diff --git a/AGENTS.md b/AGENTS.md
index d3d9b67..7589018 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -95,7 +95,7 @@ vps-tracker/
 Ручная проверка с VPS: `curl -fsSL https://vt.shnt.top/cc | bash` (тот же контейнер, Traefik dual Host).
 
 - **Vendor:** `apps/api/scripts/censorcheck/censorcheck.sh` (pin SHA `12c5839`, MIT)
-- **Launcher:** `GET /cc` минтит HMAC ingest-токен (TTL 20 мин); по `/etc/os-release` ставит `jq`/`dig`/`column` без prompt; `GET /cc/vendor` — скрипт (LF)
+- **Launcher:** `GET /cc` минтит HMAC ingest-токен (TTL 20 мин); по `/etc/os-release` ставит `jq`/`dig`/`column` без prompt; прогресс-бар в stderr; `GET /cc/vendor` — скрипт (LF)
 - **Ingest:** `POST /api/integrations/censorcheck/runs` (без portal JWT)
 - **UI:** `/blocking` — текущие прогоны и история, группировка VPS / сервис
 - Env: `CENSORCHECK_INGEST_SECRET`, `CENSORCHECK_PUBLIC_URL`, `VPS_LAUNCHER_DOMAIN`
diff --git a/apps/api/scripts/censorcheck/VENDOR.md b/apps/api/scripts/censorcheck/VENDOR.md
index 4898d2c..a326c84 100644
--- a/apps/api/scripts/censorcheck/VENDOR.md
+++ b/apps/api/scripts/censorcheck/VENDOR.md
@@ -4,5 +4,6 @@ Vendor pin of https://github.com/vernette/censorcheck
 - Commit: `12c5839` (2026-08-11)
 - License: MIT (see upstream repository)
 - Keep Unix LF and the `display_help` here-doc intact (`is_installed` lives after it).
+- Local overlay: `show_progress` пишет бар в stderr даже при `--json`.
 
 Do not fetch this script from GitHub at runtime — some probe networks block github.com.
diff --git a/apps/api/scripts/censorcheck/censorcheck.sh b/apps/api/scripts/censorcheck/censorcheck.sh
index f8c2c2b..9096a51 100644
--- a/apps/api/scripts/censorcheck/censorcheck.sh
+++ b/apps/api/scripts/censorcheck/censorcheck.sh
@@ -95,23 +95,44 @@ show_progress() {
   local current=$1
   local total=$2
   local domain=$3
+  local width=24
+  local filled=0 pct=0 empty=0
+  local label="$domain"
+  local bar
 
-  if ! $JSON_OUTPUT; then
-    printf "\r\033[K%b[%d/%d] Checking:%b %b%s%b" \
-      "$COLOR_BLUE" \
-      "$current" \
-      "$total" \
-      "$COLOR_RESET" \
-      "$COLOR_WHITE" \
-      "$domain" \
-      "$COLOR_RESET" >&2
+  if [ "$total" -gt 0 ]; then
+    filled=$((current * width / total))
+    pct=$((current * 100 / total))
   fi
+  [ "$filled" -gt "$width" ] && filled=$width
+  empty=$((width - filled))
+
+  bar="$(printf '%*s' "$filled" '' | tr ' ' '=')"
+  if [ "$empty" -gt 0 ] && [ "$filled" -lt "$width" ]; then
+    bar="${bar}>"
+    empty=$((empty - 1))
+  fi
+  bar="${bar}$(printf '%*s' "$empty" '')"
+
+  if [ "${#label}" -gt 42 ]; then
+    label="${label:0:39}..."
+  fi
+
+  # stderr: JSON на stdout не ломаем даже в --json
+  printf "\r\033[K%b[%s]%b %3d%%  %d/%d  %b%s%b" \
+    "$COLOR_BLUE" \
+    "$bar" \
+    "$COLOR_RESET" \
+    "$pct" \
+    "$current" \
+    "$total" \
+    "$COLOR_WHITE" \
+    "$label" \
+    "$COLOR_RESET" >&2
 }
 
 clear_progress() {
-  if ! $JSON_OUTPUT; then
-    printf "\r%80s\r" " " >&2
-  fi
+  printf "\n" >&2
 }
 
 cleanup() {
diff --git a/apps/api/scripts/censorcheck/launcher.sh b/apps/api/scripts/censorcheck/launcher.sh
index 4b853a6..40155fc 100644
--- a/apps/api/scripts/censorcheck/launcher.sh
+++ b/apps/api/scripts/censorcheck/launcher.sh
@@ -5,7 +5,7 @@ set -euo pipefail
 
 VT_API_URL="${VT_API_URL:-__VT_API_URL__}"
 VT_INGEST_TOKEN="${VT_INGEST_TOKEN:-__VT_INGEST_TOKEN__}"
-LAUNCHER_VERSION="3"
+LAUNCHER_VERSION="4"
 VENDOR_SHA="12c5839"
 
 OS_ID="unknown"
@@ -209,20 +209,17 @@ RUN_ID="$(uuid4)"
 log "censorcheck launcher ${LAUNCHER_VERSION} (vendor ${VENDOR_SHA})"
 log "probe IP: ${PUBLIC_IP}"
 log "runId: ${RUN_ID}"
+log "Проверяю сайты (последовательно, несколько минут)..."
 
 set +e
-RAW_JSON="$(bash "$VENDOR" --mode both --json --no-header --no-dns 2>/tmp/vt-censorcheck-err.$$)"
+# stdout = JSON; stderr = прогресс-бар (не перехватывать)
+RAW_JSON="$(bash "$VENDOR" --mode both --json --no-header --no-dns)"
 CC_EXIT=$?
 set -e
 if [ "$CC_EXIT" -ne 0 ]; then
   log "censorcheck завершился с кодом ${CC_EXIT}" >&2
-  if [ -s /tmp/vt-censorcheck-err.$$ ]; then
-    cat /tmp/vt-censorcheck-err.$$ >&2 || true
-  fi
-  rm -f /tmp/vt-censorcheck-err.$$
   exit 1
 fi
-rm -f /tmp/vt-censorcheck-err.$$
 
 PAYLOAD="$TMPDIR/payload.json"
 printf '%s' "$RAW_JSON" | jq --arg runId "$RUN_ID" --arg ip "$PUBLIC_IP" --arg lv "$LAUNCHER_VERSION" '
diff --git a/apps/api/src/routes/launcher.test.ts b/apps/api/src/routes/launcher.test.ts
index 817f882..330c99e 100644
--- a/apps/api/src/routes/launcher.test.ts
+++ b/apps/api/src/routes/launcher.test.ts
@@ -30,6 +30,8 @@ describe('GET /cc launcher', () => {
     expect(res.body).toContain('detect_os')
     expect(res.body).toContain('/etc/os-release')
     expect(res.body).toContain('apt-get install -y -qq')
+    expect(res.body).toContain('Проверяю сайты')
+    expect(res.body).not.toContain('2>/tmp/vt-censorcheck-err')
     expect(res.body).not.toContain('\r')
     expect(res.body).not.toContain('__VT_API_URL__')
     expect(res.body).not.toContain('__VT_INGEST_TOKEN__')
@@ -42,6 +44,7 @@ describe('GET /cc launcher', () => {
     expect(res.body).toContain('SCRIPT_NAME')
     expect(res.body).toContain('is_installed()')
     expect(res.body).toContain('cat <<EOF')
+    expect(res.body).toContain('JSON на stdout не ломаем')
     expect(res.body).not.toContain('\r')
   })
 })