Save-as-final-hop button, browser proxy policy + QUIC kill, HTTPS tunnel probe

Fixes 'exit proxy never used in chain' and 'browsers break when chain is green'. Chain Builder gets a Save-as-final-hop button that appends the typed exit proxy to the manual chain. On engage, Chromium browsers get pinned to our proxy via HKLM policy (ProxyMode=fixed_servers, ProxyServer, ProxyBypassList) and QuicAllowed=0 so HTTP/3 doesn't bypass HTTP proxies and stall under the kill-switch. Chain start now runs check_https_tunnel and warns clearly when proxies forward HTTP but refuse CONNECT — the real cause of green-chain-yet-blank-browser.

Co-authored-by: Cursor <cursoragent@cursor.com>

proxy_chain_manager/service.py

@@ -47,7 +47,12 @@ from .sysproxy import (
     is_system_proxy_set,
     set_system_proxy,
 )
-from .validator import check_chain_exit_ip, get_direct_ip, validate_proxies
+from .validator import (
+    check_chain_exit_ip,
+    check_https_tunnel,
+    get_direct_ip,
+    validate_proxies,
+)
 from .vpn_detect import VpnStatus, detect_vpn
 from .win_compat import probe as _win_probe
 
@@ -516,6 +521,21 @@ class ChainService:
 
         self._notify({"type": "hops", "hops": chain, "status": "healthy", "exit_ip": exit_ip})
         self._notify({"type": "log", "text": f"✓ Chain healthy — Exit IP: {exit_ip}"})
+
+        # HTTPS-tunnel probe: a chain can pass HTTP IP check but refuse CONNECT.
+        # Without this warning, "all proxies green" yet "every browser broken"
+        # is a black-box failure for the user.
+        https_ok, https_msg = await check_https_tunnel(local_proxy, timeout)
+        if https_ok:
+            self._notify({"type": "log", "text": f"✓ HTTPS tunnel OK — {https_msg}"})
+        else:
+            self._notify({"type": "log", "text": (
+                "⚠ HTTPS tunnel FAILED — chain forwards plain HTTP but refuses "
+                "CONNECT. Browsers will time out on every HTTPS page (i.e. "
+                "every site). Replace the proxies that don't support CONNECT, "
+                "or use a SOCKS5 / paid HTTPS-capable exit. " + https_msg
+            )})
+
         self._notify({"type": "phase", "phase": "running"})
         # Pre-flight: surface Group Policy locks (they will override us).
         pol_before = detect_policy_overrides()