v1.6.0 — Fast First Connect + Stability Fix

What's New

Connection Speed (Critical)

First connect time reduced from 8–20 seconds to 1–3 seconds on DPI-blocked networks.

• Parallel Race: Direct WS vs CF Fallback — on first connect, both direct WebSocket and Cloudflare fallback are launched simultaneously. The faster one wins and bridges immediately.
• CF-Proven Fast Path — after 2+ successful CF connections to a DC, direct attempts are skipped for 5 minutes. Automatically recovers when network conditions improve.
• Aggressive timeout tuning — CF proxy 6s→3s, DoH 8s→3s, race cap 6.5s→4.5s, TLS handshake 8s→5s.
• Zero-delay fallback — known-blocked DCs skip the race entirely and go straight to CF fallback.
• Deadlock-free TLS — TLS handshakes run on a dedicated thread pool, separate from the parallel connect pool. Previously they shared one pool, causing a deadlock where all threads blocked waiting for TLS and no connection could complete.

Stability (Critical)

• Fixed proxy hanging after hours — removed permanent CF-fallback lock-in that blocked direct WebSocket reconnections after a single CF success. CF success counters now decay every 5 minutes so direct paths are automatically retried.
• Fixed broken WebSocket pool health check — dead sockets were handed to clients because pingPongCheck() never completed correctly. Now uses a simple !isClosed check.
• WebSocket read timeout — set 70-second soTimeout on TLS socket so threads are freed instead of leaking forever on silent network drops (common on mobile / Doze).
• Service restart robustness — restart alarm now falls back to setAndAllowWhileIdle on devices that restrict exact alarms.

---

Full Changelog (v1.5.0 → v1.6.0)

v1.6.0 — Connection Speed + Stability

• Parallel Race: direct WS vs CF fallback on first connect (1–3s vs 8–20s)
• CF-Proven Fast Path: skip direct after 2+ CF successes, auto-recover
• Fixed thread pool deadlock: separate tlsHandshakeExecutor for TLS
• Fixed slow first connect: CF 3s, DoH 3s, race 4.5s, TLS 5s, no 150ms CF delay
• Skip race for known-blocked DCs → instant CF fallback
• Removed permanent CF lock-in; CF success decays every 5 min
• Fixed pool health check: !isClosed instead of broken recv() PING
• sslSocket.soTimeout = 70_000 (was 0/infinite)
• Service restart fallback: setAndAllowWhileIdle for restricted devices

---

How to Install

⚠️ Google Play Protect warning is expected for open-source apps. Tap "Install anyway" (or "More details → Install anyway").

Method A — APK (recommended)

1. Download tg-ws-proxy-android.apk below.
2. Transfer to your Android device (Telegram Saved Messages, USB, or cloud storage).
3. Open the APK — Android will prompt to allow installation from this source. Grant permission.
4. Install and open the app.
5. Tap Start to launch the proxy.
6. Copy the generated link and paste it into Telegram → Settings → Data and Storage → Proxy Settings → Add Proxy.

Method B — Build from Source

See BUILD.md for full instructions.

---

Requirements

• Android 8.0+ (API 26+)
• Telegram app (any client that supports MTProto proxy links, e.g. official, Forkgram, ForkgramX, Nekogram, Nagram)

---

Known Issues

Issue	Description	Workaround
Samsung freeze	Device Care may throttle foreground service after ~30 min of inactive screen	Fixed in v1.5.0 via WakeLock refresh + dataSync service type
CF domain DNS failures	Some domains in the CF pool are dead (NXDOMAIN). Balancer blacklists them, but first-time startup may try a few dead ones	Upgrade to v1.6.0 (3s timeout per domain, auto-blacklist)

---

Assets

File	SHA-256
tg-ws-proxy-android.apk	(see artifact)

---

Links

• Full Changelog
• Source Code
• Report an Issue
• Original tg-ws-proxy (desktop)

v1.6.0-beta4-hf — Race + TLS handshake timeout

What's New (Beta v1.6.0-beta4 — Race Fix)

Fixed — First Connection Speed (5-9s → <2s)

The previous beta (beta3-hf) worked correctly, but the first connection after enabling proxy took 5-9 seconds. This beta fixes that with a parallel race between Direct WS and CF fallback.

• Parallel race on first connect: handleClient() now launches direct WS and CF fallback simultaneously via coroutines. The winner (whichever connects first) is used immediately, the loser is cancelled and its socket cleaned up. This cuts first-connect time from ~5-9s down to ~1-2s on blocked networks.
• CF staggered by 150ms: CF connection starts 150ms after direct, because CF involves extra DNS resolution latency. On unblocked networks direct wins fast; on blocked networks CF wins seconds before direct would timeout.
• Reuses existing cfproxyConnectOnly(): Extracted CF-only connection logic so both raceConnection() and doFallback() share the same connection code without duplication.
• CF-proven mode preserved: Once 2+ CF successes accumulate, subsequent connections skip direct entirely (CF proven active, skipping direct), just like before.

Previously Fixed (beta1-beta3)

• Removed permanent CF-fallback lock-in (CF_SUCCESS_THRESHOLD removed)
• CF-success decay every 5 minutes via background cleanup
• Fixed broken WebSocket pool health check (infinite blocking recv() → !isClosed)
• WebSocket read timeout 70s (was infinite, caused thread leaks)
• Service restart robustness (no double-restart loop)
• Hotfix: restored missing doFallback() call after direct WS failure

---

Full Changelog

See CHANGELOG.md.

---

How to Test

1. Download tg-ws-proxy-android-beta.apk below.
2. Transfer to your Android device and install.
3. Test first connect: enable proxy on mobile data (blocked network). Telegram should connect within 1-3 seconds instead of 5-9.
4. Test reconnection: close Telegram, reopen — should reconnect instantly.
5. Longevity: leave running for 30+ min, verify no hangs.
6. Share logs via Logs tab → Share if issues occur.

---

Requirements

• Android 8.0+ (API 26+)
• Telegram app (any MTProto proxy client)

---

Assets

File	SHA-256
tg-ws-proxy-android-beta.apk	(see artifact below)

---

Links

• Full Changelog
• Source Code (beta branch)
• Report an Issue

v1.5.0 — Samsung/Android 16 Stability

What's New

Samsung / Android 16 Stability (Critical)

This release fixes the "works then freezes after 10–15 minutes" pattern reported on Samsung Galaxy devices and Android 16.

• WakeLock + WifiLock: ProxyService now acquires PARTIAL_WAKE_LOCK and adaptive WifiLock to keep the radio active during long-running proxy sessions.
• WakeLock refresh loop: A background coroutine re-acquires the WakeLock every 25 minutes, preventing Samsung Device Care from letting it expire after the 30-minute window.
• Foreground service type dataSync: Replaced specialUse with dataSync in AndroidManifest.xml, along with the required FOREGROUND_SERVICE_DATA_SYNC permission. Android 16+ is less aggressive with this foreground service type.
• Sticky restart safety: Service now uses START_REDELIVER_INTENT so the last valid Intent is replayed automatically after system-initiated restarts.
• Explicit WakeLock release: Both WakeLock and WifiLock are released explicitly in stopProxy(), preventing battery drain if the service crashes.

---

Full Changelog (v1.3.0 → v1.5.0)

v1.5.0 — Samsung/Android 16 Stability

• PARTIAL_WAKE_LOCK (30 min) + adaptive WifiLock (LOW_LATENCY on Android 10+, HIGH_PERF fallback)
• WakeLock refresh every 25 min via Kotlin Coroutine
• START_REDELIVER_INTENT for reliable sticky restarts
• foregroundServiceType="dataSync" + FOREGROUND_SERVICE_DATA_SYNC permission
• Explicit releaseWakeLocks() and cancel wakeLockRefreshJob on stopProxy()
• Auto-generated secret on first launch

v1.4.0 — Localization & UX

• Russian & English localization (system auto-detect + manual switch)
• In-app Help page (? button in toolbar)
• Check for Updates (manual button + optional auto-check on startup)
• New toggles in Bypass Settings: WS Frame Padding, DoH Rotation

v1.3.0 — DPI Bypass Hardening

• WS Frame Fragmentation: splits large payloads into random-sized chunks (512–4096 bytes)
• WS Frame Padding (self-describing u16_be length-prefix format)
• DoH Endpoint Rotation between Cloudflare / Google / Quad9

---

How to Install

⚠️ Google Play Protect warning is expected for open-source apps. Tap "Install anyway" (or "More details → Install anyway").

Method A — APK (recommended)

1. Download tg-ws-proxy-android.apk below.
2. Transfer to your Android device (Telegram Saved Messages, USB, or cloud storage).
3. Open the APK — Android will prompt to allow installation from this source. Grant permission.
4. Install and open the app.
5. Tap Start to launch the proxy.
6. Copy the generated link and paste it into Telegram → Settings → Data and Storage → Proxy Settings → Add Proxy.

Method B — Build from Source

See BUILD.md for full instructions.

---

Requirements

• Android 8.0+ (API 26+)
• Telegram app (any client that supports MTProto proxy links, e.g. official, Forkgram, ForkgramX, Nekogram, Nagram)

---

Known Issues

Issue	Description	Workaround
Samsung freeze	Device Care may throttle foreground service after ~30 min of inactive screen	Fixed in v1.5.0 via WakeLock refresh + dataSync service type

---

Assets

File	SHA-256
tg-ws-proxy-android.apk	(see artifact)

---

Links

• Full Changelog
• Source Code
• Report an Issue
• Original tg-ws-proxy (desktop)

v1.5.0-beta — Samsung/Android 16 Stability Fix (build 2)

v1.5.0-beta — Samsung/Android 16 Stability Fix (build 2)

What's changed in this build

• WakeLock refresh loop: Re-acquires PARTIAL_WAKE_LOCK every 25 minutes before Samsung's 30-minute timeout expires. Prevents network I/O from being suspended after ~30 minutes of inactive screen.
• START_REDELIVER_INTENT: When the service is sticky-restarted by the system, the last Intent is re-delivered so configuration isn't lost (more reliable than START_STICKY with null intent on Samsung).
• Adaptive WifiLock: WIFI_MODE_FULL_LOW_LATENCY on Android 10+, WIFI_MODE_FULL_HIGH_PERF on older devices — keeps radio active during proxy operations.
• Foreground service type: Changed from specialUse to dataSync in AndroidManifest.xml — Android 16+ is less aggressive with dataSync foreground services in App Standby Buckets.

For testing

Install this APK on a Galaxy S24 (or any device with One UI / Android 16).
The proxy should stay stable for >30 minutes without freezing, retry storms, or connection drops.

⚠️ Beta disclaimer

This is a pre-release build for testing only. Do not use as your daily driver unless instructed.

Known limitations

• If you experience issues, try disabling "CF Proxy priority" in Bypass Settings — some operators block CF Workers.
• Ensure the app is set to Battery → Unrestricted in Samsung Device Care.

---

SHA-256: ...

v1.4.0 — Localization, Help & Update Check

What's Changed

Added

• Russian & English Localization: Auto-detect system locale; manual language switcher in Bypass Settings (Auto / Russian / English).
• In-app Help: Localized HTML help (help_ru.html, help_en.html) loaded from assets. Covers all settings, bypass modes, logs, and tips.
• Check for Updates: GitHub releases/latest API check with 1h rate-limit and ETag caching. Auto-check on startup (toggleable in Bypass Settings). Manual check button in toolbar.
• UI Switches: Added ws_frame_padding and doh_rotation toggles to the Bypass Settings card.

Fixed

• Stable release tag: v1.4.0 drop beta suffix.

Full Changelog

v1.3.0...v1.4.0

Assets

• tg-ws-proxy-android.apk — release APK (versionCode 5, versionName 1.4.0)

v1.3.0 — WS Fragmentation, DoH Rotation & Self-Describing Padding

What's Changed

Added

• WS Frame Fragmentation: Large MTProto payloads are split into binary + continuation frames with random chunk sizes (512–4096 bytes). Reduces fixed-size signature exposure to DPI.
• Self-Describing WS Frame Padding: Each frame carries a u16_be length-prefix header followed by random padding: [u16_be payloadLen] [payload] [pad]. Safe to strip, AES-CTR-proof, disabled by default. Controlled via wsFramePadding, wsFramePaddingMinBytes, wsFramePaddingMaxBytes.
• DoH Endpoint Rotation: DoHResolver rotates through Cloudflare/Google/Quad9 via atomic round-robin. Reduces single-provider lock-in. Enabled by default via dohRotation.

Fixed (from v1.2.0)

• OutOfMemoryError from unbounded thread spawning → bounded thread pools
• ForegroundServiceDidNotStartInTimeException on sticky restart
• Graceful OOM shutdown with CoroutineExceptionHandler + UncaughtExceptionHandler
• Dead socket detection in pool with PING/PONG check
• Exponential backoff + adaptive jitter for CF domain blacklist

Full Changelog

v1.2.0...v1.3.0

Known Limitations

• Padding is disabled by default and only safe when both sides support length-prefix stripping. For standard operation (padding off), proxy behaves identically to v1.2.0.

v1.3.0-beta — WS Fragmentation + Self-Describing Padding + DoH Rotation

What's Changed

Added

• WS Frame Fragmentation + Padding: RawWebSocket.send() splits large MTProto payloads into binary + continuation frames with random chunk size (512–4096 bytes). Frames carry self-describing padding with a u16_be length-prefix: [u16_be payloadLen] [payload] [randomPadding]. This allows safe stripping on the receiving side and helps avoid fixed-size signature detection. Disabled by default; controlled via ProxyConfig.wsFramePadding / Min / Max.
• DoH Endpoint Rotation: DoHResolver rotates through providers (Cloudflare → Google → Quad9) via atomic round-robin. Each call starts from a different endpoint. Controlled by ProxyConfig.dohRotation (default true).

Fixed

• Padding format changed from naive trailing-padding to self-describing length-prefix, preventing MTProto framing corruption and ensuring safe pass-through via CF Worker.

Config

• wsFramePadding: Boolean = false
• wsFramePaddingMinBytes: Int = 8
• wsFramePaddingMaxBytes: Int = 32
• dohRotation: Boolean = true

⚠️ Beta build. Test before production use.

v1.2.0 — Stable Release

What's Changed (v1.2.0)

Fixed (Critical Stability)

• OutOfMemoryError: unable to create new native thread — connectParallel and WsPool.refill now use bounded thread pools (8 and 4 threads). Prevents crash under heavy fallback load.
• ForegroundServiceDidNotStartInTimeException — startForeground() called immediately in onStartCommand(), before any branching.
• Graceful OOM shutdown — CoroutineExceptionHandler + Thread.setDefaultUncaughtExceptionHandler for clean shutdown on memory exhaustion.
• Dead sockets from pool — pingPongCheck() validates pooled WS with PING/PONG (3s timeout) before handing to client.
• CF domain hammering — Exponential backoff TTL (*2^(failCount-1), cap 30 min) + adaptive jitter.

Full Changelog

v1.1.1...v1.2.0

v1.1.1 — Stability fixes after real-world DPI testing

What's Changed

Critical Stability Fixes

• Fixed NullPointerException in connectParallel() → app no longer crashes on failed socket connect
• Fixed ForegroundServiceDidNotStartInTimeException → service survives sticky restart on Android 12+
• Fixed socket FD exhaustion → parallel connect loser sockets are now closed properly
• Fixed global SSLSocketFactory poisoning → DoH no longer corrupts JVM-wide SSL defaults
• Fixed client read timeout → increased from 10s to 30s for MTProto handshake silence

New

• Added MIT LICENSE
• Added CHANGELOG.md and AGENTS.md
• Added unit tests (JUnit 4) for Balancer, DoHResolver, RawWebSocket
• Screenshot and SHA-256 checksum in README

SHA-256 of tg-ws-proxy-android.apk

94BC618BFB18A57852728513C616CC9A9AEE9A00F11637079E72023D9B8717F7

Attribution

Based on tg-ws-proxy by Flowseal.
Thank you for the original DPI-bypass architecture!

v1.1.1-beta — Stability & Performance Improvements

Beta Release: v1.1.1-beta

Improvements

• Thread pool limits: connectParallel (8 threads) and WsPool.refill (4 threads) now use bounded ExecutorService to prevent OOM crashes.
• Pool health-check: WebSocket PING/PONG check before yielding from pool and before adding to pool during refill.
• Graceful OOM shutdown: CoroutineExceptionHandler + Thread.setDefaultUncaughtExceptionHandler in ProxyService for clean shutdown on OutOfMemoryError.
• Exponential backoff jitter: Circuit breaker TTL doubles with each failure, capped at 30 min. Adaptive jitter (max ±30s, capped at 1/2 TTL).

⚠️ Beta build. Test before production use.