Release 2.7.3.1: harden proxy recovery, updates and local API.

Restore orphaned system proxy after crash, require update SHA-256, add macOS /api auth token, fix UDP ping false positives, HTTPS-only subscriptions, and keep the UI responsive during connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/update/update.go

@@ -18,11 +18,11 @@ import (
 
 // CurrentVersion is the product/semver used for update eligibility (feed "version").
 // Keep major.minor.patch only — no build suffix here.
-const CurrentVersion = "2.7.2"
+const CurrentVersion = "2.7.3"
 
 // BuildNumber is the monotonic build within CurrentVersion (Windows FileVersion 4th part,
 // macOS CFBundleVersion suffix, Android versionCode low digits). Bump on every release build.
-const BuildNumber = 2
+const BuildNumber = 1
 
 // DefaultManifestURL is the update feed (hosted in the project git repo).
 const DefaultManifestURL = "https://git.evilfox.cc/test2/navi/raw/branch/main/dist/update.json"
@@ -289,16 +289,18 @@ func prepareDownload(ctx context.Context, manifestURL string) (latest, url, sha,
 			}
 		}
 	}
-	if wantSHA != "" {
-		sum, err := fileSHA256(tmp)
-		if err != nil {
-			_ = os.Remove(tmp)
-			return "", "", "", "", "", err
-		}
-		if !strings.EqualFold(sum, wantSHA) {
-			_ = os.Remove(tmp)
-			return "", "", "", "", "", fmt.Errorf("checksum mismatch")
-		}
+	if wantSHA == "" {
+		_ = os.Remove(tmp)
+		return "", "", "", "", "", fmt.Errorf("в манифесте нет sha256 — обновление отклонено")
+	}
+	sum, err := fileSHA256(tmp)
+	if err != nil {
+		_ = os.Remove(tmp)
+		return "", "", "", "", "", err
+	}
+	if !strings.EqualFold(sum, wantSHA) {
+		_ = os.Remove(tmp)
+		return "", "", "", "", "", fmt.Errorf("checksum mismatch")
 	}
 	return st.Latest, st.URL, wantSHA, exe, tmp, nil
 }