fix: audit pass — WebRTC audit, HTTPS gate, leak compare, kill-switch guard, doc backlog

proxy_chain_manager/service.py

@@ -390,6 +390,14 @@ class ChainService:
             )
 
             # Pinned (manual) chain mode — skip pool management
+            if self._settings.use_pinned_chain and not self._settings.pinned_chain:
+                self._notify({
+                    "type": "log",
+                    "text": (
+                        "Pinned chain enabled but list is empty — add hops in Chain Builder "
+                        "or disable 'Use pinned chain'."
+                    ),
+                })
             if self._settings.use_pinned_chain and self._settings.pinned_chain:
                 chain = list(self._settings.pinned_chain)
                 rotation_num += 1
@@ -564,22 +572,27 @@ class ChainService:
             self._proc = None
             return False
 
+        # HTTPS CONNECT must work before the chain is marked healthy.
+        https_ok, https_msg = await check_https_tunnel(local_proxy, timeout)
+        if not https_ok:
+            self._notify({"type": "hops", "hops": chain, "status": "dead", "exit_ip": exit_ip})
+            self._notify({"type": "log", "text": (
+                "HTTPS tunnel FAILED — chain forwards plain HTTP but refuses CONNECT. "
+                "Browsers will time out on HTTPS sites. Rotating. " + https_msg
+            )})
+            fixed = self._manual_exit_url()
+            for h in chain:
+                if fixed and h == fixed:
+                    continue
+                self._blacklist.add(h)
+                self._available = [x for x in self._available if x != h]
+            terminate_process(self._proc)
+            self._proc = None
+            return False
+
         self._notify({"type": "hops", "hops": chain, "status": "healthy", "exit_ip": exit_ip})
         self._notify({"type": "log", "text": f"✓ Chain healthy — Exit IP: {exit_ip}"})
-
-        # HTTPS-tunnel probe: a chain can pass HTTP IP check but refuse CONNECT.
-        # Without this warning, "all proxies green" yet "every browser broken"
-        # is a black-box failure for the user.
-        https_ok, https_msg = await check_https_tunnel(local_proxy, timeout)
-        if https_ok:
-            self._notify({"type": "log", "text": f"✓ HTTPS tunnel OK — {https_msg}"})
-        else:
-            self._notify({"type": "log", "text": (
-                "⚠ HTTPS tunnel FAILED — chain forwards plain HTTP but refuses "
-                "CONNECT. Browsers will time out on every HTTPS page (i.e. "
-                "every site). Replace the proxies that don't support CONNECT, "
-                "or use a SOCKS5 / paid HTTPS-capable exit. " + https_msg
-            )})
+        self._notify({"type": "log", "text": f"✓ HTTPS tunnel OK — {https_msg}"})
 
         self._notify({"type": "phase", "phase": "running"})
         # Pre-flight: surface Group Policy locks (they will override us).