fix: production-ready build pipeline + audit_device() crash

- fingerprint.py: audit_device() crashed with "cannot unpack non-iterable
  bool" because of a stray `webrtc_ok, _ = ... and True or False` line.
  Replaced with a proper Chrome+Edge registry probe using _WEBRTC_*
  module constants.

- ProxyChainManager.spec: removed the hardcoded absolute run.py path,
  resolve everything relative to SPECPATH so the spec is portable on any
  machine / CI runner. Bundled signup_extension/ and world_map.png as
  data files (these were missing — the runtime would fall back to drawn
  landmasses and the signup browser extension would 404 in the frozen
  build). Added PIL._tkinter_finder hidden import for safety.

- scripts/setup_and_build.ps1: build now uses the spec file instead of
  re-deriving CLI flags. The old `--onefile --windowed --collect-all
  customtkinter` invocation IGNORED the spec and silently dropped the
  bundled data files. Also added explicit $LASTEXITCODE check.

Verified end-to-end: clean PyInstaller build produces a 32MB exe with
signup_extension (8 TOC entries), world_map.png (4), customtkinter
(365) all present.

Co-authored-by: Cursor <cursoragent@cursor.com>

ProxyChainManager.spec

@@ -1,21 +1,43 @@
 # -*- mode: python ; coding: utf-8 -*-
+"""PyInstaller spec for ProxyChainManager.
+
+Build:
+    python -m PyInstaller --noconfirm --clean ProxyChainManager.spec
+
+Always builds relative to the spec file's directory so the script works on
+any machine / CI runner.
+"""
+import os
+from pathlib import Path
 from PyInstaller.utils.hooks import collect_all
 
-datas = [
-    # Signup autofill WebExtension (manifest + content.js)
-    ('proxy_chain_manager/signup_extension', 'proxy_chain_manager/signup_extension'),
-    # Neon world-map background image for the chain map widget
-    ('proxy_chain_manager/world_map.png', 'proxy_chain_manager'),
-]
+# SPECPATH is provided by PyInstaller; fall back to CWD for IDE linters.
+_ROOT = Path(globals().get("SPECPATH", os.getcwd())).resolve()
+
+datas = []
 binaries = []
-hiddenimports = ['pystray._win32']
+hiddenimports = [
+    'pystray._win32',
+    'PIL._tkinter_finder',
+]
+
 tmp_ret = collect_all('customtkinter')
 datas += tmp_ret[0]; binaries += tmp_ret[1]; hiddenimports += tmp_ret[2]
 
+# Bundle runtime data files. Each tuple is (src_relative_to_spec, dest_in_bundle).
+_BUNDLE_DATA = [
+    ('proxy_chain_manager/signup_extension', 'proxy_chain_manager/signup_extension'),
+    ('proxy_chain_manager/world_map.png',    'proxy_chain_manager'),
+]
+for src, dest in _BUNDLE_DATA:
+    p = _ROOT / src
+    if p.exists():
+        datas.append((str(p), dest))
+
 
 a = Analysis(
-    ['C:\\Users\\india\\Desktop\\proxy god\\proxy-god\\run.py'],
-    pathex=[],
+    [str(_ROOT / 'run.py')],
+    pathex=[str(_ROOT)],
     binaries=binaries,
     datas=datas,
     hiddenimports=hiddenimports,

proxy_chain_manager/fingerprint.py

@@ -339,21 +339,24 @@ def audit_device() -> FingerprintAudit:
         "── Recommendations ────────────────────────────────",
     ]
 
-    # Quick consistency checks
-    webrtc_ok, _ = apply_webrtc_hardening.__doc__ and True or False
-    try:
-        import winreg as _wr
-        with _wr.OpenKey(_wr.HKEY_LOCAL_MACHINE, r"SOFTWARE\Policies\Google\Chrome",
-                         0, _wr.KEY_QUERY_VALUE) as k:
-            v = int(_wr.QueryValueEx(k, "DefaultWebRtcIpHandlingPolicy")[0])
-            webrtc_ok = v == 2
-    except Exception:
-        webrtc_ok = False
+    # Quick consistency checks — WebRTC IP-handling policy (Chrome / Edge)
+    webrtc_ok = False
+    for hive_root in (_WEBRTC_CHROME, _WEBRTC_EDGE):
+        try:
+            with winreg.OpenKey(
+                winreg.HKEY_LOCAL_MACHINE, hive_root, 0, winreg.KEY_QUERY_VALUE
+            ) as k:
+                v = int(winreg.QueryValueEx(k, _WEBRTC_VALUE)[0])
+                if v == _WEBRTC_DISABLE:
+                    webrtc_ok = True
+                    break
+        except OSError:
+            continue
 
-    if not webrtc_ok:
-        lines.append("  ⚠ Chrome/Edge WebRTC policy not set — enable in Privacy tab")
+    if webrtc_ok:
+        lines.append("  ✓ Chrome/Edge WebRTC IP-handling policy is set (disable_non_proxied_udp)")
     else:
-        lines.append("  ✓ Chrome/Edge WebRTC policy is set")
+        lines.append("  ⚠ Chrome/Edge WebRTC policy not set — enable in Privacy tab")
 
     # Check IPv6
     try:

scripts/setup_and_build.ps1

@@ -38,14 +38,14 @@ Write-Host "`n== dependencies + PyInstaller =="
 & $py -m pip install -r "$root\requirements.txt"
 & $py -m pip install pyinstaller
 
-Write-Host "`n== PyInstaller =="
-& $py -m PyInstaller --noconfirm --clean `
-    --onefile --windowed `
-    --uac-admin `
-    --name ProxyChainManager `
-    --collect-all customtkinter `
-    --hidden-import pystray._win32 `
-    "$root\run.py"
+Write-Host "`n== PyInstaller (using ProxyChainManager.spec) =="
+# Always build from the spec — it bundles signup_extension/, world_map.png,
+# customtkinter assets, and the right hidden imports. Do NOT override with
+# CLI flags or the data files will be missing from the .exe.
+$spec = Join-Path $root "ProxyChainManager.spec"
+if (-not (Test-Path $spec)) { throw "Spec not found: $spec" }
+& $py -m PyInstaller --noconfirm --clean $spec
+if ($LASTEXITCODE -ne 0) { throw "PyInstaller failed (exit $LASTEXITCODE)" }
 
 $distExe = Join-Path $root "dist\ProxyChainManager.exe"
 if (-not (Test-Path $distExe)) {