitN(item, ":", 2)
+		if len(parts) != 2 {
+			return nil, fmt.Errorf("invalid --dc-ip: %s", item)
+		}
+		dc, err := strconv.Atoi(parts[0])
+		if err != nil {
+			return nil, fmt.Errorf("invalid dc: %s", parts[0])
+		}
+		if net.ParseIP(parts[1]) == nil {
+			return nil, fmt.Errorf("invalid ip: %s", parts[1])
+		}
+		ip := parts[1]
+		dcPool[dc] = []string{ip}
+		dcMap[dc] = ip
+	}
+
+	for _, item := range dcIPPools {
+		parts := strings.SplitN(item, ":", 2)
+		if len(parts) != 2 {
+			return nil, fmt.Errorf("invalid --dc-ip-pool: %s", item)
+		}
+		dc, err := strconv.Atoi(parts[0])
+		if err != nil {
+			return nil, fmt.Errorf("invalid dc in --dc-ip-pool: %s", parts[0])
+		}
+		poolIPs, err := parseIPCSV(parts[1])
+		if err != nil {
+			return nil, fmt.Errorf("invalid --dc-ip-pool for dc %d: %w", dc, err)
+		}
+		dcPool[dc] = append([]string(nil), poolIPs...)
+		dcMap[dc] = dcPool[dc][0]
+	}
+
+	return &Config{
+		Host:        *host,
+		Port:        *port,
+		SecretHex:   *secret,
+		DCMap:       dcMap,
+		DCPool:      dcPool,
+		Verbose:     *verbose,
+		BufKB:       maxInt(*bufKB, 4),
+		PoolSize:    maxInt(*poolSize, 0),
+		LogFile:     *logFile,
+		LogMaxMB:    *logMaxMB,
+		LogBackups:  maxInt(*logBackups, 0),
+		PprofListen: strings.TrimSpace(*pprofListen),
+	}, nil
+}
+
+type multiFlag []string
+
+func (m *multiFlag) String() string { return strings.Join(*m, ",") }
+func (m *multiFlag) Set(v string) error {
+	*m = append(*m, v)
+	return nil
+}
+
+func maxInt(a, b int) int {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+func parseIPCSV(raw string) ([]string, error) {
+	parts := strings.Split(raw, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		ip := strings.TrimSpace(p)
+		if ip == "" {
+			continue
+		}
+		if net.ParseIP(ip) == nil {
+			return nil, fmt.Errorf("invalid ip: %s", ip)
+		}
+		out = appendUniqueIP(out, ip)
+	}
+	if len(out) == 0 {
+		return nil, errors.New("empty ip pool")
+	}
+	return out, nil
+}
+
+func appendUniqueIP(dst []string, ip string) []string {
+	for _, v := range dst {
+		if v == ip {
+			return dst
+		}
+	}
+	return append(dst, ip)
+}

src/constants.go

@@ -0,0 +1,47 @@
+package main
+
+import "time"
+
+const (
+	handshakeLen = 64
+	skipLen      = 8
+	prekeyLen    = 32
+	keyLen       = 32
+	ivLen        = 16
+	protoTagPos  = 56
+	dcIdxPos     = 60
+
+	protoAbridgedInt           = 0xEFEFEFEF
+	protoIntermediateInt       = 0xEEEEEEEE
+	protoPaddedIntermediateInt = 0xDDDDDDDD
+
+	wsPoolMaxAge   = 120 * time.Second
+	dcFailCooldown = 30 * time.Second
+)
+
+var (
+	protoTagAbridged     = []byte{0xef, 0xef, 0xef, 0xef}
+	protoTagIntermediate = []byte{0xee, 0xee, 0xee, 0xee}
+	protoTagSecure       = []byte{0xdd, 0xdd, 0xdd, 0xdd}
+
+	reservedFirst = map[byte]bool{0xef: true}
+	reservedStart = [][]byte{
+		[]byte("HEAD"),
+		[]byte("POST"),
+		[]byte("GET "),
+		{0xee, 0xee, 0xee, 0xee},
+		{0xdd, 0xdd, 0xdd, 0xdd},
+		{0x16, 0x03, 0x01, 0x02},
+	}
+
+	dcDefaults = map[int]string{
+		1:   "149.154.175.50",
+		2:   "149.154.167.51",
+		3:   "149.154.175.100",
+		4:   "149.154.167.91",
+		5:   "149.154.171.5",
+		203: "91.105.192.100",
+	}
+
+	dcOverrides = map[int]int{203: 2}
+)

src/crypto.go

@@ -0,0 +1,188 @@
+package main
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/binary"
+	"math"
+	"strconv"
+)
+
+func tryHandshake(handshake, secret []byte) (*handshakeInfo, bool) {
+	if len(handshake) != handshakeLen {
+		return nil, false
+	}
+	decPrekeyAndIV := handshake[skipLen : skipLen+prekeyLen+ivLen]
+	decPrekey := decPrekeyAndIV[:prekeyLen]
+	decIV := decPrekeyAndIV[prekeyLen:]
+
+	h := keyFromPrekeyAndSecret(decPrekey, secret)
+	block, err := aes.NewCipher(h[:])
+	if err != nil {
+		return nil, false
+	}
+	dec := cipher.NewCTR(block, decIV)
+	decrypted := make([]byte, len(handshake))
+	dec.XORKeyStream(decrypted, handshake)
+
+	protoTag := decrypted[protoTagPos : protoTagPos+4]
+	if !bytes.Equal(protoTag, protoTagAbridged) && !bytes.Equal(protoTag, protoTagIntermediate) && !bytes.Equal(protoTag, protoTagSecure) {
+		return nil, false
+	}
+
+	dcIdx := int16(binary.LittleEndian.Uint16(decrypted[dcIdxPos : dcIdxPos+2]))
+	dc := int(math.Abs(float64(dcIdx)))
+	isMedia := dcIdx < 0
+
+	pt := make([]byte, 4)
+	copy(pt, protoTag)
+	civ := make([]byte, len(decPrekeyAndIV))
+	copy(civ, decPrekeyAndIV)
+	return &handshakeInfo{DC: dc, IsMedia: isMedia, ProtoTag: pt, ClientDecI: civ}, true
+}
+
+func generateRelayInit(protoTag []byte, dcIdx int16) []byte {
+	rnd := make([]byte, handshakeLen)
+	for {
+		_, _ = rand.Read(rnd)
+		if reservedFirst[rnd[0]] {
+			continue
+		}
+		bad := false
+		for _, rs := range reservedStart {
+			if bytes.Equal(rnd[:4], rs) {
+				bad = true
+				break
+			}
+		}
+		if bad {
+			continue
+		}
+		if bytes.Equal(rnd[4:8], []byte{0, 0, 0, 0}) {
+			continue
+		}
+		break
+	}
+
+	encKey := rnd[skipLen : skipLen+prekeyLen]
+	encIV := rnd[skipLen+prekeyLen : skipLen+prekeyLen+ivLen]
+	block, _ := aes.NewCipher(encKey)
+	enc := cipher.NewCTR(block, encIV)
+	encryptedFull := make([]byte, handshakeLen)
+	enc.XORKeyStream(encryptedFull, rnd)
+
+	tailPlain := make([]byte, 8)
+	copy(tailPlain[:4], protoTag)
+	binary.LittleEndian.PutUint16(tailPlain[4:6], uint16(dcIdx))
+	_, _ = rand.Read(tailPlain[6:8])
+
+	result := make([]byte, handshakeLen)
+	copy(result, rnd)
+	for i := 0; i < 8; i++ {
+		keystream := encryptedFull[56+i] ^ rnd[56+i]
+		result[56+i] = tailPlain[i] ^ keystream
+	}
+	return result
+}
+
+func buildCiphers(clientDecPrekeyAndIV, relayInit, secret []byte) (cltDec, cltEnc, tgEnc, tgDec cipher.Stream, err error) {
+	cltDecPrekey := clientDecPrekeyAndIV[:prekeyLen]
+	cltDecIV := clientDecPrekeyAndIV[prekeyLen:]
+	k1 := keyFromPrekeyAndSecret(cltDecPrekey, secret)
+	b1, err := aes.NewCipher(k1[:])
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	cltDec = cipher.NewCTR(b1, cltDecIV)
+
+	rev := reverseBytes(clientDecPrekeyAndIV)
+	encPrekey := rev[:prekeyLen]
+	encIV := rev[prekeyLen:]
+	k2 := keyFromPrekeyAndSecret(encPrekey, secret)
+	b2, err := aes.NewCipher(k2[:])
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	cltEnc = cipher.NewCTR(b2, encIV)
+
+	relayEncKey := relayInit[8:40]
+	relayEncIV := relayInit[40:56]
+	b3, err := aes.NewCipher(relayEncKey)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	tgEnc = cipher.NewCTR(b3, relayEncIV)
+
+	relayDecPI := reverseBytes(relayInit[8:56])
+	relayDecKey := relayDecPI[:keyLen]
+	relayDecIV := relayDecPI[keyLen:]
+	b4, err := aes.NewCipher(relayDecKey)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	tgDec = cipher.NewCTR(b4, relayDecIV)
+
+	zeros := make([]byte, handshakeLen)
+	tmp := make([]byte, handshakeLen)
+	cltDec.XORKeyStream(tmp, zeros)
+	tgEnc.XORKeyStream(tmp, zeros)
+
+	return cltDec, cltEnc, tgEnc, tgDec, nil
+}
+
+func keyFromPrekeyAndSecret(prekey, secret []byte) [32]byte {
+	b := make([]byte, 0, len(prekey)+len(secret))
+	b = append(b, prekey...)
+	b = append(b, secret...)
+	return sha256.Sum256(b)
+}
+
+func reverseBytes(in []byte) []byte {
+	out := make([]byte, len(in))
+	for i := range in {
+		out[len(in)-1-i] = in[i]
+	}
+	return out
+}
+
+func protoFromTag(tag []byte) uint32 {
+	switch {
+	case bytes.Equal(tag, protoTagAbridged):
+		return protoAbridgedInt
+	case bytes.Equal(tag, protoTagIntermediate):
+		return protoIntermediateInt
+	default:
+		return protoPaddedIntermediateInt
+	}
+}
+
+func wsDomains(dc int, isMedia bool) []string {
+	dcS := strconv.Itoa(dc)
+	if isMedia {
+		return []string{
+			"kws" + dcS + "-1.web.telegram.org",
+			"kws" + dcS + ".web.telegram.org",
+		}
+	}
+	return []string{
+		"kws" + dcS + ".web.telegram.org",
+		"kws" + dcS + "-1.web.telegram.org",
+	}
+}
+
+func signedDC(dc int, media bool) int16 {
+	if media {
+		return int16(-dc)
+	}
+	return int16(dc)
+}
+
+func fallbackIP(dc int) string {
+	if ip, ok := dcDefaults[dc]; ok {
+		return ip
+	}
+	return ""
+}

src/errors.go

@@ -0,0 +1,5 @@
+package main
+
+import "errors"
+
+var errNoDomains = errors.New("no domains to connect")

src/go.mod

@@ -0,0 +1,5 @@
+module tg-ws-proxy
+
+go 1.22
+
+require github.com/gorilla/websocket v1.5.3

src/go.sum

@@ -0,0 +1,2 @@
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=

src/logging.go

@@ -0,0 +1,98 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	_ "net/http/pprof"
+	"os"
+	"sync"
+)
+
+func initLogger(cfg *Config) {
+	log.SetFlags(log.Ltime)
+	if cfg.LogFile == "" {
+		return
+	}
+	f, err := os.OpenFile(cfg.LogFile, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
+	if err != nil {
+		log.Printf("WARN   failed to open log file %s: %v", cfg.LogFile, err)
+		return
+	}
+	log.SetOutput(newRotatingWriter(f, cfg.LogFile, cfg.LogMaxMB, cfg.LogBackups))
+}
+
+func startPprof(cfg *Config) {
+	if cfg.PprofListen == "" {
+		return
+	}
+	go func(addr string) {
+		log.Printf("INFO   pprof enabled on http://%s/debug/pprof/", addr)
+		if err := http.ListenAndServe(addr, nil); err != nil {
+			log.Printf("WARN   pprof server stopped: %v", err)
+		}
+	}(cfg.PprofListen)
+}
+
+type rotatingWriter struct {
+	mu        sync.Mutex
+	f         *os.File
+	path      string
+	maxBytes  int64
+	backups   int
+	checkTick int
+}
+
+func newRotatingWriter(f *os.File, path string, maxMB float64, backups int) *rotatingWriter {
+	maxBytes := int64(maxMB * 1024 * 1024)
+	if maxBytes < 32*1024 {
+		maxBytes = 32 * 1024
+	}
+	return &rotatingWriter{f: f, path: path, maxBytes: maxBytes, backups: backups}
+}
+
+func (w *rotatingWriter) Write(p []byte) (int, error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	w.checkTick++
+	if w.checkTick%32 == 0 {
+		if st, err := w.f.Stat(); err == nil && st.Size() >= w.maxBytes {
+			_ = w.rotate()
+		}
+	}
+	return w.f.Write(p)
+}
+
+func (w *rotatingWriter) rotate() error {
+	_ = w.f.Close()
+	if w.backups > 0 {
+		for i := w.backups - 1; i >= 1; i-- {
+			old := fmt.Sprintf("%s.%d", w.path, i)
+			newp := fmt.Sprintf("%s.%d", w.path, i+1)
+			_ = os.Rename(old, newp)
+		}
+		_ = os.Rename(w.path, fmt.Sprintf("%s.1", w.path))
+	} else {
+		_ = os.Remove(w.path)
+	}
+	f, err := os.OpenFile(w.path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
+	if err != nil {
+		return err
+	}
+	w.f = f
+	return nil
+}
+
+func debugf(cfg *Config, format string, args ...any) {
+	if cfg.Verbose {
+		log.Printf("DEBUG  "+format, args...)
+	}
+}
+
+func warnf(format string, args ...any) {
+	log.Printf("WARNING  "+format, args...)
+}
+
+func logf(format string, args ...any) {
+	log.Printf(format, args...)
+}

src/pool.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+type pooledWS struct {
+	Conn    *websocket.Conn
+	Created time.Time
+}
+
+type wsPool struct {
+	mu        sync.Mutex
+	idle      map[dcKey][]pooledWS
+	refilling map[dcKey]bool
+}
+
+func newWSPool() *wsPool {
+	return &wsPool{
+		idle:      make(map[dcKey][]pooledWS),
+		refilling: make(map[dcKey]bool),
+	}
+}
+
+func (p *wsPool) get(cfg *Config, key dcKey, targetIP string, domains []string, st *Stats) *websocket.Conn {
+	now := time.Now()
+	p.mu.Lock()
+	bucket := p.idle[key]
+	for len(bucket) > 0 {
+		item := bucket[0]
+		bucket = bucket[1:]
+		if now.Sub(item.Created) > wsPoolMaxAge {
+			_ = item.Conn.Close()
+			continue
+		}
+		p.idle[key] = bucket
+		p.scheduleRefill(cfg, key, targetIP, domains)
+		p.mu.Unlock()
+		atomic.AddInt64(&st.poolHits, 1)
+		return item.Conn
+	}
+	p.idle[key] = bucket
+	p.scheduleRefill(cfg, key, targetIP, domains)
+	p.mu.Unlock()
+	atomic.AddInt64(&st.poolMisses, 1)
+	return nil
+}
+
+func (p *wsPool) scheduleRefill(cfg *Config, key dcKey, targetIP string, domains []string) {
+	if cfg.PoolSize <= 0 || p.refilling[key] {
+		return
+	}
+	p.refilling[key] = true
+	go p.refill(cfg, key, targetIP, domains)
+}
+
+func (p *wsPool) refill(cfg *Config, key dcKey, targetIP string, domains []string) {
+	defer func() {
+		p.mu.Lock()
+		delete(p.refilling, key)
+		p.mu.Unlock()
+	}()
+
+	for {
+		p.mu.Lock()
+		cur := len(p.idle[key])
+		p.mu.Unlock()
+		if cur >= cfg.PoolSize {
+			return
+		}
+		conn, _, err := wsConnect(targetIP, domains, 8*time.Second)
+		if err != nil {
+			return
+		}
+		p.mu.Lock()
+		p.idle[key] = append(p.idle[key], pooledWS{Conn: conn, Created: time.Now()})
+		p.mu.Unlock()
+	}
+}
+
+func warmupPool(cfg *Config) {
+	if cfg.PoolSize <= 0 {
+		return
+	}
+	for dc, targets := range cfg.DCPool {
+		if len(targets) == 0 {
+			continue
+		}
+		ip := targets[0]
+		for _, media := range []bool{false, true} {
+			dcw := dc
+			if v, ok := dcOverrides[dcw]; ok {
+				dcw = v
+			}
+			key := dcKey{DC: dc, IsMedia: media}
+			domains := wsDomains(dcw, media)
+			pool.mu.Lock()
+			pool.scheduleRefill(cfg, key, ip, domains)
+			pool.mu.Unlock()
+		}
+	}
+	logf("INFO   WS pool warmup started for %d DC(s)", len(cfg.DCMap))
+}

src/server.go

@@ -0,0 +1,207 @@
+package main
+
+import (
+	"encoding/hex"
+	"io"
+	"log"
+	"net"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+func main() {
+	cfg, err := parseFlags()
+	if err != nil {
+		log.Fatalf("config error: %v", err)
+	}
+
+	initLogger(cfg)
+	startPprof(cfg)
+
+	linkHost := getLinkHost(cfg.Host)
+	log.Printf("INFO   %s", strings.Repeat("=", 60))
+	log.Printf("INFO     Telegram MTProto WS Bridge Proxy (Go)")
+	log.Printf("INFO     Listening on   %s:%d", cfg.Host, cfg.Port)
+	log.Printf("INFO     Secret:        %s", cfg.SecretHex)
+	log.Printf("INFO     Target DC IPs:")
+	for _, item := range sortedDCMap(cfg.DCMap) {
+		dc, ip := item.dc, item.ip
+		log.Printf("INFO       DC%d: %s", dc, ip)
+	}
+	log.Printf("INFO   %s", strings.Repeat("=", 60))
+	log.Printf("INFO     Connect link:")
+	log.Printf("INFO       tg://proxy?server=%s&port=%d&secret=dd%s", linkHost, cfg.Port, cfg.SecretHex)
+	log.Printf("INFO   %s", strings.Repeat("=", 60))
+
+	go func() {
+		for {
+			time.Sleep(60 * time.Second)
+			log.Printf("INFO   stats: %s", stats.summary())
+		}
+	}()
+
+	warmupPool(cfg)
+
+	ln, err := net.Listen("tcp", net.JoinHostPort(cfg.Host, strconv.Itoa(cfg.Port)))
+	if err != nil {
+		log.Fatalf("listen error: %v", err)
+	}
+	defer ln.Close()
+
+	secret, _ := hex.DecodeString(cfg.SecretHex)
+
+	for {
+		c, err := ln.Accept()
+		if err != nil {
+			log.Printf("WARN   accept error: %v", err)
+			continue
+		}
+		atomic.AddInt64(&stats.connectionsTotal, 1)
+		go handleClient(c, cfg, secret)
+	}
+}
+
+func handleClient(client net.Conn, cfg *Config, secret []byte) {
+	atomic.AddInt64(&stats.connectionsActive, 1)
+	defer atomic.AddInt64(&stats.connectionsActive, -1)
+	defer client.Close()
+	label := client.RemoteAddr().String()
+
+	_ = setSockOpts(client, cfg.BufKB*1024)
+
+	_ = client.SetReadDeadline(time.Now().Add(10 * time.Second))
+	hs := make([]byte, handshakeLen)
+	if _, err := io.ReadFull(client, hs); err != nil {
+		debugf(cfg, "[%s] client disconnected before handshake", label)
+		return
+	}
+	_ = client.SetReadDeadline(time.Time{})
+
+	hi, ok := tryHandshake(hs, secret)
+	if !ok {
+		atomic.AddInt64(&stats.connectionsBad, 1)
+		debugf(cfg, "[%s] bad handshake", label)
+		return
+	}
+
+	protoInt := protoFromTag(hi.ProtoTag)
+	mediaTag := ""
+	if hi.IsMedia {
+		mediaTag = " media"
+	}
+
+	relayInit := generateRelayInit(hi.ProtoTag, signedDC(hi.DC, hi.IsMedia))
+	cltDec, cltEnc, tgEnc, tgDec, err := buildCiphers(hi.ClientDecI, relayInit, secret)
+	if err != nil {
+		log.Printf("ERROR  [%s] cipher init failed: %v", label, err)
+		return
+	}
+
+	if isBlacklisted(hi.DC, hi.IsMedia) {
+		fallback := fallbackIP(hi.DC)
+		if fallback == "" {
+			log.Printf("WARN   [%s] DC%d%s WS blacklisted and no fallback", label, hi.DC, mediaTag)
+			return
+		}
+		log.Printf("INFO   [%s] DC%d%s WS blacklisted -> TCP fallback %s:443", label, hi.DC, mediaTag, fallback)
+		_ = tcpFallback(client, fallback, relayInit, cltDec, cltEnc, tgEnc, tgDec)
+		return
+	}
+
+	targets, hasTarget := cfg.DCPool[hi.DC]
+	if !hasTarget || len(targets) == 0 {
+		fallback := fallbackIP(hi.DC)
+		if fallback == "" {
+			log.Printf("WARN   [%s] DC%d%s no fallback available", label, hi.DC, mediaTag)
+			return
+		}
+		log.Printf("INFO   [%s] DC%d not in config -> TCP fallback %s:443", label, hi.DC, fallback)
+		_ = tcpFallback(client, fallback, relayInit, cltDec, cltEnc, tgEnc, tgDec)
+		return
+	}
+	primaryTarget := targets[0]
+
+	dcW := hi.DC
+	if v, ok := dcOverrides[dcW]; ok {
+		dcW = v
+	}
+	domains := wsDomains(dcW, hi.IsMedia)
+	key := dcKey{DC: hi.DC, IsMedia: hi.IsMedia}
+
+	var ws *websocket.Conn
+	if pooled := pool.get(cfg, key, primaryTarget, domains, &stats); pooled != nil {
+		ws = pooled
+		log.Printf("INFO   [%s] DC%d%s -> pool hit via %s", label, hi.DC, mediaTag, primaryTarget)
+	}
+
+	if ws == nil {
+		timeout := 10 * time.Second
+		if inCooldown(key) {
+			timeout = 2 * time.Second
+		}
+		wsFailedRedirect := false
+		allRedirect := true
+
+		for _, target := range targets {
+			for _, d := range domains {
+				log.Printf("INFO   [%s] DC%d%s -> wss://%s/apiws via %s", label, hi.DC, mediaTag, d, target)
+				conn, resp, err := wsConnect(target, []string{d}, timeout)
+				if err == nil {
+					ws = conn
+					allRedirect = false
+					break
+				}
+				atomic.AddInt64(&stats.wsErrors, 1)
+				if resp != nil && isRedirect(resp.StatusCode) {
+					wsFailedRedirect = true
+					warnf("[%s] DC%d%s got %d from %s via %s", label, hi.DC, mediaTag, resp.StatusCode, d, target)
+					continue
+				}
+				allRedirect = false
+				warnf("[%s] DC%d%s WS connect failed via %s: %v", label, hi.DC, mediaTag, target, err)
+			}
+			if ws != nil {
+				break
+			}
+		}
+
+		if ws == nil {
+			if wsFailedRedirect && allRedirect {
+				setBlacklisted(key)
+				warnf("[%s] DC%d%s blacklisted for WS (all redirects)", label, hi.DC, mediaTag)
+			} else {
+				setCooldown(key)
+			}
+			fallback := fallbackIP(hi.DC)
+			if fallback == "" {
+				fallback = primaryTarget
+			}
+			log.Printf("INFO   [%s] DC%d%s -> TCP fallback to %s:443", label, hi.DC, mediaTag, fallback)
+			ok := tcpFallback(client, fallback, relayInit, cltDec, cltEnc, tgEnc, tgDec)
+			if ok == nil {
+				log.Printf("INFO   [%s] DC%d%s TCP fallback closed", label, hi.DC, mediaTag)
+			}
+			return
+		}
+	}
+
+	clearCooldown(key)
+	atomic.AddInt64(&stats.connectionsWS, 1)
+
+	var splitter *msgSplitter
+	if ms, err := newMsgSplitter(relayInit, protoInt); err == nil {
+		splitter = ms
+	}
+
+	if err := ws.WriteMessage(websocket.BinaryMessage, relayInit); err != nil {
+		warnf("[%s] ws init write failed: %v", label, err)
+		_ = ws.Close()
+		return
+	}
+
+	bridgeWS(label, hi.DC, hi.IsMedia, client, ws, cltDec, cltEnc, tgEnc, tgDec, splitter)
+}

src/splitter.go

@@ -0,0 +1,122 @@
+package main
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/binary"
+)
+
+type msgSplitter struct {
+	dec       cipher.Stream
+	proto     uint32
+	cipherBuf []byte
+	plainBuf  []byte
+	disabled  bool
+}
+
+func newMsgSplitter(relayInit []byte, proto uint32) (*msgSplitter, error) {
+	b, err := aes.NewCipher(relayInit[8:40])
+	if err != nil {
+		return nil, err
+	}
+	dec := cipher.NewCTR(b, relayInit[40:56])
+	zero := make([]byte, handshakeLen)
+	tmp := make([]byte, handshakeLen)
+	dec.XORKeyStream(tmp, zero)
+	return &msgSplitter{dec: dec, proto: proto}, nil
+}
+
+func (m *msgSplitter) split(chunk []byte) [][]byte {
+	if len(chunk) == 0 {
+		return nil
+	}
+	if m.disabled {
+		return [][]byte{chunk}
+	}
+
+	plain := make([]byte, len(chunk))
+	m.dec.XORKeyStream(plain, chunk)
+	m.cipherBuf = append(m.cipherBuf, chunk...)
+	m.plainBuf = append(m.plainBuf, plain...)
+
+	parts := make([][]byte, 0, 2)
+	for len(m.cipherBuf) > 0 {
+		next := m.nextPacketLen()
+		if next < 0 {
+			break
+		}
+		if next == 0 {
+			parts = append(parts, append([]byte(nil), m.cipherBuf...))
+			m.cipherBuf = m.cipherBuf[:0]
+			m.plainBuf = m.plainBuf[:0]
+			m.disabled = true
+			break
+		}
+		parts = append(parts, append([]byte(nil), m.cipherBuf[:next]...))
+		m.cipherBuf = m.cipherBuf[next:]
+		m.plainBuf = m.plainBuf[next:]
+	}
+	return parts
+}
+
+func (m *msgSplitter) flush() [][]byte {
+	if len(m.cipherBuf) == 0 {
+		return nil
+	}
+	tail := append([]byte(nil), m.cipherBuf...)
+	m.cipherBuf = m.cipherBuf[:0]
+	m.plainBuf = m.plainBuf[:0]
+	return [][]byte{tail}
+}
+
+func (m *msgSplitter) nextPacketLen() int {
+	if len(m.plainBuf) == 0 {
+		return -1
+	}
+	switch m.proto {
+	case protoAbridgedInt:
+		return m.nextAbridgedLen()
+	case protoIntermediateInt, protoPaddedIntermediateInt:
+		return m.nextIntermediateLen()
+	default:
+		return 0
+	}
+}
+
+func (m *msgSplitter) nextAbridgedLen() int {
+	first := m.plainBuf[0]
+	headerLen := 1
+	payloadLen := 0
+	if first == 0x7F || first == 0xFF {
+		if len(m.plainBuf) < 4 {
+			return -1
+		}
+		headerLen = 4
+		payloadLen = int(uint32(m.plainBuf[1])|uint32(m.plainBuf[2])<<8|uint32(m.plainBuf[3])<<16) * 4
+	} else {
+		payloadLen = int(first&0x7F) * 4
+	}
+	if payloadLen <= 0 {
+		return 0
+	}
+	packetLen := headerLen + payloadLen
+	if len(m.plainBuf) < packetLen {
+		return -1
+	}
+	return packetLen
+}
+
+func (m *msgSplitter) nextIntermediateLen() int {
+	if len(m.plainBuf) < 4 {
+		return -1
+	}
+	payloadLen := int(binary.LittleEndian.Uint32(m.plainBuf[:4]) & 0x7FFFFFFF)
+	if payloadLen <= 0 {
+		return 0
+	}
+	packetLen := 4 + payloadLen
+	if len(m.plainBuf) < packetLen {
+		return -1
+	}
+	return packetLen
+}

src/state.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"sort"
+	"sync"
+	"time"
+)
+
+var (
+	stats     Stats
+	pool      = newWSPool()
+	blacklist = make(map[dcKey]struct{})
+	blMu      sync.Mutex
+	failUntil = make(map[dcKey]time.Time)
+	fuMu      sync.Mutex
+)
+
+func setCooldown(k dcKey) {
+	fuMu.Lock()
+	failUntil[k] = time.Now().Add(dcFailCooldown)
+	fuMu.Unlock()
+}
+
+func inCooldown(k dcKey) bool {
+	fuMu.Lock()
+	t, ok := failUntil[k]
+	fuMu.Unlock()
+	return ok && time.Now().Before(t)
+}
+
+func clearCooldown(k dcKey) {
+	fuMu.Lock()
+	delete(failUntil, k)
+	fuMu.Unlock()
+}
+
+func setBlacklisted(k dcKey) {
+	blMu.Lock()
+	blacklist[k] = struct{}{}
+	blMu.Unlock()
+}
+
+func isBlacklisted(dc int, media bool) bool {
+	blMu.Lock()
+	_, ok := blacklist[dcKey{DC: dc, IsMedia: media}]
+	blMu.Unlock()
+	return ok
+}
+
+func sortedDCMap(m map[int]string) []dcMapItem {
+	items := make([]dcMapItem, 0, len(m))
+	for dc, ip := range m {
+		items = append(items, dcMapItem{dc: dc, ip: ip})
+	}
+	sort.Slice(items, func(i, j int) bool {
+		return items[i].dc < items[j].dc
+	})
+	return items
+}

src/transport.go

@@ -0,0 +1,200 @@
+package main
+
+import (
+	"context"
+	"crypto/cipher"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"sync/atomic"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+func dialWS(targetIP, domain string, timeout time.Duration) (*websocket.Conn, *http.Response, error) {
+	u := url.URL{Scheme: "wss", Host: domain, Path: "/apiws"}
+	dialer := websocket.Dialer{
+		HandshakeTimeout: timeout,
+		Subprotocols:     []string{"binary"},
+		TLSClientConfig: &tls.Config{
+			ServerName:         domain,
+			InsecureSkipVerify: true,
+		},
+		NetDialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			d := &net.Dialer{Timeout: timeout}
+			return d.DialContext(ctx, "tcp", net.JoinHostPort(targetIP, "443"))
+		},
+	}
+	headers := http.Header{}
+	headers.Set("Host", domain)
+	headers.Set("Origin", "https://web.telegram.org")
+	headers.Set("User-Agent", "Mozilla/5.0")
+	return dialer.Dial(u.String(), headers)
+}
+
+func bridgeWS(label string, dc int, isMedia bool, client net.Conn, ws *websocket.Conn, cltDec, cltEnc, tgEnc, tgDec cipher.Stream, splitter *msgSplitter) {
+	mediaTag := ""
+	if isMedia {
+		mediaTag = "m"
+	}
+	start := time.Now()
+	var upBytes, downBytes int64
+	var upPkts, downPkts int64
+
+	done := make(chan struct{}, 2)
+
+	go func() {
+		defer func() { done <- struct{}{} }()
+		buf := make([]byte, 64*1024)
+		for {
+			n, err := client.Read(buf)
+			if n > 0 {
+				atomic.AddInt64(&stats.bytesUp, int64(n))
+				upBytes += int64(n)
+				upPkts++
+				chunk := buf[:n]
+				cltDec.XORKeyStream(chunk, chunk)
+				tgEnc.XORKeyStream(chunk, chunk)
+
+				if splitter != nil {
+					parts := splitter.split(chunk)
+					if len(parts) == 0 {
+						continue
+					}
+					for _, p := range parts {
+						if werr := ws.WriteMessage(websocket.BinaryMessage, p); werr != nil {
+							return
+						}
+					}
+				} else {
+					if werr := ws.WriteMessage(websocket.BinaryMessage, chunk); werr != nil {
+						return
+					}
+				}
+			}
+			if err != nil {
+				if splitter != nil {
+					for _, p := range splitter.flush() {
+						_ = ws.WriteMessage(websocket.BinaryMessage, p)
+					}
+				}
+				return
+			}
+		}
+	}()
+
+	go func() {
+		defer func() { done <- struct{}{} }()
+		for {
+			mt, data, err := ws.ReadMessage()
+			if err != nil {
+				return
+			}
+			if mt != websocket.BinaryMessage {
+				continue
+			}
+			atomic.AddInt64(&stats.bytesDown, int64(len(data)))
+			downBytes += int64(len(data))
+			downPkts++
+
+			tgDec.XORKeyStream(data, data)
+			cltEnc.XORKeyStream(data, data)
+			if _, werr := client.Write(data); werr != nil {
+				return
+			}
+		}
+	}()
+
+	<-done
+	_ = ws.Close()
+	_ = client.Close()
+	logf("INFO   [%s] DC%d%s WS session closed: ^%s (%d pkts) v%s (%d pkts) in %.1fs",
+		label,
+		dc,
+		mediaTag,
+		humanBytes(upBytes),
+		upPkts,
+		humanBytes(downBytes),
+		downPkts,
+		time.Since(start).Seconds(),
+	)
+}
+
+func tcpFallback(client net.Conn, dst string, relayInit []byte, cltDec, cltEnc, tgEnc, tgDec cipher.Stream) error {
+	r, err := net.DialTimeout("tcp", net.JoinHostPort(dst, "443"), 10*time.Second)
+	if err != nil {
+		logf("WARNING  TCP fallback to %s:443 failed: %v", dst, err)
+		return err
+	}
+	defer r.Close()
+	atomic.AddInt64(&stats.connectionsTCP, 1)
+
+	if _, err := r.Write(relayInit); err != nil {
+		return err
+	}
+
+	done := make(chan struct{}, 2)
+	go func() {
+		defer func() { done <- struct{}{} }()
+		buf := make([]byte, 64*1024)
+		for {
+			n, err := client.Read(buf)
+			if n > 0 {
+				atomic.AddInt64(&stats.bytesUp, int64(n))
+				chunk := buf[:n]
+				cltDec.XORKeyStream(chunk, chunk)
+				tgEnc.XORKeyStream(chunk, chunk)
+				if _, werr := r.Write(chunk); werr != nil {
+					return
+				}
+			}
+			if err != nil {
+				return
+			}
+		}
+	}()
+
+	go func() {
+		defer func() { done <- struct{}{} }()
+		buf := make([]byte, 64*1024)
+		for {
+			n, err := r.Read(buf)
+			if n > 0 {
+				atomic.AddInt64(&stats.bytesDown, int64(n))
+				chunk := buf[:n]
+				tgDec.XORKeyStream(chunk, chunk)
+				cltEnc.XORKeyStream(chunk, chunk)
+				if _, werr := client.Write(chunk); werr != nil {
+					return
+				}
+			}
+			if err != nil {
+				return
+			}
+		}
+	}()
+
+	<-done
+	_ = client.Close()
+	_ = r.Close()
+	return nil
+}
+
+func wsConnect(targetIP string, domains []string, timeout time.Duration) (*websocket.Conn, *http.Response, error) {
+	var lastErr error
+	var lastResp *http.Response
+	for _, domain := range domains {
+		conn, resp, err := dialWS(targetIP, domain, timeout)
+		if err == nil {
+			return conn, resp, nil
+		}
+		lastErr = err
+		lastResp = resp
+	}
+	if lastErr == nil {
+		lastErr = errNoDomains
+	}
+	return nil, lastResp, lastErr
+}

src/types.go

@@ -0,0 +1,73 @@
+package main
+
+import (
+	"fmt"
+	"sync/atomic"
+)
+
+type Config struct {
+	Host        string
+	Port        int
+	SecretHex   string
+	DCMap       map[int]string
+	DCPool      map[int][]string
+	Verbose     bool
+	BufKB       int
+	PoolSize    int
+	LogFile     string
+	LogMaxMB    float64
+	LogBackups  int
+	PprofListen string
+}
+
+type Stats struct {
+	connectionsTotal  int64
+	connectionsActive int64
+	connectionsWS     int64
+	connectionsTCP    int64
+	connectionsBad    int64
+	wsErrors          int64
+	bytesUp           int64
+	bytesDown         int64
+	poolHits          int64
+	poolMisses        int64
+}
+
+func (s *Stats) summary() string {
+	hits := atomic.LoadInt64(&s.poolHits)
+	misses := atomic.LoadInt64(&s.poolMisses)
+	poolTotal := hits + misses
+	poolS := "n/a"
+	if poolTotal > 0 {
+		poolS = fmt.Sprintf("%d/%d", hits, poolTotal)
+	}
+	return fmt.Sprintf(
+		"total=%d active=%d ws=%d tcp_fb=%d bad=%d err=%d pool=%s up=%s down=%s",
+		atomic.LoadInt64(&s.connectionsTotal),
+		atomic.LoadInt64(&s.connectionsActive),
+		atomic.LoadInt64(&s.connectionsWS),
+		atomic.LoadInt64(&s.connectionsTCP),
+		atomic.LoadInt64(&s.connectionsBad),
+		atomic.LoadInt64(&s.wsErrors),
+		poolS,
+		humanBytes(atomic.LoadInt64(&s.bytesUp)),
+		humanBytes(atomic.LoadInt64(&s.bytesDown)),
+	)
+}
+
+type handshakeInfo struct {
+	DC         int
+	IsMedia    bool
+	ProtoTag   []byte
+	ClientDecI []byte
+}
+
+type dcKey struct {
+	DC      int
+	IsMedia bool
+}
+
+type dcMapItem struct {
+	dc int
+	ip string
+}

src/utils.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"fmt"
+	"math"
+	"net"
+)
+
+func formatFloat(v float64) string {
+	return fmt.Sprintf("%.1f", v)
+}
+
+func humanBytes(n int64) string {
+	v := float64(n)
+	units := []string{"B", "KB", "MB", "GB", "TB"}
+	u := 0
+	for math.Abs(v) >= 1024 && u < len(units)-1 {
+		v /= 1024
+		u++
+	}
+	return formatFloat(v) + units[u]
+}
+
+func getLinkHost(host string) string {
+	if host != "0.0.0.0" {
+		return host
+	}
+	c, err := net.Dial("udp", "8.8.8.8:80")
+	if err != nil {
+		return "127.0.0.1"
+	}
+	defer c.Close()
+	la, ok := c.LocalAddr().(*net.UDPAddr)
+	if !ok || la.IP == nil {
+		return "127.0.0.1"
+	}
+	return la.IP.String()
+}
+
+func isRedirect(code int) bool {
+	return code == 301 || code == 302 || code == 303 || code == 307 || code == 308
+}
+
+func setSockOpts(c net.Conn, bufSize int) error {
+	tcp, ok := c.(*net.TCPConn)
+	if !ok {
+		return nil
+	}
+	_ = tcp.SetNoDelay(true)
+	_ = tcp.SetReadBuffer(bufSize)
+	_ = tcp.SetWriteBuffer(bufSize)
+	return nil
+}

ui/__init__.py

@@ -1,4 +0,0 @@
-"""
-Интерфейс tray (CustomTkinter): тема, диалоги настроек, подсказки.
-Ядро прокси — пакет `proxy`.
-"""

ui/ctk_theme.py

@@ -1,111 +0,0 @@
-from __future__ import annotations
-
-import sys
-import tkinter
-from dataclasses import dataclass
-from typing import Any, Callable, Optional, Tuple
-
-_tk_variable_del_guard_installed = False
-
-
-def install_tkinter_variable_del_guard() -> None:
-    global _tk_variable_del_guard_installed
-    if _tk_variable_del_guard_installed:
-        return
-    _orig = tkinter.Variable.__del__
-
-    def _safe_variable_del(self: Any, _orig: Any = _orig) -> None:
-        try:
-            _orig(self)
-        except (RuntimeError, tkinter.TclError):
-            pass
-
-    tkinter.Variable.__del__ = _safe_variable_del  # type: ignore[assignment]
-    _tk_variable_del_guard_installed = True
-
-CONFIG_DIALOG_SIZE: Tuple[int, int] = (460, 560)
-CONFIG_DIALOG_FRAME_PAD: Tuple[int, int] = (20, 14)
-FIRST_RUN_SIZE: Tuple[int, int] = (520, 480)
-FIRST_RUN_FRAME_PAD: Tuple[int, int] = (28, 24)
-
-
-@dataclass(frozen=True)
-class CtkTheme:
-    tg_blue: tuple = ("#3390ec", "#3390ec")
-    tg_blue_hover: tuple = ("#2b7cd4", "#2b7cd4")
-
-    bg: tuple = ("#ffffff", "#1e1e1e")
-    field_bg: tuple = ("#f0f2f5", "#2b2b2b")
-    field_border: tuple = ("#d6d9dc", "#3a3a3a")
-
-    text_primary: tuple = ("#000000", "#ffffff")
-    text_secondary: tuple = ("#707579", "#aaaaaa")
-
-    ui_font_family: str = "Sans"
-    mono_font_family: str = "Monospace"
-
-
-def ctk_theme_for_platform() -> CtkTheme:
-    if sys.platform == "win32":
-        return CtkTheme(ui_font_family="Segoe UI", mono_font_family="Consolas")
-    return CtkTheme()
-
-
-_APPEARANCE_MODE_MAP = {"auto": "system", "light": "Light", "dark": "Dark"}
-
-
-def apply_ctk_appearance(ctk: Any, mode: str = "auto") -> None:
-    ctk.set_appearance_mode(_APPEARANCE_MODE_MAP.get(mode, "system"))
-    ctk.set_default_color_theme("blue")
-
-def center_ctk_geometry(root: Any, width: int, height: int) -> None:
-    sw = root.winfo_screenwidth()
-    sh = root.winfo_screenheight()
-    root.geometry(f"{width}x{height}+{(sw - width) // 2}+{(sh - height) // 2}")
-
-
-def create_ctk_toplevel(
-    ctk: Any,
-    *,
-    title: str,
-    width: int,
-    height: int,
-    theme: CtkTheme,
-    topmost: bool = True,
-    after_create: Optional[Callable[[Any], None]] = None,
-) -> Any:
-    root = ctk.CTkToplevel()
-    root.title(title)
-    root.resizable(False, False)
-    center_ctk_geometry(root, width, height)
-    root.configure(fg_color=theme.bg)
-    if topmost:
-        root.attributes("-topmost", True)
-    root.lift()
-    root.focus_force()
-    if after_create:
-        _after_id = root.after(300, lambda: after_create(root))
-        _orig_destroy = root.destroy
-
-        def _safe_destroy():
-            try:
-                root.after_cancel(_after_id)
-            except Exception:
-                pass
-            _orig_destroy()
-
-        root.destroy = _safe_destroy
-    return root
-
-
-def main_content_frame(
-    ctk: Any,
-    root: Any,
-    theme: CtkTheme,
-    *,
-    padx: int,
-    pady: int,
-) -> Any:
-    frame = ctk.CTkFrame(root, fg_color=theme.bg, corner_radius=0)
-    frame.pack(fill="both", expand=True, padx=padx, pady=pady)
-    return frame

ui/ctk_tooltip.py

@@ -1,109 +0,0 @@
-from __future__ import annotations
-
-import tkinter as tk
-from typing import Any, List, Optional
-
-
-class CtkTooltip:
-    def __init__(
-        self,
-        widget: Any,
-        text: str,
-        *,
-        delay_ms: int = 450,
-        wraplength: int = 320,
-    ) -> None:
-        self.widget = widget
-        self.text = text
-        self.delay_ms = delay_ms
-        self.wraplength = wraplength
-        self._after_id: Optional[str] = None
-        self._tip: Optional[tk.Toplevel] = None
-        widget.bind("<Enter>", self._schedule, add="+")
-        widget.bind("<Leave>", self._hide, add="+")
-        widget.bind("<Button>", self._hide, add="+")
-        widget.bind("<Destroy>", self._on_destroy, add="+")
-
-    def _schedule(self, _event: Any = None) -> None:
-        if self.widget is None:
-            return
-        self._cancel_after()
-        self._after_id = self.widget.after(self.delay_ms, self._show)
-
-    def _cancel_after(self) -> None:
-        if self._after_id is not None:
-            try:
-                self.widget.after_cancel(self._after_id)
-            except Exception:
-                pass
-            self._after_id = None
-
-    def _show(self) -> None:
-        self._after_id = None
-        if self._tip is not None:
-            return
-        try:
-            if not self.widget.winfo_exists():
-                return
-        except Exception:
-            return
-
-        tw = tk.Toplevel(self.widget.winfo_toplevel())
-        tw.wm_overrideredirect(True)
-        try:
-            tw.wm_attributes("-topmost", True)
-        except Exception:
-            pass
-        tw.configure(bg="#2b2b2b")
-        lbl = tk.Label(
-            tw,
-            text=self.text,
-            justify="left",
-            wraplength=self.wraplength,
-            background="#2b2b2b",
-            foreground="#f0f0f0",
-            relief="flat",
-            borderwidth=0,
-            padx=10,
-            pady=8,
-            font=("Segoe UI", 10) if _is_windows() else None,
-        )
-        lbl.pack()
-        x = self.widget.winfo_rootx() + 12
-        y = self.widget.winfo_rooty() + self.widget.winfo_height() + 4
-        tw.wm_geometry(f"+{x}+{y}")
-        self._tip = tw
-
-    def _hide(self, _event: Any = None) -> None:
-        self._cancel_after()
-        if self._tip is not None:
-            try:
-                self._tip.destroy()
-            except Exception:
-                pass
-            self._tip = None
-
-    def _on_destroy(self, _event: Any = None) -> None:
-        self._hide()
-        self.widget = None
-
-
-def _is_windows() -> bool:
-    import sys
-
-    return sys.platform == "win32"
-
-
-def attach_ctk_tooltip(
-    widget: Any,
-    text: str,
-    *,
-    delay_ms: int = 450,
-    wraplength: int = 320,
-) -> None:
-    CtkTooltip(widget, text, delay_ms=delay_ms, wraplength=wraplength)
-
-
-def attach_tooltip_to_widgets(widgets: List[Any], text: str, **kwargs: Any) -> None:
-    for w in widgets:
-        attach_ctk_tooltip(w, text, **kwargs)

ui/ctk_tray_ui.py

@@ -1,807 +0,0 @@
-from __future__ import annotations
-
-import os
-import webbrowser
-from dataclasses import dataclass
-from typing import Any, Callable, Dict, List, Optional, Tuple, Union
-
-from proxy import __version__, get_link_host, parse_dc_ip_list
-from proxy.balancer import balancer
-from utils.update_check import RELEASES_PAGE_URL, get_status
-
-
-from ui.ctk_theme import (
-    FIRST_RUN_FRAME_PAD,
-    CtkTheme,
-    main_content_frame,
-)
-from ui.ctk_tooltip import attach_ctk_tooltip, attach_tooltip_to_widgets
-
-_TIP_HOST = (
-    "Адрес, на котором прокси принимает подключения.\n"
-    "Обычно 127.0.0.1 — локальная сеть, 0.0.0.0 - все интерфейсы"
-)
-_TIP_PORT = (
-    "Порт прокси. В Telegram Desktop в настройках прокси должен быть "
-    "указан тот же порт"
-)
-_TIP_SECRET = "Секретный ключ для авторизации клиентов"
-_TIP_DC = (
-    "Соответствие номера датацентра Telegram (DC) и IP-адреса сервера.\n"
-    "Каждая строка: «номер:IP», например 4:149.154.167.220. "
-    "Прокси по этим правилам направляет трафик к нужным серверам Telegram\n\n"
-    "Если у вас не работают медиа и работает CF-прокси, то попробуйте убрать строку 2:149.154.167.220"
-)
-_TIP_VERBOSE = (
-    "Если включено, в файл логов пишется больше подробностей — "
-    "необходимо при поиске неполадок"
-)
-_TIP_BUF_KB = (
-    "Размер буфера приёма/передачи в килобайтах.\n"
-    "Больше значение — больше выделение памяти на сокет"
-)
-_TIP_POOL = (
-    "Сколько параллельных WebSocket-сессий к одному датацентру можно держать.\n"
-    "Увеличение может помочь при высокой нагрузке"
-)
-_TIP_LOG_MB = (
-    "Максимальный размер файла лога; при достижении лимита файл перезаписывается"
-)
-_TIP_AUTOSTART = (
-    "Запускать TG WS Proxy при входе в Windows. "
-    "Если вы переместите программу в другую папку, автозапуск сбросится"
-)
-_TIP_CHECK_UPDATES = "При запуске проверять наличие обновлений"
-_TIP_CFPROXY = (
-    "Использовать Cloudflare прокси для недоступных датацентров"
-)
-_TIP_CFPROXY_PRIORITY = (
-    "Пробовать CF-прокси раньше прямого TCP-подключения"
-)
-_TIP_CFPROXY_DOMAIN = (
-    "Ваш собственный домен, проксируемый через Cloudflare, для WS-подключения.\n"
-    "Если не указан — выбирается автоматически из поддерживаемых доменов"
-)
-_TIP_CFPROXY_USER_DOMAIN_CB = (
-    "Указать свой домен вместо автоматического выбора"
-)
-_TIP_SAVE = "Сохранить настройки"
-_TIP_CANCEL = "Закрыть окно без сохранения изменений"
-
-_CFPROXY_HELP_URL = "https://uralgit.ru/ural/tg-ws-proxy-go/blob/main/docs/CfProxy.md"
-_CFPROXY_TEST_DCS = [1, 2, 3, 4, 5, 203]
-
-
-def _run_cfproxy_connectivity_test(domain: str) -> dict:
-    import base64
-    import ssl
-    import socket as _socket
-
-    ctx = ssl.create_default_context()
-    ctx.check_hostname = False
-    ctx.verify_mode = ssl.CERT_NONE
-    results = {}
-    for dc in _CFPROXY_TEST_DCS:
-        host = f"kws{dc}.{domain}"
-        try:
-            with _socket.create_connection((host, 443), timeout=5) as raw:
-                with ctx.wrap_socket(raw, server_hostname=host) as ssock:
-                    ws_key = base64.b64encode(os.urandom(16)).decode()
-                    req = (
-                        f"GET /apiws HTTP/1.1\r\n"
-                        f"Host: {host}\r\n"
-                        f"Upgrade: websocket\r\n"
-                        f"Connection: Upgrade\r\n"
-                        f"Sec-WebSocket-Key: {ws_key}\r\n"
-                        f"Sec-WebSocket-Version: 13\r\n"
-                        f"Sec-WebSocket-Protocol: binary\r\n"
-                        f"\r\n"
-                    ).encode()
-                    ssock.sendall(req)
-                    ssock.settimeout(5)
-                    buf = b""
-                    while b"\r\n\r\n" not in buf:
-                        chunk = ssock.recv(512)
-                        if not chunk:
-                            break
-                        buf += chunk
-                    first = buf.decode("utf-8", errors="replace").split("\r\n")[0]
-                    if "101" in first:
-                        results[dc] = True
-                    else:
-                        results[dc] = first or "нет ответа"
-                    ssock.close()
-                raw.close()
-        except _socket.timeout:
-            results[dc] = "таймаут"
-        except OSError as exc:
-            msg = str(exc)
-            results[dc] = msg[:60] if len(msg) > 60 else msg
-    return results
-
-
-def _run_cfproxy_auto_test(domains: list) -> tuple:
-    merged: dict = {}
-    best_domain = None
-    for domain in reversed(domains):
-        res = _run_cfproxy_connectivity_test(domain)
-        if all(v is True for v in res.values()):
-            return domain, res
-        for dc, v in res.items():
-            if v is True:
-                merged[dc] = True
-                best_domain = domain
-            elif dc not in merged:
-                merged[dc] = v
-    return best_domain, merged
-
-
-def _cfproxy_show_test_results(domain: str, results: dict) -> None:
-    import tkinter as _tk
-    from tkinter import messagebox as _mb
-
-    ok = [dc for dc, v in results.items() if v is True]
-    fail = [(dc, v) for dc, v in results.items() if v is not True]
-    if len(ok) == len(_CFPROXY_TEST_DCS):
-        title = "CF-прокси: всё работает"
-        msg = f"\u2713 Все {len(_CFPROXY_TEST_DCS)} серверов доступны через {domain}."
-    elif not ok:
-        title = "CF-прокси: недоступен"
-        msg = f"\u2717 Ни один сервер не отвечает через {domain}.\n\nОшибки:\n"
-        msg += "\n".join(f"  kws{dc}: {v}" for dc, v in fail)
-    else:
-        title = "CF-прокси: частично работает"
-        msg = (
-            f"Домен: {domain}\n\n"
-            f"\u2713 Работают: {', '.join(f'kws{dc}' for dc in ok)}\n\n"
-            f"\u2717 Недоступны:\n"
-            + "\n".join(f"  kws{dc}: {v}" for dc, v in fail)
-        )
-    root = _tk.Tk()
-    root.withdraw()
-    try:
-        root.attributes("-topmost", True)
-    except Exception:
-        pass
-    _mb.showinfo(title, msg, parent=root)
-    root.destroy()
-
-
-def _cfproxy_show_auto_test_results(ok_domain, results: dict) -> None:
-    import tkinter as _tk
-    from tkinter import messagebox as _mb
-
-    if ok_domain is not None:
-        title = "CF-прокси: доступен"
-        ok = [dc for dc, v in results.items() if v is True]
-        msg = f"\u2713 CF-прокси работает. {len(ok)} из {len(_CFPROXY_TEST_DCS)} серверов доступны."
-    else:
-        title = "CF-прокси: недоступен"
-        msg = "\u2717 Ни один из автоматических CF-доменов не отвечает.\n"
-        msg += "Возможно, блокировка или проблемы с сетью."
-    root = _tk.Tk()
-    root.withdraw()
-    try:
-        root.attributes("-topmost", True)
-    except Exception:
-        pass
-    _mb.showinfo(title, msg, parent=root)
-    root.destroy()
-
-_INNER_W = 396
-
-_APPEARANCE_OPTIONS = ["Авто", "Светлая", "Тёмная"]
-_APPEARANCE_FROM_CFG = {"auto": "Авто", "light": "Светлая", "dark": "Тёмная"}
-_APPEARANCE_TO_CFG = {"Авто": "auto", "Светлая": "light", "Тёмная": "dark"}
-_APPEARANCE_TO_CTK = {"auto": "system", "light": "Light", "dark": "Dark"}
-
-
-def _entry(ctk, parent, theme, *, var=None, width=0, height=36, radius=10, **kw):
-    opts = dict(
-        font=(theme.ui_font_family, 13), corner_radius=radius,
-        fg_color=theme.bg, border_color=theme.field_border,
-        border_width=1, text_color=theme.text_primary,
-    )
-    if var is not None:
-        opts["textvariable"] = var
-    if width:
-        opts["width"] = width
-    opts["height"] = height
-    opts.update(kw)
-    return ctk.CTkEntry(parent, **opts)
-
-
-def _checkbox(ctk, parent, theme, text, variable):
-    return ctk.CTkCheckBox(
-        parent, text=text, variable=variable,
-        font=(theme.ui_font_family, 13), text_color=theme.text_primary,
-        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
-        corner_radius=6, border_width=2, border_color=theme.field_border,
-    )
-
-
-def _label(ctk, parent, theme, text, *, size=12, bold=False, secondary=True, **kw):
-    weight = "bold" if bold else "normal"
-    return ctk.CTkLabel(
-        parent, text=text,
-        font=(theme.ui_font_family, size, weight),
-        text_color=theme.text_secondary if secondary else theme.text_primary,
-        anchor="w", **kw,
-    )
-
-
-def _labeled_entry(ctk, parent, theme, label_text, value, *, tip="", width=0, pack_fill=False):
-    col = ctk.CTkFrame(parent, fg_color="transparent")
-    lbl = _label(ctk, col, theme, label_text)
-    lbl.pack(anchor="w", pady=(0, 2))
-    var = ctk.StringVar(value=str(value))
-    ent = _entry(ctk, col, theme, var=var, width=width)
-    if pack_fill:
-        ent.pack(fill="x")
-    else:
-        ent.pack(anchor="w")
-    if tip:
-        attach_tooltip_to_widgets([lbl, ent, col], tip)
-    return col, var
-
-
-def tray_settings_scroll_and_footer(
-    ctk: Any,
-    content_parent: Any,
-    theme: CtkTheme,
-) -> Tuple[Any, Any]:
-    footer = ctk.CTkFrame(content_parent, fg_color=theme.bg)
-    footer.pack(side="bottom", fill="x")
-    scroll = ctk.CTkScrollableFrame(
-        content_parent,
-        fg_color=theme.bg,
-        corner_radius=0,
-        scrollbar_button_color=theme.field_border,
-        scrollbar_button_hover_color=theme.text_secondary,
-    )
-    scroll.pack(fill="both", expand=True)
-    return scroll, footer
-
-
-def _config_section(
-    ctk: Any,
-    parent: Any,
-    theme: CtkTheme,
-    title: str,
-    *,
-    bottom_spacer: int = 6,
-) -> Any:
-    wrap = ctk.CTkFrame(parent, fg_color="transparent")
-    wrap.pack(fill="x", pady=(0, bottom_spacer))
-    _label(ctk, wrap, theme, title, secondary=False, bold=True).pack(anchor="w", pady=(0, 2))
-    card = ctk.CTkFrame(
-        wrap, fg_color=theme.field_bg, corner_radius=10,
-        border_width=1, border_color=theme.field_border,
-    )
-    card.pack(fill="x")
-    inner = ctk.CTkFrame(card, fg_color="transparent")
-    inner.pack(fill="x", padx=10, pady=8)
-    return inner
-
-
-@dataclass
-class TrayConfigFormWidgets:
-    host_var: Any
-    port_var: Any
-    secret_var: Any
-    dc_textbox: Any
-    verbose_var: Any
-    adv_entries: List[Any]
-    adv_keys: Tuple[str, ...]
-    autostart_var: Optional[Any]
-    check_updates_var: Optional[Any]
-    cfproxy_var: Optional[Any] = None
-    cfproxy_priority_var: Optional[Any] = None
-    cfproxy_user_domain_var: Optional[Any] = None
-    appearance_var: Optional[Any] = None
-
-
-def install_tray_config_form(
-    ctk: Any,
-    frame: Any,
-    theme: CtkTheme,
-    cfg: dict,
-    default_config: dict,
-    *,
-    show_autostart: bool = False,
-    autostart_value: bool = False,
-) -> TrayConfigFormWidgets:
-    header = ctk.CTkFrame(frame, fg_color="transparent")
-    header.pack(fill="x", pady=(0, 2))
-    ctk.CTkLabel(
-        header, text="Настройки",
-        font=(theme.ui_font_family, 17, "bold"),
-        text_color=theme.text_primary, anchor="w",
-    ).pack(side="left")
-    ctk.CTkLabel(
-        header, text=f"v{__version__}",
-        font=(theme.ui_font_family, 12),
-        text_color=theme.text_secondary, anchor="e",
-    ).pack(side="right", padx=(4, 0))
-    appearance_var = ctk.StringVar(
-        value=_APPEARANCE_FROM_CFG.get(cfg.get("appearance", "auto"), "Авто")
-    )
-
-    def _on_appearance_change(choice: str) -> None:
-        cfg_val = _APPEARANCE_TO_CFG.get(choice, "auto")
-        ctk.set_appearance_mode(_APPEARANCE_TO_CTK[cfg_val])
-        cfg["appearance"] = cfg_val
-
-    ctk.CTkComboBox(
-        header,
-        values=_APPEARANCE_OPTIONS,
-        variable=appearance_var,
-        width=102,
-        height=28,
-        font=(theme.ui_font_family, 12),
-        text_color=theme.text_secondary,
-        fg_color=theme.field_bg,
-        border_color=theme.field_border,
-        button_color=theme.field_border,
-        button_hover_color=theme.text_secondary,
-        dropdown_fg_color=theme.field_bg,
-        dropdown_text_color=theme.text_primary,
-        dropdown_hover_color=theme.field_border,
-        corner_radius=8,
-        state="readonly",
-        command=_on_appearance_change,
-    ).pack(side="right")
-
-    ctk.CTkButton(
-        header, text="Donate ♥", width=90, height=28,
-        font=(theme.ui_font_family, 13, "bold"), corner_radius=8,
-        fg_color="#22c55e", hover_color="#16a34a",
-        text_color="#ffffff", border_width=0,
-        command=lambda: (
-            header.winfo_toplevel().iconify(),
-            webbrowser.open("https://uralgit.ru/ural/tg-ws-proxy-go/blob/main/docs/Funding.md"),
-        ),
-    ).pack(side="right", padx=(0, 6))
-
-    conn = _config_section(ctk, frame, theme, "Подключение MTProto")
-
-    host_row = ctk.CTkFrame(conn, fg_color="transparent")
-    host_row.pack(fill="x")
-
-    host_col, host_var = _labeled_entry(
-        ctk, host_row, theme, "IP-адрес",
-        cfg.get("host", default_config["host"]),
-        tip=_TIP_HOST, width=160, pack_fill=True,
-    )
-    host_col.pack(side="left", fill="x", expand=True, padx=(0, 10))
-
-    port_col, port_var = _labeled_entry(
-        ctk, host_row, theme, "Порт",
-        cfg.get("port", default_config["port"]),
-        tip=_TIP_PORT, width=100,
-    )
-    port_col.pack(side="left")
-
-    secret_row = ctk.CTkFrame(conn, fg_color="transparent")
-    secret_row.pack(fill="x")
-
-    secret_col, secret_var = _labeled_entry(
-        ctk, secret_row, theme, "Secret",
-        cfg.get("secret", default_config["secret"]),
-        tip=_TIP_SECRET, width=160, pack_fill=True,
-    )
-    secret_col.pack(side="left", fill="x", expand=True, padx=(0, 10))
-
-    regen_col = ctk.CTkFrame(secret_row, fg_color="transparent")
-    regen_col.pack(side="left", anchor="s")
-    ctk.CTkLabel(regen_col, text="", font=(theme.ui_font_family, 12)).pack(pady=(0, 2))
-    ctk.CTkButton(
-        regen_col, text="↺", width=36, height=36,
-        font=(theme.ui_font_family, 18), corner_radius=10,
-        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
-        text_color="#ffffff", border_width=1, border_color=theme.field_border,
-        command=lambda: secret_var.set(os.urandom(16).hex()),
-    ).pack()
-
-    dc_inner = _config_section(ctk, frame, theme, "Датацентры Telegram (DC → IP)")
-    dc_lbl = _label(ctk, dc_inner, theme, "По одному правилу на строку, формат: номер:IP", size=11)
-    dc_lbl.pack(anchor="w", pady=(0, 4))
-    dc_textbox = ctk.CTkTextbox(
-        dc_inner, width=_INNER_W, height=88,
-        font=(theme.mono_font_family, 12), corner_radius=10,
-        fg_color=theme.bg, border_color=theme.field_border,
-        border_width=1, text_color=theme.text_primary,
-    )
-    dc_textbox.pack(fill="x")
-    dc_textbox.insert("1.0", "\n".join(cfg.get("dc_ip", default_config["dc_ip"])))
-    attach_tooltip_to_widgets([dc_lbl, dc_textbox], _TIP_DC)
-
-    cf_inner = _config_section(ctk, frame, theme, "Cloudflare Proxy")
-
-    cf_row = ctk.CTkFrame(cf_inner, fg_color="transparent")
-    cf_row.pack(fill="x", pady=(0, 4))
-
-    cfproxy_var = ctk.BooleanVar(
-        value=cfg.get("cfproxy", default_config.get("cfproxy", True))
-    )
-    cf_cb = _checkbox(ctk, cf_row, theme, "Включить CF-прокси", cfproxy_var)
-    cf_cb.pack(side="left", padx=(0, 16))
-    attach_ctk_tooltip(cf_cb, _TIP_CFPROXY)
-
-    cfproxy_priority_var = ctk.BooleanVar(
-        value=cfg.get("cfproxy_priority", default_config.get("cfproxy_priority", True))
-    )
-    cf_prio_cb = _checkbox(ctk, cf_row, theme, "Приоритет", cfproxy_priority_var)
-    cf_prio_cb.pack(side="left")
-    attach_ctk_tooltip(cf_prio_cb, _TIP_CFPROXY_PRIORITY)
-
-    _cf_test_btn = [None]
-
-    def _on_cf_test():
-        user_domain = cfproxy_user_domain_var.get().strip() if cf_custom_cb_var.get() else ""
-        btn = _cf_test_btn[0]
-        if btn:
-            btn.configure(text="...", state="disabled")
-        import threading as _threading
-        if user_domain:
-            def _worker():
-                try:
-                    res = _run_cfproxy_connectivity_test(user_domain)
-                    if btn:
-                        btn.after(0, lambda: _cfproxy_show_test_results(user_domain, res))
-                except Exception as exc:
-                    log.error("CF proxy test failed: %s", exc)
-                finally:
-                    if btn:
-                        btn.after(0, lambda: btn.configure(text="Тест", state="normal"))
-            _threading.Thread(target=_worker, daemon=True).start()
-        else:
-            def _worker_auto():
-                try:
-                    ok_domain, res = _run_cfproxy_auto_test(balancer.domains)
-                    if btn:
-                        btn.after(0, lambda: _cfproxy_show_auto_test_results(ok_domain, res))
-                except Exception as exc:
-                    log.error("CF proxy auto-test failed: %s", exc)
-                finally:
-                    if btn:
-                        btn.after(0, lambda: btn.configure(text="Тест", state="normal"))
-            _threading.Thread(target=_worker_auto, daemon=True).start()
-
-    _cf_test_widget = ctk.CTkButton(
-        cf_row, text="Тест", width=56, height=28,
-        font=(theme.ui_font_family, 13), corner_radius=8,
-        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
-        text_color="#ffffff", border_width=1, border_color=theme.field_border,
-        command=_on_cf_test,
-    )
-    _cf_test_widget.pack(side="right")
-    _cf_test_btn[0] = _cf_test_widget
-
-    cf_custom_row = ctk.CTkFrame(cf_inner, fg_color="transparent")
-    cf_custom_row.pack(fill="x")
-
-    saved_user_domain = cfg.get("cfproxy_user_domain", default_config.get("cfproxy_user_domain", ""))
-    cf_custom_cb_var = ctk.BooleanVar(value=bool(saved_user_domain))
-    cf_custom_cb = _checkbox(ctk, cf_custom_row, theme, "Свой домен", cf_custom_cb_var)
-    cf_custom_cb.pack(side="left", padx=(0, 10))
-    attach_ctk_tooltip(cf_custom_cb, _TIP_CFPROXY_USER_DOMAIN_CB)
-
-    ctk.CTkButton(
-        cf_custom_row, text="?", width=28, height=32,
-        font=(theme.ui_font_family, 14), corner_radius=8,
-        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
-        text_color="#ffffff", border_width=1, border_color=theme.field_border,
-        command=lambda: webbrowser.open(_CFPROXY_HELP_URL),
-    ).pack(side="right")
-
-    cfproxy_user_domain_var = ctk.StringVar(value=saved_user_domain)
-    cf_domain_entry = _entry(
-        ctk, cf_custom_row, theme, var=cfproxy_user_domain_var,
-        height=32, radius=8,
-    )
-    cf_domain_entry.pack(side="left", fill="x", expand=True, padx=(0, 6))
-    attach_ctk_tooltip(cf_domain_entry, _TIP_CFPROXY_DOMAIN)
-
-    def _sync_domain_entry(*_):
-        state = "normal" if cf_custom_cb_var.get() else "disabled"
-        cf_domain_entry.configure(state=state)
-        if not cf_custom_cb_var.get():
-            cfproxy_user_domain_var.set("")
-
-    cf_custom_cb_var.trace_add("write", _sync_domain_entry)
-    _sync_domain_entry()
-
-    log_inner = _config_section(ctk, frame, theme, "Логи и производительность")
-
-    verbose_var = ctk.BooleanVar(value=cfg.get("verbose", False))
-    verbose_cb = _checkbox(ctk, log_inner, theme, "Подробное логирование (verbose)", verbose_var)
-    verbose_cb.pack(anchor="w", pady=(0, 6))
-    attach_ctk_tooltip(verbose_cb, _TIP_VERBOSE)
-
-    adv_frame = ctk.CTkFrame(log_inner, fg_color="transparent")
-    adv_frame.pack(fill="x")
-
-    adv_rows = [
-        ("Буфер, КБ (по умолчанию 256)", "buf_kb", _TIP_BUF_KB),
-        ("Пул WebSocket-сессий (по умолчанию 4)", "pool_size", _TIP_POOL),
-        ("Макс. размер лога, МБ (по умолчанию 5)", "log_max_mb", _TIP_LOG_MB),
-    ]
-    for label_text, key, tip in adv_rows:
-        col = ctk.CTkFrame(adv_frame, fg_color="transparent")
-        col.pack(fill="x", pady=(0, 0 if key == "log_max_mb" else 5))
-        adv_l = _label(ctk, col, theme, label_text, size=11)
-        adv_l.pack(anchor="w", pady=(0, 2))
-        adv_e = _entry(
-            ctk, col, theme, width=_INNER_W, height=32, radius=8,
-            textvariable=ctk.StringVar(value=str(cfg.get(key, default_config[key]))),
-        )
-        adv_e.pack(fill="x")
-        attach_tooltip_to_widgets([adv_l, adv_e, col], tip)
-
-    adv_entries = list(adv_frame.winfo_children())
-    adv_keys = ("buf_kb", "pool_size", "log_max_mb")
-
-    upd_inner = _config_section(ctk, frame, theme, "Обновления")
-    st = get_status()
-    check_updates_var = ctk.BooleanVar(
-        value=bool(cfg.get("check_updates", default_config.get("check_updates", True)))
-    )
-    upd_cb = _checkbox(ctk, upd_inner, theme, "Проверять обновления при запуске", check_updates_var)
-    upd_cb.pack(anchor="w", pady=(0, 6))
-    attach_ctk_tooltip(upd_cb, _TIP_CHECK_UPDATES)
-
-    if st.get("error"):
-        upd_status = "Не удалось связаться с GitHub. Проверьте сеть."
-    elif not st.get("checked"):
-        upd_status = "Статус появится после фоновой проверки при запуске."
-    elif st.get("has_update") and st.get("latest"):
-        upd_status = (
-            f"На GitHub доступна версия {st['latest']} "
-            f"(у вас {__version__})."
-        )
-    elif st.get("ahead_of_release") and st.get("latest"):
-        upd_status = (
-            f"У вас {__version__} — новее последнего релиза на GitHub "
-            f"({st['latest']})."
-        )
-    else:
-        upd_status = "Установлена последняя известная версия с GitHub."
-
-    _label(ctk, upd_inner, theme, upd_status, size=11,
-           justify="left", wraplength=_INNER_W).pack(anchor="w", pady=(0, 8))
-
-    rel_url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
-    ctk.CTkButton(
-        upd_inner, text="Открыть страницу релиза", height=32,
-        font=(theme.ui_font_family, 13), corner_radius=8,
-        fg_color=theme.field_bg, hover_color=theme.field_border,
-        text_color=theme.text_primary, border_width=1,
-        border_color=theme.field_border,
-        command=lambda u=rel_url: webbrowser.open(u),
-    ).pack(anchor="w")
-
-    autostart_var = None
-    if show_autostart:
-        sys_inner = _config_section(ctk, frame, theme, "Запуск Windows", bottom_spacer=4)
-        autostart_var = ctk.BooleanVar(value=autostart_value)
-        as_cb = _checkbox(ctk, sys_inner, theme, "Автозапуск при включении компьютера", autostart_var)
-        as_cb.pack(anchor="w", pady=(0, 4))
-        as_hint = _label(
-            ctk, sys_inner, theme,
-            "Если переместить программу в другую папку, запись автозапуска может сброситься.",
-            size=11, justify="left", wraplength=_INNER_W,
-        )
-        as_hint.pack(anchor="w")
-        attach_tooltip_to_widgets([as_cb, as_hint], _TIP_AUTOSTART)
-
-    return TrayConfigFormWidgets(
-        host_var=host_var, port_var=port_var, secret_var=secret_var,
-        dc_textbox=dc_textbox, verbose_var=verbose_var,
-        adv_entries=adv_entries, adv_keys=adv_keys,
-        autostart_var=autostart_var, check_updates_var=check_updates_var,
-        cfproxy_var=cfproxy_var,
-        cfproxy_priority_var=cfproxy_priority_var,
-        cfproxy_user_domain_var=cfproxy_user_domain_var,
-        appearance_var=appearance_var,
-    )
-
-
-def merge_adv_from_form(
-    widgets: TrayConfigFormWidgets,
-    base: Dict[str, Any],
-    default_config: dict,
-) -> None:
-    for i, key in enumerate(widgets.adv_keys):
-        col_frame = widgets.adv_entries[i]
-        entry = col_frame.winfo_children()[1]
-        try:
-            val = float(entry.get().strip())
-            if key in ("buf_kb", "pool_size"):
-                val = int(val)
-            base[key] = val
-        except ValueError:
-            base[key] = default_config[key]
-
-
-def validate_config_form(
-    widgets: TrayConfigFormWidgets,
-    default_config: dict,
-    *,
-    include_autostart: bool,
-) -> Union[dict, str]:
-    import socket as _sock
-
-    host_val = widgets.host_var.get().strip()
-    try:
-        _sock.inet_aton(host_val)
-    except OSError:
-        return "Некорректный IP-адрес."
-
-    try:
-        port_val = int(widgets.port_var.get().strip())
-        if not (1 <= port_val <= 65535):
-            raise ValueError
-    except ValueError:
-        return "Порт должен быть числом 1-65535"
-
-    lines = [
-        line.strip()
-        for line in widgets.dc_textbox.get("1.0", "end").strip().splitlines()
-        if line.strip()
-    ]
-    try:
-        parse_dc_ip_list(lines)
-    except ValueError as e:
-        return str(e)
-
-    secret_val = widgets.secret_var.get().strip()
-    if len(secret_val) != 32:
-        return "Secret должен содержать ровно 32 hex-символа (16 байт)."
-    try:
-        bytes.fromhex(secret_val)
-    except ValueError:
-        return "Secret должен состоять только из hex-символов (0-9, a-f)."
-
-    new_cfg: Dict[str, Any] = {
-        "host": host_val,
-        "port": port_val,
-        "secret": secret_val,
-        "dc_ip": lines,
-        "verbose": widgets.verbose_var.get(),
-    }
-    if include_autostart:
-        new_cfg["autostart"] = (
-            widgets.autostart_var.get()
-            if widgets.autostart_var is not None
-            else False
-        )
-
-    merge_adv_from_form(widgets, new_cfg, default_config)
-    if widgets.check_updates_var is not None:
-        new_cfg["check_updates"] = bool(widgets.check_updates_var.get())
-    if widgets.cfproxy_var is not None:
-        new_cfg["cfproxy"] = bool(widgets.cfproxy_var.get())
-    if widgets.cfproxy_priority_var is not None:
-        new_cfg["cfproxy_priority"] = bool(widgets.cfproxy_priority_var.get())
-    if widgets.cfproxy_user_domain_var is not None:
-        new_cfg["cfproxy_user_domain"] = widgets.cfproxy_user_domain_var.get().strip()
-    if widgets.appearance_var is not None:
-        new_cfg["appearance"] = _APPEARANCE_TO_CFG.get(widgets.appearance_var.get(), "auto")
-    return new_cfg
-
-
-def install_tray_config_buttons(
-    ctk: Any,
-    frame: Any,
-    theme: CtkTheme,
-    *,
-    on_save: Callable[[], None],
-    on_cancel: Callable[[], None],
-) -> None:
-    ctk.CTkFrame(
-        frame,
-        fg_color=theme.field_border,
-        height=1,
-        corner_radius=0,
-    ).pack(fill="x", pady=(4, 10))
-    btn_frame = ctk.CTkFrame(frame, fg_color="transparent")
-    btn_frame.pack(fill="x", pady=(0, 0))
-    save_btn = ctk.CTkButton(
-        btn_frame, text="Сохранить", height=38,
-        font=(theme.ui_font_family, 14, "bold"), corner_radius=10,
-        fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
-        text_color="#ffffff",
-        command=on_save)
-    save_btn.pack(side="left", fill="x", expand=True, padx=(0, 8))
-    attach_ctk_tooltip(save_btn, _TIP_SAVE)
-    cancel_btn = ctk.CTkButton(
-        btn_frame, text="Отмена", height=38,
-        font=(theme.ui_font_family, 14), corner_radius=10,
-        fg_color=theme.field_bg, hover_color=theme.field_border,
-        text_color=theme.text_primary, border_width=1,
-        border_color=theme.field_border,
-        command=on_cancel)
-    cancel_btn.pack(side="right", fill="x", expand=True)
-    attach_ctk_tooltip(cancel_btn, _TIP_CANCEL)
-
-
-def populate_first_run_window(
-    ctk: Any,
-    root: Any,
-    theme: CtkTheme,
-    *,
-    host: str,
-    port: int,
-    secret: str,
-    on_done: Callable[[bool], None],
-) -> None:
-    link_host = get_link_host(host)
-    tg_url = f"tg://proxy?server={link_host}&port={port}&secret=dd{secret}"
-    fpx, fpy = FIRST_RUN_FRAME_PAD
-    frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
-
-    title_frame = ctk.CTkFrame(frame, fg_color="transparent")
-    title_frame.pack(anchor="w", pady=(0, 16), fill="x")
-
-    accent_bar = ctk.CTkFrame(title_frame, fg_color=theme.tg_blue,
-                              width=4, height=32, corner_radius=2)
-    accent_bar.pack(side="left", padx=(0, 12))
-
-    ctk.CTkLabel(title_frame, text="Прокси запущен и работает в системном трее",
-                 font=(theme.ui_font_family, 17, "bold"),
-                 text_color=theme.text_primary).pack(side="left")
-
-    sections = [
-        ("Как подключить Telegram Desktop:", True),
-        ("  Автоматически:", True),
-        ("  ПКМ по иконке в трее → «Открыть в Telegram»", False),
-        (f"  Или скопировать ссылку, отправить её себе в TG и нажать по ней: {tg_url}", False),
-        ("\n  Вручную:", True),
-        ("  Настройки → Продвинутые → Тип подключения → Прокси", False),
-        (f"  MTProto → {link_host} : {port}", False),
-        (f"  Secret: dd{secret}", False),
-    ]
-
-    textbox = ctk.CTkTextbox(
-        frame,
-        font=(theme.ui_font_family, 13),
-        fg_color=theme.bg,
-        border_width=0,
-        text_color=theme.text_primary,
-        activate_scrollbars=False,
-        wrap="word",
-        height=275,
-    )
-    textbox._textbox.tag_configure("bold", font=(theme.ui_font_family, 13, "bold"))
-    textbox._textbox.configure(spacing1=1, spacing3=1)
-    for text, bold in sections:
-        if text.startswith("\n"):
-            textbox.insert("end", "\n")
-            text = text[1:]
-        if bold:
-            textbox.insert("end", text + "\n", "bold")
-        else:
-            textbox.insert("end", text + "\n")
-    textbox.configure(state="disabled")
-    textbox.pack(anchor="w", fill="x")
-
-    ctk.CTkFrame(frame, fg_color="transparent", height=16).pack()
-
-    ctk.CTkFrame(frame, fg_color=theme.field_border, height=1,
-                 corner_radius=0).pack(fill="x", pady=(0, 12))
-
-    auto_var = ctk.BooleanVar(value=True)
-    _checkbox(ctk, frame, theme, "Открыть прокси в Telegram сейчас",
-              auto_var).pack(anchor="w", pady=(0, 16))
-
-    def on_ok():
-        on_done(auto_var.get())
-
-    ctk.CTkButton(frame, text="Начать", width=180, height=42,
-                  font=(theme.ui_font_family, 15, "bold"), corner_radius=10,
-                  fg_color=theme.tg_blue, hover_color=theme.tg_blue_hover,
-                  text_color="#ffffff",
-                  command=on_ok).pack(pady=(0, 0))
-
-    root.protocol("WM_DELETE_WINDOW", on_ok)

utils/__init__.py

@@ -1,5 +0,0 @@
-"""Вспомогательные утилиты (проверка релизов и т.п.)."""
-
-from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
-
-__all__ = ["RELEASES_PAGE_URL", "get_status", "run_check"]

utils/default_config.py

@@ -1,33 +0,0 @@
-"""
-Общие значения по умолчанию для tray-приложений (Windows / Linux / macOS).
-Единственное отличие по платформе — ключ autostart только на Windows.
-"""
-from __future__ import annotations
-
-import sys
-import os
-from typing import Any, Dict
-
-_TRAY_DEFAULTS_COMMON: Dict[str, Any] = {
-    "port": 1443,
-    "host": "127.0.0.1",
-    "dc_ip": ["2:149.154.167.220", "4:149.154.167.220"],
-    "verbose": False,
-    "check_updates": True,
-    "log_max_mb": 5,
-    "buf_kb": 256,
-    "pool_size": 4,
-    "cfproxy": True,
-    "cfproxy_priority": True,
-    "cfproxy_user_domain": "",
-}
-
-
-def default_tray_config() -> Dict[str, Any]:
-    cfg = dict(_TRAY_DEFAULTS_COMMON)
-    cfg["secret"] = os.urandom(16).hex()
-
-    if sys.platform == "win32":
-        cfg["autostart"] = False
-
-    return cfg

utils/tray_common.py

@@ -1,469 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import json
-import logging
-import logging.handlers
-import os
-import socket as _socket
-import sys
-import threading
-import time
-from pathlib import Path
-from typing import Any, Callable, Dict, Optional, Tuple
-
-import psutil
-
-from proxy import __version__, get_link_host, parse_dc_ip_list, proxy_config
-from proxy.tg_ws_proxy import _run
-from utils.default_config import default_tray_config
-
-log = logging.getLogger("tg-ws-tray")
-
-APP_NAME = "TgWsProxy"
-
-
-def _app_dir() -> Path:
-    if sys.platform == "win32":
-        return Path(os.environ.get("APPDATA", Path.home())) / APP_NAME
-    if sys.platform == "darwin":
-        return Path.home() / "Library" / "Application Support" / APP_NAME
-    return Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config")) / APP_NAME
-
-
-APP_DIR = _app_dir()
-CONFIG_FILE = APP_DIR / "config.json"
-LOG_FILE = APP_DIR / "proxy.log"
-FIRST_RUN_MARKER = APP_DIR / ".first_run_done_mtproto"
-IPV6_WARN_MARKER = APP_DIR / ".ipv6_warned"
-
-DEFAULT_CONFIG: Dict[str, Any] = default_tray_config()
-
-IS_FROZEN = bool(getattr(sys, "frozen", False))
-
-
-def ensure_dirs() -> None:
-    APP_DIR.mkdir(parents=True, exist_ok=True)
-
-
-# single-instance lock
-
-_lock_file_path: Optional[Path] = None
-
-
-def _same_process(meta: dict, proc: psutil.Process) -> bool:
-    try:
-        lock_ct = float(meta.get("create_time", 0.0))
-        if lock_ct > 0 and abs(lock_ct - proc.create_time()) > 1.0:
-            return False
-    except Exception:
-        return False
-    if IS_FROZEN:
-        return APP_NAME.lower() in proc.name().lower()
-    return False
-
-
-def acquire_lock() -> bool:
-    global _lock_file_path
-    ensure_dirs()
-    for f in list(APP_DIR.glob("*.lock")):
-        try:
-            pid = int(f.stem)
-        except Exception:
-            try:
-                f.unlink(missing_ok=True)
-            except OSError:
-                pass
-            continue
-        meta: dict = {}
-        try:
-            raw = f.read_text(encoding="utf-8").strip()
-            if raw:
-                meta = json.loads(raw)
-        except Exception:
-            pass
-        is_running = False
-        try:
-            is_running = _same_process(meta, psutil.Process(pid))
-        except Exception:
-            pass
-        if is_running:
-            return False
-        try:
-            f.unlink(missing_ok=True)
-        except OSError:
-            pass
-
-    lock_file = APP_DIR / f"{os.getpid()}.lock"
-    try:
-        proc = psutil.Process(os.getpid())
-        lock_file.write_text(
-            json.dumps({"create_time": proc.create_time()}, ensure_ascii=False),
-            encoding="utf-8",
-        )
-    except Exception:
-        try:
-            lock_file.touch()
-        except Exception:
-            pass
-    _lock_file_path = lock_file
-    return True
-
-
-def release_lock() -> None:
-    global _lock_file_path
-    if _lock_file_path:
-        try:
-            _lock_file_path.unlink(missing_ok=True)
-        except Exception:
-            pass
-        _lock_file_path = None
-
-
-# config
-
-def load_config() -> dict:
-    ensure_dirs()
-    if CONFIG_FILE.exists():
-        try:
-            with open(CONFIG_FILE, "r", encoding="utf-8") as f:
-                data = json.load(f)
-            for k, v in DEFAULT_CONFIG.items():
-                data.setdefault(k, v)
-            return data
-        except Exception as exc:
-            log.warning("Failed to load config: %s", repr(exc))
-    return dict(DEFAULT_CONFIG)
-
-
-def save_config(cfg: dict) -> None:
-    ensure_dirs()
-    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
-        json.dump(cfg, f, indent=2, ensure_ascii=False)
-
-
-# logging
-
-_LOG_FMT_FILE = "%(asctime)s  %(levelname)-5s  %(name)s  %(message)s"
-_LOG_FMT_CONSOLE = "%(asctime)s  %(levelname)-5s  %(message)s"
-
-
-def setup_logging(verbose: bool = False, log_max_mb: float = 5) -> None:
-    ensure_dirs()
-    level = logging.DEBUG if verbose else logging.INFO
-    root = logging.getLogger()
-    root.setLevel(level)
-    logging.getLogger('asyncio').setLevel(logging.WARNING)
-
-    fh = logging.handlers.RotatingFileHandler(
-        str(LOG_FILE),
-        maxBytes=max(32 * 1024, int(log_max_mb * 1024 * 1024)),
-        backupCount=0,
-        encoding="utf-8",
-    )
-    fh.setLevel(logging.DEBUG)
-    fh.setFormatter(logging.Formatter(_LOG_FMT_FILE, datefmt="%Y-%m-%d %H:%M:%S"))
-    root.addHandler(fh)
-
-    if not IS_FROZEN:
-        ch = logging.StreamHandler(sys.stdout)
-        ch.setLevel(level)
-        ch.setFormatter(logging.Formatter(_LOG_FMT_CONSOLE, datefmt="%H:%M:%S"))
-        root.addHandler(ch)
-
-
-# icon
-
-def make_icon_image(size: int = 64, *, color: Tuple[int, ...] = (0, 136, 204, 255)):
-    from PIL import Image, ImageDraw, ImageFont
-
-    img = Image.new("RGBA", (size, size), (0, 0, 0, 0))
-    draw = ImageDraw.Draw(img)
-    margin = 2
-    draw.ellipse([margin, margin, size - margin, size - margin], fill=color)
-
-    for path in _font_paths():
-        try:
-            font = ImageFont.truetype(path, size=int(size * 0.55))
-            break
-        except Exception:
-            continue
-    else:
-        font = ImageFont.load_default()
-
-    bbox = draw.textbbox((0, 0), "T", font=font)
-    tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
-    draw.text(
-        ((size - tw) // 2 - bbox[0], (size - th) // 2 - bbox[1]),
-        "T",
-        fill=(255, 255, 255, 255),
-        font=font,
-    )
-    return img
-
-
-def _font_paths():
-    if sys.platform == "win32":
-        return ["arial.ttf"]
-    if sys.platform == "darwin":
-        return ["/System/Library/Fonts/Helvetica.ttc"]
-    return [
-        "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf",
-        "/usr/share/fonts/TTF/DejaVuSans-Bold.ttf",
-    ]
-
-
-def load_icon():
-    from PIL import Image
-
-    icon_path = Path(__file__).parents[1] / "icon.ico"
-    if icon_path.exists():
-        try:
-            return Image.open(str(icon_path))
-        except Exception:
-            pass
-    return make_icon_image(64)
-
-
-# proxy lifecycle
-
-_proxy_thread: Optional[threading.Thread] = None
-_async_stop: Optional[Tuple[asyncio.AbstractEventLoop, asyncio.Event]] = None
-
-
-def _run_proxy_thread(on_port_busy: Callable[[str], None]) -> None:
-    global _async_stop
-
-    loop = asyncio.new_event_loop()
-    asyncio.set_event_loop(loop)
-    stop_ev = asyncio.Event()
-    _async_stop = (loop, stop_ev)
-
-    try:
-        loop.run_until_complete(_run(stop_event=stop_ev))
-    except Exception as exc:
-        log.error("Proxy thread crashed: %s", repr(exc))
-        if "Address already in use" in str(exc) or "10048" in str(exc):
-            on_port_busy(
-                "Не удалось запустить прокси:\n"
-                "Порт уже используется другим приложением.\n\n"
-                "Закройте приложение, использующее этот порт, "
-                "или измените порт в настройках прокси и перезапустите."
-            )
-    finally:
-        loop.close()
-        _async_stop = None
-
-
-def apply_proxy_config(cfg: dict) -> bool:
-    dc_ip_list = cfg.get("dc_ip", DEFAULT_CONFIG["dc_ip"])
-    try:
-        dc_redirects = parse_dc_ip_list(dc_ip_list)
-    except ValueError as e:
-        log.error("Bad config dc_ip: %s", e)
-        return False
-
-    pc = proxy_config
-    pc.port = cfg.get("port", DEFAULT_CONFIG["port"])
-    pc.host = cfg.get("host", DEFAULT_CONFIG["host"])
-    pc.secret = cfg.get("secret", DEFAULT_CONFIG["secret"])
-    pc.dc_redirects = dc_redirects
-    pc.buffer_size = max(4, cfg.get("buf_kb", DEFAULT_CONFIG["buf_kb"])) * 1024
-    pc.pool_size = max(0, cfg.get("pool_size", DEFAULT_CONFIG["pool_size"]))
-    pc.fallback_cfproxy = cfg.get("cfproxy", DEFAULT_CONFIG["cfproxy"])
-    pc.fallback_cfproxy_priority = cfg.get("cfproxy_priority", DEFAULT_CONFIG["cfproxy_priority"])
-    pc.cfproxy_user_domain = cfg.get("cfproxy_user_domain", DEFAULT_CONFIG["cfproxy_user_domain"])
-    return True
-
-
-def start_proxy(cfg: dict, on_error: Callable[[str], None]) -> None:
-    global _proxy_thread
-    if _proxy_thread and _proxy_thread.is_alive():
-        log.info("Proxy already running")
-        return
-
-    if not apply_proxy_config(cfg):
-        on_error("Ошибка конфигурации DC → IP.")
-        return
-
-    pc = proxy_config
-    log.info("Starting proxy on %s:%d ...", pc.host, pc.port)
-    _proxy_thread = threading.Thread(
-        target=_run_proxy_thread, args=(on_error,), daemon=True, name="proxy"
-    )
-    _proxy_thread.start()
-
-
-def stop_proxy() -> None:
-    global _proxy_thread, _async_stop
-    if _async_stop:
-        loop, stop_ev = _async_stop
-        loop.call_soon_threadsafe(stop_ev.set)
-        if _proxy_thread:
-            _proxy_thread.join(timeout=5)
-    _proxy_thread = None
-    log.info("Proxy stopped")
-
-
-def restart_proxy(cfg: dict, on_error: Callable[[str], None]) -> None:
-    log.info("Restarting proxy...")
-    stop_proxy()
-    time.sleep(0.3)
-    start_proxy(cfg, on_error)
-
-
-def tg_proxy_url(cfg: dict) -> str:
-    host = cfg.get("host", DEFAULT_CONFIG["host"])
-    port = cfg.get("port", DEFAULT_CONFIG["port"])
-    secret = cfg.get("secret", DEFAULT_CONFIG["secret"])
-    link_host = get_link_host(host)
-    return f"tg://proxy?server={link_host}&port={port}&secret=dd{secret}"
-
-
-_IPV6_WARNING = (
-    "На вашем компьютере включена поддержка подключения по IPv6.\n\n"
-    "Telegram может пытаться подключаться через IPv6, "
-    "что не поддерживается и может привести к ошибкам.\n\n"
-    "Если прокси не работает или в логах присутствуют ошибки, "
-    "связанные с попытками подключения по IPv6 - "
-    "попробуйте отключить в настройках прокси Telegram попытку соединения "
-    "по IPv6. Если данная мера не помогает, попробуйте отключить IPv6 "
-    "в системе.\n\n"
-    "Это предупреждение будет показано только один раз."
-)
-
-
-def _has_ipv6() -> bool:
-    try:
-        for addr in _socket.getaddrinfo(_socket.gethostname(), None, _socket.AF_INET6):
-            ip = addr[4][0]
-            if ip and not ip.startswith("::1") and not ip.startswith("fe80::1"):
-                return True
-    except Exception:
-        pass
-    try:
-        s = _socket.socket(_socket.AF_INET6, _socket.SOCK_STREAM)
-        s.bind(("::1", 0))
-        s.close()
-        return True
-    except Exception:
-        return False
-
-
-def check_ipv6_warning(show_info: Callable[[str, str], None]) -> None:
-    ensure_dirs()
-    if IPV6_WARN_MARKER.exists() or not _has_ipv6():
-        return
-    IPV6_WARN_MARKER.touch()
-    threading.Thread(
-        target=lambda: show_info(_IPV6_WARNING, "TG WS Proxy"),
-        daemon=True,
-    ).start()
-
-
-# update check
-
-def maybe_notify_update(
-    cfg: dict,
-    is_exiting: Callable[[], bool],
-    ask_open: Callable[[str, str], bool],
-) -> None:
-    if not cfg.get("check_updates", True):
-        return
-
-    def _work():
-        time.sleep(1.5)
-        if is_exiting():
-            return
-        try:
-            from utils.update_check import RELEASES_PAGE_URL, get_status, run_check
-            import webbrowser
-
-            run_check(__version__)
-            st = get_status()
-            if not st.get("has_update"):
-                return
-            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
-            ver = st.get("latest") or "?"
-            if ask_open(
-                f"Доступна новая версия: {ver}\n\nОткрыть страницу релиза в браузере?",
-                "TG WS Proxy — обновление",
-            ):
-                webbrowser.open(url)
-        except Exception as exc:
-            log.warning("Update check failed: %s", repr(exc))
-
-    threading.Thread(target=_work, daemon=True, name="update-check").start()
-
-
-# ctk thread (windows / linux)
-
-_ctk_root: Any = None
-_ctk_root_ready = threading.Event()
-
-
-def ensure_ctk_thread(ctk: Any, mode: str = "auto") -> bool:
-    global _ctk_root
-    if ctk is None:
-        return False
-    if _ctk_root_ready.is_set():
-        return True
-
-    def _run():
-        global _ctk_root
-        from ui.ctk_theme import apply_ctk_appearance, install_tkinter_variable_del_guard
-
-        install_tkinter_variable_del_guard()
-        apply_ctk_appearance(ctk, mode)
-        _ctk_root = ctk.CTk()
-        _ctk_root.withdraw()
-        _ctk_root_ready.set()
-        _ctk_root.mainloop()
-
-    threading.Thread(target=_run, daemon=True, name="ctk-root").start()
-    _ctk_root_ready.wait(timeout=5.0)
-    return _ctk_root is not None
-
-
-def ctk_run_dialog(build_fn: Callable[[threading.Event], None]) -> None:
-    if _ctk_root is None:
-        return
-    done = threading.Event()
-
-    def _invoke():
-        try:
-            build_fn(done)
-        except Exception:
-            log.exception("CTk dialog failed")
-            done.set()
-
-    _ctk_root.after(0, _invoke)
-    done.wait()
-    import gc
-    gc.collect()
-
-
-def quit_ctk() -> None:
-    if _ctk_root is not None:
-        try:
-            _ctk_root.after(0, _ctk_root.quit)
-        except Exception:
-            pass
-
-
-# common bootstrap
-
-def bootstrap(cfg: dict) -> None:
-    save_config(cfg)
-    if LOG_FILE.exists():
-        try:
-            LOG_FILE.unlink()
-        except Exception:
-            pass
-    setup_logging(
-        cfg.get("verbose", False),
-        log_max_mb=cfg.get("log_max_mb", DEFAULT_CONFIG["log_max_mb"]),
-    )
-    log.info("TG WS Proxy версия %s starting", __version__)
-    log.info("Config: %s", cfg)
-    log.info("Log file: %s", LOG_FILE)

utils/update_check.py

@@ -1,276 +0,0 @@
-"""
-Минимальная проверка новой версии через GitHub Releases API (без сторонних зависимостей).
-
-Ограничение частоты запросов: не чаще одного раза в час на машину (кэш в каталоге
-данных приложения). Поддерживается If-None-Match (ETag) для ответа 304.
-"""
-from __future__ import annotations
-
-import json
-import os
-import sys
-import time
-from itertools import zip_longest
-from pathlib import Path
-from typing import Any, Dict, Optional, Tuple
-from urllib.error import HTTPError, URLError
-from urllib.request import Request
-from proxy.utils import build_github_opener
-
-REPO = "ural/tg-ws-proxy-go"
-RELEASES_LATEST_API = f"https://uralgit.ru/api/v1/repos/{REPO}/releases/latest"
-RELEASES_PAGE_URL = f"https://uralgit.ru/{REPO}/releases/latest"
-
-# Не чаще одного полного запроса к API в час (без учёта 304 с тем же ETag).
-_MIN_FETCH_INTERVAL_SEC = 3600.0
-
-_state: Dict[str, Any] = {
-    "checked": False,
-    "has_update": False,
-    "ahead_of_release": False,
-    "latest": None,
-    "html_url": None,
-    "error": None,
-    "assets": [],
-}
-
-
-def _cache_file() -> Optional[Path]:
-    try:
-        if sys.platform == "win32":
-            root = Path(os.environ.get("APPDATA", str(Path.home()))) / "TgWsProxy"
-        elif sys.platform == "darwin":
-            root = Path.home() / "Library/Application Support/TgWsProxy"
-        else:
-            xdg = os.environ.get("XDG_CONFIG_HOME")
-            root = (Path(xdg).expanduser() if xdg else Path.home() / ".config") / "TgWsProxy"
-        root.mkdir(parents=True, exist_ok=True)
-        return root / ".update_check_cache.json"
-    except OSError:
-        return None
-
-
-def _load_cache(path: Optional[Path]) -> Dict[str, Any]:
-    if not path or not path.is_file():
-        return {}
-    try:
-        return json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
-        return {}
-
-
-def _save_cache(path: Optional[Path], data: Dict[str, Any]) -> None:
-    if not path:
-        return
-    try:
-        path.write_text(json.dumps(data), encoding="utf-8")
-    except OSError:
-        pass
-
-
-def _parse_version_tuple(s: str) -> tuple:
-    s = (s or "").strip().lstrip("vV")
-    if not s:
-        return (0,)
-    parts = []
-    for seg in s.split("."):
-        digits = next((seg[:i] for i, c in enumerate(seg) if not c.isdigit()), seg)
-        if digits:
-            try:
-                parts.append(int(digits))
-            except ValueError:
-                parts.append(0)
-        else:
-            parts.append(0)
-    return tuple(parts) if parts else (0,)
-
-
-def _version_gt(a: str, b: str) -> bool:
-    """True, если версия a новее b (простое сравнение по сегментам)."""
-    ta = _parse_version_tuple(a)
-    tb = _parse_version_tuple(b)
-    for x, y in zip_longest(ta, tb, fillvalue=0):
-        if x > y:
-            return True
-        if x < y:
-            return False
-    return False
-
-
-def _apply_release_tag(
-    tag: str, html_url: str, current_version: str,
-) -> None:
-    global _state
-    if not tag:
-        _state["has_update"] = False
-        _state["ahead_of_release"] = False
-        _state["latest"] = None
-        _state["html_url"] = html_url.strip() or RELEASES_PAGE_URL
-        return
-    latest_clean = tag.lstrip("vV")
-    cur = (current_version or "").strip().lstrip("vV")
-    _state["latest"] = latest_clean
-    _state["html_url"] = html_url.strip() or RELEASES_PAGE_URL
-    _state["has_update"] = _version_gt(latest_clean, cur)
-    _state["ahead_of_release"] = bool(latest_clean) and _version_gt(
-        cur, latest_clean
-    )
-
-
-def fetch_latest_release(
-    timeout: float = 12.0,
-    etag: Optional[str] = None,
-) -> Tuple[Optional[dict], Optional[str], int]:
-    """
-    GET releases/latest. Возвращает (data или None при 304, etag или None, HTTP-код).
-    """
-    headers = {
-        "Accept": "application/vnd.github+json",
-        "User-Agent": "tg-ws-proxy-update-check",
-    }
-    if etag:
-        headers["If-None-Match"] = etag
-    req = Request(
-        RELEASES_LATEST_API,
-        headers=headers,
-        method="GET",
-    )
-    try:
-        with build_github_opener().open(req, timeout=timeout) as resp:
-            code = getattr(resp, "status", None) or resp.getcode()
-            new_etag = resp.headers.get("ETag")
-            raw = resp.read().decode("utf-8", errors="replace")
-            return json.loads(raw), new_etag, int(code)
-    except HTTPError as e:
-        if e.code == 304:
-            hdrs = e.headers
-            new_etag = hdrs.get("ETag") if hdrs else None
-            return None, new_etag or etag, 304
-        raise
-
-
-def run_check(current_version: str) -> None:
-    """Запрашивает последний релиз и обновляет внутреннее состояние."""
-    global _state
-    _state["checked"] = True
-    _state["error"] = None
-
-    cache_path = _cache_file()
-    cache = _load_cache(cache_path)
-    now = time.time()
-    last_attempt = float(cache.get("last_attempt_at") or 0)
-
-    if last_attempt and (now - last_attempt) < _MIN_FETCH_INTERVAL_SEC:
-        tag = (cache.get("tag_name") or "").strip()
-        if tag:
-            _apply_release_tag(tag, cache.get("html_url") or "", current_version)
-            _state["assets"] = cache.get("assets") or []
-            return
-        err = cache.get("last_error")
-        _state["error"] = (
-            err if err else "Проверка обновлений отложена (интервал между запросами)."
-        )
-        _state["has_update"] = False
-        _state["ahead_of_release"] = False
-        _state["latest"] = None
-        _state["html_url"] = RELEASES_PAGE_URL
-        return
-
-    etag = (cache.get("etag") or "").strip() or None
-    try:
-        data, new_etag, code = fetch_latest_release(etag=etag)
-        cache["last_attempt_at"] = now
-        if code == 304:
-            tag = (cache.get("tag_name") or "").strip()
-            url = (cache.get("html_url") or "").strip() or RELEASES_PAGE_URL
-            _apply_release_tag(tag, url, current_version)
-            _state["assets"] = cache.get("assets") or []
-            if new_etag:
-                cache["etag"] = new_etag
-            _save_cache(cache_path, cache)
-            return
-
-        assert data is not None
-        tag = (data.get("tag_name") or "").strip()
-        html_url = (data.get("html_url") or "").strip() or RELEASES_PAGE_URL
-        if not tag:
-            _state["has_update"] = False
-            _state["ahead_of_release"] = False
-            _state["latest"] = None
-            _state["html_url"] = html_url
-        else:
-            _apply_release_tag(tag, html_url, current_version)
-        if new_etag:
-            cache["etag"] = new_etag
-        cache["tag_name"] = tag
-        cache["html_url"] = html_url
-        assets = [
-            {"name": a.get("name", ""), "url": a.get("browser_download_url", ""), "digest": a.get("digest", "")}
-            for a in (data.get("assets") or [])
-            if a.get("name") and a.get("browser_download_url")
-        ]
-        _state["assets"] = assets
-        cache["assets"] = assets
-        cache.pop("last_error", None)
-        _save_cache(cache_path, cache)
-    except (HTTPError, URLError, OSError, TimeoutError, ValueError, json.JSONDecodeError) as e:
-        cache["last_attempt_at"] = now
-        msg = str(e)
-        if isinstance(e, HTTPError) and e.code == 403:
-            msg = (
-                "GitHub API вернул 403 (лимит или доступ). Повторите позже."
-            )
-        cache["last_error"] = msg
-        _save_cache(cache_path, cache)
-        _state["error"] = msg
-        _state["has_update"] = False
-        _state["ahead_of_release"] = False
-        _state["latest"] = None
-        _state["html_url"] = RELEASES_PAGE_URL
-
-
-def get_status() -> Dict[str, Any]:
-    """Снимок состояния после run_check (для подписей в настройках)."""
-    return dict(_state)
-
-
-def get_update_asset(exe_path: Path) -> Optional[Tuple[str, str]]:
-    assets = _state.get("assets") or []
-    if not assets:
-        return None
-
-    # Try SHA256 match against release asset digests
-    try:
-        import hashlib
-        h = hashlib.sha256()
-        with open(exe_path, "rb") as f:
-            while True:
-                chunk = f.read(65536)
-                if not chunk:
-                    break
-                h.update(chunk)
-        exe_sha = h.hexdigest().lower()
-        for a in assets:
-            d = (a.get("digest") or "").lower()
-            if d.startswith("sha256:") and d[7:] == exe_sha:
-                return a["url"], a["name"]
-    except Exception:
-        pass
-
-    # Fallback
-    import struct
-    is_64 = struct.calcsize("P") * 8 == 64
-    try:
-        is_modern = sys.getwindowsversion().major >= 10
-    except Exception:
-        is_modern = True
-    if is_modern:
-        name = "TgWsProxy_windows.exe"
-    elif is_64:
-        name = "TgWsProxy_windows_7_64bit.exe"
-    else:
-        name = "TgWsProxy_windows_7_32bit.exe"
-    for a in assets:
-        if a.get("name") == name:
-            return a["url"], a["name"]
-    return None

utils/win32_theme.py

@@ -1,35 +0,0 @@
-from __future__ import annotations
-
-import sys
-
-def is_windows_dark_theme() -> bool:
-    if sys.platform != "win32":
-        return False
-
-    try:
-        import winreg
-        key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, r"Software\Microsoft\Windows\CurrentVersion\Themes\Personalize")
-        value, _ = winreg.QueryValueEx(key, "AppsUseLightTheme")
-        return value == 0
-    except Exception:
-        return False
-
-def apply_windows_dark_theme() -> None:
-    try:
-        import ctypes
-        uxtheme = ctypes.windll.uxtheme
-        
-        try:
-            set_preferred = uxtheme[135]
-            result = set_preferred(2)
-            if result == 0:
-                flush = uxtheme[136]
-                flush()
-        except Exception:
-            try:
-                allow_dark = uxtheme[135]
-                allow_dark(True)
-            except Exception:
-                pass
-    except Exception:
-        pass

windows.py

@@ -1,664 +0,0 @@
-from __future__ import annotations
-
-import ctypes
-import os
-import subprocess
-import sys
-import threading
-import time
-import webbrowser
-import winreg
-import tempfile
-
-from pathlib import Path
-from typing import Optional
-from proxy.utils import build_github_opener
-
-try:
-    import pyperclip
-except ImportError:
-    pyperclip = None
-
-try:
-    import pystray
-except ImportError:
-    pystray = None
-
-try:
-    import customtkinter as ctk
-except ImportError:
-    ctk = None
-
-try:
-    from PIL import Image
-except ImportError:
-    Image = None
-
-from proxy import get_link_host
-
-from utils.win32_theme import (
-    is_windows_dark_theme, 
-    apply_windows_dark_theme,
-)
-from utils.tray_common import (
-    APP_NAME, DEFAULT_CONFIG, FIRST_RUN_MARKER, IS_FROZEN, LOG_FILE,
-    acquire_lock, bootstrap, check_ipv6_warning, ctk_run_dialog,
-    ensure_ctk_thread, ensure_dirs, load_config, load_icon, log,
-    quit_ctk, release_lock, restart_proxy,
-    save_config, start_proxy, stop_proxy, tg_proxy_url,
-)
-from ui.ctk_tray_ui import (
-    install_tray_config_buttons, install_tray_config_form,
-    populate_first_run_window, tray_settings_scroll_and_footer,
-    validate_config_form,
-)
-from ui.ctk_theme import (
-    CONFIG_DIALOG_FRAME_PAD, CONFIG_DIALOG_SIZE, FIRST_RUN_SIZE,
-    create_ctk_toplevel, ctk_theme_for_platform, main_content_frame,
-)
-
-_tray_icon: Optional[object] = None
-_config: dict = {}
-_exiting = False
-_win_mutex_handle = None
-
-_ERROR_ALREADY_EXISTS = 183
-
-
-def _acquire_win_mutex() -> bool | None:
-    global _win_mutex_handle
-    try:
-        kernel32 = ctypes.windll.kernel32
-        kernel32.CreateMutexW.restype = ctypes.c_void_p
-        kernel32.CreateMutexW.argtypes = [ctypes.c_void_p, ctypes.c_bool, ctypes.c_wchar_p]
-        handle = kernel32.CreateMutexW(None, True, "Local\\TgWsProxy_SingleInstance")
-        if kernel32.GetLastError() == _ERROR_ALREADY_EXISTS:
-            kernel32.CloseHandle(ctypes.c_void_p(handle))
-            return False
-        if not handle:
-            return None
-        _win_mutex_handle = handle
-        return True
-    except Exception:
-        return None
-
-
-def _release_win_mutex() -> None:
-    global _win_mutex_handle
-    if _win_mutex_handle:
-        try:
-            kernel32 = ctypes.windll.kernel32
-            kernel32.ReleaseMutex(ctypes.c_void_p(_win_mutex_handle))
-            kernel32.CloseHandle(ctypes.c_void_p(_win_mutex_handle))
-        except Exception:
-            pass
-        _win_mutex_handle = None
-
-ICON_PATH = str(Path(__file__).parent / "icon.ico")
-
-# win32 dialogs
-
-_u32 = ctypes.windll.user32
-_u32.MessageBoxW.argtypes = [ctypes.c_void_p, ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.c_uint]
-_u32.MessageBoxW.restype = ctypes.c_int
-
-_MB_OK_ERR = 0x10
-_MB_OK_INFO = 0x40
-_MB_YESNO_Q = 0x24
-_MB_YESNOCANCEL_Q = 0x23
-_IDYES = 6
-_IDNO = 7
-
-
-def _show_error(text: str, title: str = "TG WS Proxy — Ошибка") -> None:
-    _u32.MessageBoxW(None, text, title, _MB_OK_ERR)
-
-
-def _show_info(text: str, title: str = "TG WS Proxy") -> None:
-    _u32.MessageBoxW(None, text, title, _MB_OK_INFO)
-
-
-def _ask_yes_no(text: str, title: str = "TG WS Proxy") -> bool:
-    return _u32.MessageBoxW(None, text, title, _MB_YESNO_Q) == _IDYES
-
-
-def update_ctk_form(
-    text: str, title: str = "TG WS Proxy", download_url: Optional[str] = None,
-    release_url: Optional[str] = None,
-) -> str:
-    if ctk is None or not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
-        result = _u32.MessageBoxW(None, text, title, _MB_YESNOCANCEL_Q)
-        if result == _IDYES:
-            return "update"
-        if result == _IDNO:
-            return "open"
-        return "close"
-
-    result = {"value": "close"}
-
-    def _build(done: threading.Event) -> None:
-        theme = ctk_theme_for_platform()
-        root = create_ctk_toplevel(
-            ctk,
-            title=title,
-            width=310 if IS_FROZEN else 210,
-            height=130 if IS_FROZEN else 100,
-            theme=theme,
-            after_create=lambda r: r.iconbitmap(ICON_PATH),
-        )
-        frame = main_content_frame(ctk, root, theme, padx=16, pady=14)
-
-        ctk.CTkLabel(
-            frame,
-            text=text,
-            justify="left",
-            anchor="w",
-            wraplength=270,
-            font=(theme.ui_font_family, 12),
-            text_color=theme.text_primary,
-        ).pack(fill="x", pady=(0, 10))
-
-        row = ctk.CTkFrame(frame, fg_color="transparent")
-        row.pack(fill="x")
-
-        status_label = ctk.CTkLabel(
-            frame, text="", justify="left", anchor="w", wraplength=270,
-            font=(theme.ui_font_family, 11), text_color=theme.text_secondary,
-        )
-        status_label.pack(fill="x", pady=(6, 0))
-
-        btns: list = []
-
-        def _set_status(msg: str) -> None:
-            root.after(0, lambda: status_label.configure(text=msg))
-
-        def _close_with(value: str) -> None:
-            result["value"] = value
-            root.destroy()
-            done.set()
-
-        def _on_update() -> None:
-            if not download_url:
-                if release_url:
-                    webbrowser.open(release_url)
-                _close_with("open")
-                return
-            for b in btns:
-                b.configure(state="disabled")
-            root.protocol("WM_DELETE_WINDOW", lambda: None)
-            def _run():
-                _perform_update(download_url, set_status=_set_status)
-                root.after(0, lambda: [b.configure(state="normal") for b in btns])
-                root.after(0, lambda: root.protocol("WM_DELETE_WINDOW", lambda: _close_with("close")))
-            threading.Thread(target=_run, daemon=True).start()
-
-        if IS_FROZEN:
-            btn_upd = ctk.CTkButton(
-                row, text="Обновить", width=88, height=34,
-                font=(theme.ui_font_family, 13), command=_on_update,
-            )
-            btn_upd.pack(side="left", padx=(0, 6))
-            btns.append(btn_upd)
-        btn_pg = ctk.CTkButton(
-            row, text="Страница", width=88, height=34,
-            font=(theme.ui_font_family, 13), command=lambda: _close_with("open"),
-        )
-        btn_pg.pack(side="left", padx=(0, 6))
-        btns.append(btn_pg)
-        btn_cl = ctk.CTkButton(
-            row, text="Закрыть", width=88, height=34,
-            font=(theme.ui_font_family, 13),
-            fg_color=theme.field_bg, hover_color=theme.field_border,
-            text_color=theme.text_primary, border_width=1, border_color=theme.field_border,
-            command=lambda: _close_with("close"),
-        )
-        btn_cl.pack(side="left")
-        btns.append(btn_cl)
-
-        root.protocol("WM_DELETE_WINDOW", lambda: _close_with("close"))
-
-    ctk_run_dialog(_build)
-    return result["value"]
-
-
-def _perform_update(download_url: str, set_status=None) -> None:
-    def _step(msg: str) -> None:
-        log.info("Update: %s", msg)
-        if set_status:
-            set_status(msg)
-            time.sleep(0.8)
-
-    def _err(msg: str) -> None:
-        log.error("Update error: %s", msg)
-        if set_status:
-            set_status(f"Ошибка: {msg}")
-        else:
-            _show_error(msg)
-
-    _step("Скачивание...")
-    cur_exe = Path(sys.executable)
-    old_exe = cur_exe.with_name(cur_exe.stem + "_oldtgws.exe")
-    tmp_path = None
-    try:
-        fd, tmp_name = tempfile.mkstemp(dir=cur_exe.parent, suffix=".tmp")
-        os.close(fd)
-        tmp_path = Path(tmp_name)
-        log.info("Downloading update from %s", download_url)
-        opener = build_github_opener()
-        with opener.open(download_url) as _resp:
-            with open(str(tmp_path), "wb") as _fout:
-                while True:
-                    _chunk = _resp.read(65536)
-                    if not _chunk:
-                        break
-                    _fout.write(_chunk)
-    except Exception as exc:
-        _err(f"Не удалось скачать:\n{exc}")
-        if tmp_path:
-            try:
-                tmp_path.unlink(missing_ok=True)
-            except OSError:
-                pass
-        return
-
-    _step("Замена файла...")
-    try:
-        if old_exe.exists():
-            old_exe.unlink()
-        cur_exe.rename(old_exe)
-    except Exception as exc:
-        _err(f"Не удалось переименовать файл:\n{exc}")
-        try:
-            tmp_path.unlink(missing_ok=True)
-        except OSError:
-            pass
-        return
-
-    try:
-        tmp_path.rename(cur_exe)
-    except Exception as exc:
-        _err(f"Не удалось переместить файл:\n{exc}")
-        try:
-            old_exe.rename(cur_exe)
-        except OSError:
-            pass
-        try:
-            tmp_path.unlink(missing_ok=True)
-        except OSError:
-            pass
-        return
-
-    _step("Перезапуск...")
-    _release_win_mutex()
-    stop_proxy()
-
-    # Don't reuse existing _MEI* dir
-    env = os.environ.copy()
-    for _k in [k for k in env if k.startswith("_PYI_") or k == "_MEIPASS"]:
-        del env[_k]
-    if hasattr(sys, "_MEIPASS"):
-        _mei = os.path.normcase(sys._MEIPASS.rstrip("\\/"))
-        env["PATH"] = os.pathsep.join(
-            p for p in env.get("PATH", "").split(os.pathsep)
-            if os.path.normcase(p.rstrip("\\/")) != _mei
-        )
-
-    try:
-        subprocess.Popen(
-            [str(cur_exe)],
-            env=env,
-            creationflags=subprocess.DETACHED_PROCESS | subprocess.CREATE_NEW_PROCESS_GROUP,
-        )
-    except Exception as exc:
-        log.error("Failed to launch updated exe: %s", exc)
-    time.sleep(0.5)
-    os._exit(0)
-
-
-def _maybe_do_update(cfg: dict, is_exiting) -> None:
-    if not cfg.get("check_updates", True):
-        return
-
-    def _work():
-        time.sleep(1.5)
-        if is_exiting():
-            return
-        try:
-            from proxy import __version__
-            from utils.update_check import RELEASES_PAGE_URL, get_status, get_update_asset, run_check
-
-            run_check(__version__)
-            st = get_status()
-            if not st.get("has_update") or is_exiting():
-                return
-            url = (st.get("html_url") or "").strip() or RELEASES_PAGE_URL
-            ver = st.get("latest") or "?"
-            asset = get_update_asset(Path(sys.executable)) if IS_FROZEN else None
-            choice = update_ctk_form(
-                f"Доступна новая версия: {ver}",
-                download_url=asset[0] if asset else None,
-                release_url=url,
-            )
-            if choice == "open":
-                webbrowser.open(url)
-        except Exception as exc:
-            log.warning("Update check failed: %s", repr(exc))
-
-    threading.Thread(target=_work, daemon=True, name="update-check").start()
-
-
-# autostart (registry)
-
-_RUN_KEY = r"Software\Microsoft\Windows\CurrentVersion\Run"
-
-
-def _supports_autostart() -> bool:
-    return IS_FROZEN
-
-
-def _autostart_command() -> str:
-    return f'"{sys.executable}"'
-
-
-def is_autostart_enabled() -> bool:
-    try:
-        with winreg.OpenKey(winreg.HKEY_CURRENT_USER, _RUN_KEY, 0, winreg.KEY_READ) as k:
-            val, _ = winreg.QueryValueEx(k, APP_NAME)
-        return str(val).strip() == _autostart_command().strip()
-    except (FileNotFoundError, OSError):
-        return False
-
-
-def set_autostart_enabled(enabled: bool) -> None:
-    try:
-        with winreg.CreateKey(winreg.HKEY_CURRENT_USER, _RUN_KEY) as k:
-            if enabled:
-                winreg.SetValueEx(k, APP_NAME, 0, winreg.REG_SZ, _autostart_command())
-            else:
-                try:
-                    winreg.DeleteValue(k, APP_NAME)
-                except FileNotFoundError:
-                    pass
-    except OSError as exc:
-        log.error("Failed to update autostart: %s", exc)
-        _show_error(
-            "Не удалось изменить автозапуск.\n\n"
-            "Попробуйте запустить приложение от имени пользователя "
-            f"с правами на реестр.\n\nОшибка: {exc}"
-        )
-
-
-# tray callbacks
-
-def _on_open_in_telegram(icon=None, item=None) -> None:
-    url = tg_proxy_url(_config)
-    log.info("Opening %s", url)
-    try:
-        if not webbrowser.open(url):
-            raise RuntimeError
-    except Exception:
-        log.info("Browser open failed, copying to clipboard")
-        if pyperclip is None:
-            _show_error(
-                "Не удалось открыть Telegram автоматически.\n\n"
-                f"Установите пакет pyperclip для копирования в буфер или откройте вручную:\n{url}"
-            )
-            return
-        try:
-            pyperclip.copy(url)
-            _show_info(
-                "Не удалось открыть Telegram автоматически.\n\n"
-                f"Ссылка скопирована в буфер обмена, отправьте её в Telegram и нажмите по ней ЛКМ:\n{url}"
-            )
-        except Exception as exc:
-            log.error("Clipboard copy failed: %s", exc)
-            _show_error(f"Не удалось скопировать ссылку:\n{exc}")
-
-
-def _on_copy_link(icon=None, item=None) -> None:
-    url = tg_proxy_url(_config)
-    log.info("Copying link: %s", url)
-    if pyperclip is None:
-        _show_error(
-            "Установите пакет pyperclip для копирования в буфер обмена."
-        )
-        return
-    try:
-        pyperclip.copy(url)
-    except Exception as exc:
-        log.error("Clipboard copy failed: %s", exc)
-        _show_error(f"Не удалось скопировать ссылку:\n{exc}")
-
-
-def _on_restart(icon=None, item=None) -> None:
-    threading.Thread(
-        target=lambda: restart_proxy(_config, _show_error), daemon=True
-    ).start()
-
-
-def _on_edit_config(icon=None, item=None) -> None:
-    threading.Thread(target=_edit_config_dialog, daemon=True).start()
-
-
-def _on_open_logs(icon=None, item=None) -> None:
-    log.info("Opening log file: %s", LOG_FILE)
-    if LOG_FILE.exists():
-        try:
-            os.startfile(str(LOG_FILE))
-        except Exception as exc:
-            log.error("Failed to open log file: %s", exc)
-            _show_error(f"Не удалось открыть файл логов:\n{exc}")
-    else:
-        _show_info("Файл логов ещё не создан.")
-
-
-def _on_exit(icon=None, item=None) -> None:
-    global _exiting
-    if _exiting:
-        os._exit(0)
-        return
-    _exiting = True
-    log.info("User requested exit")
-    quit_ctk()
-    threading.Thread(target=lambda: (time.sleep(3), os._exit(0)), daemon=True, name="force-exit").start()
-    if icon:
-        icon.stop()
-
-
-# settings dialog
-
-def _edit_config_dialog() -> None:
-    if not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
-        _show_error("customtkinter не установлен.")
-        return
-
-    cfg = dict(_config)
-    cfg["autostart"] = is_autostart_enabled()
-    if _supports_autostart() and not cfg["autostart"]:
-        set_autostart_enabled(False)
-
-    def _build(done: threading.Event) -> None:
-        theme = ctk_theme_for_platform()
-        w, h = CONFIG_DIALOG_SIZE
-        if _supports_autostart():
-            h += 100
-
-        root = create_ctk_toplevel(
-            ctk, title="TG WS Proxy — Настройки", width=w, height=h, theme=theme,
-            after_create=lambda r: r.iconbitmap(ICON_PATH),
-        )
-        fpx, fpy = CONFIG_DIALOG_FRAME_PAD
-        frame = main_content_frame(ctk, root, theme, padx=fpx, pady=fpy)
-        scroll, footer = tray_settings_scroll_and_footer(ctk, frame, theme)
-        widgets = install_tray_config_form(
-            ctk, scroll, theme, cfg, DEFAULT_CONFIG,
-            show_autostart=_supports_autostart(),
-            autostart_value=cfg.get("autostart", False),
-        )
-
-        _original_appearance = ctk.get_appearance_mode()
-
-        def _finish() -> None:
-            root.destroy()
-            done.set()
-
-        def _cancel() -> None:
-            ctk.set_appearance_mode(_original_appearance)
-            _finish()
-
-        def on_save() -> None:
-            from tkinter import messagebox
-            merged = validate_config_form(widgets, DEFAULT_CONFIG, include_autostart=_supports_autostart())
-            if isinstance(merged, str):
-                messagebox.showerror("TG WS Proxy — Ошибка", merged, parent=root)
-                return
-
-            _ui_only_keys = {"appearance", "autostart", "check_updates"}
-            config_changed = any(merged.get(k) != cfg.get(k) for k in merged)
-            proxy_changed = any(merged.get(k) != cfg.get(k) for k in merged if k not in _ui_only_keys)
-
-            if not config_changed:
-                _finish()
-                return
-
-            save_config(merged)
-            _config.update(merged)
-            log.info("Config saved: %s", merged)
-            if _supports_autostart():
-                set_autostart_enabled(bool(merged.get("autostart", False)))
-            _tray_icon.menu = _build_menu()
-
-            if not proxy_changed:
-                _finish()
-                return
-
-            do_restart = messagebox.askyesno(
-                "Перезапустить?",
-                "Настройки сохранены.\n\nПерезапустить прокси сейчас?",
-                parent=root,
-            )
-            _finish()
-            if do_restart:
-                threading.Thread(target=lambda: restart_proxy(_config, _show_error), daemon=True).start()
-
-        root.protocol("WM_DELETE_WINDOW", _cancel)
-        install_tray_config_buttons(ctk, footer, theme, on_save=on_save, on_cancel=_cancel)
-
-    ctk_run_dialog(_build)
-
-
-# first run
-
-def _show_first_run() -> None:
-    ensure_dirs()
-    if FIRST_RUN_MARKER.exists():
-        return
-    if not ensure_ctk_thread(ctk, _config.get("appearance", "auto")):
-        FIRST_RUN_MARKER.touch()
-        return
-
-    host = _config.get("host", DEFAULT_CONFIG["host"])
-    port = _config.get("port", DEFAULT_CONFIG["port"])
-    secret = _config.get("secret", DEFAULT_CONFIG["secret"])
-
-    def _build(done: threading.Event) -> None:
-        theme = ctk_theme_for_platform()
-        w, h = FIRST_RUN_SIZE
-        root = create_ctk_toplevel(
-            ctk, title="TG WS Proxy", width=w, height=h, theme=theme,
-            after_create=lambda r: r.iconbitmap(ICON_PATH),
-        )
-
-        def on_done(open_tg: bool) -> None:
-            FIRST_RUN_MARKER.touch()
-            root.destroy()
-            done.set()
-            if open_tg:
-                _on_open_in_telegram()
-
-        populate_first_run_window(ctk, root, theme, host=host, port=port, secret=secret, on_done=on_done)
-
-    ctk_run_dialog(_build)
-
-
-# tray menu
-
-def _build_menu():
-    if pystray is None:
-        return None
-    host = _config.get("host", DEFAULT_CONFIG["host"])
-    port = _config.get("port", DEFAULT_CONFIG["port"])
-    link_host = get_link_host(host)
-    return pystray.Menu(
-        pystray.MenuItem(f"Открыть в Telegram ({link_host}:{port})", _on_open_in_telegram, default=True),
-        pystray.MenuItem("Скопировать ссылку", _on_copy_link),
-        pystray.Menu.SEPARATOR,
-        pystray.MenuItem("Перезапустить прокси", _on_restart),
-        pystray.MenuItem("Настройки...", _on_edit_config),
-        pystray.MenuItem("Открыть логи", _on_open_logs),
-        pystray.Menu.SEPARATOR,
-        pystray.MenuItem("Выход", _on_exit),
-    )
-
-
-# entry point
-
-def run_tray() -> None:
-    global _tray_icon, _config
-
-    _config = load_config()
-
-    if is_windows_dark_theme():
-        apply_windows_dark_theme()
-
-    bootstrap(_config)
-
-    if pystray is None or Image is None or ctk is None:
-        log.error("pystray, Pillow or customtkinter not installed; running in console mode")
-        start_proxy(_config, _show_error)
-        try:
-            while True:
-                time.sleep(1)
-        except KeyboardInterrupt:
-            stop_proxy()
-        return
-
-    start_proxy(_config, _show_error)
-    _maybe_do_update(_config, lambda: _exiting)
-    _show_first_run()
-    check_ipv6_warning(_show_info)
-
-    _tray_icon = pystray.Icon(APP_NAME, load_icon(), "TG WS Proxy", menu=_build_menu())
-    log.info("Tray icon running")
-    _tray_icon.run()
-
-    stop_proxy()
-    log.info("Tray app exited")
-
-
-def main() -> None:
-    if (mutex_result := _acquire_win_mutex()) is False or mutex_result is None and not acquire_lock():
-        _show_info("Приложение уже запущено.", os.path.basename(sys.argv[0]))
-        return
-
-    if IS_FROZEN:
-        def _cleanup_old_exes():
-            exe_dir = Path(sys.executable).parent
-            time.sleep(3)
-            for _f in exe_dir.glob("*_oldtgws.exe"):
-                try:
-                    _f.unlink()
-                    log.info("Deleted leftover: %s", _f)
-                except OSError:
-                    pass
-        threading.Thread(target=_cleanup_old_exes, daemon=True, name="cleanup-old").start()
-
-    try:
-        run_tray()
-    finally:
-        release_lock()
-        _release_win_mutex()
-
-
-if __name__ == "__main__":
-    main()