---

/bin/sh <<'TB_WEB'
date -u
/usr/sbin/sysctl net.inet.tcp.tso
tb_before=$(/usr/sbin/netstat -an -p tcp | awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print $4, $5}')
[ -n "$tb_before" ] || { echo 'Stop: corporate VPN TCP connection not found.'; exit 1; }
echo 'Current corporate connection:'
printf '%s\n' "$tb_before"

echo 'Primary DNS resolver:'
/usr/sbin/scutil --dns | awk '
  /^resolver #1$/ {active=1; next}
  active && /^resolver #/ {exit}
  active && /^[[:space:]]*(nameserver\[[0-9]+\]|port)[[:space:]]*:/ {print}
'

for tb_host in my.vk.team www.google.com; do
  echo "Direct HTTPS: $tb_host"
  /usr/bin/curl -q -4 --noproxy '*' --connect-timeout 5 --max-time 12 \
    --silent --show-error --output /dev/null \
    --write-out 'ip=%{remote_ip} http=%{http_code} bytes=%{size_download} dns=%{time_namelookup} tcp=%{time_connect} tls=%{time_appconnect} first_byte=%{time_starttransfer} total=%{time_total}\n' \
    "https://$tb_host/"
done

echo 'Configured PAC download and rule evaluation (25-second limit):'
/usr/bin/perl -e 'alarm 25; exec @ARGV' /usr/bin/osascript -l JavaScript <<'TB_PAC'
ObjC.import('Foundation');
ObjC.import('CFNetwork');
function cf(value) { return ObjC.deepUnwrap(ObjC.castRefToObject(value)); }
function choice(pac, host) {
    var start = Date.now();
    var url = $.CFURLCreateWithString(null, $('https://' + host + '/'), null);
    var entries = cf($.CFNetworkCopyProxiesForAutoConfigurationScript($(pac), url, null));
    if (!Array.isArray(entries)) { console.log('PAC ' + host + ': evaluation failed'); return; }
    var labels = entries.map(function (entry) {
        if (entry.kCFProxyTypeKey === 'kCFProxyTypeNone') return 'DIRECT';
        var name = entry.kCFProxyHostNameKey, port = entry.kCFProxyPortNumberKey;
        var type = String(entry.kCFProxyTypeKey || '').replace(/^kCFProxyType/, '');
        if (!/^(HTTP|HTTPS|SOCKS)$/.test(type) || typeof name !== 'string' ||
            !/^[A-Za-z0-9._:\[\]-]+$/.test(name) || !Number.isInteger(port) || port < 1 || port > 65535)
            return 'unhandled proxy entry';
        return type + ' proxy ' + name + ':' + port;
    });
    console.log('PAC ' + host + ': ' + labels.join(' then ') + ' (' + (Date.now() - start) + ' ms)');
}
function run() {
    var settings = cf($.CFNetworkCopySystemProxySettings());
    if (!settings || Number(settings.ProxyAutoConfigEnable) !== 1) {
        console.log('No enabled primary PAC setting found; no fetch.'); return;
    }
    var address = settings.ProxyAutoConfigURLString;
    if (typeof address !== 'string' || !/^https?:\/\//i.test(address) || /[\x00-\x20\x7f]/.test(address)) {
        console.log('PAC URL format not handled; no fetch.'); return;
    }
    console.log('PAC host: ' + ObjC.unwrap($.NSURL.URLWithString($(address)).host) + ' (path/query omitted)');
    var task = $.NSTask.alloc.init, input = $.NSPipe.pipe, output = $.NSPipe.pipe;
    task.launchPath = '/usr/bin/curl';
    task.arguments = $(['-q', '-4', '--noproxy', '*', '--connect-timeout', '5', '--max-time', '8',
        '--max-filesize', '1048576', '--silent', '--output', '-', '--config', '-', '--write-out',
        '\n__TB_PAC_METRICS__ %{http_code} %{time_namelookup} %{time_connect} %{time_total}\n']);
    task.standardInput = input; task.standardOutput = output;
    task.standardError = $.NSFileHandle.fileHandleWithNullDevice;
    task.launch;
    var config = 'url = "' + address.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"\n';
    input.fileHandleForWriting.writeData($(config).dataUsingEncoding($.NSUTF8StringEncoding));
    input.fileHandleForWriting.closeFile;
    var data = output.fileHandleForReading.readDataToEndOfFile;
    task.waitUntilExit;
    var result = ObjC.unwrap($.NSString.alloc.initWithDataEncoding(data, $.NSUTF8StringEncoding));
    var metrics = typeof result === 'string' && result.match(/\n__TB_PAC_METRICS__ (\d{3}) ([0-9.]+) ([0-9.]+) ([0-9.]+)\n$/);
    console.log('PAC curl_exit=' + task.terminationStatus);
    if (!metrics) { console.log('PAC metadata unavailable; contents omitted.'); return; }
    console.log('PAC HTTP=' + metrics[1] + ' dns=' + metrics[2] + ' tcp=' + metrics[3] + ' total=' + metrics[4]);
    if (task.terminationStatus !== 0 || metrics[1] !== '200') return;
    var pac = result.slice(0, metrics.index);
    choice(pac, 'my.vk.team'); choice(pac, 'www.google.com');
}
TB_PAC

tb_after=$(/usr/sbin/netstat -an -p tcp | awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print $4, $5}')
if [ "$tb_after" = "$tb_before" ]; then
  echo 'Corporate TCP connection unchanged.'
else
  echo 'Corporate TCP connection changed; comparisons are limited.'
fi
date -u
TB_WEB