Merge pull request #42 from samosvalishe/release-please--branches--master

chore(master): release 1.7.0
2026-10-12 09:41:53 +02:00 · 2026-07-02 21:22:33 +03:00 · 2026-07-02 12:30:15 +03:00 · 2026-07-02 12:28:31 +03:00 · 2026-07-01 19:30:28 +03:00 · 2026-07-01 19:29:28 +03:00
34 changed files with 1084 additions and 265 deletions
@@ -1,3 +1,3 @@
 {
-  ".": "1.5.2"
+  ".": "1.7.0"
 }
@@ -1,5 +1,25 @@
 # Changelog

+## [1.7.0](https://github.com/samosvalishe/free-turn-proxy/compare/v1.6.0...v1.7.0) (2026-07-02)
+
+
+### Features
+
+* **mobile:** add host socket protector (SetProtect) for tun/VPN hosts ([0a6bc0a](https://github.com/samosvalishe/free-turn-proxy/commit/0a6bc0ae4f38f03722855f99461cc91f4181e057))
+
+
+### Bug Fixes
+
+* **vkauth:** fast-fail on terminal call/link errors (9000/9008, anonymous-only, full) ([805228e](https://github.com/samosvalishe/free-turn-proxy/commit/805228e62a42f71ab6c0d345e2a510af5cae32c3))
+* **vkauth:** классификация terminal-ошибок по коду перед текстом ([b391d7b](https://github.com/samosvalishe/free-turn-proxy/commit/b391d7bf255e6f027d655c7e1a20a21ce04ab22a))
+
+## [1.6.0](https://github.com/samosvalishe/free-turn-proxy/compare/v1.5.2...v1.6.0) (2026-06-30)
+
+
+### Features
+
+* **vk:** улучшение браузерных отпечатков для captcha ([12161ae](https://github.com/samosvalishe/free-turn-proxy/commit/12161aed4ab582504785ff79f2f9f4f051ee0d9d))
+
 ## [1.5.2](https://github.com/samosvalishe/free-turn-proxy/compare/v1.5.1...v1.5.2) (2026-06-25)


@@ -40,7 +40,11 @@ tasks:
    cmds:
      - rm -rf dist/mobile.aar dist/mobile-sources.jar
      - mkdir -p dist
-      - gomobile bind -target android -androidapi 21 -ldflags "-checklinkname=0" -o dist/mobile.aar ./mobile
+      - cmd: gomobile bind -target android -androidapi 21 -ldflags "-checklinkname=0" -o dist/mobile.aar ./mobile
+        platforms: [linux, darwin]
+      - cmd: |
+          powershell -NoProfile -Command '$env:JAVA_HOME = "C:\Program Files\Android\Android Studio\jbr"; $env:PATH = "$env:JAVA_HOME\bin;$env:PATH"; gomobile bind -target android -androidapi 21 -ldflags "-checklinkname=0" -o dist/mobile.aar ./mobile'
+        platforms: [windows]

  test:
    desc: Run unit tests with race detector
@@ -21,7 +21,7 @@
 | `-gen-obf-key` | `false` | напечатать новый ключ и выйти |
 | `-manual-captcha` | `false` | сразу ручной режим captcha (только `-provider vk`) |
 | `-streams-per-cred` | `10` | потоков на один кеш VK-учёток (только `-provider vk`) |
-| `-browser` | `firefox` | браузерный профиль VK-auth (UA + TLS JA3 + client hints): `chrome` \| `firefox` (только `-provider vk`) |
+| `-browser` | `firefox` | браузерный профиль VK-auth (UA + TLS JA3 + client hints): `chrome` \| `firefox` \| `safari` (только `-provider vk`) |
 | `-dns-mode` | `auto` | `plain` (UDP/53) \| `doh` \| `auto` |
 | `-dns-servers` | пусто | свои UDP/53 резолверы, `ip[:port][,ip[:port]...]` |
 | `-client-id` | авто | уникальный ID клиента (автогенерация если не задан) |
@@ -4,7 +4,7 @@ go 1.26.4

 require (
 	github.com/bogdanfinn/fhttp v0.6.8
-	github.com/bogdanfinn/tls-client v1.14.0
+	github.com/bogdanfinn/tls-client v1.15.1
 	github.com/cbeuw/connutil v1.0.1
 	github.com/google/uuid v1.6.0
 	github.com/miekg/dns v1.1.72
@@ -10,8 +10,8 @@ github.com/bogdanfinn/fhttp v0.6.8 h1:LiQyHOY3i0QoxxNB7nq27/nGNNbtPj0fuBPozhR7Ws
 github.com/bogdanfinn/fhttp v0.6.8/go.mod h1:A+EKDzMx2hb4IUbMx4TlkoHnaJEiLl8r/1Ss1Y+5e5M=
 github.com/bogdanfinn/quic-go-utls v1.0.9-utls h1:tV6eDEiRbRCcepALSzxR94JUVD3N3ACIiRLgyc2Ep8s=
 github.com/bogdanfinn/quic-go-utls v1.0.9-utls/go.mod h1:aHph9B9H9yPOt5xnhWKSOum27DJAqpiHzwX+gjvaXcg=
-github.com/bogdanfinn/tls-client v1.14.0 h1:vyk7Cn4BIvLAGVuMfb0tP22OqogfO1lYamquQNEZU1A=
-github.com/bogdanfinn/tls-client v1.14.0/go.mod h1:LsU6mXVn8MOFDwTkyRfI7V1BZM1p0wf2ZfZsICW/1fM=
+github.com/bogdanfinn/tls-client v1.15.1 h1:KiFAlED55DJ8Fcocn+/1nX6PrDFcttIHAf/GDkV6KN8=
+github.com/bogdanfinn/tls-client v1.15.1/go.mod h1:LsU6mXVn8MOFDwTkyRfI7V1BZM1p0wf2ZfZsICW/1fM=
 github.com/bogdanfinn/utls v1.7.7-barnius h1:OuJ497cc7F3yKNVHRsYPQdGggmk5x6+V5ZlrCR7fOLU=
 github.com/bogdanfinn/utls v1.7.7-barnius/go.mod h1:aAK1VZQlpKZClF1WEQeq6kyclbkPq4hz6xTbB5xSlmg=
 github.com/bogdanfinn/websocket v1.5.5-barnius h1:bY+qnxpai1qe7Jmjx+Sds/cmOSpuuLoR8x61rWltjOI=
@@ -93,8 +93,6 @@ go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
 golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20260522023950-e5306b2f3e96 h1:O1tFPDuiV6lk+c24ew9UqcKgmhgDF6aPXwSvYGxVR2A=
@@ -105,8 +103,6 @@ golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvx
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mobile v0.0.0-20260611195102-4dd8f1dbf5d2 h1:zoM1gIKhVkcQNm43kad8OHLgPNoJ12xIqmxHtKr8Mug=
 golang.org/x/mobile v0.0.0-20260611195102-4dd8f1dbf5d2/go.mod h1:QGMqsqLn6orFQ/ksqYMf+Fa33Soa1vPoHEd0Pj7N+lQ=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
 golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -116,16 +112,12 @@ golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20211104170005-ce137452f963/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
 golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -134,16 +126,12 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
 golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
 golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
@@ -153,10 +141,12 @@ golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
 golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -21,6 +21,7 @@ import (
 	"github.com/miekg/dns"

 	"github.com/samosvalishe/free-turn-proxy/internal/logx"
+	"github.com/samosvalishe/free-turn-proxy/internal/netctl"

 	// встроенные Mozilla CA roots для CGO_ENABLED=0 сборок (Android).
 	_ "golang.org/x/crypto/x509roots/fallback"
@@ -98,7 +99,7 @@ func newBootstrapTransport(endpoints []DohEndpoint) *http.Transport {
 	for _, ep := range endpoints {
 		bootstrap[ep.Hostname] = ep.BootstrapIPs
 	}
-	dialer := &net.Dialer{Timeout: dohDialerTimeout, KeepAlive: dohDialerKeepAlive}
+	dialer := &net.Dialer{Timeout: dohDialerTimeout, KeepAlive: dohDialerKeepAlive, Control: netctl.Apply}

 	return &http.Transport{
 		MaxIdleConns:        8,
@@ -440,6 +441,7 @@ func newAppDialer(dial dialFunc) net.Dialer {
 		Timeout:   appDialerTimeout,
 		KeepAlive: appDialerKeepAlive,
 		Resolver:  &net.Resolver{PreferGo: true, Dial: dial},
+		Control:   netctl.Apply,
 	}
 }

@@ -78,14 +78,13 @@ type ProxyOpts struct {
 	Peer    string    // -peer: адрес серверного прокси, куда дозванивается клиент (только клиент)
 }

-// Browser выбирает браузерный профиль (UA + TLS JA3 + client hints) для
-// control-plane запросов VK-провайдера. firefox несёт меньше client hints
-// (sec-ch-ua* - Chromium-only), chrome даёт herd-cover.
+// Browser выбирает браузерный профиль для control-plane запросов VK-провайдера.
 type Browser string

 const (
 	BrowserChrome  Browser = "chrome"
 	BrowserFirefox Browser = "firefox"
+	BrowserSafari  Browser = "safari"
 )

 // VKOpts - опции VK-учёток и captcha (только клиент, провайдер "vk").
@@ -93,7 +92,7 @@ type VKOpts struct {
 	Links          []string // -links (нормализованные join-коды); несколько = больше стримов
 	StreamsPerCred int      // -streams-per-cred
 	ManualCaptcha  bool     // -manual-captcha
-	Browser        Browser  // -browser: chrome | firefox
+	Browser        Browser  // -browser: chrome | firefox | safari
 }

 // ProviderOpts выбирает реализацию provider.Provider.
@@ -192,7 +191,7 @@ func ParseClient(args []string, errOut io.Writer) (*Client, error) {
 	streamsPerCred := fs.Int("streams-per-cred", defaultStreamsPerCache, "TURN-потоков на один кеш VK-creds; только -provider vk")
 	debug := fs.Bool("debug", false, "подробные debug-логи")
 	manualCaptcha := fs.Bool("manual-captcha", false, "ручная VK captcha в браузере вместо авто; только -provider vk")
-	browser := fs.String("browser", string(BrowserFirefox), "браузерный профиль VK-auth: chrome | firefox; только -provider vk")
+	browser := fs.String("browser", string(BrowserFirefox), "браузерный профиль VK-auth: chrome | firefox | safari; только -provider vk")
 	dnsMode := fs.String("dns-mode", dnsModeAuto, "резолвер клиента: plain | doh | auto")
 	dnsServers := fs.String("dns-servers", "", "свои UDP/53 DNS через запятую: ip[:port][,ip[:port]...]")
 	clientID := fs.String("client-id", "", "уникальный ID клиента (автогенерация если не задан)")
@@ -336,9 +335,9 @@ func ParseClient(args []string, errOut io.Writer) (*Client, error) {
 			return nil, fmt.Errorf("-streams-per-cred must be positive")
 		}
 		switch c.VK.Browser {
-		case BrowserChrome, BrowserFirefox:
+		case BrowserChrome, BrowserFirefox, BrowserSafari:
 		default:
-			return nil, fmt.Errorf("invalid -browser value %q: must be %s | %s", c.VK.Browser, BrowserChrome, BrowserFirefox)
+			return nil, fmt.Errorf("invalid -browser value %q: must be %s | %s | %s", c.VK.Browser, BrowserChrome, BrowserFirefox, BrowserSafari)
 		}
 		rawLinks := strings.Split(*links, ",")
 		if len(rawLinks) == 1 && rawLinks[0] == "" {
@@ -115,6 +115,25 @@ func TestParseClient_InvalidDNS(t *testing.T) {
 	}
 }

+func TestParseClient_BrowserSafari(t *testing.T) {
+	args := append(validClientArgs(), "-browser", "safari")
+	c, err := ParseClient(args, io.Discard)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.VK.Browser != BrowserSafari {
+		t.Errorf("VK.Browser = %q, want %q", c.VK.Browser, BrowserSafari)
+	}
+}
+
+func TestParseClient_BrowserInvalid(t *testing.T) {
+	args := append(validClientArgs(), "-browser", "opera")
+	_, err := ParseClient(args, io.Discard)
+	if err == nil || !strings.Contains(err.Error(), "invalid -browser") {
+		t.Errorf("expected browser error, got %v", err)
+	}
+}
+
 func TestParseClient_BondWithoutTCPMode(t *testing.T) {
 	args := append(validClientArgs(), "-bond")
 	_, err := ParseClient(args, io.Discard)
@@ -12,6 +12,7 @@ import (
 	"time"

 	"github.com/pion/transport/v4"
+	"github.com/samosvalishe/free-turn-proxy/internal/netctl"
 )

 // DirectNet реализует transport.Net через стандартный net.
@@ -34,32 +35,84 @@ type directTCPListener struct {
 	*net.TCPListener
 }

+// All socket-creating methods route through a net.Dialer / net.ListenConfig
+// carrying netctl.Apply as Control so the host can protect each fd from the
+// VPN tunnel. (net.DialUDP / net.ListenUDP take no Control, so we go via
+// Dialer/ListenConfig and type-assert back to the concrete UDP/TCP conn.)
 func (DirectNet) ListenPacket(network string, address string) (net.PacketConn, error) {
-	return net.ListenPacket(network, address) //nolint:noctx
+	return (&net.ListenConfig{Control: netctl.Apply}).ListenPacket(context.Background(), network, address)
 }

 func (DirectNet) ListenUDP(network string, locAddr *net.UDPAddr) (transport.UDPConn, error) {
-	return net.ListenUDP(network, locAddr)
-}
-
-func (DirectNet) ListenTCP(network string, laddr *net.TCPAddr) (transport.TCPListener, error) {
-	listener, err := net.ListenTCP(network, laddr)
+	addr := ""
+	if locAddr != nil {
+		addr = locAddr.String()
+	}
+	pc, err := (&net.ListenConfig{Control: netctl.Apply}).ListenPacket(context.Background(), network, addr)
 	if err != nil {
 		return nil, err
 	}
-	return directTCPListener{listener}, nil
+	udp, ok := pc.(*net.UDPConn)
+	if !ok {
+		_ = pc.Close()
+		return nil, fmt.Errorf("netconn: expected *net.UDPConn, got %T", pc)
+	}
+	return udp, nil
+}
+
+func (DirectNet) ListenTCP(network string, laddr *net.TCPAddr) (transport.TCPListener, error) {
+	addr := ""
+	if laddr != nil {
+		addr = laddr.String()
+	}
+	l, err := (&net.ListenConfig{Control: netctl.Apply}).Listen(context.Background(), network, addr)
+	if err != nil {
+		return nil, err
+	}
+	tl, ok := l.(*net.TCPListener)
+	if !ok {
+		_ = l.Close()
+		return nil, fmt.Errorf("netconn: expected *net.TCPListener, got %T", l)
+	}
+	return directTCPListener{tl}, nil
 }

 func (DirectNet) Dial(network, address string) (net.Conn, error) {
-	return net.Dial(network, address) //nolint:noctx
+	return (&net.Dialer{Control: netctl.Apply}).Dial(network, address)
 }

 func (DirectNet) DialUDP(network string, laddr, raddr *net.UDPAddr) (transport.UDPConn, error) {
-	return net.DialUDP(network, laddr, raddr)
+	d := &net.Dialer{Control: netctl.Apply}
+	if laddr != nil {
+		d.LocalAddr = laddr
+	}
+	c, err := d.Dial(network, raddr.String())
+	if err != nil {
+		return nil, err
+	}
+	udp, ok := c.(*net.UDPConn)
+	if !ok {
+		_ = c.Close()
+		return nil, fmt.Errorf("netconn: expected *net.UDPConn, got %T", c)
+	}
+	return udp, nil
 }

 func (DirectNet) DialTCP(network string, laddr, raddr *net.TCPAddr) (transport.TCPConn, error) {
-	return net.DialTCP(network, laddr, raddr)
+	d := &net.Dialer{Control: netctl.Apply}
+	if laddr != nil {
+		d.LocalAddr = laddr
+	}
+	c, err := d.Dial(network, raddr.String())
+	if err != nil {
+		return nil, err
+	}
+	tcp, ok := c.(*net.TCPConn)
+	if !ok {
+		_ = c.Close()
+		return nil, fmt.Errorf("netconn: expected *net.TCPConn, got %T", c)
+	}
+	return tcp, nil
 }

 func (DirectNet) ResolveIPAddr(network, address string) (*net.IPAddr, error) {
@@ -87,10 +140,16 @@ func (DirectNet) InterfaceByName(name string) (*transport.Interface, error) {
 }

 func (DirectNet) CreateDialer(dialer *net.Dialer) transport.Dialer {
+	if dialer.Control == nil {
+		dialer.Control = netctl.Apply
+	}
 	return directDialer{Dialer: dialer}
 }

 func (DirectNet) CreateListenConfig(listenerConfig *net.ListenConfig) transport.ListenConfig {
+	if listenerConfig.Control == nil {
+		listenerConfig.Control = netctl.Apply
+	}
 	return directListenConfig{ListenConfig: listenerConfig}
 }

@@ -0,0 +1,28 @@
+// Package netctl carries a process-global socket Control hook applied to every
+// OUTBOUND socket the vendored free-turn client opens. The host installs it so
+// those sockets are excluded from the VPN tunnel (Android VpnService.protect on
+// the raw fd) — without it the client's own TURN/VK/DNS traffic loops back into
+// the tunnel and hangs. This patch is local to our vendored copy: upstream has
+// no such hook, and the dialers it creates (netconn.DirectNet, dnsdial,
+// turndial) are routed through Apply below.
+package netctl
+
+import "syscall"
+
+var control func(network, address string, c syscall.RawConn) error
+
+// SetControl installs the per-socket protector. Call before the client starts.
+// nil (the default) makes Apply a no-op, so desktop builds are unaffected.
+func SetControl(fn func(network, address string, c syscall.RawConn) error) {
+	control = fn
+}
+
+// Apply is assigned as the Control func of every outbound net.Dialer /
+// net.ListenConfig in the vendored client. It reads `control` at dial time so
+// the host may register the protector before or after the client starts.
+func Apply(network, address string, c syscall.RawConn) error {
+	if control != nil {
+		return control(network, address, c)
+	}
+	return nil
+}
@@ -3,53 +3,85 @@ package browserprofile
 import (
 	"encoding/json"
 	"os"
+	"strings"

 	fhttp "github.com/bogdanfinn/fhttp"
 )

-// Kind - семейство браузера. Определяет UA, JA3-профиль и набор client hints.
+// Kind - семейство браузера.
 type Kind string

 const (
 	Chrome  Kind = "chrome"
 	Firefox Kind = "firefox"
+	Safari  Kind = "safari"
 )

 // KindFromString мапит строку флага -browser в Kind. Пустое/неизвестное -
 // Firefox (текущий дефолт продукта).
 func KindFromString(s string) Kind {
-	if s == string(Chrome) {
+	switch s {
+	case string(Chrome):
 		return Chrome
+	case string(Safari):
+		return Safari
 	}
 	return Firefox
 }

 type Profile struct {
 	UserAgent       string
-	SecChUa         string // пусто для Firefox (Chromium-only client hint)
+	SecChUa         string // пусто для non-Chromium профилей (Chromium-only client hint)
 	SecChUaMobile   string
 	SecChUaPlatform string
 	AcceptLanguage  string
 }

-// ForKind возвращает канонический профиль для браузера. JA3 (см.
-// vkauth.clientProfile) обязан совпадать с UA отсюда, иначе рассинхрон = флаг.
+// ForKind возвращает канонический профиль для браузера.
 func ForKind(k Kind) Profile {
-	if k == Firefox {
+	switch k {
+	case Safari:
 		return Profile{
-			UserAgent:      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0",
-			AcceptLanguage: "en-US,en;q=0.5",
+			UserAgent:      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15",
+			AcceptLanguage: "ru-RU,ru;q=0.9",
+		}
+	case Firefox:
+		return Profile{
+			UserAgent:      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0",
+			AcceptLanguage: "ru-RU,ru;q=0.9",
 		}
 	}
 	return Profile{
 		UserAgent:       "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
-		SecChUa:         `"Not(A:Brand";v="99", "Google Chrome";v="146", "Chromium";v="146"`,
+		SecChUa:         `"Google Chrome";v="146", "Chromium";v="146", "Not)A;Brand";v="24"`,
 		SecChUaMobile:   "?0",
 		SecChUaPlatform: `"Windows"`,
-		AcceptLanguage:  "en-US,en;q=0.9",
+		AcceptLanguage:  "ru-RU,ru;q=0.9",
 	}
 }

+func Family(p Profile) Kind {
+	ua := strings.ToLower(p.UserAgent)
+	switch {
+	case strings.Contains(ua, "firefox/"):
+		return Firefox
+	case strings.Contains(ua, "version/") && strings.Contains(ua, "safari/") && !strings.Contains(ua, "chrome/") && !strings.Contains(ua, "chromium/"):
+		return Safari
+	case strings.Contains(ua, "chrome/") || strings.Contains(ua, "chromium/"):
+		return Chrome
+	default:
+		return ""
+	}
+}
+
+func IsMobile(p Profile) bool {
+	ua := strings.ToLower(p.UserAgent)
+	return strings.Contains(ua, " mobile ") ||
+		strings.Contains(ua, " mobile/") ||
+		strings.Contains(ua, "android") ||
+		strings.Contains(strings.ToLower(p.SecChUaMobile), "?1")
+}
+
 type Saved struct {
 	Profile
 	DeviceJSON string
@@ -58,8 +90,16 @@ type Saved struct {

 const profileFile = "vk_profile.json"

+// profilePath возвращает путь к сохранённому профилю.
+func profilePath() string {
+	if p := strings.TrimSpace(os.Getenv("VK_PROFILE_PATH")); p != "" {
+		return p
+	}
+	return profileFile
+}
+
 func Load() (*Saved, error) {
-	data, err := os.ReadFile(profileFile)
+	data, err := os.ReadFile(profilePath())
 	if err != nil {
 		return nil, err
 	}
@@ -75,13 +115,11 @@ func Save(sp Saved) error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(profileFile, data, 0600)
+	return os.WriteFile(profilePath(), data, 0600)
 }

 func ApplyFhttp(req *fhttp.Request, profile Profile) {
 	req.Header.Set("User-Agent", profile.UserAgent)
-	// sec-ch-ua* - Chromium-only client hints. Для Firefox SecChUa пуст -
-	// заголовки не ставим (UA Firefox + sec-ch-ua = мгновенный флаг).
 	if profile.SecChUa != "" {
 		req.Header.Set("sec-ch-ua", profile.SecChUa)
 		req.Header.Set("sec-ch-ua-mobile", profile.SecChUaMobile)
@@ -89,8 +127,7 @@ func ApplyFhttp(req *fhttp.Request, profile Profile) {
 	}
 	acceptLang := profile.AcceptLanguage
 	if acceptLang == "" {
-		acceptLang = "en-US,en;q=0.9"
+		acceptLang = "ru-RU,ru;q=0.9"
 	}
 	req.Header.Set("Accept-Language", acceptLang)
-	req.Header.Set("DNT", "1")
 }
@@ -0,0 +1,97 @@
+package browserprofile
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	fhttp "github.com/bogdanfinn/fhttp"
+)
+
+func TestKindFromString(t *testing.T) {
+	cases := []struct {
+		in   string
+		want Kind
+	}{
+		{"chrome", Chrome},
+		{"firefox", Firefox},
+		{"safari", Safari},
+		{"", Firefox},
+		{"unknown", Firefox},
+	}
+	for _, tc := range cases {
+		if got := KindFromString(tc.in); got != tc.want {
+			t.Fatalf("KindFromString(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
+
+func TestProfilePathHonorsEnv(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "vk_profile_chrome_42.json")
+	t.Setenv("VK_PROFILE_PATH", path)
+
+	want := Saved{Profile: ForKind(Chrome), DeviceJSON: "{}", BrowserFp: "abc123"}
+	if err := Save(want); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(path); err != nil {
+		t.Fatalf("profile not written to VK_PROFILE_PATH %s: %v", path, err)
+	}
+
+	got, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.BrowserFp != want.BrowserFp || got.UserAgent != want.UserAgent {
+		t.Fatalf("loaded = %+v, want fp=%s ua=%s", got, want.BrowserFp, want.UserAgent)
+	}
+}
+
+func TestForKindChrome146(t *testing.T) {
+	p := ForKind(Chrome)
+	if p.UserAgent != "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" {
+		t.Fatalf("unexpected chrome UA: %q", p.UserAgent)
+	}
+	if p.SecChUa != `"Google Chrome";v="146", "Chromium";v="146", "Not)A;Brand";v="24"` {
+		t.Fatalf("unexpected chrome sec-ch-ua: %q", p.SecChUa)
+	}
+}
+
+func TestApplyFhttpOmitsClientHintsForFirefoxAndSafari(t *testing.T) {
+	for _, kind := range []Kind{Firefox, Safari} {
+		req, err := fhttp.NewRequest(fhttp.MethodGet, "https://example.com/", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		ApplyFhttp(req, ForKind(kind))
+		if req.Header.Get("sec-ch-ua") != "" {
+			t.Fatalf("%s sec-ch-ua = %q, want empty", kind, req.Header.Get("sec-ch-ua"))
+		}
+		if req.Header.Get("DNT") != "" {
+			t.Fatalf("%s DNT = %q, want empty", kind, req.Header.Get("DNT"))
+		}
+	}
+}
+
+func TestFamily(t *testing.T) {
+	for _, kind := range []Kind{Chrome, Firefox, Safari} {
+		if got := Family(ForKind(kind)); got != kind {
+			t.Fatalf("Family(%s profile) = %q, want %q", kind, got, kind)
+		}
+	}
+	if got := Family(Profile{UserAgent: "curl/8.0"}); got != "" {
+		t.Fatalf("Family(unknown) = %q, want empty", got)
+	}
+}
+
+func TestIsMobile(t *testing.T) {
+	if IsMobile(ForKind(Chrome)) {
+		t.Fatal("desktop chrome detected as mobile")
+	}
+	if !IsMobile(Profile{UserAgent: "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36"}) {
+		t.Fatal("android chrome was not detected as mobile")
+	}
+	if !IsMobile(Profile{UserAgent: ForKind(Chrome).UserAgent, SecChUaMobile: "?1"}) {
+		t.Fatal("sec-ch-ua-mobile ?1 was not detected as mobile")
+	}
+}
@@ -11,7 +11,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
+	neturl "net/url"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -25,18 +28,19 @@ import (
 	"github.com/samosvalishe/free-turn-proxy/internal/randx"
 )

-// Log - пакетный логгер. По умолчанию no-op; main устанавливает его через
-// SetLogger, чтобы captcha-вывод подчинялся глобальному -debug. Solve также
-// принимает logger параметром для DI.
+// Log - пакетный логгер.
 var Log logx.Logger = logx.Nop()

-// SetLogger ставит логгер пакета. Безопасно вызывать один раз при старте.
+// SetLogger ставит логгер пакета.
 func SetLogger(l logx.Logger) { Log = logx.OrNop(l) }

 const (
-	captchaAPIVersion    = "5.131"
-	captchaScriptVersion = "1.1.1359"
-	captchaDeviceInfo    = `{"screenWidth":1920,"screenHeight":1080,"screenAvailWidth":1920,"screenAvailHeight":1080,"innerWidth":1920,"innerHeight":951,"devicePixelRatio":1,"language":"en-US","languages":["en-US","en"],"webdriver":false,"hardwareConcurrency":8,"notificationsPermission":"denied"}`
+	captchaAPIVersion        = "5.131"
+	captchaScriptVersion     = "1.1.1370"
+	captchaAPIOrigin         = "https://id.vk.ru"
+	captchaDomain            = "vk.ru"
+	captchaDeviceInfo        = `{"screenWidth":1920,"screenHeight":1080,"screenAvailWidth":1920,"screenAvailHeight":1032,"innerWidth":1147,"innerHeight":945,"devicePixelRatio":1,"language":"ru-RU","languages":["ru-RU"],"webdriver":false,"hardwareConcurrency":8,"deviceMemory":16,"connectionEffectiveType":"4g","notificationsPermission":"denied"}`
+	captchaConnectionSamples = 4
 )

 var (
@@ -84,8 +88,9 @@ type captchaInitData struct {
 }

 type captchaInitSetting struct {
-	Type     string `json:"type"`
-	Settings string `json:"settings"`
+	Type        string `json:"type"`
+	Settings    string `json:"settings"`
+	SettingsKey string `json:"settings_key"`
 }

 type captchaPage struct {
@@ -114,6 +119,7 @@ type captchaSession struct {
 	client       tlsclient.HttpClient
 	profile      browserprofile.Profile
 	savedProfile *browserprofile.Saved
+	domain       string
 	log          logx.Logger
 }

@@ -124,9 +130,7 @@ func (s *captchaSession) logger() logx.Logger {
 	return Log
 }

-// Solve запускает авторешение captcha против VK captchaNotRobot API
-// и возвращает success-токен при успехе. log может быть nil - тогда
-// используется пакетный Log.
+// Solve запускает авторешение captcha против VK captchaNotRobot API.
 func Solve(
 	ctx context.Context,
 	captchaErr *Error,
@@ -142,7 +146,7 @@ func Solve(
 	l := logx.OrNop(log)
 	l.Infof("[STREAM %d] [Captcha] Solving VK Smart Captcha automatically...", streamID)

-	s := &captchaSession{ctx: ctx, client: client, profile: profile, savedProfile: savedProfile, log: l}
+	s := &captchaSession{ctx: ctx, client: client, profile: profile, savedProfile: savedProfile, domain: captchaDomain, log: l}

 	for attempt := 1; attempt <= captchaMaxAttempts; attempt++ {
 		token, solveErr := s.solveOnce(captchaErr)
@@ -150,7 +154,7 @@ func Solve(
 			return token, nil
 		}
 		l.Warnf("[STREAM %d] [Captcha] solve attempt %d failed: %v", streamID, attempt, solveErr)
-		if errors.Is(solveErr, errCaptchaRateLimit) {
+		if errors.Is(solveErr, errCaptchaRateLimit) || errors.Is(solveErr, errCaptchaBot) {
 			return "", solveErr
 		}

@@ -167,29 +171,34 @@ func Solve(
 }

 func (s *captchaSession) solveOnce(captchaErr *Error) (string, error) {
+	s.domain = captchaDomainFromRedirectURI(captchaErr.RedirectURI)
+	s.logger().Debugf("[Captcha] using domain=%s", s.domain)
+
 	html, err := s.fetchCaptchaHTML(captchaErr.RedirectURI)
 	if err != nil {
 		return "", err
 	}
+	s.logger().Debugf("[Captcha] html fetched bytes=%d", len(html))

 	page, err := parseCaptchaPage(html)
 	if err != nil {
 		return "", err
 	}
+	s.logCaptchaPage(page)
 	if page.PowInput == "" {
 		return "", errors.New("failed to find PoW settings")
 	}

-	sliderSettings := ""
+	sliderContent := captchaContentRef{}
 	if page.Init != nil {
 		for _, setting := range page.Init.Data.CaptchaSettings {
 			if setting.Type == "slider" {
-				sliderSettings = setting.Settings
+				sliderContent = setting.contentRef()
 			}
 		}
 	}
-	if page.Init != nil && page.Init.Data.ShowCaptchaType == "slider" && sliderSettings == "" {
-		return "", errors.New("failed to find slider captcha settings")
+	if page.Init != nil && page.Init.Data.ShowCaptchaType == "slider" && sliderContent.Value == "" {
+		return "", errors.New("failed to find slider captcha settings key")
 	}

 	s.logger().Debugf("[Captcha] solving pow difficulty=%d", page.PowDifficulty)
@@ -197,9 +206,9 @@ func (s *captchaSession) solveOnce(captchaErr *Error) (string, error) {
 	if hash == "" {
 		return "", errors.New("captcha pow failed")
 	}
-	s.logger().Debugf("[Captcha] pow solved")
+	s.logger().Debugf("[Captcha] pow solved hash_len=%d", len(hash))

-	base := captchaBaseValues(captchaErr.SessionToken)
+	base := s.captchaBaseValues(captchaErr.SessionToken)
 	if _, settingsErr := s.captchaRequest("captchaNotRobot.settings", base); settingsErr != nil {
 		return "", fmt.Errorf("captcha settings failed: %w", settingsErr)
 	}
@@ -208,13 +217,16 @@ func (s *captchaSession) solveOnce(captchaErr *Error) (string, error) {
 	if err != nil {
 		return "", err
 	}
+	browserFPSource := "generated"
 	if s.savedProfile != nil && strings.TrimSpace(s.savedProfile.BrowserFp) != "" {
 		browserFP = s.savedProfile.BrowserFp
+		browserFPSource = "saved"
 	}
+	s.logger().Debugf("[Captcha] browser_fp source=%s len=%d", browserFPSource, len(browserFP))

 	if m := reCaptchaVersion.FindStringSubmatch(page.ScriptURL); len(m) > 1 {
 		if m[1] != captchaScriptVersion {
-			s.logger().Warnf("[Captcha] script version drift: known=%s latest=%s", captchaScriptVersion, m[1])
+			s.logger().Debugf("[Captcha] script version drift: known=%s latest=%s", captchaScriptVersion, m[1])
 		}
 	}

@@ -227,30 +239,18 @@ func (s *captchaSession) solveOnce(captchaErr *Error) (string, error) {
 	if page.Init != nil {
 		showType = page.Init.Data.ShowCaptchaType
 	}
+	s.logger().Debugf("[Captcha] solving show_type=%s", showType)
 	var token string
-	for {
-		s.logger().Debugf("[Captcha] solving show_type=%s", showType)
-		switch showType {
-		case "slider":
-			token, err = s.solveSliderCaptcha(captchaErr.SessionToken, browserFP, hash, sliderSettings, debugInfo)
-		case "checkbox", "":
-			token, err = s.solveCheckboxCaptcha(captchaErr.SessionToken, browserFP, hash, debugInfo)
-		default:
-			return "", fmt.Errorf("unsupported captcha type: %s", showType)
-		}
-		if err == nil {
-			break
-		}
-		if errors.Is(err, errCaptchaBot) && !strings.EqualFold(showType, "slider") && sliderSettings != "" {
-			s.logger().Infof("[Captcha] checkbox returned BOT, trying slider challenge")
-			showType = "slider"
-			continue
-		}
-		var stErr *captchaShowTypeError
-		if !errors.As(err, &stErr) || stErr.ShowType == "" {
-			return "", err
-		}
-		showType = stErr.ShowType
+	switch showType {
+	case "slider":
+		token, err = s.solveSliderCaptcha(captchaErr.SessionToken, browserFP, hash, sliderContent, debugInfo)
+	case "checkbox", "":
+		token, err = s.solveCheckboxCaptcha(captchaErr.SessionToken, browserFP, hash, debugInfo)
+	default:
+		return "", fmt.Errorf("unsupported captcha type: %s", showType)
+	}
+	if err != nil {
+		return "", err
 	}

 	if _, endErr := s.captchaRequest("captchaNotRobot.endSession", base); endErr != nil {
@@ -259,15 +259,43 @@ func (s *captchaSession) solveOnce(captchaErr *Error) (string, error) {
 	return token, nil
 }

-func captchaBaseValues(sessionToken string) [][2]string {
+// captchaContentRef несёт значение настроек слайдера.
+type captchaContentRef struct {
+	Source string
+	Value  string
+}
+
+func (s captchaInitSetting) contentRef() captchaContentRef {
+	if v := strings.TrimSpace(s.SettingsKey); v != "" {
+		return captchaContentRef{Source: "settings_key", Value: v}
+	}
+	if v := strings.TrimSpace(s.Settings); v != "" {
+		return captchaContentRef{Source: "captcha_settings", Value: v}
+	}
+	return captchaContentRef{}
+}
+
+func (s *captchaSession) captchaBaseValues(sessionToken string) [][2]string {
 	return [][2]string{
 		{"session_token", sessionToken},
-		{"domain", "vk.ru"},
+		{"domain", s.domain},
 		{"adFp", ""},
 		{"access_token", ""},
 	}
 }

+func captchaDomainFromRedirectURI(redirectURI string) string {
+	u, err := neturl.Parse(redirectURI)
+	if err != nil {
+		return captchaDomain
+	}
+	domain := strings.TrimSpace(u.Query().Get("domain"))
+	if domain == "" {
+		return captchaDomain
+	}
+	return domain
+}
+
 func captchaBrowserFP() (string, error) {
 	b := make([]byte, 16)
 	if _, err := rand.Read(b); err != nil {
@@ -298,7 +326,7 @@ func (s *captchaSession) fetchDebugInfo(scriptURL string) (string, error) {
 	}
 	body, err := s.doRaw(fhttp.MethodGet, scriptURL, nil, map[string]string{
 		"Accept":  "text/javascript,*/*",
-		"Referer": "https://id.vk.ru/",
+		"Referer": captchaAPIOrigin + "/",
 	})
 	if err != nil {
 		return "", err
@@ -353,11 +381,14 @@ func parseCaptchaPage(html string) (*captchaPage, error) {

 func (s *captchaSession) captchaRequest(method string, form [][2]string) (map[string]any, error) {
 	endpoint := "https://api.vk.ru/method/" + method + "?v=" + captchaAPIVersion
-	body, err := s.doRaw(fhttp.MethodPost, endpoint, form, map[string]string{
-		"Origin":   "https://id.vk.ru",
-		"Referer":  "https://id.vk.ru/",
-		"Priority": "u=1, i",
-	})
+	headers := map[string]string{
+		"Origin":  captchaAPIOrigin,
+		"Referer": captchaAPIOrigin + "/",
+	}
+	if browserprofile.Family(s.profile) != browserprofile.Firefox {
+		headers["Priority"] = "u=1, i"
+	}
+	body, err := s.doRaw(fhttp.MethodPost, endpoint, form, headers)
 	if err != nil {
 		return nil, err
 	}
@@ -365,6 +396,7 @@ func (s *captchaSession) captchaRequest(method string, form [][2]string) (map[st
 	if err := json.Unmarshal(body, &out); err != nil {
 		return nil, fmt.Errorf("captcha api decode: %w", err)
 	}
+	s.logger().Debugf("[Captcha] api %s response=%s", method, captchaAPIResponseSummary(out))
 	return out, nil
 }

@@ -376,27 +408,35 @@ func (s *captchaSession) performCaptchaCheck(
 	cursor string,
 	debugInfo string,
 ) (*captchaCheck, error) {
-	values := [][2]string{
-		{"session_token", sessionToken},
-		{"domain", "vk.ru"},
-		{"adFp", ""},
-		{"accelerometer", "[]"},
-		{"gyroscope", "[]"},
-		{"motion", "[]"},
-		{"cursor", cursor},
-		{"taps", "[]"},
-		{"connectionRtt", "[]"},
-		{"connectionDownlink", "[]"},
-		{"browser_fp", browserFP},
-		{"hash", hash},
-		{"answer", base64.StdEncoding.EncodeToString([]byte(answerJSON))},
-		{"debug_info", debugInfo},
-		{"access_token", ""},
+	mobile := browserprofile.IsMobile(s.profile)
+	accelerometer := "[]"
+	if mobile {
+		accelerometer = captchaMobileAccelerometer()
 	}
+	values := make([][2]string, 0, 15)
+	values = append(values,
+		[2]string{"session_token", sessionToken},
+		[2]string{"domain", s.domain},
+		[2]string{"adFp", ""},
+		[2]string{"accelerometer", accelerometer},
+		[2]string{"gyroscope", "[]"},
+		[2]string{"motion", "[]"},
+		[2]string{"cursor", cursor},
+		[2]string{"taps", "[]"},
+	)
+	values = append(values, captchaConnectionFields(browserprofile.Family(s.profile), mobile)...)
+	values = append(values,
+		[2]string{"browser_fp", browserFP},
+		[2]string{"hash", hash},
+		[2]string{"answer", base64.StdEncoding.EncodeToString([]byte(answerJSON))},
+		[2]string{"debug_info", debugInfo},
+		[2]string{"access_token", ""},
+	)
 	resp, err := s.captchaRequest("captchaNotRobot.check", values)
 	if err != nil {
 		return nil, fmt.Errorf("captcha check failed: %w", err)
 	}
+	s.logger().Debugf("[Captcha] check payload answer_bytes=%d cursor_bytes=%d debug_info=%t", len(answerJSON), len(cursor), debugInfo != "")
 	check, err := parseCaptchaCheck(resp)
 	if err != nil {
 		return nil, err
@@ -432,12 +472,15 @@ func (s *captchaSession) solveCheckboxCaptcha(
 	debugInfo string,
 ) (string, error) {
 	deviceJSON := captchaDeviceInfo
+	deviceSource := "default"
 	if s.savedProfile != nil && strings.TrimSpace(s.savedProfile.DeviceJSON) != "" {
 		deviceJSON = s.savedProfile.DeviceJSON
+		deviceSource = "saved"
 	}
+	s.logger().Debugf("[Captcha] checkbox componentDone device_source=%s device_bytes=%d", deviceSource, len(deviceJSON))
 	if _, err := s.captchaRequest("captchaNotRobot.componentDone", [][2]string{
 		{"session_token", sessionToken},
-		{"domain", "vk.ru"},
+		{"domain", s.domain},
 		{"adFp", ""},
 		{"browser_fp", browserFP},
 		{"device", deviceJSON},
@@ -479,8 +522,6 @@ func solveCaptchaPoW(ctx context.Context, input string, difficulty int) string {
 		return ""
 	}
 	target := strings.Repeat("0", difficulty)
-	// ctx-check каждые 1024 итерации - задержка отмены в пределах нескольких мс
-	// даже на слабом ARM (было 4096).
 	buf := make([]byte, 0, len(input)+20)
 	buf = append(buf, input...)
 	for nonce := 1; nonce <= 10_000_000; nonce++ {
@@ -495,12 +536,26 @@ func solveCaptchaPoW(ctx context.Context, input string, difficulty int) string {
 		sum := sha256.Sum256(buf)
 		hashHex := hex.EncodeToString(sum[:])
 		if strings.HasPrefix(hashHex, target) {
-			return hashHex
+			return encodeCaptchaPoW(hashHex, nonce)
 		}
 	}
 	return ""
 }

+func encodeCaptchaPoW(hash string, nonce int) string {
+	payload, err := json.Marshal(struct {
+		Hash  string `json:"hash"`
+		Nonce int    `json:"nonce"`
+	}{
+		Hash:  hash,
+		Nonce: nonce,
+	})
+	if err != nil {
+		return ""
+	}
+	return "v2." + base64.RawURLEncoding.EncodeToString(payload)
+}
+
 func (s *captchaSession) doRaw(
 	method string,
 	endpoint string,
@@ -520,8 +575,8 @@ func (s *captchaSession) doRaw(
 	req.Header.Set("Sec-Fetch-Site", "same-site")
 	req.Header.Set("Sec-Fetch-Mode", "cors")
 	req.Header.Set("Sec-Fetch-Dest", "empty")
-	req.Header.Set("Origin", "https://vk.ru")
-	req.Header.Set("Referer", "https://vk.ru/")
+	req.Header.Set("Origin", captchaAPIOrigin)
+	req.Header.Set("Referer", captchaAPIOrigin+"/")
 	if form != nil {
 		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	}
@@ -531,8 +586,10 @@ func (s *captchaSession) doRaw(
 	req.Header[fhttp.HeaderOrderKey] = captchaHeaderOrder
 	req.Header[fhttp.PHeaderOrderKey] = captchaPHeaderOrder

+	start := time.Now()
 	resp, err := s.client.Do(req)
 	if err != nil {
+		s.logger().Debugf("[Captcha] http %s %s failed after=%s form=%s err=%v", method, captchaSafeURL(endpoint), time.Since(start).Truncate(time.Millisecond), captchaFormSummary(form), err)
 		return nil, err
 	}
 	defer func() {
@@ -540,7 +597,87 @@ func (s *captchaSession) doRaw(
 			s.logger().Warnf("[Captcha] close body: %s", closeErr)
 		}
 	}()
-	return io.ReadAll(resp.Body)
+	data, readErr := io.ReadAll(resp.Body)
+	s.logger().Debugf("[Captcha] http %s %s status=%d bytes=%d after=%s form=%s", method, captchaSafeURL(endpoint), resp.StatusCode, len(data), time.Since(start).Truncate(time.Millisecond), captchaFormSummary(form))
+	return data, readErr
+}
+
+func (s *captchaSession) logCaptchaPage(page *captchaPage) {
+	showType := ""
+	settingsSummary := "none"
+	if page.Init != nil {
+		showType = page.Init.Data.ShowCaptchaType
+		parts := make([]string, 0, len(page.Init.Data.CaptchaSettings))
+		for _, setting := range page.Init.Data.CaptchaSettings {
+			ref := setting.contentRef()
+			valueLen := 0
+			if ref.Value != "" {
+				valueLen = len(ref.Value)
+			}
+			parts = append(parts, fmt.Sprintf("%s:%s:%d", setting.Type, ref.Source, valueLen))
+		}
+		if len(parts) > 0 {
+			settingsSummary = strings.Join(parts, ",")
+		}
+	}
+	scriptVersion := ""
+	if m := reCaptchaVersion.FindStringSubmatch(page.ScriptURL); len(m) > 1 {
+		scriptVersion = m[1]
+	}
+	s.logger().Debugf("[Captcha] page parsed show_type=%q settings=%s pow_difficulty=%d script_version=%q script_url=%s", showType, settingsSummary, page.PowDifficulty, scriptVersion, captchaSafeURL(page.ScriptURL))
+}
+
+func captchaAPIResponseSummary(raw map[string]any) string {
+	if errData, ok := raw["error"].(map[string]any); ok {
+		return fmt.Sprintf("error code=%s msg=%q keys=%s", captchaStringifyAny(errData["error_code"]), captchaStringifyAny(errData["error_msg"]), captchaMapKeys(errData))
+	}
+	if resp, ok := raw["response"].(map[string]any); ok {
+		status := captchaStringifyAny(resp["status"])
+		showType := captchaStringifyAny(resp["show_captcha_type"])
+		tokenLen := len(captchaStringifyAny(resp["success_token"]))
+		return fmt.Sprintf("ok status=%q show_type=%q success_token_len=%d keys=%s", status, showType, tokenLen, captchaMapKeys(resp))
+	}
+	return "unknown keys=" + captchaMapKeys(raw)
+}
+
+func captchaMapKeys(m map[string]any) string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return strings.Join(keys, ",")
+}
+
+func captchaSafeURL(raw string) string {
+	u, err := neturl.Parse(raw)
+	if err != nil {
+		return "<invalid-url>"
+	}
+	if u.Host == "" {
+		return u.Path
+	}
+	path := u.EscapedPath()
+	if path == "" {
+		path = "/"
+	}
+	return u.Host + path
+}
+
+func captchaFormSummary(values [][2]string) string {
+	if len(values) == 0 {
+		return "none"
+	}
+	parts := make([]string, 0, len(values))
+	for _, kv := range values {
+		switch kv[0] {
+		case "session_token", "browser_fp", "hash", "answer", "debug_info", "device", "settings_key", "captcha_settings":
+			parts = append(parts, fmt.Sprintf("%s:%d", kv[0], len(kv[1])))
+		default:
+			parts = append(parts, kv[0])
+		}
+	}
+	return strings.Join(parts, ",")
 }

 func captchaEncodeForm(values [][2]string) string {
@@ -598,3 +735,98 @@ func captchaStringifyAny(value any) string {
 		return string(data)
 	}
 }
+
+// captchaConnectionFields возвращает Chrome-only поля NetworkInformation API.
+func captchaConnectionFields(family browserprofile.Kind, mobile bool) [][2]string {
+	if family != browserprofile.Chrome {
+		return nil
+	}
+	n := captchaConnectionSamples
+	if mobile {
+		rtt := 50 * (1 + randx.Intn(2)) // 50 | 100
+		dl := 1.4 + randx.Float64()*0.7 // [1.4, 2.1)
+		return [][2]string{
+			{"connectionRtt", captchaRepeatNumberJSON(rtt, n)},
+			{"connectionDownlink", captchaRepeatFloatJSON(round2(dl), n)},
+		}
+	}
+	rtt := 50 * (1 + randx.Intn(3)) // 50 | 100 | 150
+	dl := 5.0 + randx.Float64()*5.0 // [5, 10)
+	return [][2]string{
+		{"connectionRtt", captchaRepeatNumberJSON(rtt, n)},
+		{"connectionDownlink", captchaRepeatFloatJSON(round1(dl), n)},
+	}
+}
+
+// captchaMobileAccelerometer генерирует сэмплы покоящегося телефона.
+func captchaMobileAccelerometer() string {
+	type sample struct {
+		X float64 `json:"x"`
+		Y float64 `json:"y"`
+		Z float64 `json:"z"`
+	}
+	const g = 9.81
+	bx := -2.5 + randx.Float64()*5.0 // [-2.5, 2.5)
+	by := 4.0 + randx.Float64()*4.0  // [4, 8)
+	bz := g
+	if rem := g*g - bx*bx - by*by; rem > 0 {
+		bz = math.Sqrt(rem)
+	}
+	jitter := func() float64 { return (randx.Float64() - 0.5) * 0.2 } // ±0.1
+	pts := make([]sample, 3)
+	for i := range pts {
+		pts[i] = sample{X: round1(bx + jitter()), Y: round1(by + jitter()), Z: round1(bz + jitter())}
+	}
+	data, err := json.Marshal(pts)
+	if err != nil {
+		return "[]"
+	}
+	return string(data)
+}
+
+func round1(v float64) float64 { return math.Round(v*10) / 10 }
+func round2(v float64) float64 { return math.Round(v*100) / 100 }
+
+func captchaRepeatFloatJSON(value float64, count int) string {
+	if count <= 0 {
+		return "[]"
+	}
+	s := strconv.FormatFloat(value, 'g', -1, 64)
+	parts := make([]string, count)
+	for i := range parts {
+		parts[i] = s
+	}
+	return "[" + strings.Join(parts, ",") + "]"
+}
+
+func captchaCursorPointCount(cursor string) int {
+	cursor = strings.TrimSpace(cursor)
+	if cursor == "" || cursor == "[]" {
+		return 0
+	}
+	var points []struct {
+		X int `json:"x"`
+		Y int `json:"y"`
+	}
+	if err := json.Unmarshal([]byte(cursor), &points); err != nil {
+		return 0
+	}
+	return len(points)
+}
+
+func captchaRepeatNumberJSON(value int, count int) string {
+	if count <= 0 {
+		return "[]"
+	}
+	var sb strings.Builder
+	sb.Grow(count*4 + 2)
+	sb.WriteByte('[')
+	for i := 0; i < count; i++ {
+		if i > 0 {
+			sb.WriteByte(',')
+		}
+		sb.WriteString(strconv.Itoa(value))
+	}
+	sb.WriteByte(']')
+	return sb.String()
+}
@@ -0,0 +1,169 @@
+package captcha
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/samosvalishe/free-turn-proxy/internal/provider/vk/internal/browserprofile"
+)
+
+func TestCaptchaInitSettingContentRefPrefersSettingsKey(t *testing.T) {
+	setting := captchaInitSetting{
+		Type:        "slider",
+		Settings:    "legacy-settings",
+		SettingsKey: "new-settings-key",
+	}
+
+	got := setting.contentRef()
+	if got.Source != "settings_key" || got.Value != "new-settings-key" {
+		t.Fatalf("contentRef = %+v, want settings_key/new-settings-key", got)
+	}
+}
+
+func TestCaptchaInitSettingContentRefLegacySettings(t *testing.T) {
+	setting := captchaInitSetting{
+		Type:     "slider",
+		Settings: "legacy-settings",
+	}
+
+	got := setting.contentRef()
+	if got.Source != "captcha_settings" || got.Value != "legacy-settings" {
+		t.Fatalf("contentRef = %+v, want captcha_settings/legacy-settings", got)
+	}
+}
+
+func TestParseCaptchaPageSettingsKey(t *testing.T) {
+	html := `<html><head><script src="https://static.vk.ru/vkid/1.1.1359/not_robot_captcha.js"></script></head><body>
+<script>
+window.init = {"data":{"show_captcha_type":"slider","captcha_settings":[{"type":"slider","settings_key":"abc123"}]}};
+const powInput = "input";
+const difficulty = 2;
+</script>
+</body></html>`
+
+	page, err := parseCaptchaPage(html)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if page.Init == nil || len(page.Init.Data.CaptchaSettings) != 1 {
+		t.Fatalf("captcha settings missing: %+v", page.Init)
+	}
+	got := page.Init.Data.CaptchaSettings[0].contentRef()
+	if got.Source != "settings_key" || got.Value != "abc123" {
+		t.Fatalf("contentRef = %+v, want settings_key/abc123", got)
+	}
+}
+
+func TestEncodeCaptchaPoW(t *testing.T) {
+	got := encodeCaptchaPoW("00abcdef", 147)
+	if !strings.HasPrefix(got, "v2.") {
+		t.Fatalf("pow = %q, want v2 prefix", got)
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(got, "v2."))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded struct {
+		Hash  string `json:"hash"`
+		Nonce int    `json:"nonce"`
+	}
+	if err := json.Unmarshal(payload, &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if decoded.Hash != "00abcdef" || decoded.Nonce != 147 {
+		t.Fatalf("decoded = %+v, want hash/nonce", decoded)
+	}
+}
+
+func TestCaptchaDomainFromRedirectURI(t *testing.T) {
+	tests := []struct {
+		name        string
+		redirectURI string
+		want        string
+	}{
+		{
+			name:        "vk com from query",
+			redirectURI: "https://id.vk.ru/not_robot_captcha?domain=vk.com&session_token=x",
+			want:        "vk.com",
+		},
+		{
+			name:        "vk ru from query",
+			redirectURI: "https://id.vk.ru/not_robot_captcha?domain=vk.ru&session_token=x",
+			want:        "vk.ru",
+		},
+		{
+			name:        "fallback without domain",
+			redirectURI: "https://id.vk.ru/not_robot_captcha?session_token=x",
+			want:        captchaDomain,
+		},
+		{
+			name:        "fallback invalid url",
+			redirectURI: "%",
+			want:        captchaDomain,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := captchaDomainFromRedirectURI(tt.redirectURI); got != tt.want {
+				t.Fatalf("domain = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCaptchaConnectionFieldsGatedByFamily(t *testing.T) {
+	for _, family := range []browserprofile.Kind{browserprofile.Firefox, browserprofile.Safari} {
+		if got := captchaConnectionFields(family, true); got != nil {
+			t.Fatalf("%s must omit NetworkInformation telemetry, got %v", family, got)
+		}
+	}
+	got := captchaConnectionFields(browserprofile.Chrome, true)
+	if len(got) != 2 || got[0][0] != "connectionRtt" || got[1][0] != "connectionDownlink" {
+		t.Fatalf("chrome connection fields = %v, want rtt+downlink", got)
+	}
+	// Реальный браузер шлёт фиксированную выборку, не привязанную к курсору.
+	var rtt []int
+	if err := json.Unmarshal([]byte(got[0][1]), &rtt); err != nil || len(rtt) != captchaConnectionSamples {
+		t.Fatalf("connectionRtt = %s, want %d samples", got[0][1], captchaConnectionSamples)
+	}
+}
+
+func TestCaptchaMobileAccelerometerIsGravity(t *testing.T) {
+	var pts []struct{ X, Y, Z float64 }
+	if err := json.Unmarshal([]byte(captchaMobileAccelerometer()), &pts); err != nil {
+		t.Fatal(err)
+	}
+	if len(pts) != 3 {
+		t.Fatalf("samples = %d, want 3", len(pts))
+	}
+	// Магнитуда каждого сэмпла ~ g (покоящийся телефон).
+	for _, p := range pts {
+		mag := p.X*p.X + p.Y*p.Y + p.Z*p.Z
+		if mag < 64 || mag > 144 { // |a| в [8, 12]
+			t.Fatalf("accelerometer magnitude^2 = %.1f, not gravity-like", mag)
+		}
+	}
+}
+
+func TestReverseSwapPairs(t *testing.T) {
+	got := reverseSwapPairs([]int{1, 2, 3, 4, 5, 6})
+	want := []int{5, 6, 3, 4, 1, 2}
+	if len(got) != len(want) {
+		t.Fatalf("len = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("reverseSwapPairs = %v, want %v", got, want)
+		}
+	}
+}
+
+func TestBuildSliderCursorIsBrowserLike(t *testing.T) {
+	cursor := buildSliderCursor(5, 25)
+	if got := captchaCursorPointCount(cursor); got < 70 {
+		t.Fatalf("cursor point count = %d, want at least 70", got)
+	}
+}
@@ -39,8 +39,6 @@ func ParseError(errData map[string]any) *Error {
 	if !ok {
 		if sidNum, ok2 := errData["captcha_sid"].(float64); ok2 {
 			captchaSid = fmt.Sprintf("%.0f", sidNum)
-		} else {
-			Log.Debugf("[Captcha] captcha_sid not present in error data")
 		}
 	}

@@ -0,0 +1,25 @@
+package captcha
+
+import "testing"
+
+func TestParseErrorSmartCaptchaWithoutSid(t *testing.T) {
+	errData := map[string]any{
+		"error_code":   float64(14),
+		"error_msg":    "Captcha needed",
+		"redirect_uri": "https://id.vk.ru/not_robot_captcha?domain=vk.com&session_token=token",
+	}
+
+	got := ParseError(errData)
+	if got == nil {
+		t.Fatal("ParseError returned nil")
+	}
+	if !got.IsCaptcha() {
+		t.Fatalf("IsCaptcha = false, got %+v", got)
+	}
+	if got.CaptchaSid != "" {
+		t.Fatalf("CaptchaSid = %q, want empty", got.CaptchaSid)
+	}
+	if got.SessionToken != "token" {
+		t.Fatalf("SessionToken = %q, want token", got.SessionToken)
+	}
+}
@@ -68,9 +68,9 @@ func localCaptchaHosts() []string {

 func isAllowedProxyHost(hostname string) bool {
 	allowed := []string{
-		".vk.ru", ".vk.ru", ".vkontakte.ru",
+		".vk.com", ".vk.ru", ".vkontakte.ru",
 		".userapi.com", ".okcdn.ru", ".mycdn.me",
-		".api.vk.ru",
+		".api.vk.com", ".api.vk.ru",
 	}
 	for _, suffix := range allowed {
 		if strings.HasSuffix(hostname, suffix) || hostname == suffix[1:] {
@@ -663,6 +663,7 @@ func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
 						SecChUa:         req.Header.Get("Sec-Ch-Ua"),
 						SecChUaMobile:   req.Header.Get("Sec-Ch-Ua-Mobile"),
 						SecChUaPlatform: req.Header.Get("Sec-Ch-Ua-Platform"),
+						AcceptLanguage:  req.Header.Get("Accept-Language"),
 					},
 					DeviceJSON: device,
 					BrowserFp:  browserFp,
@@ -847,10 +848,7 @@ func solveViaProxy(ctx context.Context, redirectURI string, dialer net.Dialer, p
 				// разрешаем cross-origin доступ к ресурсу
 				res.Header.Set("Access-Control-Allow-Origin", "*")

-				// captchaNotRobot.check уходит на api.vk.ru (другой хост, чем
-				// upstream vk.ru), поэтому идёт через /generic_proxy. Извлекаем
-				// success_token здесь - серверный путь работает на iOS даже если
-				// JS-callback в браузере не сработал.
+				// captchaNotRobot.check идёт через /generic_proxy на api.vk.com/api.vk.ru.
 				if strings.Contains(targetAuthURL, "captchaNotRobot.check") {
 					bodyBytes, readErr := io.ReadAll(res.Body)
 					if readErr == nil {
@@ -32,6 +32,7 @@ type sliderGuess struct {
 	Score         int64
 	ScoreRGB      int64
 	ScoreLuma     int64
+	ScoreReverse  int64
 	ScoreText     float64
 	ConsensusRank int
 }
@@ -40,15 +41,19 @@ func (s *captchaSession) solveSliderCaptcha(
 	sessionToken string,
 	browserFP string,
 	hash string,
-	settings string,
+	content captchaContentRef,
 	debugInfo string,
 ) (string, error) {
+	if content.Value == "" {
+		return "", errors.New("slider content settings missing")
+	}
+	s.logger().Debugf("[Captcha] slider getContent source=%s len=%d", content.Source, len(content.Value))
 	values := [][2]string{
 		{"session_token", sessionToken},
-		{"domain", "vk.ru"},
+		{"domain", s.domain},
 		{"adFp", ""},
 		{"access_token", ""},
-		{"captcha_settings", settings},
+		{"captcha_settings", content.Value},
 	}

 	resp, err := s.captchaRequest("captchaNotRobot.getContent", values)
@@ -59,7 +64,7 @@ func (s *captchaSession) solveSliderCaptcha(
 	if err != nil {
 		return "", err
 	}
-	Log.Debugf("[Captcha] slider puzzle decoded: grid=%d attempts=%d swaps=%d", puzzle.Size, puzzle.Attempts, len(puzzle.Swaps))
+	s.logger().Debugf("[Captcha] slider puzzle decoded: grid=%d attempts=%d swaps=%d", puzzle.Size, puzzle.Attempts, len(puzzle.Swaps))

 	guesses, err := rankSliderGuesses(puzzle.Image, puzzle.Size, puzzle.Swaps)
 	if err != nil {
@@ -73,15 +78,18 @@ func (s *captchaSession) solveSliderCaptcha(
 	if limit <= 0 {
 		return "", errors.New("slider has no attempts available")
 	}
-	Log.Debugf("[Captcha] slider guesses ranked: total=%d limit=%d", len(guesses), limit)
+	s.logger().Debugf("[Captcha] slider guesses ranked: total=%d limit=%d", len(guesses), limit)

 	deviceJSON := captchaDeviceInfo
+	deviceSource := "default"
 	if s.savedProfile != nil && strings.TrimSpace(s.savedProfile.DeviceJSON) != "" {
 		deviceJSON = s.savedProfile.DeviceJSON
+		deviceSource = "saved"
 	}
+	s.logger().Debugf("[Captcha] slider componentDone device_source=%s device_bytes=%d", deviceSource, len(deviceJSON))
 	if _, err := s.captchaRequest("captchaNotRobot.componentDone", [][2]string{
 		{"session_token", sessionToken},
-		{"domain", "vk.ru"},
+		{"domain", s.domain},
 		{"adFp", ""},
 		{"access_token", ""},
 		{"browser_fp", browserFP},
@@ -91,7 +99,7 @@ func (s *captchaSession) solveSliderCaptcha(
 	}

 	for i := 0; i < limit; i++ {
-		Log.Debugf("[Captcha] slider attempt %d/%d (guess #%d)", i+1, limit, guesses[i].Index)
+		s.logger().Debugf("[Captcha] slider attempt %d/%d (guess #%d)", i+1, limit, guesses[i].Index)
 		answerData, err := json.Marshal(struct {
 			Value []int `json:"value"`
 		}{Value: guesses[i].Swaps})
@@ -109,11 +117,12 @@ func (s *captchaSession) solveSliderCaptcha(
 		if err != nil {
 			return "", err
 		}
+		s.logger().Debugf("[Captcha] slider attempt %d status=%s show_type=%s token_len=%d", i+1, check.Status, check.ShowType, len(check.SuccessToken))
 		if strings.EqualFold(check.Status, "ok") {
 			if check.SuccessToken == "" {
 				return "", errors.New("captcha success token not found")
 			}
-			Log.Infof("[Captcha] slider accepted on attempt %d", i+1)
+			s.logger().Infof("[Captcha] slider accepted on attempt %d", i+1)
 			return check.SuccessToken, nil
 		}
 		if strings.EqualFold(check.Status, "error_limit") {
@@ -211,6 +220,15 @@ func rankSliderGuesses(img image.Image, gridSize int, swaps []int) ([]sliderGues
 		}
 		guesses[idx-1] = sliderGuess{Index: idx, Swaps: active}
 		guesses[idx-1].ScoreLuma = seamScoreLuma(img, gridSize, mapping)
+		if len(active) > 2 {
+			reverseMapping, err := applySliderSwaps(gridSize, reverseSwapPairs(active))
+			if err != nil {
+				return nil, err
+			}
+			guesses[idx-1].ScoreReverse = seamScoreLuma(img, gridSize, reverseMapping)
+		} else {
+			guesses[idx-1].ScoreReverse = guesses[idx-1].ScoreLuma
+		}
 	}

 	lumaOrder := append([]sliderGuess(nil), guesses...)
@@ -226,9 +244,6 @@ func rankSliderGuesses(img image.Image, gridSize int, swaps []int) ([]sliderGues
 	}

 	stage2Count := candidateCount
-	if stage2Count > 12 {
-		stage2Count = 12
-	}
 	stage2Set := make(map[int]struct{}, stage2Count)
 	for i := 0; i < stage2Count; i++ {
 		stage2Set[lumaOrder[i].Index] = struct{}{}
@@ -314,9 +329,21 @@ func rankSliderGuesses(img image.Image, gridSize int, swaps []int) ([]sliderGues
 		textRank[g.Index] = rank
 	}

+	reverseOrder := append([]sliderGuess(nil), guesses...)
+	sort.SliceStable(reverseOrder, func(i, j int) bool {
+		if reverseOrder[i].ScoreReverse == reverseOrder[j].ScoreReverse {
+			return reverseOrder[i].Index < reverseOrder[j].Index
+		}
+		return reverseOrder[i].ScoreReverse < reverseOrder[j].ScoreReverse
+	})
+	reverseRank := make(map[int]int, len(reverseOrder))
+	for rank, g := range reverseOrder {
+		reverseRank[g.Index] = rank
+	}
+
 	for i := range guesses {
 		g := &guesses[i]
-		g.ConsensusRank = lumaRank[g.Index]
+		g.ConsensusRank = lumaRank[g.Index] + reverseRank[g.Index]
 		if _, ok := stage2Set[g.Index]; ok {
 			g.ConsensusRank += rgbRank[g.Index] + textRank[g.Index]
 		} else {
@@ -337,6 +364,14 @@ func rankSliderGuesses(img image.Image, gridSize int, swaps []int) ([]sliderGues
 	return guesses, nil
 }

+func reverseSwapPairs(swaps []int) []int {
+	out := make([]int, 0, len(swaps))
+	for i := len(swaps) - 2; i >= 0; i -= 2 {
+		out = append(out, swaps[i], swaps[i+1])
+	}
+	return out
+}
+
 func activeSwapsForIndex(swaps []int, index int) []int {
 	if index <= 0 {
 		return []int{}
@@ -580,41 +615,45 @@ func buildSliderCursor(candidateIndex int, candidateCount int) string {
 	targetX := baseTargetX + randx.Intn(10) - 5
 	targetY := 655 + randx.Intn(14)

-	points := make([]cursorPoint, 0, 28)
+	points := make([]cursorPoint, 0, 128)

-	for i := 0; i < 1+randx.Intn(3); i++ {
+	for i := 0; i < 4+randx.Intn(8); i++ {
 		points = append(points, cursorPoint{
 			X: startX + randx.Intn(5) - 2,
 			Y: startY + randx.Intn(5) - 2,
 		})
 	}

-	transitSteps := 2 + randx.Intn(3)
+	transitSteps := 32 + randx.Intn(26)
 	arcOffX := randx.Intn(60) - 30
 	arcOffY := -(randx.Intn(30) + 10)
 	for i := 1; i <= transitSteps; i++ {
-		t := float64(i) / float64(transitSteps+1)
+		t := easeInOut(float64(i) / float64(transitSteps+1))
 		cx := float64(startX+targetX)/2 + float64(arcOffX)
 		cy := float64(startY+targetY)/2 + float64(arcOffY)
 		bx := (1-t)*(1-t)*float64(startX) + 2*t*(1-t)*cx + t*t*float64(targetX)
 		by := (1-t)*(1-t)*float64(startY) + 2*t*(1-t)*cy + t*t*float64(targetY)
-		jitter := int((1-t)*8) + 2
+		jitter := int((1-t)*5) + 1
 		points = append(points, cursorPoint{
 			X: int(math.Round(bx)) + randx.Intn(jitter*2+1) - jitter,
 			Y: int(math.Round(by)) + randx.Intn(jitter*2+1) - jitter,
 		})
+		if i%9 == 0 && randx.Intn(3) == 0 {
+			last := points[len(points)-1]
+			points = append(points, last)
+		}
 	}

-	approachSteps := 4 + randx.Intn(4)
+	approachSteps := 16 + randx.Intn(14)
 	prev := points[len(points)-1]
 	for i := 1; i <= approachSteps; i++ {
-		t := float64(i) / float64(approachSteps)
+		t := easeOut(float64(i) / float64(approachSteps))
 		ax := prev.X + int(math.Round(t*float64(targetX-prev.X))) + randx.Intn(5) - 2
 		ay := prev.Y + int(math.Round(t*float64(targetY-prev.Y))) + randx.Intn(5) - 2
 		points = append(points, cursorPoint{X: ax, Y: ay})
 	}

-	settleCount := 3 + randx.Intn(5)
+	settleCount := 18 + randx.Intn(24)
 	for i := 0; i < settleCount; i++ {
 		points = append(points, cursorPoint{
 			X: targetX + randx.Intn(7) - 3,
@@ -628,3 +667,16 @@ func buildSliderCursor(candidateIndex int, candidateCount int) string {
 	}
 	return string(data)
 }
+
+func easeInOut(t float64) float64 {
+	if t < 0.5 {
+		return 2 * t * t
+	}
+	p := -2*t + 2
+	return 1 - p*p/2
+}
+
+func easeOut(t float64) float64 {
+	p := 1 - t
+	return 1 - p*p*p
+}
@@ -3,6 +3,7 @@ package vkauth
 import (
 	"context"
 	"fmt"
+	"strings"

 	"github.com/samosvalishe/free-turn-proxy/internal/provider/vk/internal/browserprofile"
 	"github.com/samosvalishe/free-turn-proxy/internal/provider/vk/internal/captcha"
@@ -10,10 +11,7 @@ import (
 	tlsclient "github.com/bogdanfinn/tls-client"
 )

-// DefaultAutoSolve запускает in-page widget flow. Загружает сохранённый профиль
-// браузера, если доступен, - капча видит стабильные fingerprints на этапе
-// загрузки страницы и POST-запроса.
-func DefaultAutoSolve(
+func (c *Client) defaultAutoSolve(
 	ctx context.Context,
 	captchaErr *captcha.Error,
 	streamID int,
@@ -31,10 +29,25 @@ func DefaultAutoSolve(
 	}

 	var savedProfile *browserprofile.Saved
-	if sp, err := browserprofile.Load(); err == nil {
-		log.Infof("[STREAM %d] [Captcha] Using saved real browser profile", streamID)
+	switch sp, err := browserprofile.Load(); {
+	case err == nil && savedProfileUsable(*sp):
+		savedFamily := browserprofile.Family(sp.Profile)
+		log.Infof("[STREAM %d] [Captcha] Using captured browser profile (authority) family=%s mobile=%t ua=%q device=%t browser_fp=%t",
+			streamID, savedFamily, browserprofile.IsMobile(sp.Profile), sp.UserAgent, sp.DeviceJSON != "", sp.BrowserFp != "")
 		savedProfile = sp
 		profile = sp.Profile
+		if savedFamily != "" && normalizeFamily(savedFamily) != normalizeFamily(c.browser) {
+			if rebuilt, rebuildErr := c.newTLSClientForKind(savedFamily, tlsclient.NewCookieJar()); rebuildErr == nil {
+				client = rebuilt
+				log.Infof("[STREAM %d] [Captcha] Rebuilt TLS client to match captured family=%s", streamID, savedFamily)
+			} else {
+				log.Warnf("[STREAM %d] [Captcha] Failed to rebuild TLS for captured family=%s: %v; keeping -browser TLS", streamID, savedFamily, rebuildErr)
+			}
+		}
+	case err == nil:
+		log.Warnf("[STREAM %d] [Captcha] Captured profile unusable (empty UA); using -browser fallback", streamID)
+	default:
+		log.Debugf("[STREAM %d] [Captcha] No captured browser profile: %v", streamID, err)
 	}

 	successToken, err := captcha.Solve(ctx, captchaErr, streamID, client, profile, savedProfile, log)
@@ -44,3 +57,16 @@ func DefaultAutoSolve(
 	log.Infof("[STREAM %d] [Captcha] solver succeeded", streamID)
 	return successToken, nil
 }
+
+func savedProfileUsable(saved browserprofile.Saved) bool {
+	return strings.TrimSpace(saved.UserAgent) != ""
+}
+
+func normalizeFamily(k browserprofile.Kind) browserprofile.Kind {
+	switch k {
+	case browserprofile.Firefox, browserprofile.Safari:
+		return k
+	default:
+		return browserprofile.Chrome
+	}
+}
@@ -257,7 +257,9 @@ func (c *Client) fetch(ctx context.Context, link string, streamID int) (string,
 		lastErr = err
 		c.log.Warnf("[STREAM %d] [VK Auth] Failed with client_id=%s: %v", streamID, creds.ClientID, err)

-		if errors.Is(err, ErrCaptchaWaitRequired) || errors.Is(err, ErrFatalCaptchaNoStreams) {
+		if errors.Is(err, ErrCaptchaWaitRequired) || errors.Is(err, ErrFatalCaptchaNoStreams) ||
+			errors.Is(err, ErrInvalidJoinLink) || errors.Is(err, ErrAnonymousBlocked) ||
+			errors.Is(err, ErrCallFull) {
 			return "", "", nil, err
 		}
 		es := err.Error()
@@ -49,23 +49,25 @@ func (d *splitDialer) DialContext(ctx context.Context, network, addr string) (ne
 	}, nil
 }

-// clientProfile выбирает TLS/HTTP2-профиль (JA3 + client hints) под браузер.
-// JA3 обязан совпадать с UA из browserprofile.ForKind, иначе рассинхрон = флаг.
-func (c *Client) clientProfile() profiles.ClientProfile {
-	if c.browser == browserprofile.Firefox {
-		return profiles.Firefox_147
+// clientProfileForKind мапит семейство браузера в TLS/HTTP2-профиль.
+func clientProfileForKind(kind browserprofile.Kind) profiles.ClientProfile {
+	switch kind {
+	case browserprofile.Safari:
+		return profiles.Safari_16_0
+	case browserprofile.Firefox:
+		return profiles.Firefox_148
 	}
 	return profiles.Chrome_146
 }

-// newTLSClient строит tls-client с Chrome-fingerprint и фрагментацией
-// ClientHello на всех исходящих control-plane TLS-соединениях. Базовый дилер -
-// c.dialer (несёт DNS-резолвер dnsdial); фабрика вызывается без proxyUrl, поэтому
-// CONNECT не используется - splitDialer работает как прямой транспорт.
 func (c *Client) newTLSClient(jar tlsclient.CookieJar) (tlsclient.HttpClient, error) {
+	return c.newTLSClientForKind(c.browser, jar)
+}
+
+func (c *Client) newTLSClientForKind(kind browserprofile.Kind, jar tlsclient.CookieJar) (tlsclient.HttpClient, error) {
 	return tlsclient.NewHttpClient(tlsclient.NewNoopLogger(),
 		tlsclient.WithTimeoutSeconds(20),
-		tlsclient.WithClientProfile(c.clientProfile()),
+		tlsclient.WithClientProfile(clientProfileForKind(kind)),
 		tlsclient.WithCookieJar(jar),
 		tlsclient.WithProxyDialerFactory(func(_ string, timeout time.Duration, localAddr *net.TCPAddr, _ fhttp.Header, _ tlsclient.Logger) (proxy.ContextDialer, error) {
 			base := c.dialer
@@ -1,6 +1,10 @@
 package vkauth

-import "testing"
+import (
+	"testing"
+
+	"github.com/samosvalishe/free-turn-proxy/internal/provider/vk/internal/browserprofile"
+)

 func TestCaptchaSolveModeForAttempt(t *testing.T) {
 	t.Parallel()
@@ -36,3 +40,38 @@ func TestCaptchaSolveModeForAttempt(t *testing.T) {
 		}
 	})
 }
+
+func TestSavedProfileUsable(t *testing.T) {
+	t.Parallel()
+
+	if savedProfileUsable(browserprofile.Saved{}) {
+		t.Fatal("empty profile must be unusable (no UA to impersonate)")
+	}
+	if savedProfileUsable(browserprofile.Saved{Profile: browserprofile.Profile{UserAgent: "   "}}) {
+		t.Fatal("whitespace UA must be unusable")
+	}
+	mobile := browserprofile.Saved{Profile: browserprofile.Profile{
+		UserAgent:     "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36",
+		SecChUaMobile: "?1",
+	}}
+	if !savedProfileUsable(mobile) {
+		t.Fatal("captured mobile profile must be usable")
+	}
+}
+
+func TestNormalizeFamily(t *testing.T) {
+	t.Parallel()
+
+	cases := map[browserprofile.Kind]browserprofile.Kind{
+		browserprofile.Firefox: browserprofile.Firefox,
+		browserprofile.Safari:  browserprofile.Safari,
+		browserprofile.Chrome:  browserprofile.Chrome,
+		"":                     browserprofile.Chrome,
+		"weird":                browserprofile.Chrome,
+	}
+	for in, want := range cases {
+		if got := normalizeFamily(in); got != want {
+			t.Fatalf("normalizeFamily(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	neturl "net/url"
+	"strings"
 	"time"

 	"github.com/samosvalishe/free-turn-proxy/internal/provider/vk/internal/browserprofile"
@@ -43,6 +44,10 @@ func (c *Client) fetchCallToken(
 				data = retryData
 				continue
 			}
+			if termErr := classifyLinkError(errObj); termErr != nil {
+				c.log.Errorf("[STREAM %d] [VK Auth] terminal link error: %v", streamID, termErr)
+				return "", termErr
+			}
 			return "", fmt.Errorf("VK API error: %v", errObj)
 		}

@@ -58,6 +63,48 @@ func (c *Client) fetchCallToken(
 	}
 }

+// classifyLinkError распознаёт ТЕРМИНАЛЬНЫЕ ответы VK в join-флоу и возвращает
+// соответствующий sentinel (или nil, если ошибку можно ретраить дальше по
+// client_id). Терминал = ни client_id, ни captcha не помогут, поэтому fast-fail
+// вместо бесконечного цикла "решить captcha -> ошибка -> следующий client_id".
+//
+// Порядок важен: сначала явные коды (терминальные и транзиентные), и только для
+// неизвестного кода - матч по тексту error_msg. Так текстовый матч не может
+// перекрыть транзиентный код (5 auth-failed, 6/9/29 rate/flood, 14 captcha) и
+// убить рабочее подключение из-за подстроки в сообщении.
+func classifyLinkError(errObj map[string]any) error {
+	code := 0
+	if f, ok := errObj["error_code"].(float64); ok {
+		code = int(f)
+	}
+
+	// Явные терминальные коды: 9008 Join link is not valid, 9000 Call not found.
+	if code == 9000 || code == 9008 {
+		return ErrInvalidJoinLink
+	}
+	// Явные транзиентные коды: гасить нельзя, текст ниже к ним не применяем.
+	switch code {
+	case 5, 6, 9, 14, 29:
+		return nil
+	}
+
+	// Код неизвестен/плавает - осторожный матч по тексту.
+	msg := ""
+	if s, ok := errObj["error_msg"].(string); ok {
+		msg = strings.ToLower(s)
+	}
+	switch {
+	case strings.Contains(msg, "not valid") || strings.Contains(msg, "not found"):
+		return ErrInvalidJoinLink
+	// Анонимный вход запрещён. Матчим по "anonym" (не "authoriz" - коллизия с auth-failed).
+	case strings.Contains(msg, "anonym"):
+		return ErrAnonymousBlocked
+	case strings.Contains(msg, "full"):
+		return ErrCallFull
+	}
+	return nil
+}
+
 // solveCaptcha выполняет одну попытку решения captcha и возвращает тело POST
 // для следующего retry или ошибку при исчерпании всех режимов.
 func (c *Client) solveCaptcha(
@@ -87,7 +134,7 @@ func (c *Client) solveCaptcha(
 	case CaptchaSolveModeAuto:
 		solveFn := c.autoSolver
 		if solveFn == nil {
-			solveFn = DefaultAutoSolve
+			solveFn = c.defaultAutoSolve
 		}
 		if captchaErr.SessionToken != "" && captchaErr.RedirectURI != "" {
 			successToken, solveErr = solveFn(ctx, captchaErr, streamID, httpClient, profile)
@@ -36,7 +36,9 @@ func (c *Client) doRequest(ctx context.Context, httpClient tlsclient.HttpClient,
 	req.Header.Set("Sec-Fetch-Site", "same-site")
 	req.Header.Set("Sec-Fetch-Mode", "cors")
 	req.Header.Set("Sec-Fetch-Dest", "empty")
-	req.Header.Set("Priority", "u=1, i")
+	if browserprofile.Family(profile) != browserprofile.Firefox {
+		req.Header.Set("Priority", "u=1, i")
+	}

 	httpResp, err := httpClient.Do(req)
 	if err != nil {
@@ -59,4 +59,19 @@ var (
 	ErrCaptchaWaitRequired   = errors.Join(provider.ErrBackoffActive, errors.New("CAPTCHA_WAIT_REQUIRED"))
 	ErrFatalCaptchaNoStreams = errors.Join(provider.ErrFatalNoStreams, errors.New("FATAL_CAPTCHA_FAILED_NO_STREAMS"))
 	ErrLockoutActive         = errors.New("global lockout active")
+
+	// Terminal call/link errors: retrying other client_ids or solving the captcha
+	// won't help — only the user changing the link / call settings will. We fast-
+	// fail on these instead of looping "solve captcha -> error -> next credential"
+	// forever, and the joined provider.ErrFatalNoStreams lets the host surface a
+	// specific, actionable message.
+	//
+	// ErrInvalidJoinLink: VK 9008 "Join link is not valid" (broken link) or 9000
+	// "Call not found" (the call ended / no longer exists).
+	ErrInvalidJoinLink = errors.Join(provider.ErrFatalNoStreams, errors.New("INVALID_JOIN_LINK"))
+	// ErrAnonymousBlocked: the call is live but anonymous join is disabled
+	// ("authorized users only") — the user must allow joining by link in VK.
+	ErrAnonymousBlocked = errors.Join(provider.ErrFatalNoStreams, errors.New("ANON_BLOCKED"))
+	// ErrCallFull: the call has reached its participant limit.
+	ErrCallFull = errors.Join(provider.ErrFatalNoStreams, errors.New("CALL_FULL"))
 )
@@ -32,7 +32,7 @@ type Config struct {
 	// ManualOnly форсирует ручной путь captcha с первой попытки.
 	ManualOnly bool

-	// Browser - браузерный профиль control-plane: "chrome" | "firefox".
+	// Browser - браузерный профиль control-plane: "chrome" | "firefox" | "safari".
 	// Пустое -> firefox (дефолт продукта).
 	Browser string

@@ -271,16 +271,11 @@ func createSmuxSession(ctx context.Context, deps *Deps, params *Params, peer *ne
 		return nil, nil, fmt.Errorf("send client ID: %w", werr)
 	}

-	statsCtx, statsCancel := context.WithCancel(ctx) //nolint:gosec // cancel is held in cleanupFns and invoked via cleanup() LIFO
-	cleanupFns = append(cleanupFns, statsCancel)
-	st := stats.New(deps.log().DebugEnabled())
-	go st.LogEvery(statsCtx, deps.log().Debugf, fmt.Sprintf("[session %d] TCP", id), "to-turn", "from-turn")
-
 	var countedConn net.Conn = dtlsConn
 	if params.TrafficStats != nil {
 		countedConn = &stats.CountingConn{Conn: countedConn, Stats: params.TrafficStats}
 	}
-	kcpSess, err := kcptun.NewKCPOverDTLS(&stats.CountingConn{Conn: countedConn, Stats: st}, false, params.KCPProfile, params.KCPFEC)
+	kcpSess, err := kcptun.NewKCPOverDTLS(countedConn, false, params.KCPProfile, params.KCPFEC)
 	if err != nil {
 		cleanup()
 		return nil, nil, fmt.Errorf("KCP session: %w", err)
@@ -14,7 +14,6 @@ import (
 	"github.com/samosvalishe/free-turn-proxy/internal/logx"
 	"github.com/samosvalishe/free-turn-proxy/internal/netconn"
 	"github.com/samosvalishe/free-turn-proxy/internal/proxy/bondserver"
-	"github.com/samosvalishe/free-turn-proxy/internal/stats"
 	"github.com/samosvalishe/free-turn-proxy/internal/transport/kcptun"
 	"github.com/samosvalishe/free-turn-proxy/internal/wire/bondframe"
 	"github.com/xtaci/smux"
@@ -24,18 +23,7 @@ import (
 // TCP-соединение к connectAddr. Потоки, чьи первые 4 байта совпадают с bond magic,
 // передаются в registry.
 func Handle(ctx context.Context, logger logx.Logger, registry *bondserver.Registry, dtlsConn net.Conn, connectAddr string, kcpProfile kcptun.Profile, kcpFEC kcptun.FEC) {
-	statsCtx, statsCancel := context.WithCancel(ctx)
-	defer statsCancel()
-	st := stats.New(logger.DebugEnabled())
-	go st.LogEvery(
-		statsCtx,
-		logger.Debugf,
-		"[VLESS "+dtlsConn.RemoteAddr().String()+"]",
-		"to-client",
-		"from-client",
-	)
-
-	kcpSess, err := kcptun.NewKCPOverDTLS(&stats.CountingConn{Conn: dtlsConn, Stats: st}, true, kcpProfile, kcpFEC)
+	kcpSess, err := kcptun.NewKCPOverDTLS(dtlsConn, true, kcpProfile, kcpFEC)
 	if err != nil {
 		logger.Errorf("tcpfwdserver: KCP session: %s", err)
 		return
@@ -14,7 +14,6 @@ import (
 	"github.com/samosvalishe/free-turn-proxy/internal/provider"
 	"github.com/samosvalishe/free-turn-proxy/internal/proxy/common"
 	"github.com/samosvalishe/free-turn-proxy/internal/randx"
-	"github.com/samosvalishe/free-turn-proxy/internal/stats"
 	"github.com/samosvalishe/free-turn-proxy/internal/wire/shape"
 )

@@ -258,8 +257,6 @@ func oneTURN(ctx context.Context, deps *Deps, params *Params, peer *net.UDPAddr,

 	wg := sync.WaitGroup{}
 	turnctx, turncancel := context.WithCancel(ctx)
-	st := stats.New(deps.log().DebugEnabled())
-	go st.LogEvery(turnctx, deps.log().Debugf, fmt.Sprintf("[STREAM %d] TURN", streamID), "to-turn", "from-turn")

 	context.AfterFunc(turnctx, func() {
 		if err := relayConn.SetDeadline(time.Now()); err != nil {
@@ -330,7 +327,6 @@ func oneTURN(ctx context.Context, deps *Deps, params *Params, peer *net.UDPAddr,
 			}

 			written, err1 := relayConn.WriteTo(out, peer)
-			st.AddTx(written)
 			if params.TrafficStats != nil {
 				params.TrafficStats.AddTx(written)
 			}
@@ -367,7 +363,6 @@ func oneTURN(ctx context.Context, deps *Deps, params *Params, peer *net.UDPAddr,
 					}
 					payload = p
 				}
-				st.AddRx(len(payload))
 				if params.TrafficStats != nil {
 					params.TrafficStats.AddRx(len(payload))
 				}
@@ -4,13 +4,11 @@ package udpserver

 import (
 	"context"
-	"fmt"
 	"net"
 	"sync"
 	"time"

 	"github.com/samosvalishe/free-turn-proxy/internal/logx"
-	"github.com/samosvalishe/free-turn-proxy/internal/stats"
 )

 const (
@@ -34,14 +32,6 @@ func Handle(ctx context.Context, logger logx.Logger, conn net.Conn, connectAddr

 	ctx2, cancel := context.WithCancel(ctx)
 	defer cancel()
-	st := stats.New(logger.DebugEnabled())
-	go st.LogEvery(
-		ctx2,
-		logger.Debugf,
-		fmt.Sprintf("[DTLS %s]", conn.RemoteAddr()),
-		"dtls-to-backend",
-		"backend-to-dtls",
-	)

 	context.AfterFunc(ctx2, func() {
 		if err := conn.SetDeadline(time.Now()); err != nil {
@@ -55,18 +45,18 @@ func Handle(ctx context.Context, logger logx.Logger, conn net.Conn, connectAddr
 	var wg sync.WaitGroup
 	wg.Go(func() {
 		defer cancel()
-		copyOne(ctx2, logger, conn, serverConn, st.AddTx)
+		copyOne(ctx2, logger, conn, serverConn)
 	})
 	wg.Go(func() {
 		defer cancel()
-		copyOne(ctx2, logger, serverConn, conn, st.AddRx)
+		copyOne(ctx2, logger, serverConn, conn)
 	})
 	wg.Wait()
 }

 // copyOne читает из src и пишет в dst до отмены ctx или ошибки любой стороны.
 // Каждый read/write сбрасывает idle timeout - зависший конец закрывается, а не висит.
-func copyOne(ctx context.Context, logger logx.Logger, src, dst net.Conn, count func(int)) {
+func copyOne(ctx context.Context, logger logx.Logger, src, dst net.Conn) {
 	buf := make([]byte, udpRelayBufSize)
 	for {
 		select {
@@ -87,9 +77,7 @@ func copyOne(ctx context.Context, logger logx.Logger, src, dst net.Conn, count f
 			logger.Errorf("udpserver: set write deadline: %s", werr)
 			return
 		}
-		written, werr := dst.Write(buf[:n])
-		count(written)
-		if werr != nil {
+		if _, werr := dst.Write(buf[:n]); werr != nil {
 			logger.Debugf("udpserver: write: %s", werr)
 			return
 		}
@@ -3,15 +3,13 @@
 package stats

 import (
-	"context"
 	"fmt"
 	"net"
 	"sync/atomic"
 	"time"
 )

-// Stats хранит счётчики tx/rx байт. При enabled=false Add* - no-op,
-// LogEvery возвращается сразу (поведение под isDebug).
+// Stats хранит счётчики tx/rx байт. При enabled=false Add* - no-op.
 type Stats struct {
 	tx      atomic.Uint64
 	rx      atomic.Uint64
@@ -49,49 +47,6 @@ func (s *Stats) AddRx(n int) {
 	s.rx.Add(uint64(n))
 }

-// LogEvery каждые 5с печатает сводку пропускной способности через logf,
-// пока не отменён ctx. No-op, если Stats выключен.
-func (s *Stats) LogEvery(ctx context.Context, logf func(string, ...any), label, txName, rxName string) {
-	if !s.enabled {
-		return
-	}
-
-	ticker := time.NewTicker(5 * time.Second)
-	defer ticker.Stop()
-
-	var prevTx, prevRx uint64
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			tx := s.tx.Load()
-			rx := s.rx.Load()
-			deltaTx := tx - prevTx
-			deltaRx := rx - prevRx
-			prevTx = tx
-			prevRx = rx
-
-			if deltaTx == 0 && deltaRx == 0 {
-				continue
-			}
-
-			logf(
-				"%s throughput: %s=%s %s=%s total_%s=%s total_%s=%s",
-				label,
-				txName,
-				FormatBitsPerSecond(deltaTx, 5*time.Second),
-				rxName,
-				FormatBitsPerSecond(deltaRx, 5*time.Second),
-				txName,
-				FormatByteCount(tx),
-				rxName,
-				FormatByteCount(rx),
-			)
-		}
-	}
-}
-
 // FormatBitsPerSecond форматирует пропускную способность из числа байт и интервала.
 func FormatBitsPerSecond(bytes uint64, interval time.Duration) string {
 	if interval <= 0 {
@@ -17,6 +17,7 @@ import (
 	"github.com/pion/logging"
 	"github.com/pion/turn/v5"
 	"github.com/samosvalishe/free-turn-proxy/internal/netconn"
+	"github.com/samosvalishe/free-turn-proxy/internal/netctl"
 	"github.com/samosvalishe/free-turn-proxy/internal/randx"
 )

@@ -83,10 +84,15 @@ func Open(ctx context.Context, cfg Config, peer *net.UDPAddr, user, pass, rawAdd
 		closeConn func() error
 	)
 	if cfg.TransportUDP {
-		c, derr := net.DialUDP("udp", nil, turnServerUDPAddr) //nolint:noctx
+		raw, derr := (&net.Dialer{Control: netctl.Apply}).Dial("udp", turnServerUDPAddr.String())
 		if derr != nil {
 			return nil, fmt.Errorf("dial TURN (udp): %w", derr)
 		}
+		c, ok := raw.(*net.UDPConn)
+		if !ok {
+			_ = raw.Close()
+			return nil, fmt.Errorf("turndial: expected *net.UDPConn, got %T", raw)
+		}
 		turnConn = &netconn.ConnectedUDPConn{UDPConn: c}
 		closeConn = c.Close
 	} else {
@@ -0,0 +1,30 @@
+package mobile
+
+import (
+	"syscall"
+
+	"github.com/samosvalishe/free-turn-proxy/internal/netctl"
+)
+
+// Protector is implemented by the host to keep the client's own sockets out of
+// a VPN tunnel it is feeding. On Android that is VpnService.protect(fd); on
+// other tun-based hosts the equivalent. Without it the client's TURN / VK API /
+// DNS traffic is routed back into the tunnel and the connection deadlocks.
+type Protector interface {
+	// Protect is invoked once for every outbound socket the client opens, with
+	// the socket's raw file descriptor, before it connects.
+	Protect(fd int) bool
+}
+
+// SetProtect installs the host socket protector. Pass nil to clear it (the
+// default is a no-op, so desktop builds are unaffected). May be called before
+// or after Start; it is read at dial time.
+func SetProtect(p Protector) {
+	if p == nil {
+		netctl.SetControl(nil)
+		return
+	}
+	netctl.SetControl(func(_, _ string, c syscall.RawConn) error {
+		return c.Control(func(fd uintptr) { p.Protect(int(fd)) })
+	})
+}
Author	SHA1	Message	Date
Anton	859c7ff683	Merge pull request #42 from samosvalishe/release-please--branches--master chore(master): release 1.7.0	2026-07-02 21:22:33 +03:00
Anton	f3d8da6919	chore(master): release 1.7.0	2026-07-02 12:30:15 +03:00
samosvalishe	b391d7bf25	fix(vkauth): классификация terminal-ошибок по коду перед текстом Транзиентные коды (5, 6, 9, 14, 29) короткозамыкаются в nil до матча по error_msg, поэтому подстрока в сообщении больше не может пометить рабочую ошибку как терминальную и уронить подключение через ErrFatalNoStreams.	2026-07-02 12:28:31 +03:00
Anton	0a6bc0ae4f	Merge pull request #36 from smediainfo/feat/host-socket-protect feat(mobile): add host socket protector (SetProtect) for tun/VPN hosts	2026-07-01 19:30:28 +03:00
Anton	805228e62a	Merge pull request #35 from smediainfo/feat/terminal-link-errors fix(vkauth): fast-fail on terminal call/link errors (9000/9008, anonymous-only, full)	2026-07-01 19:29:28 +03:00
Anton	b2e1d02b8f	Merge pull request #38 from samosvalishe/release-please--branches--master chore(master): release 1.6.0	2026-06-30 19:19:47 +03:00
Anton	4824bff766	chore(master): release 1.6.0	2026-06-30 19:17:05 +03:00
samosvalishe	12161aed4a	feat(vk): улучшение браузерных отпечатков для captcha - Добавлена поддержка Safari в -browser. Обновлена валидация флага, документация и выбор TLS/HTTP2-профиля для chrome, firefox и safari. - Улучшено переиспользование сохранённого браузерного профиля. Добавлен VK_PROFILE_PATH, сохраняется Accept-Language, определяется семейство браузера и mobile-профиль, а TLS-клиент пересобирается под захваченный UA. - Обновлена форма запросов VK Smart Captcha. Учитываются domain из redirect_uri, id.vk.ru origin/referer, settings_key для slider captcha, сохранённый browser_fp и device JSON. - Улучшено автоматическое решение captcha. Обновлён формат PoW-ответа, добавлена mobile accelerometer телеметрия, NetworkInformation отправляется только для Chromium-профилей, а slider solver получил обратный скоринг и более естественные cursor traces. - Убрано шумное throughput debug-логирование в relay-путях. Удалён Stats.LogEvery и его вызовы в UDP/TCP relay, при этом агрегированная TrafficStats-статистика сохранена. - Обновлены тесты и инфраструктура сборки. Добавлены проверки Safari, browser profile storage, captcha telemetry и saved-profile fallback; tls-client обновлён до v1.15.1; Android bind в Taskfile разделён для Windows и Unix-платформ	2026-06-30 19:16:35 +03:00
smediainfo	3481de79a3	feat(mobile): add host socket protector (SetProtect) for tun/VPN hosts Checked type assertions (errcheck) and Close() error returns to satisfy golangci-lint.	2026-06-28 15:31:04 +03:00
smediainfo	014f964ad9	fix(vkauth): fast-fail on terminal call/link errors (9000/9008, anonymous-only, full)	2026-06-28 15:21:28 +03:00