Release 2.7.3.1: harden proxy recovery, updates and local API.

Restore orphaned system proxy after crash, require update SHA-256, add macOS /api auth token, fix UDP ping false positives, HTTPS-only subscriptions, and keep the UI responsive during connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/sysproxy/windows.go

@@ -95,6 +95,14 @@ func (c *windowsController) Disable() error {
 	if !c.enabled {
 		return nil
 	}
+	return c.disableLocked(true)
+}
+
+func (c *windowsController) ForceDisable() error {
+	return c.disableLocked(false)
+}
+
+func (c *windowsController) disableLocked(restoreSaved bool) error {
 	key, err := registry.OpenKey(registry.CURRENT_USER,
 		`Software\Microsoft\Windows\CurrentVersion\Internet Settings`,
 		registry.QUERY_VALUE|registry.SET_VALUE)
@@ -103,7 +111,7 @@ func (c *windowsController) Disable() error {
 	}
 	defer key.Close()
 
-	if c.hadProxy {
+	if restoreSaved && c.hadProxy {
 		_ = key.SetDWordValue("ProxyEnable", uint32(c.oldEnable))
 		if c.oldServer != "" {
 			_ = key.SetStringValue("ProxyServer", c.oldServer)
@@ -114,12 +122,21 @@ func (c *windowsController) Disable() error {
 			_ = key.SetStringValue("ProxyOverride", c.oldOverride)
 		}
 	} else {
-		_ = key.SetDWordValue("ProxyEnable", 0)
+		// Crash recovery: if proxy still points at local Navis ports, clear it.
+		server, _, _ := key.GetStringValue("ProxyServer")
+		lower := strings.ToLower(server)
+		if strings.Contains(lower, "127.0.0.1") || strings.Contains(lower, "localhost") {
+			_ = key.SetDWordValue("ProxyEnable", 0)
+			_ = key.DeleteValue("ProxyServer")
+		} else if !restoreSaved {
+			_ = key.SetDWordValue("ProxyEnable", 0)
+		}
 	}
 
 	_ = notifyInternetSettingsChanged()
 
 	c.enabled = false
+	c.hadProxy = false
 	return nil
 }