chore: extend prebuilts support for MacOS NE by clang 21+ (#2633)

* chore: extend prebuilts support for MacOS NE by clang 21+

* chore: trigger prebuilts on workflow file changes

.github/workflows/deploy.yml

@@ -22,6 +22,7 @@ jobs:
             recipes:
               - 'recipes/**'
               - 'conanfile.py'
+              - '.github/workflows/deploy.yml'
 
   Bake-Prebuilts-Linux:
     runs-on: ubuntu-latest
@@ -539,13 +540,17 @@ jobs:
 # ------------------------------------------------------
 
   Bake-Prebuilts-MacOS-NE:
-    runs-on: macos-latest
     needs: Detect-Changes
     if: needs.Detect-Changes.outputs.recipes_changed == 'true'
 
     strategy:
       matrix:
-        xcode-version: [16.2, 16.4]
+        xcode-version: [16.2, 16.4, 26.4]
+        include:
+          - xcode-version: 26.4
+            os: macos-26
+
+    runs-on: ${{ matrix.os || 'macos-latest' }}
 
     steps:
     - uses: actions/checkout@v4

client/core/controllers/selfhosted/installController.cpp

@@ -119,14 +119,9 @@ ErrorCode InstallController::setupContainer(const ServerCredentials &credentials
         return e;
     qDebug().noquote() << "InstallController::setupContainer prepareHostWorker finished";
 
-    amnezia::ScriptVars removeContainerVars =
-            amnezia::genBaseVars(credentials, container, QString(), QString());
-    if (!isUpdate) {
-        removeContainerVars.append({ { "$REMOVE_CONTAINER_DATA", QStringLiteral("1") } });
-    }
     sshSession.runScript(credentials,
-                         sshSession.replaceVars(amnezia::scriptData(SharedScriptType::remove_container),
-                                                removeContainerVars));
+                                  sshSession.replaceVars(amnezia::scriptData(SharedScriptType::remove_container),
+                                                                  amnezia::genBaseVars(credentials, container, QString(), QString())));
     qDebug().noquote() << "InstallController::setupContainer removeContainer finished";
 
     qDebug().noquote() << "buildContainerWorker start";
@@ -947,12 +942,10 @@ ErrorCode InstallController::removeContainer(const QString &serverId, DockerCont
         return ErrorCode::InternalError;
     }
     SshSession sshSession(this);
-    amnezia::ScriptVars removeContainerVars =
-            amnezia::genBaseVars(credentials, container, QString(), QString());
-    removeContainerVars.append({ { "$REMOVE_CONTAINER_DATA", QStringLiteral("1") } });
     ErrorCode errorCode = sshSession.runScript(
             credentials,
-            sshSession.replaceVars(amnezia::scriptData(SharedScriptType::remove_container), removeContainerVars));
+            sshSession.replaceVars(amnezia::scriptData(SharedScriptType::remove_container),
+                                            amnezia::genBaseVars(credentials, container, QString(), QString())));
 
     if (errorCode == ErrorCode::NoError) {
         QMap<DockerContainer, ContainerConfig> containers = adminConfig->containers;

client/core/utils/selfhosted/scriptsRegistry.cpp

@@ -295,8 +295,6 @@ amnezia::ScriptVars amnezia::genMtProxyVars(const ContainerConfig &containerConf
 
         vars.append({{"$MTPROXY_PORT", c.port.isEmpty() ? QString(protocols::mtProxy::defaultPort) : c.port}});
         vars.append({{"$MTPROXY_SECRET", c.secret}});
-        vars.append({{"$MTPROXY_REGENERATE_SECRET",
-                      c.secret.isEmpty() ? QStringLiteral("1") : QStringLiteral("0")}});
         vars.append({{"$MTPROXY_TAG", c.tag}});
         vars.append({{"$MTPROXY_TRANSPORT_MODE",
                       c.transportMode.isEmpty() ? QString(protocols::mtProxy::transportModeStandard)
@@ -352,8 +350,6 @@ amnezia::ScriptVars amnezia::genTelemtVars(const ContainerConfig &containerConfi
         vars.append({ { "$TELEMT_TOML_TLS", faketls ? QLatin1String("true") : QLatin1String("false") } });
         vars.append({ { "$TELEMT_PORT", c.port.isEmpty() ? QString(protocols::telemt::defaultPort) : c.port } });
         vars.append({ { "$TELEMT_SECRET", c.secret } });
-        vars.append({ { "$TELEMT_REGENERATE_SECRET",
-                         c.secret.isEmpty() ? QStringLiteral("1") : QStringLiteral("0") } });
         vars.append({ { "$TELEMT_TAG", c.tag } });
         QString tlsDomain = c.tlsDomain;
         if (tlsDomain.isEmpty()) {

client/server_scripts/mtproxy/configure_container.sh

@@ -4,10 +4,8 @@
 curl -s https://core.telegram.org/getProxySecret -o /data/proxy-secret
 curl -s https://core.telegram.org/getProxyConfig -o /data/proxy-multi.conf
 
-# Determine secret: regenerate (fresh install) -> env var -> saved file -> generate new
-if [ "$MTPROXY_REGENERATE_SECRET" = "1" ]; then
-    SECRET=$(openssl rand -hex 16)
-elif [ -n "$MTPROXY_SECRET" ]; then
+# Determine secret: env var -> saved file -> generate new
+if [ -n "$MTPROXY_SECRET" ]; then
     SECRET="$MTPROXY_SECRET"
 elif [ -f /data/secret ]; then
     SECRET=$(cat /data/secret)

client/server_scripts/remove_container.sh

@@ -1,4 +1,3 @@
 sudo docker stop $CONTAINER_NAME;\
 sudo docker rm -fv $CONTAINER_NAME;\
-sudo docker rmi $CONTAINER_NAME;\
-test "$REMOVE_CONTAINER_DATA" = "1" && sudo docker volume rm -f ${CONTAINER_NAME}-data 2>/dev/null || true
+sudo docker rmi $CONTAINER_NAME

client/server_scripts/telemt/configure_container.sh

@@ -4,10 +4,8 @@
 echo "[*] Amnezia Telemt: configure script start"
 mkdir -p /data/tlsfront
 
-# Secret: regenerate (fresh install) -> env var -> saved file -> openssl
-if [ "$TELEMT_REGENERATE_SECRET" = "1" ]; then
-    SECRET=$(openssl rand -hex 16)
-elif [ -n "$TELEMT_SECRET" ]; then
+# Secret: substituted $TELEMT_SECRET -> saved file -> openssl (same rules as MTProxy configure)
+if [ -n "$TELEMT_SECRET" ]; then
     SECRET="$TELEMT_SECRET"
 elif [ -f /data/secret ]; then
     SECRET=$(cat /data/secret)

client/ui/qml/Components/SettingsContainersListView.qml

@@ -47,10 +47,10 @@ ListViewType {
                         PageController.goToPage(PageEnum.PageServiceDnsSettings)
                     } else if (isMtProxy) {
                         MtProxyConfigModel.updateModel(config)
-                        PageController.goToPage(PageEnum.PageServiceMtProxySettings, false)
+                        PageController.goToPage(PageEnum.PageServiceMtProxySettings)
                     } else if (isTelemt) {
                         TelemtConfigModel.updateModel(config)
-                        PageController.goToPage(PageEnum.PageServiceTelemtSettings, false)
+                        PageController.goToPage(PageEnum.PageServiceTelemtSettings)
                     } else {
                         InstallController.updateProtocols(ServersUiController.getServerId(ServersUiController.processedServerIndex), containerIndex)
                         PageController.goToPage(PageEnum.PageSettingsServerProtocol)

client/ui/qml/Pages2/PageServiceMtProxySettings.qml

@@ -20,10 +20,15 @@ import "../Components"
 PageType {
     id: root
 
+    Rectangle {
+        anchors.fill: parent
+        z: -1
+        color: AmneziaStyle.color.onyxBlack
+    }
+
     property int containerStatus: 1
     property bool isUpdating: false
     property bool isCheckingStatus: false
-    property bool isFetchingSecret: false
     property bool previousEnabled: true
     property int previousContainerStatus: 1
 
@@ -45,7 +50,7 @@ PageType {
 
     onSavedTransportModeChanged: {
         if (savedTransportMode === "faketls") {
-            root.syncedSecretTabIndex = 1
+            root.syncedSecretTabIndex = 2
         } else if (savedTransportMode !== "") {
             root.syncedSecretTabIndex = 0
         }
@@ -63,96 +68,9 @@ PageType {
 
     readonly property bool mtProxyNetworkBlocked: !NetworkReachabilityController.hasInternetAccess
 
-    property bool remoteOperationBusy: false
-    readonly property bool operationInProgress: isCheckingStatus || isFetchingSecret || isUpdating || diagLoading
-    readonly property bool pageBusy: operationInProgress || remoteOperationBusy
-    readonly property bool navigationBlockedWhileBusy: pageBusy
-
-    property bool pageOpenHandled: false
-    property bool busyIndicatorShown: false
-
-    function syncPageBusyIndicator() {
-        if (!root.pageOpenHandled) {
-            return
-        }
-        var wantBusy = root.pageBusy
-        if (wantBusy === root.busyIndicatorShown) {
-            return
-        }
-        root.busyIndicatorShown = wantBusy
-        PageController.showBusyIndicator(wantBusy)
-    }
-
-    onPageBusyChanged: syncPageBusyIndicator()
-
-    function mtProxyDomainToHex(domain) {
-        var hex = ""
-        for (var i = 0; i < domain.length; i++) {
-            var code = domain.charCodeAt(i).toString(16)
-            hex += (code.length < 2 ? "0" : "") + code
-        }
-        return hex
-    }
-
-    function mtProxyClientSecret(baseHex32, mode, tlsDomain) {
-        if (baseHex32 === "") {
-            return ""
-        }
-        if (mode === "faketls") {
-            return "ee" + baseHex32 + mtProxyDomainToHex(tlsDomain)
-        }
-        return "dd" + baseHex32
-    }
-
-    function mtProxyClientSecretForTabIndex(baseHex32, tabIndex, tlsDomain, defaultTlsDomain) {
-        var domain = tlsDomain !== "" ? tlsDomain : defaultTlsDomain
-        if (tabIndex === 1) {
-            return mtProxyClientSecret(baseHex32, "faketls", domain)
-        }
-        return mtProxyClientSecret(baseHex32, "standard", domain)
-    }
-
-    property bool containerStatusRefreshCallPending: false
-
-    function mtProxyRequestContainerStatusRefresh() {
-        if (!NetworkReachabilityController.hasInternetAccess) {
-            isCheckingStatus = false
-            syncPageBusyIndicator()
-            return
-        }
-        isCheckingStatus = true
-        syncPageBusyIndicator()
-        InstallController.refreshContainerStatus(ServersUiController.getServerId(ServersUiController.processedServerIndex), ServersUiController.processedContainerIndex)
-    }
-
-    function mtProxyScheduleContainerStatusRefresh() {
-        if (containerStatusRefreshCallPending) {
-            return
-        }
-        containerStatusRefreshCallPending = true
-        Qt.callLater(function () {
-            containerStatusRefreshCallPending = false
-            root.mtProxyRequestContainerStatusRefresh()
-        })
-    }
-
-    function mtProxyOnPageShown() {
-        if (root.pageOpenHandled) {
-            return
-        }
-        root.pageOpenHandled = true
-
-        PageController.disableControls(navigationBlockedWhileBusy)
-
-        if (!NetworkReachabilityController.hasInternetAccess) {
-            isCheckingStatus = false
-        } else {
-            isCheckingStatus = true
-        }
-        syncPageBusyIndicator()
-        root.mtProxyScheduleContainerStatusRefresh()
-    }
+    readonly property bool navigationBlockedWhileBusy: isUpdating || diagLoading
 
+    // Hex values that exist in last loaded / last successfully saved config — show link panel only for these.
     property var mtProxyPersistedAdditionalHex: []
 
     function mtProxyRefreshPersistedAdditionalSecrets() {
@@ -174,8 +92,11 @@ PageType {
         return false
     }
 
+    // Rejects garbage like "123123123123"; only dotted IPv4 shape (≤3 digits per octet, ≤4 octets).
     readonly property var natIpv4InputFormat: /^(\d{1,3}\.){0,3}\d{0,3}$/
 
+    // Defer SSH/updateContainer so QML control handlers return before nested event loops run;
+    // avoids "Object destroyed while one of its QML signal handlers is in progress".
     function mtProxyScheduleUpdate(closePage) {
         var cp = closePage === undefined ? false : closePage
         Qt.callLater(function () {
@@ -183,6 +104,7 @@ PageType {
         })
     }
 
+    // Optional IPv4: show invalid while typing only when the string looks complete (four octets), so partial entry is not nagged.
     function natIpv4FieldShowInvalidError(text) {
         var t = text ? String(text).replace(/^\s+|\s+$/g, '') : ""
         if (t === "")
@@ -245,9 +167,15 @@ PageType {
             root.mtProxyRefreshPersistedAdditionalSecrets()
         })
 
-        Qt.callLater(root.mtProxyOnPageShown)
+        if (!NetworkReachabilityController.hasInternetAccess) {
+            isCheckingStatus = false
+            return
+        }
+        isCheckingStatus = true
+        InstallController.refreshContainerStatus(ServersUiController.getServerId(ServersUiController.processedServerIndex), ServersUiController.processedContainerIndex)
     }
 
+    // Block back navigation and Escape (via PageStart.isControlsDisabled) while SSH/update or diagnostics refresh runs.
     onNavigationBlockedWhileBusyChanged: {
         if (root.visible) {
             PageController.disableControls(navigationBlockedWhileBusy)
@@ -256,16 +184,10 @@ PageType {
 
     onVisibleChanged: {
         if (!visible) {
-            root.pageOpenHandled = false
-            containerStatusRefreshCallPending = false
-            isCheckingStatus = false
-            isFetchingSecret = false
-            busyIndicatorShown = false
             PageController.disableControls(false)
-            PageController.showBusyIndicator(false)
             diagLoading = false
         } else {
-            root.mtProxyOnPageShown()
+            PageController.disableControls(navigationBlockedWhileBusy)
         }
     }
 
@@ -277,7 +199,8 @@ PageType {
                 return
             }
             if (NetworkReachabilityController.hasInternetAccess) {
-                root.mtProxyScheduleContainerStatusRefresh()
+                isCheckingStatus = true
+                InstallController.refreshContainerStatus(ServersUiController.getServerId(ServersUiController.processedServerIndex), ServersUiController.processedContainerIndex)
             }
         }
     }
@@ -285,15 +208,10 @@ PageType {
     Connections {
         target: InstallController
 
-        function onServerIsBusy(busy) {
-            remoteOperationBusy = busy
-        }
-
         function onUpdateContainerFinished(message, closePage) {
             if (!root.visible) {
                 isUpdating = false
                 isCheckingStatus = false
-                isFetchingSecret = false
                 return
             }
             isUpdating = false
@@ -309,11 +227,9 @@ PageType {
             if (!root.visible) {
                 isUpdating = false
                 isCheckingStatus = false
-                isFetchingSecret = false
                 return
             }
             isUpdating = false
-            isFetchingSecret = false
             containerStatus = previousContainerStatus
             MtProxyConfigModel.setEnabled(previousEnabled)
             MtProxyConfigModel.setPort(previousPort)
@@ -338,7 +254,6 @@ PageType {
             }
             if (enabled && pendingUpdateAfterEnable) {
                 pendingUpdateAfterEnable = false
-                isUpdating = true
                 root.mtProxyScheduleUpdate(false)
                 return
             }
@@ -351,9 +266,9 @@ PageType {
         function onContainerStatusRefreshed(status) {
             if (!root.visible) {
                 isCheckingStatus = false
-                isFetchingSecret = false
                 return
             }
+            isCheckingStatus = false
             containerStatus = status
 
             root.savedTransportMode = MtProxyConfigModel.getTransportMode()
@@ -361,17 +276,10 @@ PageType {
             root.savedPublicHost = MtProxyConfigModel.getPublicHost()
             if (status === 1) {
                 MtProxyConfigModel.setEnabled(true)
-                isFetchingSecret = true
-                isCheckingStatus = false
                 InstallController.fetchContainerSecret(ServersUiController.getServerId(ServersUiController.processedServerIndex), ServersUiController.processedContainerIndex)
-            } else {
-                isFetchingSecret = false
-                isCheckingStatus = false
-                if (status === 2) {
-                    MtProxyConfigModel.setEnabled(false)
-                }
+            } else if (status === 2) {
+                MtProxyConfigModel.setEnabled(false)
             }
-            syncPageBusyIndicator()
         }
 
         function onContainerDiagnosticsRefreshed(portReachable, upstreamReachable, clientsConnected, lastConfigRefresh, statsEndpoint) {
@@ -388,35 +296,20 @@ PageType {
 
         function onContainerSecretFetched(secret) {
             if (!root.visible) {
-                isFetchingSecret = false
                 return
             }
-            isFetchingSecret = false
-            syncPageBusyIndicator()
             MtProxyConfigModel.validateAndSetSecret(secret)
         }
     }
 
-    Item {
-        id: contentLayer
-        anchors.fill: parent
-        enabled: !root.pageBusy
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
         anchors.left: parent.left
         anchors.right: parent.right
-        anchors.topMargin: 20 + PageController.safeAreaTopMargin
-
+        anchors.topMargin: 20 + SettingsController.safeAreaTopMargin
         onFocusChanged: {
-            if (this.activeFocus) {
-                if (mainTabBar.currentIndex === 0) {
-                    connectionListView.positionViewAtBeginning()
-                } else {
-                    settingsListView.positionViewAtBeginning()
-                }
-            }
+            if (this.activeFocus) connectionListView.positionViewAtBeginning()
         }
     }
 
@@ -425,20 +318,20 @@ PageType {
         anchors.top: backButton.bottom
         anchors.left: parent.left
         anchors.right: parent.right
+        anchors.topMargin: 8
         spacing: 0
 
         BaseHeaderType {
             Layout.fillWidth: true
             Layout.leftMargin: 16
             Layout.rightMargin: 16
-            Layout.bottomMargin: 24
-
+            Layout.topMargin: 8
             headerText: qsTr("MTProxy settings")
         }
 
         LabelWithButtonType {
             Layout.fillWidth: true
-            Layout.leftMargin: 16
+            Layout.leftMargin: 0
             Layout.rightMargin: 16
             text: qsTr("Read more about this settings")
             textColor: AmneziaStyle.color.goldenApricot
@@ -447,49 +340,35 @@ PageType {
             }
         }
 
-        CaptionTextType {
+        TabBar {
+            id: mainTabBar
             Layout.fillWidth: true
-            Layout.leftMargin: 16
-            Layout.rightMargin: 16
-            Layout.topMargin: 8
-            visible: root.mtProxyNetworkBlocked
-            text: qsTr("No internet connection. Connect to the internet to change MTProxy settings.")
-            color: AmneziaStyle.color.mutedGray
-            wrapMode: Text.WordWrap
-            font.pixelSize: 14
-        }
-    }
+            Layout.topMargin: 4
 
-    TabBar {
-        id: mainTabBar
-        anchors.top: pageHeader.bottom
-        anchors.left: parent.left
-        anchors.right: parent.right
-        width: parent.width
-
-        background: Rectangle {
-            color: AmneziaStyle.color.transparent
-            Rectangle {
-                width: parent.width
-                height: 1
-                anchors.bottom: parent.bottom
-                color: AmneziaStyle.color.slateGray
+            background: Rectangle {
+                color: AmneziaStyle.color.transparent
+                Rectangle {
+                    width: parent.width
+                    height: 1
+                    anchors.bottom: parent.bottom
+                    color: AmneziaStyle.color.slateGray
+                }
             }
-        }
 
-        TabButtonType {
-            text: qsTr("Connection")
-            isSelected: mainTabBar.currentIndex === 0
-        }
-        TabButtonType {
-            text: qsTr("Settings")
-            isSelected: mainTabBar.currentIndex === 1
+            TabButtonType {
+                text: qsTr("Connection")
+                isSelected: mainTabBar.currentIndex === 0
+            }
+            TabButtonType {
+                text: qsTr("Settings")
+                isSelected: mainTabBar.currentIndex === 1
+            }
         }
     }
 
     StackLayout {
         id: tabContent
-        anchors.top: mainTabBar.bottom
+        anchors.top: pageHeader.bottom
         anchors.bottom: parent.bottom
         anchors.left: parent.left
         anchors.right: parent.right
@@ -503,11 +382,35 @@ PageType {
                 width: connectionListView.width
                 spacing: 0
 
+                function domainToHex(domain) {
+                    var hex = ""
+                    for (var i = 0; i < domain.length; i++) {
+                        var code = domain.charCodeAt(i).toString(16)
+                        hex += (code.length < 2 ? "0" : "") + code
+                    }
+                    return hex
+                }
+
+                function secretForMode(mode) {
+                    if (mode === "faketls") {
+                        var domain = root.savedTlsDomain !== "" ? root.savedTlsDomain : MtProxyConfigModel.defaultTlsDomain()
+                        return "ee" + secret + domainToHex(domain)
+                    } else if (mode === "padded") {
+                        return "dd" + secret
+                    }
+                    return secret
+                }
+
                 property int secretTabIndex: root.syncedSecretTabIndex
 
                 function activeSecret() {
-                    return root.mtProxyClientSecretForTabIndex(secret, root.syncedSecretTabIndex,
-                        root.savedTlsDomain, MtProxyConfigModel.defaultTlsDomain())
+                    if (root.syncedSecretTabIndex === 0) {
+                        return secretForMode("standard")
+                    }
+                    if (root.syncedSecretTabIndex === 1) {
+                        return secretForMode("padded")
+                    }
+                    return secretForMode("faketls")
                 }
 
                 function effectiveSecret() {
@@ -851,9 +754,33 @@ PageType {
                 width: settingsListView.width
                 spacing: 0
 
+                function mtProxyDomainToHex(domain) {
+                    var hex = ""
+                    for (var i = 0; i < domain.length; i++) {
+                        var code = domain.charCodeAt(i).toString(16)
+                        hex += (code.length < 2 ? "0" : "") + code
+                    }
+                    return hex
+                }
+
+                function mtProxySecretForBaseHex(baseHex, mode) {
+                    if (mode === "faketls") {
+                        var domain = root.savedTlsDomain !== "" ? root.savedTlsDomain : MtProxyConfigModel.defaultTlsDomain()
+                        return "ee" + baseHex + mtProxyDomainToHex(domain)
+                    } else if (mode === "padded") {
+                        return "dd" + baseHex
+                    }
+                    return baseHex
+                }
+
                 function mtProxyActiveSecretForBaseHex(baseHex) {
-                    return root.mtProxyClientSecretForTabIndex(baseHex, root.syncedSecretTabIndex,
-                        root.savedTlsDomain, MtProxyConfigModel.defaultTlsDomain())
+                    if (root.syncedSecretTabIndex === 0) {
+                        return mtProxySecretForBaseHex(baseHex, "standard")
+                    }
+                    if (root.syncedSecretTabIndex === 1) {
+                        return mtProxySecretForBaseHex(baseHex, "padded")
+                    }
+                    return mtProxySecretForBaseHex(baseHex, "faketls")
                 }
 
                 function mtProxyEffectiveHostForLinks() {
@@ -877,7 +804,7 @@ PageType {
                     Layout.bottomMargin: 16
                     text: qsTr("Enable MTProxy")
                     checked: isEnabled
-                    enabled: containerStatus !== 0 && containerStatus !== 3 && !root.pageBusy
+                    enabled: !isCheckingStatus && containerStatus !== 0 && containerStatus !== 3 && !isUpdating
                         && !root.mtProxyNetworkBlocked
                     onToggled: function () {
                         if (checked !== isEnabled) {
@@ -916,14 +843,13 @@ PageType {
 
                         CaptionTextType {
                             Layout.fillWidth: true
-                            text: secret !== "" ? mtProxyActiveSecretForBaseHex(secret) : qsTr("Not generated")
+                            text: secret !== "" ? secret : qsTr("Not generated")
                             color: secret !== "" ? AmneziaStyle.color.paleGray : AmneziaStyle.color.mutedGray
-                            wrapMode: Text.WrapAnywhere
+                            elide: Text.ElideMiddle
                             font.pixelSize: 14
                         }
 
                         ImageButtonType {
-                            Layout.alignment: Qt.AlignTop
                             implicitWidth: 36
                             implicitHeight: 36
                             hoverEnabled: true
@@ -1172,7 +1098,6 @@ PageType {
                                 clickedFunction: function () {
                                     transportMode = (index === 0) ? "standard" : "faketls"
                                     MtProxyConfigModel.setTransportMode(transportMode)
-                                    root.syncedSecretTabIndex = transportMode === "faketls" ? 1 : 0
                                     transportModeDropDown.closeTriggered()
                                 }
                             }
@@ -1361,9 +1286,6 @@ PageType {
                                         imageColor: AmneziaStyle.color.vibrantRed
                                         onClicked: {
                                             MtProxyConfigModel.removeAdditionalSecret(index)
-                                            if (containerStatus === 1) {
-                                                root.mtProxyScheduleUpdate(false)
-                                            }
                                         }
                                     }
                                 }
@@ -1930,5 +1852,34 @@ PageType {
         }
     }
 
+    Rectangle {
+        anchors.fill: parent
+        visible: isCheckingStatus || isUpdating || root.mtProxyNetworkBlocked
+        color: AmneziaStyle.color.midnightBlack
+        opacity: 0.6
+        z: 1
+        MouseArea {
+            anchors.fill: parent
+        }
+        BusyIndicator {
+            anchors.centerIn: parent
+            visible: isCheckingStatus || isUpdating
+            running: isCheckingStatus || isUpdating
+            width: 48
+            height: 48
+        }
+        CaptionTextType {
+            anchors.left: parent.left
+            anchors.right: parent.right
+            anchors.verticalCenter: parent.verticalCenter
+            anchors.leftMargin: 24
+            anchors.rightMargin: 24
+            visible: root.mtProxyNetworkBlocked && !isCheckingStatus && !isUpdating
+            horizontalAlignment: Text.AlignHCenter
+            text: qsTr("No internet connection. Connect to the internet to change MTProxy settings.")
+            color: AmneziaStyle.color.paleGray
+            wrapMode: Text.WordWrap
+            font.pixelSize: 14
+        }
     }
 }

client/ui/qml/Pages2/PageServiceTelemtSettings.qml

@@ -18,10 +18,15 @@ import "../Components"
 PageType {
     id: root
 
+    Rectangle {
+        anchors.fill: parent
+        z: -1
+        color: AmneziaStyle.color.onyxBlack
+    }
+
     property int containerStatus: 1
     property bool isUpdating: false
     property bool isCheckingStatus: false
-    property bool isFetchingSecret: false
     property bool previousEnabled: true
     property int previousContainerStatus: 1
 
@@ -35,7 +40,6 @@ PageType {
     property bool   previousNatEnabled: false
     property string previousNatInternalIp: ""
     property string previousNatExternalIp: ""
-    property string previousSecret: ""
 
     property string savedTransportMode: ""
     property string savedTlsDomain: ""
@@ -43,7 +47,7 @@ PageType {
 
     onSavedTransportModeChanged: {
         if (savedTransportMode === "faketls") {
-            root.syncedSecretTabIndex = 1
+            root.syncedSecretTabIndex = 2
         } else if (savedTransportMode !== "") {
             root.syncedSecretTabIndex = 0
         }
@@ -60,97 +64,9 @@ PageType {
     property string diagStatsEndpoint: ""
 
     readonly property bool telemtNetworkBlocked: !NetworkReachabilityController.hasInternetAccess
+    readonly property bool navigationBlockedWhileBusy: isUpdating || diagLoading
 
-    property bool remoteOperationBusy: false
-    readonly property bool operationInProgress: isCheckingStatus || isFetchingSecret || isUpdating || diagLoading
-    readonly property bool pageBusy: operationInProgress || remoteOperationBusy
-    readonly property bool navigationBlockedWhileBusy: pageBusy
-
-    property bool pageOpenHandled: false
-    property bool busyIndicatorShown: false
-
-    function syncPageBusyIndicator() {
-        if (!root.pageOpenHandled) {
-            return
-        }
-        var wantBusy = root.pageBusy
-        if (wantBusy === root.busyIndicatorShown) {
-            return
-        }
-        root.busyIndicatorShown = wantBusy
-        PageController.showBusyIndicator(wantBusy)
-    }
-
-    onPageBusyChanged: syncPageBusyIndicator()
-
-    function telemtDomainToHex(domain) {
-        var hex = ""
-        for (var i = 0; i < domain.length; i++) {
-            var code = domain.charCodeAt(i).toString(16)
-            hex += (code.length < 2 ? "0" : "") + code
-        }
-        return hex
-    }
-
-    function telemtClientSecret(baseHex32, mode, tlsDomain) {
-        if (baseHex32 === "") {
-            return ""
-        }
-        if (mode === "faketls") {
-            return "ee" + baseHex32 + telemtDomainToHex(tlsDomain)
-        }
-        return "dd" + baseHex32
-    }
-
-    function telemtClientSecretForTabIndex(baseHex32, tabIndex, tlsDomain, defaultTlsDomain) {
-        var domain = tlsDomain !== "" ? tlsDomain : defaultTlsDomain
-        if (tabIndex === 1) {
-            return telemtClientSecret(baseHex32, "faketls", domain)
-        }
-        return telemtClientSecret(baseHex32, "standard", domain)
-    }
-
-    property bool containerStatusRefreshCallPending: false
-
-    function telemtRequestContainerStatusRefresh() {
-        if (!NetworkReachabilityController.hasInternetAccess) {
-            isCheckingStatus = false
-            syncPageBusyIndicator()
-            return
-        }
-        isCheckingStatus = true
-        syncPageBusyIndicator()
-        InstallController.refreshContainerStatus(ServersUiController.getServerId(ServersUiController.processedServerIndex), ServersUiController.processedContainerIndex)
-    }
-
-    function telemtScheduleContainerStatusRefresh() {
-        if (containerStatusRefreshCallPending) {
-            return
-        }
-        containerStatusRefreshCallPending = true
-        Qt.callLater(function () {
-            containerStatusRefreshCallPending = false
-            root.telemtRequestContainerStatusRefresh()
-        })
-    }
-
-    function telemtOnPageShown() {
-        if (root.pageOpenHandled) {
-            return
-        }
-        root.pageOpenHandled = true
-
-        PageController.disableControls(navigationBlockedWhileBusy)
-
-        if (!NetworkReachabilityController.hasInternetAccess) {
-            isCheckingStatus = false
-        } else {
-            isCheckingStatus = true
-        }
-        syncPageBusyIndicator()
-        root.telemtScheduleContainerStatusRefresh()
-    }
-
+    // Defer SSH/updateContainer so QML control handlers return before nested event loops run.
     function telemtScheduleUpdate(closePage) {
         var cp = closePage === undefined ? false : closePage
         Qt.callLater(function () {
@@ -189,7 +105,12 @@ PageType {
         root.savedTlsDomain = TelemtConfigModel.getTlsDomain()
         root.savedPublicHost = TelemtConfigModel.getPublicHost()
 
-        Qt.callLater(root.telemtOnPageShown)
+        if (!NetworkReachabilityController.hasInternetAccess) {
+            isCheckingStatus = false
+            return
+        }
+        isCheckingStatus = true
+        InstallController.refreshContainerStatus(ServersUiController.getServerId(ServersUiController.processedServerIndex), ServersUiController.processedContainerIndex)
     }
 
     onNavigationBlockedWhileBusyChanged: {
@@ -200,16 +121,10 @@ PageType {
 
     onVisibleChanged: {
         if (!visible) {
-            root.pageOpenHandled = false
-            containerStatusRefreshCallPending = false
-            isCheckingStatus = false
-            isFetchingSecret = false
-            busyIndicatorShown = false
             PageController.disableControls(false)
-            PageController.showBusyIndicator(false)
             diagLoading = false
         } else {
-            root.telemtOnPageShown()
+            PageController.disableControls(navigationBlockedWhileBusy)
         }
     }
 
@@ -221,7 +136,8 @@ PageType {
                 return
             }
             if (NetworkReachabilityController.hasInternetAccess) {
-                root.telemtScheduleContainerStatusRefresh()
+                isCheckingStatus = true
+                InstallController.refreshContainerStatus(ServersUiController.getServerId(ServersUiController.processedServerIndex), ServersUiController.processedContainerIndex)
             }
         }
     }
@@ -229,15 +145,10 @@ PageType {
     Connections {
         target: InstallController
 
-        function onServerIsBusy(busy) {
-            remoteOperationBusy = busy
-        }
-
         function onUpdateContainerFinished(message, closePage) {
             if (!root.visible) {
                 isUpdating = false
                 isCheckingStatus = false
-                isFetchingSecret = false
                 return
             }
             isUpdating = false
@@ -255,11 +166,9 @@ PageType {
             if (!root.visible) {
                 isUpdating = false
                 isCheckingStatus = false
-                isFetchingSecret = false
                 return
             }
             isUpdating = false
-            isFetchingSecret = false
             containerStatus = previousContainerStatus
             TelemtConfigModel.setEnabled(previousEnabled)
             TelemtConfigModel.setPort(previousPort)
@@ -272,9 +181,6 @@ PageType {
             TelemtConfigModel.setNatEnabled(previousNatEnabled)
             TelemtConfigModel.setNatInternalIp(previousNatInternalIp)
             TelemtConfigModel.setNatExternalIp(previousNatExternalIp)
-            if (previousSecret !== "") {
-                TelemtConfigModel.setSecret(previousSecret)
-            }
         }
 
         function onSetContainerEnabledFinished(enabled) {
@@ -284,7 +190,6 @@ PageType {
             }
             if (enabled && pendingUpdateAfterEnable) {
                 pendingUpdateAfterEnable = false
-                isUpdating = true
                 root.telemtScheduleUpdate(false)
                 return
             }
@@ -297,9 +202,9 @@ PageType {
         function onContainerStatusRefreshed(status) {
             if (!root.visible) {
                 isCheckingStatus = false
-                isFetchingSecret = false
                 return
             }
+            isCheckingStatus = false
             containerStatus = status
 
             root.savedTransportMode = TelemtConfigModel.getTransportMode()
@@ -307,17 +212,10 @@ PageType {
             root.savedPublicHost = TelemtConfigModel.getPublicHost()
             if (status === 1) {
                 TelemtConfigModel.setEnabled(true)
-                isFetchingSecret = true
-                isCheckingStatus = false
                 InstallController.fetchContainerSecret(ServersUiController.getServerId(ServersUiController.processedServerIndex), ServersUiController.processedContainerIndex)
-            } else {
-                isFetchingSecret = false
-                isCheckingStatus = false
-                if (status === 2) {
-                    TelemtConfigModel.setEnabled(false)
-                }
+            } else if (status === 2) {
+                TelemtConfigModel.setEnabled(false)
             }
-            syncPageBusyIndicator()
         }
 
         function onContainerDiagnosticsRefreshed(portReachable, upstreamReachable, clientsConnected, lastConfigRefresh, statsEndpoint) {
@@ -334,35 +232,20 @@ PageType {
 
         function onContainerSecretFetched(secret) {
             if (!root.visible) {
-                isFetchingSecret = false
                 return
             }
-            isFetchingSecret = false
-            syncPageBusyIndicator()
             TelemtConfigModel.validateAndSetSecret(secret)
         }
     }
 
-    Item {
-        id: contentLayer
-        anchors.fill: parent
-        enabled: !root.pageBusy
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
         anchors.left: parent.left
         anchors.right: parent.right
-        anchors.topMargin: 20 + PageController.safeAreaTopMargin
-
+        anchors.topMargin: 20 + SettingsController.safeAreaTopMargin
         onFocusChanged: {
-            if (this.activeFocus) {
-                if (mainTabBar.currentIndex === 0) {
-                    connectionListView.positionViewAtBeginning()
-                } else {
-                    settingsListView.positionViewAtBeginning()
-                }
-            }
+            if (this.activeFocus) connectionListView.positionViewAtBeginning()
         }
     }
 
@@ -371,20 +254,20 @@ PageType {
         anchors.top: backButton.bottom
         anchors.left: parent.left
         anchors.right: parent.right
+        anchors.topMargin: 8
         spacing: 0
 
         BaseHeaderType {
             Layout.fillWidth: true
             Layout.leftMargin: 16
             Layout.rightMargin: 16
-            Layout.bottomMargin: 24
-
+            Layout.topMargin: 8
             headerText: qsTr("Telemt settings")
         }
 
         LabelWithButtonType {
             Layout.fillWidth: true
-            Layout.leftMargin: 16
+            Layout.leftMargin: 0
             Layout.rightMargin: 16
             text: qsTr("Read more about this settings")
             textColor: AmneziaStyle.color.goldenApricot
@@ -393,49 +276,35 @@ PageType {
             }
         }
 
-        CaptionTextType {
+        TabBar {
+            id: mainTabBar
             Layout.fillWidth: true
-            Layout.leftMargin: 16
-            Layout.rightMargin: 16
-            Layout.topMargin: 8
-            visible: root.telemtNetworkBlocked
-            text: qsTr("No internet connection. Connect to the internet to change Telemt settings.")
-            color: AmneziaStyle.color.mutedGray
-            wrapMode: Text.WordWrap
-            font.pixelSize: 14
-        }
-    }
+            Layout.topMargin: 4
 
-    TabBar {
-        id: mainTabBar
-        anchors.top: pageHeader.bottom
-        anchors.left: parent.left
-        anchors.right: parent.right
-        width: parent.width
-
-        background: Rectangle {
-            color: AmneziaStyle.color.transparent
-            Rectangle {
-                width: parent.width
-                height: 1
-                anchors.bottom: parent.bottom
-                color: AmneziaStyle.color.slateGray
+            background: Rectangle {
+                color: AmneziaStyle.color.transparent
+                Rectangle {
+                    width: parent.width
+                    height: 1
+                    anchors.bottom: parent.bottom
+                    color: AmneziaStyle.color.slateGray
+                }
             }
-        }
 
-        TabButtonType {
-            text: qsTr("Connection")
-            isSelected: mainTabBar.currentIndex === 0
-        }
-        TabButtonType {
-            text: qsTr("Settings")
-            isSelected: mainTabBar.currentIndex === 1
+            TabButtonType {
+                text: qsTr("Connection")
+                isSelected: mainTabBar.currentIndex === 0
+            }
+            TabButtonType {
+                text: qsTr("Settings")
+                isSelected: mainTabBar.currentIndex === 1
+            }
         }
     }
 
     StackLayout {
         id: tabContent
-        anchors.top: mainTabBar.bottom
+        anchors.top: pageHeader.bottom
         anchors.bottom: parent.bottom
         anchors.left: parent.left
         anchors.right: parent.right
@@ -449,11 +318,36 @@ PageType {
                 width: connectionListView.width
                 spacing: 0
 
+                function domainToHex(domain) {
+                    var hex = ""
+                    for (var i = 0; i < domain.length; i++) {
+                        var code = domain.charCodeAt(i).toString(16)
+                        hex += (code.length < 2 ? "0" : "") + code
+                    }
+                    return hex
+                }
+
+                function secretForMode(mode) {
+                    if (mode === "faketls") {
+                        var domain = root.savedTlsDomain !== "" ? root.savedTlsDomain : TelemtConfigModel.defaultTlsDomain()
+                        return "ee" + secret + domainToHex(domain)
+                    } else if (mode === "padded") {
+                        return "dd" + secret
+                    }
+                    // Telemt default (secure MTProto, not FakeTLS): Telegram proxy links require dd + hex secret
+                    return "dd" + secret
+                }
+
                 property int secretTabIndex: root.syncedSecretTabIndex
 
                 function activeSecret() {
-                    return root.telemtClientSecretForTabIndex(secret, root.syncedSecretTabIndex,
-                        root.savedTlsDomain, TelemtConfigModel.defaultTlsDomain())
+                    if (root.syncedSecretTabIndex === 0) {
+                        return secretForMode("standard")
+                    }
+                    if (root.syncedSecretTabIndex === 1) {
+                        return secretForMode("padded")
+                    }
+                    return secretForMode("faketls")
                 }
 
                 function effectiveSecret() {
@@ -796,11 +690,6 @@ PageType {
                 width: settingsListView.width
                 spacing: 0
 
-                function telemtActiveSecretForBaseHex(baseHex) {
-                    return root.telemtClientSecretForTabIndex(baseHex, root.syncedSecretTabIndex,
-                        root.savedTlsDomain, TelemtConfigModel.defaultTlsDomain())
-                }
-
                 SwitcherType {
                     id: enableTelemtSwitch
                     Layout.fillWidth: true
@@ -810,13 +699,11 @@ PageType {
                     Layout.bottomMargin: 16
                     text: qsTr("Enable Telemt")
                     checked: isEnabled
-                    enabled: containerStatus !== 0 && containerStatus !== 3 && !root.pageBusy
-                        && !root.telemtNetworkBlocked
+                    enabled: !isCheckingStatus && containerStatus !== 0 && containerStatus !== 3 && !isUpdating
                     onToggled: function () {
                         if (checked !== isEnabled) {
                             previousEnabled = isEnabled
                             previousContainerStatus = containerStatus
-                            root.previousSecret = secret
                             isEnabled = checked
                             isUpdating = true
                             if (checked) {
@@ -849,14 +736,13 @@ PageType {
 
                         CaptionTextType {
                             Layout.fillWidth: true
-                            text: secret !== "" ? telemtActiveSecretForBaseHex(secret) : qsTr("Not generated")
+                            text: secret !== "" ? secret : qsTr("Not generated")
                             color: secret !== "" ? AmneziaStyle.color.paleGray : AmneziaStyle.color.mutedGray
-                            wrapMode: Text.WrapAnywhere
+                            elide: Text.ElideMiddle
                             font.pixelSize: 14
                         }
 
                         ImageButtonType {
-                            Layout.alignment: Qt.AlignTop
                             implicitWidth: 36
                             implicitHeight: 36
                             hoverEnabled: true
@@ -864,14 +750,12 @@ PageType {
                             imageColor: AmneziaStyle.color.paleGray
                             visible: ServersModel.isProcessedServerHasWriteAccess()
                             onClicked: {
-                                var secretSnapshot = secret
                                 showQuestionDrawer(
                                     qsTr("Generate new secret?"),
                                     qsTr("All existing connection links will stop working. Users will need new links."),
                                     qsTr("Generate"),
                                     qsTr("Cancel"),
                                         function () {
-                                        root.previousSecret = secretSnapshot
                                         if (containerStatus === 1) {
                                             isUpdating = true
                                             TelemtConfigModel.generateSecret()
@@ -1042,7 +926,6 @@ PageType {
                                 clickedFunction: function () {
                                     transportMode = (index === 0) ? "standard" : "faketls"
                                     TelemtConfigModel.setTransportMode(transportMode)
-                                    root.syncedSecretTabIndex = transportMode === "faketls" ? 1 : 0
                                     transportModeDropDown.closeTriggered()
                                 }
                             }
@@ -1523,7 +1406,6 @@ PageType {
                         previousNatEnabled = natEnabled
                         previousNatInternalIp = natInternalIp
                         previousNatExternalIp = natExternalIp
-                        root.previousSecret = secret
                         isUpdating = true
                         root.telemtScheduleUpdate(false)
                     }
@@ -1532,5 +1414,34 @@ PageType {
         }
     }
 
+    Rectangle {
+        anchors.fill: parent
+        visible: isCheckingStatus || isUpdating || root.telemtNetworkBlocked
+        color: AmneziaStyle.color.midnightBlack
+        opacity: 0.6
+        z: 1
+        MouseArea {
+            anchors.fill: parent
+        }
+        BusyIndicator {
+            anchors.centerIn: parent
+            visible: isCheckingStatus || isUpdating
+            running: isCheckingStatus || isUpdating
+            width: 48
+            height: 48
+        }
+        CaptionTextType {
+            anchors.left: parent.left
+            anchors.right: parent.right
+            anchors.verticalCenter: parent.verticalCenter
+            anchors.leftMargin: 24
+            anchors.rightMargin: 24
+            visible: root.telemtNetworkBlocked && !isCheckingStatus && !isUpdating
+            horizontalAlignment: Text.AlignHCenter
+            text: qsTr("No internet connection. Connect to the internet to change Telemt settings.")
+            color: AmneziaStyle.color.paleGray
+            wrapMode: Text.WordWrap
+            font.pixelSize: 14
+        }
     }
 }