fix: audit round 3 - fail-closed leak, shared asyncio loop, GOST bundling, close-X UX, persona key lookup, +29 tests

scripts/prepare_bundled_gost.ps1

@@ -0,0 +1,58 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Pre-build step: download gost.exe v3.2.6, verify SHA256, and stage it in
+  proxy_chain_manager/_bundled/gost.exe so PyInstaller can bundle it.
+
+.DESCRIPTION
+  Runs before scripts\setup_and_build.ps1. After this step, the spec file
+  includes _bundled/gost.exe as a data file inside the exe and ensure_gost()
+  copies it out to %LOCALAPPDATA% on first run.
+#>
+$ErrorActionPreference = "Stop"
+$root = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
+$bundleDir = Join-Path $root "proxy_chain_manager\_bundled"
+$bundleExe = Join-Path $bundleDir "gost.exe"
+$expectedZipHash = "32f4edf3d94b622e67f1979f6f5de82dac62abc0977772cf96215dd199ef7e7b"
+$zipUrl = "https://github.com/go-gost/gost/releases/download/v3.2.6/gost_3.2.6_windows_amd64.zip"
+
+if (-not (Test-Path $bundleDir)) {
+    New-Item -ItemType Directory -Path $bundleDir | Out-Null
+}
+
+# Skip if already staged and valid
+if (Test-Path $bundleExe) {
+    Write-Host "Bundled gost.exe already present at $bundleExe"
+    exit 0
+}
+
+$tempZip = Join-Path $env:TEMP "gost_bundle.zip"
+Write-Host "Downloading $zipUrl ..."
+Invoke-WebRequest -Uri $zipUrl -OutFile $tempZip -UseBasicParsing
+
+$actualZipHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $tempZip).Hash.ToLower()
+if ($actualZipHash -ne $expectedZipHash) {
+    Remove-Item -LiteralPath $tempZip -Force -ErrorAction SilentlyContinue
+    throw "GOST zip SHA256 mismatch! expected=$expectedZipHash actual=$actualZipHash"
+}
+Write-Host "Zip SHA256 OK: $actualZipHash"
+
+$tempExtract = Join-Path $env:TEMP "gost_bundle_extract"
+if (Test-Path $tempExtract) { Remove-Item -Recurse -Force $tempExtract }
+Expand-Archive -LiteralPath $tempZip -DestinationPath $tempExtract -Force
+
+$extractedExe = Get-ChildItem -Path $tempExtract -Filter "gost.exe" -Recurse | Select-Object -First 1
+if (-not $extractedExe) {
+    throw "gost.exe not found inside extracted zip"
+}
+
+Copy-Item -LiteralPath $extractedExe.FullName -Destination $bundleExe -Force
+
+# Pin the exe hash so runtime can verify the copy that gets dropped to %LOCALAPPDATA%
+$exeHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $bundleExe).Hash.ToLower()
+"$exeHash" | Out-File -FilePath "$bundleExe.sha256" -Encoding ascii -Force
+
+Remove-Item -LiteralPath $tempZip -Force -ErrorAction SilentlyContinue
+Remove-Item -Recurse -Force $tempExtract -ErrorAction SilentlyContinue
+
+Write-Host "Bundled gost.exe: $bundleExe ($exeHash)"

scripts/setup_and_build.ps1

@@ -39,6 +39,10 @@ Write-Host "`n== dependencies + PyInstaller =="
 # Pinned dev dep (PyInstaller version) so builds are reproducible.
 & $py -m pip install -r "$root\dev-requirements.txt"
 
+Write-Host "`n== Stage bundled GOST binary =="
+& powershell -NoProfile -ExecutionPolicy Bypass -File "$root\scripts\prepare_bundled_gost.ps1"
+if ($LASTEXITCODE -ne 0) { throw "prepare_bundled_gost.ps1 failed (exit $LASTEXITCODE)" }
+
 Write-Host "`n== PyInstaller (using ProxyChainManager.spec) =="
 # Always build from the spec — it bundles signup_extension/, world_map.png,
 # customtkinter assets, and the right hidden imports. Do NOT override with