@openclaw/proxyline 0.3.4 → 0.3.5

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.3.5 - 2026-08-01
+
+- Fixed malformed percent-encoding in proxy credentials to fail through CONNECT promises and Node request errors with `INVALID_PROXY_USERINFO`. Thanks @SebTardif.
+- Updated Undici, WebSocket and TypeScript tooling, pnpm, and pinned GitHub Actions to their latest stable releases.
+
 ## 0.3.4 - 2026-07-20
 
 - Added `AbortSignal` cancellation to explicit CONNECT tunnels, including active socket cleanup.

package/dist/connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../src/connect.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAkB,KAAK,mBAAmB,EAAqC,MAAM,aAAa,CAAC;AAE1G,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC;IACvB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC,CAAC;AAMH,KAAK,WAAW,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC;AAsB9C,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqBrF;AAkDD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,WAAW,CAAC,CAwHtB"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../src/connect.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAgD,KAAK,mBAAmB,EAAqC,MAAM,aAAa,CAAC;AAExI,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC;IACvB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC,CAAC;AAMH,KAAK,WAAW,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC;AAsB9C,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqBrF;AAkDD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,WAAW,CAAC,CA4HtB"}

package/dist/connect.js

@@ -1,6 +1,6 @@
 import net from "node:net";
 import tls from "node:tls";
-import { ProxylineError, redactProxyUrl, resolveProxyTlsCa } from "./shared.js";
+import { ProxylineError, decodeProxyUserinfoComponent, redactProxyUrl, resolveProxyTlsCa } from "./shared.js";
 const MAX_CONNECT_RESPONSE_HEADER_BYTES = 16 * 1024;
 const INVALID_CONNECT_AUTHORITY_PATTERN = /[\u0000-\u0020\u007f]/;
 const INVALID_CONNECT_HOST_DELIMITER_PATTERN = /[/:?#@\\]/;
@@ -17,8 +17,8 @@ function resolveProxyAuthorization(proxy) {
     if (!proxy.username && !proxy.password) {
         return undefined;
     }
-    const username = decodeURIComponent(proxy.username);
-    const password = decodeURIComponent(proxy.password);
+    const username = decodeProxyUserinfoComponent(proxy.username);
+    const password = decodeProxyUserinfoComponent(proxy.password);
     return `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
 }
 export function formatConnectAuthority(targetHost, targetPort) {
@@ -109,7 +109,7 @@ export async function openProxyConnectTunnel(options) {
             settled = true;
             cleanup();
             socket?.destroy();
-            reject(failConnect(proxy, error));
+            reject(error instanceof ProxylineError ? error : failConnect(proxy, error));
         };
         const succeed = (connectedSocket, tunneledBytes) => {
             if (settled) {
@@ -128,7 +128,12 @@ export async function openProxyConnectTunnel(options) {
                 fail(new Error("proxy socket missing after connect"));
                 return;
             }
-            writeConnectRequest(socket, proxy, target);
+            try {
+                writeConnectRequest(socket, proxy, target);
+            }
+            catch (error) {
+                fail(error);
+            }
         };
         const onData = (chunk) => {
             responseBuffer = Buffer.concat([responseBuffer, chunk]);

package/dist/node-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-http.d.ts","sourceRoot":"","sources":["../src/node-http.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAI/B,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAqC,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG;IAChF,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;CAC5B,CAAC;AAEF,KAAK,cAAc,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC;AAC1C,KAAK,gBAAgB,GAAG,CAAC,OAAO,EAAE,sBAAsB,KAAK,IAAI,CAAC,KAAK,CAAC;AACxE,KAAK,gBAAgB,GAAG,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;AAC/D,KAAK,uBAAuB,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAYF,KAAK,qBAAqB,GAAG,gBAAgB,GAAG;IAC9C,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,cAAc,EAAE,CACd,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,KACzB,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAOF,eAAO,MAAM,4BAA4B,YACvC,IAAI,EACJ,MAAM,EACN,SAAS,EACT,kBAAkB,EAClB,KAAK,EACL,SAAS,EACT,WAAW,EACX,kBAAkB,EAClB,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,CACV,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACjC,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IACzB,eAAe,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IACzC,YAAY,EAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACnC,QAAQ,EAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAC3B,gBAAgB,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC;CAC5C,CAAC;AAiEF,wBAAgB,kBAAkB,CAAC,OAAO,SAAS,cAAc,EAC/D,cAAc,EAAE,OAAO,EACvB,WAAW,EAAE,gBAAgB,GAC5B,OAAO,CAsCT;AAiiBD,qBAAa,uBAAwB,SAAQ,IAAI,CAAC,KAAK;;IACrD,SAAgB,OAAO,EAAE,gBAAgB,CAAC;IAY1C,YAAmB,OAAO,EAAE,qBAAqB,EAYhD;IAED,IAAW,WAAW,IAAI,MAAM,CAI/B;IAED,IAAW,WAAW,CAAC,KAAK,EAAE,MAAM,EAEnC;IAED,IAAW,QAAQ,IAAI,MAAM,CAE5B;IAED,IAAW,QAAQ,CAAC,MAAM,EAAE,MAAM,EAEjC;IAEM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAEvE;IAoCM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI,CA2BjF;IAEe,OAAO,IAAI,IAAI,CAQ9B;CACF;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,eAAe,GAAE,MAAM,GAAG,OAAgB,GACzC,uBAAuB,CAMzB;AAED,wBAAgB,qBAAqB,IAAI,uBAAuB,CAI/D;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAMF,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAIT;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,GACzC,uBAAuB,GAAG,SAAS,CAWrC"}
+{"version":3,"file":"node-http.d.ts","sourceRoot":"","sources":["../src/node-http.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAI/B,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAmE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACxH,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG;IAChF,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;CAC5B,CAAC;AAEF,KAAK,cAAc,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC;AAC1C,KAAK,gBAAgB,GAAG,CAAC,OAAO,EAAE,sBAAsB,KAAK,IAAI,CAAC,KAAK,CAAC;AACxE,KAAK,gBAAgB,GAAG,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;AAC/D,KAAK,uBAAuB,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAYF,KAAK,qBAAqB,GAAG,gBAAgB,GAAG;IAC9C,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,cAAc,EAAE,CACd,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,KACzB,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAOF,eAAO,MAAM,4BAA4B,YACvC,IAAI,EACJ,MAAM,EACN,SAAS,EACT,kBAAkB,EAClB,KAAK,EACL,SAAS,EACT,WAAW,EACX,kBAAkB,EAClB,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,CACV,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACjC,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IACzB,eAAe,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IACzC,YAAY,EAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACnC,QAAQ,EAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAC3B,gBAAgB,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC;CAC5C,CAAC;AAiEF,wBAAgB,kBAAkB,CAAC,OAAO,SAAS,cAAc,EAC/D,cAAc,EAAE,OAAO,EACvB,WAAW,EAAE,gBAAgB,GAC5B,OAAO,CAsCT;AA8hBD,qBAAa,uBAAwB,SAAQ,IAAI,CAAC,KAAK;;IACrD,SAAgB,OAAO,EAAE,gBAAgB,CAAC;IAY1C,YAAmB,OAAO,EAAE,qBAAqB,EAYhD;IAED,IAAW,WAAW,IAAI,MAAM,CAI/B;IAED,IAAW,WAAW,CAAC,KAAK,EAAE,MAAM,EAEnC;IAED,IAAW,QAAQ,IAAI,MAAM,CAE5B;IAED,IAAW,QAAQ,CAAC,MAAM,EAAE,MAAM,EAEjC;IAEM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAEvE;IAoCM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI,CA2BjF;IAEe,OAAO,IAAI,IAAI,CAQ9B;CACF;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,eAAe,GAAE,MAAM,GAAG,OAAgB,GACzC,uBAAuB,CAMzB;AAED,wBAAgB,qBAAqB,IAAI,uBAAuB,CAI/D;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAMF,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAIT;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,GACzC,uBAAuB,GAAG,SAAS,CAWrC"}

package/dist/node-http.js

@@ -5,7 +5,7 @@ import tls from "node:tls";
 import { domainToASCII } from "node:url";
 import { readProxyEnv, resolveAmbientProxyForUrl, } from "./env.js";
 import { formatConnectAuthority } from "./connect.js";
-import { ProxylineError, resolveProxyTlsCa } from "./shared.js";
+import { ProxylineError, decodeProxyUserinfoComponent, resolveProxyTlsCa } from "./shared.js";
 const MAX_CONNECT_RESPONSE_HEADER_BYTES = 16 * 1024;
 const INVALID_PROXY_TARGET_HOST_DELIMITER_PATTERN = /[/:?#@\\]/;
 const INVALID_PROXY_TARGET_HOST_CONTROL_PATTERN = /[\u0000-\u0020\u007f]/;
@@ -133,8 +133,8 @@ function proxyAuthorization(proxy) {
     if (!proxy.username && !proxy.password) {
         return undefined;
     }
-    const username = decodeURIComponent(proxy.username);
-    const password = decodeURIComponent(proxy.password);
+    const username = decodeProxyUserinfoComponent(proxy.username);
+    const password = decodeProxyUserinfoComponent(proxy.password);
     return `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
 }
 function proxyConnectOptions(proxy, proxyTls) {
@@ -445,26 +445,23 @@ class ProxylineConnectAgent extends http.Agent {
             finish(error, proxySocket);
         };
         const onConnected = () => {
-            let target;
             try {
-                target = connectTarget(options);
+                const { host, port } = connectTarget(options);
+                const authority = formatConnectAuthority(host, port);
+                const headers = [
+                    `CONNECT ${authority} HTTP/1.1`,
+                    `Host: ${authority}`,
+                    `Proxy-Connection: ${this.#keepAlive ? "Keep-Alive" : "close"}`,
+                ];
+                const authorization = proxyAuthorization(this.#proxy);
+                if (authorization !== undefined) {
+                    headers.push(`Proxy-Authorization: ${authorization}`);
+                }
+                proxySocket.write([...headers, "", ""].join("\r\n"));
             }
             catch (error) {
                 fail(error instanceof Error ? error : new Error(String(error)));
-                return;
-            }
-            const { host, port } = target;
-            const authority = formatConnectAuthority(host, port);
-            const headers = [
-                `CONNECT ${authority} HTTP/1.1`,
-                `Host: ${authority}`,
-                `Proxy-Connection: ${this.#keepAlive ? "Keep-Alive" : "close"}`,
-            ];
-            const authorization = proxyAuthorization(this.#proxy);
-            if (authorization !== undefined) {
-                headers.push(`Proxy-Authorization: ${authorization}`);
             }
-            proxySocket.write([...headers, "", ""].join("\r\n"));
         };
         const onData = (chunk) => {
             responseBuffer = Buffer.concat([responseBuffer, chunk]);

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAIV,eAAe,EACf,gBAAgB,EAIjB,MAAM,YAAY,CAAC;AAqzBpB,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAgI3E;AAED,eAAO,MAAM,kBAAkB,yBAAmB,CAAC"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAIV,eAAe,EACf,gBAAgB,EAIjB,MAAM,YAAY,CAAC;AAs0BpB,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAgI3E;AAED,eAAO,MAAM,kBAAkB,yBAAmB,CAAC"}

package/dist/runtime.js

@@ -334,13 +334,25 @@ function createUndiciProxyAgent(proxyUrl, options) {
             ...(net.isIP(proxyHostname) === 6 ? { checkServerIdentity: checkProxyServerIdentity } : {}),
         }
         : undefined;
+    const dispatcherFactory = createProxyClientFactory();
     return new UndiciProxyAgent({
         ...resolveUndiciBaseOptions(options.undici),
         uri: proxyUrl,
-        clientFactory: createProxyClientFactory(),
+        clientFactory: dispatcherFactory,
+        factory: dispatcherFactory,
         ...(proxyTls !== undefined ? { proxyTls } : {}),
     });
 }
+function normalizeUndiciDispatchOptions(options) {
+    if (options.origin === undefined || !/^https?:\/\//i.test(options.path)) {
+        return options;
+    }
+    const pathUrl = new URL(options.path);
+    return {
+        ...options,
+        path: `${pathUrl.pathname}${pathUrl.search}`,
+    };
+}
 function createUndiciProxyDispatcher(options, dispatcherOptions) {
     if (options.mode === "ambient") {
         if (!options.active) {
@@ -379,10 +391,11 @@ class ManagedUndiciDispatcher extends Dispatcher {
         if (this.#closedError !== undefined) {
             return reportClosedDispatchError(handler, this.#closedError);
         }
-        const url = resolveUndiciDispatchUrl(options);
+        const normalizedOptions = normalizeUndiciDispatchOptions(options);
+        const url = resolveUndiciDispatchUrl(normalizedOptions);
         const proxyUrl = url === undefined ? "" : this.#resolver.getProxyForUrl(url, "undici");
         const dispatcher = proxyUrl === "" ? this.#directDispatcher : this.#proxyDispatcher(proxyUrl);
-        return dispatcher.dispatch(options, handler);
+        return dispatcher.dispatch(normalizedOptions, handler);
     }
     close(callback) {
         const closing = this.#closeAll();
@@ -445,10 +458,11 @@ class AmbientUndiciDispatcher extends Dispatcher {
         if (this.#closedError !== undefined) {
             return reportClosedDispatchError(handler, this.#closedError);
         }
-        const url = resolveUndiciDispatchUrl(options);
+        const normalizedOptions = normalizeUndiciDispatchOptions(options);
+        const url = resolveUndiciDispatchUrl(normalizedOptions);
         const proxyUrl = url === undefined ? undefined : resolveAmbientProxyForUrl(url, this.#env);
         const dispatcher = proxyUrl === undefined ? this.#directDispatcher : this.#proxyDispatcher(proxyUrl);
-        return dispatcher.dispatch(options, handler);
+        return dispatcher.dispatch(normalizedOptions, handler);
     }
     close(callback) {
         const closing = this.#closeAll();

package/dist/shared.d.ts

@@ -6,6 +6,8 @@ export declare class ProxylineError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
+/** Decode proxy userinfo; invalid percent-encoding must not throw URIError mid-CONNECT. */
+export declare function decodeProxyUserinfoComponent(value: string): string;
 export declare function resolveProxyTlsCa(options: ProxylineTlsOptions | undefined): string | undefined;
 export declare function formatUrl(value: string | URL): string;
 export declare function redactProxyUrl(value: string | URL): string;

package/dist/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B,YAAmB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAI/C;CACF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW9F;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAO1D"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B,YAAmB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAI/C;CACF;AAED,2FAA2F;AAC3F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASlE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW9F;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAO1D"}

package/dist/shared.js

@@ -7,6 +7,15 @@ export class ProxylineError extends Error {
         this.code = code;
     }
 }
+/** Decode proxy userinfo; invalid percent-encoding must not throw URIError mid-CONNECT. */
+export function decodeProxyUserinfoComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        throw new ProxylineError("INVALID_PROXY_USERINFO", "Proxy username or password contains invalid percent-encoding.");
+    }
+}
 export function resolveProxyTlsCa(options) {
     if (!options) {
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/proxyline",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Process-global proxy routing for Node.js.",
   "type": "module",
   "license": "MIT",
@@ -17,7 +17,7 @@
     "url": "https://github.com/openclaw/proxyline/issues"
   },
   "homepage": "https://proxyline.dev",
-  "packageManager": "pnpm@11.9.0",
+  "packageManager": "pnpm@11.18.0",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -62,12 +62,12 @@
     "crabbox:warmup": "crabbox warmup"
   },
   "devDependencies": {
-    "@types/node": "26.1.1",
+    "@types/node": "26.1.2",
     "@types/ws": "8.18.1",
-    "tsx": "4.23.0",
+    "tsx": "4.23.1",
     "typescript": "^7.0.2",
-    "undici": "8.6.0",
-    "ws": "8.21.0"
+    "undici": "8.9.0",
+    "ws": "8.21.1"
   },
   "engines": {
     "node": ">=22.19.0"

package/src/connect.ts

@@ -1,6 +1,6 @@
 import net from "node:net";
 import tls from "node:tls";
-import { ProxylineError, type ProxylineTlsOptions, redactProxyUrl, resolveProxyTlsCa } from "./shared.js";
+import { ProxylineError, decodeProxyUserinfoComponent, type ProxylineTlsOptions, redactProxyUrl, resolveProxyTlsCa } from "./shared.js";
 
 export type OpenProxyConnectTunnelOptions = Readonly<{
   proxyUrl: string | URL;
@@ -32,8 +32,8 @@ function resolveProxyAuthorization(proxy: URL): string | undefined {
   if (!proxy.username && !proxy.password) {
     return undefined;
   }
-  const username = decodeURIComponent(proxy.username);
-  const password = decodeURIComponent(proxy.password);
+  const username = decodeProxyUserinfoComponent(proxy.username);
+  const password = decodeProxyUserinfoComponent(proxy.password);
   return `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
 }
 
@@ -142,7 +142,7 @@ export async function openProxyConnectTunnel(
       settled = true;
       cleanup();
       socket?.destroy();
-      reject(failConnect(proxy, error));
+      reject(error instanceof ProxylineError ? error : failConnect(proxy, error));
     };
 
     const succeed = (connectedSocket: ProxySocket, tunneledBytes: Buffer | undefined): void => {
@@ -163,7 +163,11 @@ export async function openProxyConnectTunnel(
         fail(new Error("proxy socket missing after connect"));
         return;
       }
-      writeConnectRequest(socket, proxy, target);
+      try {
+        writeConnectRequest(socket, proxy, target);
+      } catch (error) {
+        fail(error);
+      }
     };
 
     const onData = (chunk: Buffer): void => {

package/src/node-http.ts

@@ -9,7 +9,7 @@ import {
   type ProxyEnvSnapshot,
 } from "./env.js";
 import { formatConnectAuthority } from "./connect.js";
-import { ProxylineError, resolveProxyTlsCa, type ProxylineTlsOptions } from "./shared.js";
+import { ProxylineError, decodeProxyUserinfoComponent, resolveProxyTlsCa, type ProxylineTlsOptions } from "./shared.js";
 import type { ProxylineSurface, ProxyResolver } from "./types.js";
 
 export type NodeHttpRequestOptions = http.RequestOptions & https.RequestOptions & {
@@ -198,8 +198,8 @@ function proxyAuthorization(proxy: URL): string | undefined {
   if (!proxy.username && !proxy.password) {
     return undefined;
   }
-  const username = decodeURIComponent(proxy.username);
-  const password = decodeURIComponent(proxy.password);
+  const username = decodeProxyUserinfoComponent(proxy.username);
+  const password = decodeProxyUserinfoComponent(proxy.password);
   return `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
 }
 
@@ -591,25 +591,22 @@ class ProxylineConnectAgent extends http.Agent {
     };
 
     const onConnected = (): void => {
-      let target: { host: string; port: number };
       try {
-        target = connectTarget(options);
+        const { host, port } = connectTarget(options);
+        const authority = formatConnectAuthority(host, port);
+        const headers = [
+          `CONNECT ${authority} HTTP/1.1`,
+          `Host: ${authority}`,
+          `Proxy-Connection: ${this.#keepAlive ? "Keep-Alive" : "close"}`,
+        ];
+        const authorization = proxyAuthorization(this.#proxy);
+        if (authorization !== undefined) {
+          headers.push(`Proxy-Authorization: ${authorization}`);
+        }
+        proxySocket.write([...headers, "", ""].join("\r\n"));
       } catch (error) {
         fail(error instanceof Error ? error : new Error(String(error)));
-        return;
-      }
-      const { host, port } = target;
-      const authority = formatConnectAuthority(host, port);
-      const headers = [
-        `CONNECT ${authority} HTTP/1.1`,
-        `Host: ${authority}`,
-        `Proxy-Connection: ${this.#keepAlive ? "Keep-Alive" : "close"}`,
-      ];
-      const authorization = proxyAuthorization(this.#proxy);
-      if (authorization !== undefined) {
-        headers.push(`Proxy-Authorization: ${authorization}`);
       }
-      proxySocket.write([...headers, "", ""].join("\r\n"));
     };
 
     const onData = (chunk: Buffer): void => {

package/src/runtime.ts

@@ -524,14 +524,29 @@ function createUndiciProxyAgent(
           ...(net.isIP(proxyHostname) === 6 ? { checkServerIdentity: checkProxyServerIdentity } : {}),
         }
       : undefined;
+  const dispatcherFactory = createProxyClientFactory();
   return new UndiciProxyAgent({
     ...resolveUndiciBaseOptions(options.undici),
     uri: proxyUrl,
-    clientFactory: createProxyClientFactory(),
+    clientFactory: dispatcherFactory,
+    factory: dispatcherFactory,
     ...(proxyTls !== undefined ? { proxyTls } : {}),
   } as ConstructorParameters<typeof UndiciProxyAgent>[0]);
 }
 
+function normalizeUndiciDispatchOptions(
+  options: Dispatcher.DispatchOptions,
+): Dispatcher.DispatchOptions {
+  if (options.origin === undefined || !/^https?:\/\//i.test(options.path)) {
+    return options;
+  }
+  const pathUrl = new URL(options.path);
+  return {
+    ...options,
+    path: `${pathUrl.pathname}${pathUrl.search}`,
+  };
+}
+
 function createUndiciProxyDispatcher(
   options:
     | { mode: "managed"; resolver: ProxyResolver }
@@ -585,10 +600,11 @@ class ManagedUndiciDispatcher extends Dispatcher {
     if (this.#closedError !== undefined) {
       return reportClosedDispatchError(handler, this.#closedError);
     }
-    const url = resolveUndiciDispatchUrl(options);
+    const normalizedOptions = normalizeUndiciDispatchOptions(options);
+    const url = resolveUndiciDispatchUrl(normalizedOptions);
     const proxyUrl = url === undefined ? "" : this.#resolver.getProxyForUrl(url, "undici");
     const dispatcher = proxyUrl === "" ? this.#directDispatcher : this.#proxyDispatcher(proxyUrl);
-    return dispatcher.dispatch(options, handler);
+    return dispatcher.dispatch(normalizedOptions, handler);
   }
 
   public override close(callback: () => void): void;
@@ -671,10 +687,11 @@ class AmbientUndiciDispatcher extends Dispatcher {
     if (this.#closedError !== undefined) {
       return reportClosedDispatchError(handler, this.#closedError);
     }
-    const url = resolveUndiciDispatchUrl(options);
+    const normalizedOptions = normalizeUndiciDispatchOptions(options);
+    const url = resolveUndiciDispatchUrl(normalizedOptions);
     const proxyUrl = url === undefined ? undefined : resolveAmbientProxyForUrl(url, this.#env);
     const dispatcher = proxyUrl === undefined ? this.#directDispatcher : this.#proxyDispatcher(proxyUrl);
-    return dispatcher.dispatch(options, handler);
+    return dispatcher.dispatch(normalizedOptions, handler);
   }
 
   public override close(callback: () => void): void;

package/src/shared.ts

@@ -15,6 +15,18 @@ export class ProxylineError extends Error {
   }
 }
 
+/** Decode proxy userinfo; invalid percent-encoding must not throw URIError mid-CONNECT. */
+export function decodeProxyUserinfoComponent(value: string): string {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    throw new ProxylineError(
+      "INVALID_PROXY_USERINFO",
+      "Proxy username or password contains invalid percent-encoding.",
+    );
+  }
+}
+
 export function resolveProxyTlsCa(options: ProxylineTlsOptions | undefined): string | undefined {
   if (!options) {
     return undefined;