Fix CI compile: WebProxyCatalog Codable + skip-rebuild helper

- WebProxyCatalogEntry: Decodable only (CodingKeys.secret broke Encodable)
- WebProxyManager: implement shouldSkipCarrierRebuildDueToRecentActivity
- AppDelegate: strong Box capture; use beginBackgroundKeepalive; wire willEnterForeground
- MTWebSocketConnectionInterface: import Security for SNI override

Co-authored-by: D3C0Y <decoder-dev@users.noreply.github.com>

Author: decoder-dev

submodules/TelegramCore/Sources/Network/MTWebSocketConnectionInterface.swift

@@ -1,5 +1,6 @@
 import Foundation
 import Network
+import Security
 
 import MtProtoKit
 import SwiftSignalKit

submodules/TelegramUI/Sources/AppDelegate.swift

@@ -2088,17 +2088,18 @@ private func extractAccountManagerState(records: AccountRecordsView<TelegramAcco
         // enough — the relay's own keep-alive timer runs on the server side.
         final class Box { var value: UIBackgroundTaskIdentifier = .invalid }
         let webProxyTaskBox = Box()
-        webProxyTaskBox.value = application.beginBackgroundTask(withName: "web-proxy-keepalive") { [weak webProxyTaskBox] in
-            if let box = webProxyTaskBox, box.value != .invalid {
-                application.endBackgroundTask(box.value)
-                box.value = .invalid
+        let endWebProxyKeepaliveTask: () -> Void = {
+            if webProxyTaskBox.value != .invalid {
+                application.endBackgroundTask(webProxyTaskBox.value)
+                webProxyTaskBox.value = .invalid
             }
         }
-        DispatchQueue.main.asyncAfter(deadline: .now() + 2.0) { [weak webProxyTaskBox] in
-            let _ = WebProxyManager.shared.sendKeepalivePing()
-            if let box = webProxyTaskBox, box.value != .invalid {
-                application.endBackgroundTask(box.value)
-                box.value = .invalid
+        webProxyTaskBox.value = application.beginBackgroundTask(withName: "web-proxy-keepalive", expirationHandler: endWebProxyKeepaliveTask)
+        DispatchQueue.main.asyncAfter(deadline: .now() + 2.0) {
+            // beginBackgroundKeepalive ends the task via expirationHandler ~1s after the ping;
+            // if there is no live WEB sidecar, end it here.
+            if !WebProxyManager.shared.beginBackgroundKeepalive(expirationHandler: endWebProxyKeepaliveTask) {
+                endWebProxyKeepaliveTask()
             }
         }
     }
@@ -2144,6 +2145,8 @@ private func extractAccountManagerState(records: AccountRecordsView<TelegramAcco
                 }
             }
         }
+
+        WebProxyManager.shared.applicationWillEnterForeground()
 
         self.runForegroundTasks()
 

submodules/WebProxyTransport/Sources/WebProxyCatalog.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// A single entry in the WEB-proxy public catalog.
-public struct WebProxyCatalogEntry: Equatable, Codable {
+public struct WebProxyCatalogEntry: Equatable, Decodable {
     public var title: String
     public var host: String
     /// Raw hex of the proxy secret (`dd…` or `ee…` prefix).

submodules/WebProxyTransport/Sources/WebProxyManager.swift

@@ -209,8 +209,25 @@ public final class WebProxyManager {
         self.lock.unlock()
         guard let sidecar = sidecar else { return false }
         sidecar.sendKeepalivePing()
+        self.lock.lock()
+        self.lastActivityAt = CFAbsoluteTimeGetCurrent()
+        self.lock.unlock()
         return true
     }
+
+    /// True when a live sidecar recently carried traffic (or we just keepalive-pinged it), so a
+    /// foreground resume can leave the carrier alone instead of rebuilding.
+    private func shouldSkipCarrierRebuildDueToRecentActivity(sidecar: WebProxySidecar?, hasEndpoint: Bool) -> Bool {
+        guard hasEndpoint, let sidecar else {
+            return false
+        }
+        let sidecarAge = sidecar.secondsSinceLastActivity()
+        self.lock.lock()
+        let managerStamp = self.lastActivityAt
+        self.lock.unlock()
+        let managerAge = managerStamp > 0 ? CFAbsoluteTimeGetCurrent() - managerStamp : Double.infinity
+        return min(sidecarAge, managerAge) < 45.0
+    }
 
     /// Call from `applicationWillEnterForeground`. If the sidecar is still ready and recently
     /// active, skip the later carrier rebuild by clearing `enteredBackgroundAt` only.
@@ -239,17 +256,9 @@ public final class WebProxyManager {
     /// no live WEB sidecar. `expirationHandler` is invoked shortly after the ping is queued so the
     /// caller can end its `beginBackgroundTask`.
     public func beginBackgroundKeepalive(expirationHandler: @escaping () -> Void) -> Bool {
-        self.lock.lock()
-        let sidecar = self.sidecar
-        let ready = sidecar != nil && self.endpoint != nil
-        self.lock.unlock()
-        guard ready, let sidecar else {
+        guard self.sendKeepalivePing() else {
             return false
         }
-        sidecar.sendKeepalivePing()
-        self.lock.lock()
-        self.lastActivityAt = CFAbsoluteTimeGetCurrent()
-        self.lock.unlock()
         DispatchQueue.global(qos: .utility).asyncAfter(deadline: .now() + 1.0, execute: expirationHandler)
         return true
     }
@@ -300,21 +309,6 @@ public final class WebProxyManager {
             return
         }
 
-        // If the sidecar is healthy and had recent activity (keepalive kept it alive), skip the
-        // carrier rebuild. "Recent" = within the last 45 s — covers brief suspensions where the
-        // background task managed to run.
-        self.lock.lock()
-        let liveSidecar = self.sidecar
-        let hasLiveEndpoint = self.endpoint != nil
-        self.lock.unlock()
-        if hasLiveEndpoint, let liveSidecar = liveSidecar, liveSidecar.secondsSinceLastActivity() < 45 {
-            self.startLock.lock()
-            self.enteredBackgroundAt = 0
-            self.startLock.unlock()
-            WebProxyLog.log("skip carrier rebuild: recent activity (\(Int(liveSidecar.secondsSinceLastActivity()))s ago)")
-            return
-        }
-
         if self.shouldSkipCarrierRebuildDueToRecentActivity(sidecar: sidecar, hasEndpoint: hasEndpoint) {
             self.startLock.lock()
             self.enteredBackgroundAt = 0