fix: audit round 2 - DPAPI secrets, pinned hop probe, gost exe hash, admin guard, PID-scoped browser tracking, emergency disengage button, build sidecar

proxy_chain_manager/service.py

@@ -70,6 +70,22 @@ _FETCH_POOL = ThreadPoolExecutor(max_workers=8, thread_name_prefix="fetcher")
 from .leak_detect import is_same_subnet as _is_same_network  # noqa: F401
 
 
+async def _probe_tcp(host: str, port: int, timeout: float = 6.0) -> bool:
+    """Open and close a TCP socket; True if the handshake completes within *timeout*."""
+    try:
+        reader, writer = await asyncio.wait_for(
+            asyncio.open_connection(host, port), timeout=timeout,
+        )
+        writer.close()
+        try:
+            await writer.wait_closed()
+        except Exception:  # noqa: BLE001
+            pass
+        return True
+    except Exception:  # noqa: BLE001
+        return False
+
+
 class ChainService:
     """Background rotating proxy chain using GOST."""
 
@@ -400,6 +416,26 @@ class ChainService:
                 })
             if self._settings.use_pinned_chain and self._settings.pinned_chain:
                 chain = list(self._settings.pinned_chain)
+
+                # Optional per-hop TCP probe so a known-dead pinned chain
+                # doesn't loop forever on the 10 s retry below.
+                if self._settings.validate_pinned_on_start:
+                    from urllib.parse import urlparse as _urlparse
+                    dead = []
+                    for hop in chain:
+                        try:
+                            p = _urlparse(hop if "://" in hop else "http://" + hop)
+                            if p.hostname and p.port:
+                                if not await _probe_tcp(p.hostname, int(p.port), 6.0):
+                                    dead.append(hop)
+                        except Exception:  # noqa: BLE001
+                            dead.append(hop)
+                    if dead:
+                        self._notify({"type": "log", "text": (
+                            f"Pinned chain: {len(dead)}/{len(chain)} hop(s) failed TCP "
+                            f"probe — proceeding anyway (will retry on failure)."
+                        )})
+
                 rotation_num += 1
                 self._notify({"type": "rotation", "n": rotation_num})
                 log.info("Pinned chain run: %d hops", len(chain))