@openclaw/proxyline 0.3.3 → 0.3.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.3.4 - 2026-07-20
+
+- Added `AbortSignal` cancellation to explicit CONNECT tunnels, including active socket cleanup.
+- Fixed managed HTTPS proxy connections to IPv6 literal endpoints so equivalent compressed and expanded certificate addresses validate without sending IP-literal SNI.
+- Updated Undici to 8.5.0 and raised the compatible peer floor to pick up current security fixes; refreshed pnpm, Node types, and transitive esbuild tooling.
+
 ## 0.3.3 - 2026-05-18
 
 - Fixed managed `globalThis.fetch` so later Undici global dispatcher replacement cannot bypass the active Proxyline dispatcher. Thanks @jesse-merhi.

package/README.md

@@ -1,5 +1,7 @@
 # 🌐 Proxyline
 
+![Proxyline banner](docs/assets/readme-banner.jpg)
+
 [![npm](https://img.shields.io/npm/v/%40openclaw%2Fproxyline.svg)](https://www.npmjs.com/package/@openclaw/proxyline)
 [![node](https://img.shields.io/node/v/%40openclaw%2Fproxyline.svg)](https://nodejs.org/)
 [![license](https://img.shields.io/npm/l/%40openclaw%2Fproxyline.svg)](./LICENSE)
@@ -31,7 +33,7 @@ pnpm add @openclaw/proxyline
 npm install @openclaw/proxyline
 ```
 
-Requires Node 22.19.0+ and a host `undici` dependency compatible with `>=8.3.0 <9`.
+Requires Node 22.19.0+ and a host `undici` dependency compatible with `>=8.5.0 <9`.
 
 ## Quick start
 
@@ -76,12 +78,14 @@ const socket = new WebSocket("wss://events.example.com/", {
 ```ts
 import { openProxyConnectTunnel } from "@openclaw/proxyline";
 
+const controller = new AbortController();
 const socket = await openProxyConnectTunnel({
   proxyUrl: "https://proxy.corp.example:8443",
   proxyTls: { caFile: "/etc/proxy-ca.pem" },
   targetHost: "api.example.com",
   targetPort: 443,
   timeoutMs: 2_000,
+  signal: controller.signal,
 });
 ```
 

package/dist/connect.d.ts

@@ -7,6 +7,7 @@ export type OpenProxyConnectTunnelOptions = Readonly<{
     targetHost: string;
     targetPort: number;
     timeoutMs?: number;
+    signal?: AbortSignal;
 }>;
 type ProxySocket = net.Socket | tls.TLSSocket;
 export declare function formatConnectAuthority(targetHost: string, targetPort: number): string;

package/dist/connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../src/connect.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAkB,KAAK,mBAAmB,EAAqC,MAAM,aAAa,CAAC;AAE1G,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC;IACvB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAMH,KAAK,WAAW,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC;AAsB9C,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqBrF;AAkDD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,WAAW,CAAC,CA8GtB"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../src/connect.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAkB,KAAK,mBAAmB,EAAqC,MAAM,aAAa,CAAC;AAE1G,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC;IACvB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC,CAAC;AAMH,KAAK,WAAW,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC;AAsB9C,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqBrF;AAkDD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,WAAW,CAAC,CAwHtB"}

package/dist/connect.js

@@ -100,6 +100,7 @@ export async function openProxyConnectTunnel(options) {
             socket?.off("close", onClosed);
             socket?.off("connect", onConnected);
             socket?.off("secureConnect", onConnected);
+            options.signal?.removeEventListener("abort", onAbort);
         };
         const fail = (error) => {
             if (settled) {
@@ -162,7 +163,15 @@ export async function openProxyConnectTunnel(options) {
         const onClosed = () => {
             fail(new Error("proxy socket closed before CONNECT response"));
         };
+        const onAbort = () => {
+            fail(options.signal?.reason ?? new Error("proxy CONNECT aborted"));
+        };
         try {
+            options.signal?.addEventListener("abort", onAbort, { once: true });
+            if (options.signal?.aborted) {
+                onAbort();
+                return;
+            }
             if (options.timeoutMs !== undefined && options.timeoutMs > 0) {
                 timeout = setTimeout(() => {
                     fail(new Error(`proxy CONNECT timed out after ${Math.trunc(options.timeoutMs ?? 0)}ms`));

package/dist/node-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-http.d.ts","sourceRoot":"","sources":["../src/node-http.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAI/B,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAqC,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG;IAChF,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;CAC5B,CAAC;AAEF,KAAK,cAAc,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC;AAC1C,KAAK,gBAAgB,GAAG,CAAC,OAAO,EAAE,sBAAsB,KAAK,IAAI,CAAC,KAAK,CAAC;AACxE,KAAK,gBAAgB,GAAG,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;AAC/D,KAAK,uBAAuB,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAYF,KAAK,qBAAqB,GAAG,gBAAgB,GAAG;IAC9C,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,cAAc,EAAE,CACd,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,KACzB,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAOF,eAAO,MAAM,4BAA4B,gPAkB/B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACjC,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IACzB,eAAe,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IACzC,YAAY,EAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACnC,QAAQ,EAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAC3B,gBAAgB,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC;CAC5C,CAAC;AAiEF,wBAAgB,kBAAkB,CAAC,OAAO,SAAS,cAAc,EAC/D,cAAc,EAAE,OAAO,EACvB,WAAW,EAAE,gBAAgB,GAC5B,OAAO,CAsCT;AAiiBD,qBAAa,uBAAwB,SAAQ,IAAI,CAAC,KAAK;;IACrD,SAAgB,OAAO,EAAE,gBAAgB,CAAC;gBAYvB,OAAO,EAAE,qBAAqB;IAcjD,IAAW,WAAW,IAAI,MAAM,CAI/B;IAED,IAAW,WAAW,CAAC,KAAK,EAAE,MAAM,EAEnC;IAED,IAAW,QAAQ,IAAI,MAAM,CAE5B;IAED,IAAW,QAAQ,CAAC,MAAM,EAAE,MAAM,EAEjC;IAEM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,GAAG,MAAM;IAsCjE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI;IA6BlE,OAAO,IAAI,IAAI;CAShC;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,eAAe,GAAE,MAAM,GAAG,OAAgB,GACzC,uBAAuB,CAMzB;AAED,wBAAgB,qBAAqB,IAAI,uBAAuB,CAI/D;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAMF,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAIT;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,GACzC,uBAAuB,GAAG,SAAS,CAWrC"}
+{"version":3,"file":"node-http.d.ts","sourceRoot":"","sources":["../src/node-http.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAI/B,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAqC,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG;IAChF,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;CAC5B,CAAC;AAEF,KAAK,cAAc,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC;AAC1C,KAAK,gBAAgB,GAAG,CAAC,OAAO,EAAE,sBAAsB,KAAK,IAAI,CAAC,KAAK,CAAC;AACxE,KAAK,gBAAgB,GAAG,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;AAC/D,KAAK,uBAAuB,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAYF,KAAK,qBAAqB,GAAG,gBAAgB,GAAG;IAC9C,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,cAAc,EAAE,CACd,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,KACzB,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAOF,eAAO,MAAM,4BAA4B,YACvC,IAAI,EACJ,MAAM,EACN,SAAS,EACT,kBAAkB,EAClB,KAAK,EACL,SAAS,EACT,WAAW,EACX,kBAAkB,EAClB,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,CACV,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACjC,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IACzB,eAAe,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IACzC,YAAY,EAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACnC,QAAQ,EAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAC3B,gBAAgB,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC;CAC5C,CAAC;AAiEF,wBAAgB,kBAAkB,CAAC,OAAO,SAAS,cAAc,EAC/D,cAAc,EAAE,OAAO,EACvB,WAAW,EAAE,gBAAgB,GAC5B,OAAO,CAsCT;AAiiBD,qBAAa,uBAAwB,SAAQ,IAAI,CAAC,KAAK;;IACrD,SAAgB,OAAO,EAAE,gBAAgB,CAAC;IAY1C,YAAmB,OAAO,EAAE,qBAAqB,EAYhD;IAED,IAAW,WAAW,IAAI,MAAM,CAI/B;IAED,IAAW,WAAW,CAAC,KAAK,EAAE,MAAM,EAEnC;IAED,IAAW,QAAQ,IAAI,MAAM,CAE5B;IAED,IAAW,QAAQ,CAAC,MAAM,EAAE,MAAM,EAEjC;IAEM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAEvE;IAoCM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI,CA2BjF;IAEe,OAAO,IAAI,IAAI,CAQ9B;CACF;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,eAAe,GAAE,MAAM,GAAG,OAAgB,GACzC,uBAAuB,CAMzB;AAED,wBAAgB,qBAAqB,IAAI,uBAAuB,CAI/D;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAMF,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAIT;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,GACzC,uBAAuB,GAAG,SAAS,CAWrC"}

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAIV,eAAe,EACf,gBAAgB,EAIjB,MAAM,YAAY,CAAC;AA8xBpB,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAgI3E;AAED,eAAO,MAAM,kBAAkB,yBAAmB,CAAC"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAIV,eAAe,EACf,gBAAgB,EAIjB,MAAM,YAAY,CAAC;AAqzBpB,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAgI3E;AAED,eAAO,MAAM,kBAAkB,yBAAmB,CAAC"}

package/dist/runtime.js

@@ -1,7 +1,9 @@
 import http from "node:http";
 import https from "node:https";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { X509Certificate } from "node:crypto";
 import net from "node:net";
+import tls from "node:tls";
 import { Agent as UndiciAgent, Dispatcher, FormData as UndiciFormData, Headers as UndiciHeaders, Pool as UndiciPool, Request as UndiciRequest, Response as UndiciResponse, errors as undiciErrors, fetch as undiciFetch, getGlobalDispatcher, ProxyAgent as UndiciProxyAgent, setGlobalDispatcher, } from "undici";
 import { createAmbientProxyResolver, EMPTY_PROXY_ENV, resolveAmbientProxyForUrl, readProxyEnv, } from "./env.js";
 import { bindNodeHttpMethod, createDirectNodeAgent, createNodeProxyAgent, } from "./node-http.js";
@@ -301,6 +303,21 @@ function stripIpServernameFromConnect(connect) {
     }
     return (options, callback) => connect(stripIpServernameFromConnectOptions(options), callback);
 }
+const checkProxyServerIdentity = (hostname, certificate) => {
+    const normalizedHostname = hostname.replace(/^\[|\]$/g, "");
+    if (net.isIP(normalizedHostname) === 6) {
+        try {
+            // Compare binary addresses so compressed and expanded IPv6 SAN forms remain equivalent.
+            if (new X509Certificate(certificate.raw).checkIP(normalizedHostname) !== undefined) {
+                return undefined;
+            }
+        }
+        catch {
+            // Let Node return its canonical certificate validation error below.
+        }
+    }
+    return tls.checkServerIdentity(normalizedHostname, certificate);
+};
 function createProxyClientFactory() {
     return (origin, options) => {
         const clientOptions = isObjectRecord(options)
@@ -310,11 +327,18 @@ function createProxyClientFactory() {
     };
 }
 function createUndiciProxyAgent(proxyUrl, options) {
+    const proxyHostname = new URL(proxyUrl).hostname.replace(/^\[|\]$/g, "");
+    const proxyTls = options.proxyCa !== undefined || net.isIP(proxyHostname) === 6
+        ? {
+            ...(options.proxyCa !== undefined ? { ca: options.proxyCa } : {}),
+            ...(net.isIP(proxyHostname) === 6 ? { checkServerIdentity: checkProxyServerIdentity } : {}),
+        }
+        : undefined;
     return new UndiciProxyAgent({
         ...resolveUndiciBaseOptions(options.undici),
         uri: proxyUrl,
         clientFactory: createProxyClientFactory(),
-        ...(options.proxyCa !== undefined ? { proxyTls: { ca: options.proxyCa } } : {}),
+        ...(proxyTls !== undefined ? { proxyTls } : {}),
     });
 }
 function createUndiciProxyDispatcher(options, dispatcherOptions) {

package/dist/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAKjD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW9F;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAO1D"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B,YAAmB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAI/C;CACF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW9F;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAO1D"}

package/docs/api-reference.md

@@ -257,6 +257,7 @@ type OpenProxyConnectTunnelOptions = Readonly<{
   targetHost: string;
   targetPort: number;
   timeoutMs?: number;
+  signal?: AbortSignal;
 }>;
 ```
 
@@ -264,6 +265,7 @@ type OpenProxyConnectTunnelOptions = Readonly<{
 - `proxyTls` — CA trust for HTTPS proxies. See [Proxy TLS](./proxy-tls.md).
 - `targetHost` / `targetPort` — what to ask the proxy to connect to.
 - `timeoutMs` — overall budget for the CONNECT handshake.
+- `signal` — optional caller cancellation; aborting rejects the handshake and destroys its active proxy socket.
 
 ### `AmbientNodeProxyAgentOptions`
 

package/docs/surfaces.md

@@ -83,6 +83,7 @@ const socket = await openProxyConnectTunnel({
   targetHost: "api.example.com",
   targetPort: 443,
   timeoutMs: 2_000,
+  signal: AbortSignal.timeout(2_000),
 });
 ```
 
@@ -93,6 +94,7 @@ Properties:
 - Userinfo in the `proxyUrl` becomes a `Proxy-Authorization: Basic ...` header.
 - A bounded `16 KiB` header buffer protects against malicious or runaway proxy responses.
 - `timeoutMs` is enforced and emits a `CONNECT_FAILED` error on expiry.
+- `signal` aborts an in-progress handshake and destroys its active proxy socket.
 - Bytes the proxy sends after the response headers are re-injected with `socket.unshift()` so the caller sees the full target stream.
 - Non-2xx status lines, header overrun, premature close, and socket errors are all surfaced as `ProxylineError` with code `CONNECT_FAILED`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/proxyline",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Process-global proxy routing for Node.js.",
   "type": "module",
   "license": "MIT",
@@ -17,7 +17,7 @@
     "url": "https://github.com/openclaw/proxyline/issues"
   },
   "homepage": "https://proxyline.dev",
-  "packageManager": "pnpm@11.1.2",
+  "packageManager": "pnpm@11.9.0",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -53,20 +53,26 @@
     "prepare": "node scripts/prepack-build.mjs",
     "publish:dry-run": "pnpm publish --dry-run --access public",
     "test": "pnpm build && tsx --test test/index.test.ts test/e2e.test.ts test/package.test.ts test/scripts.test.ts && tsx --test test/package-artifact.test.ts",
-    "typecheck": "pnpm build && tsc --noEmit"
+    "typecheck": "pnpm build && tsc --noEmit",
+    "check:changed": "pnpm run check",
+    "test:changed": "pnpm run test",
+    "crabbox:hydrate": "crabbox actions hydrate",
+    "crabbox:run": "crabbox run",
+    "crabbox:stop": "crabbox stop",
+    "crabbox:warmup": "crabbox warmup"
   },
   "devDependencies": {
-    "@types/node": "25.8.0",
+    "@types/node": "26.1.1",
     "@types/ws": "8.18.1",
-    "tsx": "4.22.1",
-    "typescript": "6.0.3",
-    "undici": "8.3.0",
-    "ws": "8.20.1"
+    "tsx": "4.23.0",
+    "typescript": "^7.0.2",
+    "undici": "8.6.0",
+    "ws": "8.21.0"
   },
   "engines": {
     "node": ">=22.19.0"
   },
   "peerDependencies": {
-    "undici": ">=8.3.0 <9"
+    "undici": ">=8.5.0 <9"
   }
 }

package/scripts/prepack-build.mjs

@@ -1,12 +1,17 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
 
 const require = createRequire(import.meta.url);
 
 function resolveTypeScriptCompiler() {
   try {
-    return require.resolve("typescript/bin/tsc");
+    const packageJsonPath = require.resolve("typescript/package.json");
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+    const compiler = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.tsc;
+    return typeof compiler === "string" ? resolve(dirname(packageJsonPath), compiler) : undefined;
   } catch {
     return undefined;
   }

package/src/connect.ts

@@ -8,6 +8,7 @@ export type OpenProxyConnectTunnelOptions = Readonly<{
   targetHost: string;
   targetPort: number;
   timeoutMs?: number;
+  signal?: AbortSignal;
 }>;
 
 const MAX_CONNECT_RESPONSE_HEADER_BYTES = 16 * 1024;
@@ -131,6 +132,7 @@ export async function openProxyConnectTunnel(
       socket?.off("close", onClosed);
       socket?.off("connect", onConnected);
       socket?.off("secureConnect", onConnected);
+      options.signal?.removeEventListener("abort", onAbort);
     };
 
     const fail = (error: unknown): void => {
@@ -203,7 +205,16 @@ export async function openProxyConnectTunnel(
       fail(new Error("proxy socket closed before CONNECT response"));
     };
 
+    const onAbort = (): void => {
+      fail(options.signal?.reason ?? new Error("proxy CONNECT aborted"));
+    };
+
     try {
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+      if (options.signal?.aborted) {
+        onAbort();
+        return;
+      }
       if (options.timeoutMs !== undefined && options.timeoutMs > 0) {
         timeout = setTimeout(() => {
           fail(new Error(`proxy CONNECT timed out after ${Math.trunc(options.timeoutMs ?? 0)}ms`));

package/src/runtime.ts

@@ -1,7 +1,9 @@
 import http from "node:http";
 import https from "node:https";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { X509Certificate } from "node:crypto";
 import net from "node:net";
+import tls from "node:tls";
 import {
   Agent as UndiciAgent,
   Dispatcher,
@@ -483,6 +485,21 @@ function stripIpServernameFromConnect(connect: unknown): unknown {
     (connect as UnknownFunction)(stripIpServernameFromConnectOptions(options), callback);
 }
 
+const checkProxyServerIdentity: typeof tls.checkServerIdentity = (hostname, certificate) => {
+  const normalizedHostname = hostname.replace(/^\[|\]$/g, "");
+  if (net.isIP(normalizedHostname) === 6) {
+    try {
+      // Compare binary addresses so compressed and expanded IPv6 SAN forms remain equivalent.
+      if (new X509Certificate(certificate.raw).checkIP(normalizedHostname) !== undefined) {
+        return undefined;
+      }
+    } catch {
+      // Let Node return its canonical certificate validation error below.
+    }
+  }
+  return tls.checkServerIdentity(normalizedHostname, certificate);
+};
+
 function createProxyClientFactory(): UndiciProxyClientFactory {
   return (origin: URL, options: object): Dispatcher => {
     const clientOptions = isObjectRecord(options)
@@ -499,11 +516,19 @@ function createUndiciProxyAgent(
   proxyUrl: string,
   options: UndiciDispatcherOptions,
 ): UndiciProxyAgent {
+  const proxyHostname = new URL(proxyUrl).hostname.replace(/^\[|\]$/g, "");
+  const proxyTls =
+    options.proxyCa !== undefined || net.isIP(proxyHostname) === 6
+      ? {
+          ...(options.proxyCa !== undefined ? { ca: options.proxyCa } : {}),
+          ...(net.isIP(proxyHostname) === 6 ? { checkServerIdentity: checkProxyServerIdentity } : {}),
+        }
+      : undefined;
   return new UndiciProxyAgent({
     ...resolveUndiciBaseOptions(options.undici),
     uri: proxyUrl,
     clientFactory: createProxyClientFactory(),
-    ...(options.proxyCa !== undefined ? { proxyTls: { ca: options.proxyCa } } : {}),
+    ...(proxyTls !== undefined ? { proxyTls } : {}),
   } as ConstructorParameters<typeof UndiciProxyAgent>[0]);
 }