@vellumai/assistant 0.3.0

package/src/__tests__/scheduler-recurrence.test.ts

@@ -0,0 +1,430 @@
+import { describe, test, expect, beforeEach, afterAll, mock } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const testDir = mkdtempSync(join(tmpdir(), 'scheduler-recurrence-test-'));
+
+mock.module('../util/platform.js', () => ({
+  getDataDir: () => testDir,
+  isMacOS: () => process.platform === 'darwin',
+  isLinux: () => process.platform === 'linux',
+  isWindows: () => process.platform === 'win32',
+  getSocketPath: () => join(testDir, 'test.sock'),
+  getPidPath: () => join(testDir, 'test.pid'),
+  getDbPath: () => join(testDir, 'test.db'),
+  getLogPath: () => join(testDir, 'test.log'),
+  ensureDataDir: () => {},
+  migrateToDataLayout: () => {},
+  migrateToWorkspaceLayout: () => {},
+}));
+
+mock.module('../util/logger.js', () => ({
+  getLogger: () => new Proxy({} as Record<string, unknown>, {
+    get: () => () => {},
+  }),
+}));
+
+import { initializeDb, getDb, resetDb } from '../memory/db.js';
+import { createTask } from '../tasks/task-store.js';
+import {
+  createSchedule,
+  getSchedule,
+  getScheduleRuns,
+} from '../schedule/schedule-store.js';
+import { startScheduler } from '../schedule/scheduler.js';
+
+initializeDb();
+
+/** Access the underlying bun:sqlite Database for raw parameterized queries. */
+function getRawDb(): import('bun:sqlite').Database {
+  return (getDb() as unknown as { $client: import('bun:sqlite').Database }).$client;
+}
+
+/** Force a schedule to be due by setting next_run_at in the past. */
+function forceScheduleDue(scheduleId: string): void {
+  getRawDb().run('UPDATE cron_jobs SET next_run_at = ? WHERE id = ?', [Date.now() - 1000, scheduleId]);
+}
+
+afterAll(() => {
+  resetDb();
+  try { rmSync(testDir, { recursive: true }); } catch { /* best effort */ }
+});
+
+// Build an RRULE expression anchored at the given start date, recurring every minute.
+// This ensures the rule always has future occurrences relative to the test clock.
+function buildEveryMinuteRrule(dtstart: Date = new Date()): string {
+  const pad = (n: number) => String(n).padStart(2, '0');
+  const ds = `${dtstart.getUTCFullYear()}${pad(dtstart.getUTCMonth() + 1)}${pad(dtstart.getUTCDate())}T${pad(dtstart.getUTCHours())}${pad(dtstart.getUTCMinutes())}${pad(dtstart.getUTCSeconds())}Z`;
+  return `DTSTART:${ds}\nRRULE:FREQ=MINUTELY;INTERVAL=1`;
+}
+
+// Build an RRULE expression that ended in the past (UNTIL already passed).
+function buildEndedRrule(): string {
+  const past = new Date(Date.now() - 86_400_000 * 30); // 30 days ago
+  const until = new Date(Date.now() - 86_400_000); // 1 day ago
+  const pad = (n: number) => String(n).padStart(2, '0');
+  const ds = `${past.getUTCFullYear()}${pad(past.getUTCMonth() + 1)}${pad(past.getUTCDate())}T000000Z`;
+  const us = `${until.getUTCFullYear()}${pad(until.getUTCMonth() + 1)}${pad(until.getUTCDate())}T235959Z`;
+  return `DTSTART:${ds}\nRRULE:FREQ=DAILY;INTERVAL=1;UNTIL=${us}`;
+}
+
+// ── RRULE schedule fires through the scheduler ──────────────────────
+
+describe('scheduler RRULE execution', () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run('DELETE FROM cron_runs');
+    db.run('DELETE FROM cron_jobs');
+    db.run('DELETE FROM task_runs');
+    db.run('DELETE FROM tasks');
+    db.run('DELETE FROM messages');
+    db.run('DELETE FROM conversations');
+  });
+
+  test('RRULE schedule fires and creates cron_runs entry', async () => {
+    const rruleExpr = buildEveryMinuteRrule();
+    const schedule = createSchedule({
+      name: 'RRULE Test',
+      cronExpression: rruleExpr,
+      message: 'Hello from RRULE',
+      syntax: 'rrule',
+      expression: rruleExpr,
+    });
+
+    // Verify it was stored with rrule syntax
+    const stored = getSchedule(schedule.id);
+    expect(stored).not.toBeNull();
+    expect(stored!.syntax).toBe('rrule');
+
+    // Force it to be due
+    forceScheduleDue(schedule.id);
+
+    const processedMessages: { conversationId: string; message: string }[] = [];
+    const processMessage = async (conversationId: string, message: string) => {
+      processedMessages.push({ conversationId, message });
+    };
+
+    const scheduler = startScheduler(processMessage, () => {}, () => {});
+    await new Promise(resolve => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    // processMessage should have been called with the RRULE message
+    expect(processedMessages.some(m => m.message === 'Hello from RRULE')).toBe(true);
+
+    // A cron_runs entry should have been created
+    const runs = getScheduleRuns(schedule.id);
+    expect(runs.length).toBeGreaterThanOrEqual(1);
+    expect(runs[0].status).toBe('ok');
+  });
+
+  test('RRULE run_task:<id> triggers task runner', async () => {
+    const task = createTask({
+      title: 'RRULE Task',
+      template: 'Execute RRULE task',
+    });
+
+    const rruleExpr = buildEveryMinuteRrule();
+    const schedule = createSchedule({
+      name: 'RRULE Task Schedule',
+      cronExpression: rruleExpr,
+      message: `run_task:${task.id}`,
+      syntax: 'rrule',
+      expression: rruleExpr,
+    });
+
+    forceScheduleDue(schedule.id);
+
+    const directCalls: { conversationId: string; message: string }[] = [];
+    const processMessage = async (conversationId: string, message: string) => {
+      directCalls.push({ conversationId, message });
+    };
+
+    const scheduler = startScheduler(processMessage, () => {}, () => {});
+    await new Promise(resolve => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    // runTask renders the template, so processMessage gets the template text
+    const runTaskCalls = directCalls.filter(c => c.message === 'Execute RRULE task');
+    const rawCalls = directCalls.filter(c => c.message.startsWith('run_task:'));
+
+    expect(runTaskCalls.length).toBe(1);
+    expect(rawCalls.length).toBe(0);
+
+    // A cron_runs entry should exist
+    const runs = getScheduleRuns(schedule.id);
+    expect(runs.length).toBeGreaterThanOrEqual(1);
+  });
+
+  test('expired RRULE fires one final due run then is disabled', async () => {
+    const endedExpr = buildEndedRrule();
+
+    // Insert directly via raw SQL because createSchedule would throw when
+    // computing nextRunAt for an already-ended RRULE. This simulates a
+    // schedule that was valid when created but has since expired.
+    const id = crypto.randomUUID();
+    const now = Date.now();
+    getRawDb().run(
+      `INSERT INTO cron_jobs (id, name, enabled, cron_expression, schedule_syntax, timezone, message, next_run_at, last_run_at, last_status, retry_count, created_by, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [id, 'Ended RRULE', 1, endedExpr, 'rrule', null, 'Final expired run', now - 1000, null, null, 0, 'agent', now, now],
+    );
+
+    const processedMessages: string[] = [];
+    const processMessage = async (_conversationId: string, message: string) => {
+      processedMessages.push(message);
+    };
+
+    // First tick: the expired schedule should fire its final due run
+    const scheduler1 = startScheduler(processMessage, () => {}, () => {});
+    await new Promise(resolve => setTimeout(resolve, 500));
+    scheduler1.stop();
+
+    // The message IS delivered once
+    expect(processedMessages).toContain('Final expired run');
+
+    // One run record IS created with status 'ok'
+    const runs = getScheduleRuns(id);
+    expect(runs.length).toBe(1);
+    expect(runs[0].status).toBe('ok');
+
+    // After firing, the schedule is disabled with nextRunAt=0
+    const afterSchedule = getSchedule(id);
+    expect(afterSchedule).not.toBeNull();
+    expect(afterSchedule!.enabled).toBe(false);
+    expect(afterSchedule!.nextRunAt).toBe(0);
+
+    // Second tick: the disabled schedule must NOT fire again
+    processedMessages.length = 0;
+    const scheduler2 = startScheduler(processMessage, () => {}, () => {});
+    await new Promise(resolve => setTimeout(resolve, 500));
+    scheduler2.stop();
+
+    expect(processedMessages).not.toContain('Final expired run');
+    // No additional runs
+    const runsAfter = getScheduleRuns(id);
+    expect(runsAfter.length).toBe(1);
+  });
+
+  test('existing cron schedule behavior is unchanged', async () => {
+    const schedule = createSchedule({
+      name: 'Cron Schedule',
+      cronExpression: '* * * * *',
+      message: 'Cron message',
+    });
+
+    // Verify it defaults to cron syntax
+    const stored = getSchedule(schedule.id);
+    expect(stored).not.toBeNull();
+    expect(stored!.syntax).toBe('cron');
+
+    forceScheduleDue(schedule.id);
+
+    const processedMessages: { conversationId: string; message: string }[] = [];
+    const processMessage = async (conversationId: string, message: string) => {
+      processedMessages.push({ conversationId, message });
+    };
+
+    const scheduler = startScheduler(processMessage, () => {}, () => {});
+    await new Promise(resolve => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    // processMessage should have been called with the cron message
+    expect(processedMessages.some(m => m.message === 'Cron message')).toBe(true);
+
+    // A cron_runs entry should have been created
+    const runs = getScheduleRuns(schedule.id);
+    expect(runs.length).toBeGreaterThanOrEqual(1);
+    expect(runs[0].status).toBe('ok');
+  });
+
+  test('RRULE set with EXDATE skips excluded occurrence and advances to next valid date', async () => {
+    // Build an RRULE set that fires every minute but excludes the next immediate occurrence.
+    // The scheduler should skip the excluded date and advance to the one after.
+    const now = new Date();
+    const pad = (n: number) => String(n).padStart(2, '0');
+
+    // DTSTART one hour ago so there are plenty of past occurrences
+    const pastDate = new Date(now.getTime() - 3_600_000);
+    const ds = `${pastDate.getUTCFullYear()}${pad(pastDate.getUTCMonth() + 1)}${pad(pastDate.getUTCDate())}T${pad(pastDate.getUTCHours())}${pad(pastDate.getUTCMinutes())}${pad(pastDate.getUTCSeconds())}Z`;
+
+    // Exclude the current minute's occurrence
+    const currentMinuteDate = new Date(now);
+    currentMinuteDate.setUTCSeconds(0);
+    currentMinuteDate.setUTCMilliseconds(0);
+    // Round to the previous minute boundary relative to dtstart
+    const exDate = `${currentMinuteDate.getUTCFullYear()}${pad(currentMinuteDate.getUTCMonth() + 1)}${pad(currentMinuteDate.getUTCDate())}T${pad(currentMinuteDate.getUTCHours())}${pad(currentMinuteDate.getUTCMinutes())}00Z`;
+
+    const expression = `DTSTART:${ds}\nRRULE:FREQ=MINUTELY;INTERVAL=1\nEXDATE:${exDate}`;
+
+    const schedule = createSchedule({
+      name: 'RRULE set EXDATE test',
+      cronExpression: expression,
+      message: 'Set exclusion test',
+      syntax: 'rrule',
+      expression,
+    });
+
+    // Force the schedule to be due
+    forceScheduleDue(schedule.id);
+
+    const processedMessages: string[] = [];
+    const processMessage = async (_conversationId: string, message: string) => {
+      processedMessages.push(message);
+    };
+
+    const scheduler = startScheduler(processMessage, () => {}, () => {});
+    await new Promise(resolve => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    // The schedule should have been claimed and nextRunAt advanced
+    const after = getSchedule(schedule.id);
+    expect(after).not.toBeNull();
+    expect(after!.lastRunAt).not.toBeNull();
+    // nextRunAt should be in the future (not the excluded date)
+    expect(after!.nextRunAt).toBeGreaterThan(Date.now() - 5000);
+  });
+
+  test('RRULE set schedule fires and creates cron_runs entry', async () => {
+    const expression = [
+      'DTSTART:20250101T000000Z',
+      'RRULE:FREQ=MINUTELY;INTERVAL=1',
+      'EXDATE:20250101T000100Z',
+    ].join('\n');
+
+    const schedule = createSchedule({
+      name: 'Set schedule fire test',
+      cronExpression: expression,
+      message: 'Set fire test',
+      syntax: 'rrule',
+      expression,
+    });
+
+    forceScheduleDue(schedule.id);
+
+    const processedMessages: string[] = [];
+    const processMessage = async (_conversationId: string, message: string) => {
+      processedMessages.push(message);
+    };
+
+    const scheduler = startScheduler(processMessage, () => {}, () => {});
+    await new Promise(resolve => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    expect(processedMessages).toContain('Set fire test');
+
+    const runs = getScheduleRuns(schedule.id);
+    expect(runs.length).toBeGreaterThanOrEqual(1);
+    expect(runs[0].status).toBe('ok');
+  });
+
+  test('EXRULE schedule skips excluded occurrence and advances to next valid date', async () => {
+    // RRULE: every minute from a known dtstart
+    // EXRULE: every 2nd minute from the same dtstart (excludes offsets 0, 2, 4, ...)
+    //
+    // DTSTART is set to 59 minutes ago (floored to minute) so the first
+    // occurrence after "now" without EXRULE would be at offset 60 (even).
+    // With EXRULE active, offset 60 is excluded and the scheduler must
+    // advance to offset 61 (odd). Using 59 minutes (not 60) is critical:
+    // at 60 minutes the first post-now occurrence is offset 61 (odd), which
+    // would pass the parity check even if EXRULE were completely ignored.
+    //
+    // We mock Date.now() so the scheduler's internal clock matches the test
+    // baseline exactly, making the test fully deterministic regardless of
+    // when it runs.
+    const realNow = new Date();
+    const frozenNow = new Date(realNow);
+    frozenNow.setUTCSeconds(30);
+    frozenNow.setUTCMilliseconds(0);
+
+    const originalDateNow = Date.now;
+    Date.now = () => frozenNow.getTime();
+
+    try {
+      const pad = (n: number) => String(n).padStart(2, '0');
+      const pastDate = new Date(frozenNow.getTime() - 59 * 60_000);
+      pastDate.setUTCSeconds(0);
+      pastDate.setUTCMilliseconds(0);
+      const ds = `${pastDate.getUTCFullYear()}${pad(pastDate.getUTCMonth() + 1)}${pad(pastDate.getUTCDate())}T${pad(pastDate.getUTCHours())}${pad(pastDate.getUTCMinutes())}00Z`;
+
+      const expression = `DTSTART:${ds}\nRRULE:FREQ=MINUTELY;INTERVAL=1\nEXRULE:FREQ=MINUTELY;INTERVAL=2`;
+
+      // Compute what the next occurrence would be WITHOUT EXRULE — this should
+      // be at an even offset that EXRULE must exclude.
+      const withoutExrule = `DTSTART:${ds}\nRRULE:FREQ=MINUTELY;INTERVAL=1`;
+      const { computeNextRunAt } = await import('../schedule/recurrence-engine.js');
+      const nextWithoutExrule = computeNextRunAt(
+        { syntax: 'rrule', expression: withoutExrule },
+        frozenNow.getTime(),
+      );
+      const offsetWithout = Math.round((nextWithoutExrule - pastDate.getTime()) / 60_000);
+      // Sanity: the without-EXRULE occurrence must be even (would be excluded)
+      expect(offsetWithout % 2).toBe(0);
+
+      const schedule = createSchedule({
+        name: 'EXRULE scheduler test',
+        cronExpression: expression,
+        message: 'EXRULE scheduler fire',
+        syntax: 'rrule',
+        expression,
+      });
+
+      forceScheduleDue(schedule.id);
+
+      const processedMessages: string[] = [];
+      const processMessage = async (_conversationId: string, message: string) => {
+        processedMessages.push(message);
+      };
+
+      const scheduler = startScheduler(processMessage, () => {}, () => {});
+      await new Promise(resolve => setTimeout(resolve, 500));
+      scheduler.stop();
+
+      // The schedule should have fired
+      expect(processedMessages).toContain('EXRULE scheduler fire');
+
+      const after = getSchedule(schedule.id);
+      expect(after).not.toBeNull();
+      expect(after!.lastRunAt).not.toBeNull();
+      expect(after!.nextRunAt).toBeGreaterThan(frozenNow.getTime() - 5000);
+
+      // nextRunAt must NOT equal the without-EXRULE occurrence (which is excluded)
+      expect(after!.nextRunAt).not.toBe(nextWithoutExrule);
+
+      // nextRunAt must land on an odd-minute offset from dtstart
+      const dtstartMs = pastDate.getTime();
+      const minuteOffset = Math.round((after!.nextRunAt - dtstartMs) / 60_000);
+      expect(minuteOffset % 2).toBe(1);
+    } finally {
+      Date.now = originalDateNow;
+    }
+  });
+
+  test('RRULE schedule advances nextRunAt after firing', async () => {
+    const rruleExpr = buildEveryMinuteRrule();
+    const schedule = createSchedule({
+      name: 'Advancing RRULE',
+      cronExpression: rruleExpr,
+      message: 'Advance test',
+      syntax: 'rrule',
+      expression: rruleExpr,
+    });
+
+    const originalNextRunAt = getSchedule(schedule.id)!.nextRunAt;
+    forceScheduleDue(schedule.id);
+    const forcedDueAt = getSchedule(schedule.id)!.nextRunAt;
+
+    const processMessage = async () => {};
+    const scheduler = startScheduler(processMessage, () => {}, () => {});
+    await new Promise(resolve => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    const after = getSchedule(schedule.id);
+    expect(after).not.toBeNull();
+    // nextRunAt must have moved forward from the forced-due value
+    expect(after!.nextRunAt).toBeGreaterThan(forcedDueAt);
+    // After claiming, MINUTELY recurrence advances nextRunAt by ~60s, so allow up to 65s tolerance
+    expect(Math.abs(after!.nextRunAt - originalNextRunAt)).toBeLessThan(65000);
+    expect(after!.lastRunAt).not.toBeNull();
+  });
+});

package/src/__tests__/script-proxy-certs.test.ts

@@ -0,0 +1,90 @@
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
+import { mkdtemp, rm, stat, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { ensureLocalCA, issueLeafCert, getCAPath } from '../tools/network/script-proxy/certs.js';
+
+let dataDir: string;
+
+beforeAll(async () => {
+  dataDir = await mkdtemp(join(tmpdir(), 'vellum-certs-test-'));
+});
+
+afterAll(async () => {
+  await rm(dataDir, { recursive: true, force: true });
+});
+
+describe('ensureLocalCA', () => {
+  test('creates CA cert and key with correct permissions', async () => {
+    await ensureLocalCA(dataDir);
+
+    const caDir = join(dataDir, 'proxy-ca');
+    const certStat = await stat(join(caDir, 'ca.pem'));
+    const keyStat = await stat(join(caDir, 'ca-key.pem'));
+
+    expect(certStat.isFile()).toBe(true);
+    expect(keyStat.isFile()).toBe(true);
+
+    // Check permissions (mask with 0o777 to get just the permission bits)
+    expect(keyStat.mode & 0o777).toBe(0o600);
+    expect(certStat.mode & 0o777).toBe(0o644);
+  });
+
+  test('is idempotent — repeated calls do not regenerate', async () => {
+    const caDir = join(dataDir, 'proxy-ca');
+    const certBefore = await readFile(join(caDir, 'ca.pem'), 'utf-8');
+    const keyBefore = await readFile(join(caDir, 'ca-key.pem'), 'utf-8');
+
+    await ensureLocalCA(dataDir);
+
+    const certAfter = await readFile(join(caDir, 'ca.pem'), 'utf-8');
+    const keyAfter = await readFile(join(caDir, 'ca-key.pem'), 'utf-8');
+
+    expect(certAfter).toBe(certBefore);
+    expect(keyAfter).toBe(keyBefore);
+  });
+});
+
+describe('issueLeafCert', () => {
+  const HOSTNAME = 'example.com';
+
+  test('generates a leaf cert for a hostname', async () => {
+    const caDir = join(dataDir, 'proxy-ca');
+    const result = await issueLeafCert(caDir, HOSTNAME);
+
+    expect(result.cert).toContain('BEGIN CERTIFICATE');
+    expect(result.key).toContain('BEGIN');
+
+    // Verify the issued files exist on disk
+    const issuedDir = join(caDir, 'issued');
+    const certStat_ = await stat(join(issuedDir, `${HOSTNAME}.pem`));
+    const keyStat_ = await stat(join(issuedDir, `${HOSTNAME}-key.pem`));
+    expect(certStat_.isFile()).toBe(true);
+    expect(keyStat_.isFile()).toBe(true);
+  });
+
+  test('returns cached cert on repeated calls', async () => {
+    const caDir = join(dataDir, 'proxy-ca');
+    const first = await issueLeafCert(caDir, HOSTNAME);
+    const second = await issueLeafCert(caDir, HOSTNAME);
+
+    expect(second.cert).toBe(first.cert);
+    expect(second.key).toBe(first.key);
+  });
+
+  test('generates different certs for different hostnames', async () => {
+    const caDir = join(dataDir, 'proxy-ca');
+    const certA = await issueLeafCert(caDir, 'a.example.com');
+    const certB = await issueLeafCert(caDir, 'b.example.com');
+
+    expect(certA.cert).not.toBe(certB.cert);
+    expect(certA.key).not.toBe(certB.key);
+  });
+});
+
+describe('getCAPath', () => {
+  test('returns the correct path to the CA cert', () => {
+    const result = getCAPath('/some/data/dir');
+    expect(result).toBe('/some/data/dir/proxy-ca/ca.pem');
+  });
+});

package/src/__tests__/script-proxy-connect-tunnel.test.ts

@@ -0,0 +1,177 @@
+import { describe, test, expect, afterEach } from 'bun:test';
+import { type Server } from 'node:http';
+import { createServer as createTcpServer } from 'node:net';
+import { connect } from 'node:net';
+import { createProxyServer } from '../tools/network/script-proxy/server.js';
+
+/** Start an HTTP server and return its address + cleanup handle. */
+function listenEphemeral(server: Server): Promise<{ port: number; close: () => Promise<void> }> {
+  return new Promise((resolve, reject) => {
+    server.listen(0, '127.0.0.1', () => {
+      const addr = server.address();
+      if (!addr || typeof addr === 'string') {
+        reject(new Error('Failed to get address'));
+        return;
+      }
+      resolve({
+        port: addr.port,
+        close: () => new Promise<void>((r, j) => server.close((e) => (e ? j(e) : r()))),
+      });
+    });
+    server.on('error', reject);
+  });
+}
+
+/** Start a raw TCP echo server. */
+function listenTcpEcho(): Promise<{ port: number; close: () => Promise<void> }> {
+  return new Promise((resolve, reject) => {
+    const server = createTcpServer((socket) => {
+      socket.pipe(socket);
+    });
+    server.listen(0, '127.0.0.1', () => {
+      const addr = server.address();
+      if (!addr || typeof addr === 'string') {
+        reject(new Error('Failed to get address'));
+        return;
+      }
+      resolve({
+        port: addr.port,
+        close: () => new Promise<void>((r, j) => server.close((e) => (e ? j(e) : r()))),
+      });
+    });
+    server.on('error', reject);
+  });
+}
+
+/**
+ * Send an HTTP CONNECT request to the proxy and return the raw socket
+ * once the tunnel is established (or an error status).
+ */
+function sendConnect(
+  proxyPort: number,
+  target: string,
+): Promise<{ statusCode: number; socket: import('node:net').Socket }> {
+  return new Promise((resolve, reject) => {
+    const socket = connect(proxyPort, '127.0.0.1', () => {
+      socket.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n\r\n`);
+    });
+
+    let headerBuf = '';
+    const onData = (chunk: Buffer) => {
+      headerBuf += chunk.toString();
+      const endIdx = headerBuf.indexOf('\r\n\r\n');
+      if (endIdx !== -1) {
+        socket.removeListener('data', onData);
+        const statusLine = headerBuf.slice(0, headerBuf.indexOf('\r\n'));
+        const statusCode = Number(statusLine.split(' ')[1]);
+        // Push back any data after the header
+        const remaining = headerBuf.slice(endIdx + 4);
+        if (remaining.length > 0) {
+          socket.unshift(Buffer.from(remaining));
+        }
+        resolve({ statusCode, socket });
+      }
+    };
+
+    socket.on('data', onData);
+    socket.on('error', reject);
+  });
+}
+
+describe('CONNECT tunnel', () => {
+  const cleanups: Array<{ close: () => Promise<void> }> = [];
+
+  afterEach(async () => {
+    await Promise.all(cleanups.map((c) => c.close().catch(() => {})));
+    cleanups.length = 0;
+  });
+
+  test('successful CONNECT tunnel establishment', async () => {
+    const echo = await listenTcpEcho();
+    cleanups.push(echo);
+
+    const proxy = createProxyServer();
+    const px = await listenEphemeral(proxy);
+    cleanups.push(px);
+
+    const { statusCode, socket } = await sendConnect(px.port, `127.0.0.1:${echo.port}`);
+    cleanups.push({ close: () => { socket.destroy(); return Promise.resolve(); } });
+
+    expect(statusCode).toBe(200);
+    socket.destroy();
+  });
+
+  test('bidirectional data flow through tunnel', async () => {
+    const echo = await listenTcpEcho();
+    cleanups.push(echo);
+
+    const proxy = createProxyServer();
+    const px = await listenEphemeral(proxy);
+    cleanups.push(px);
+
+    const { statusCode, socket } = await sendConnect(px.port, `127.0.0.1:${echo.port}`);
+    cleanups.push({ close: () => { socket.destroy(); return Promise.resolve(); } });
+
+    expect(statusCode).toBe(200);
+
+    // Write through the tunnel and read back
+    const received = await new Promise<string>((resolve, reject) => {
+      socket.once('data', (chunk: Buffer) => resolve(chunk.toString()));
+      socket.on('error', reject);
+      socket.write('hello tunnel');
+    });
+
+    expect(received).toBe('hello tunnel');
+    socket.destroy();
+  });
+
+  test('malformed target (no port) rejected with 400', async () => {
+    const proxy = createProxyServer();
+    const px = await listenEphemeral(proxy);
+    cleanups.push(px);
+
+    const { statusCode, socket } = await sendConnect(px.port, 'example.com');
+    expect(statusCode).toBe(400);
+    socket.destroy();
+  });
+
+  test('malformed target (empty) rejected with 400', async () => {
+    const proxy = createProxyServer();
+    const px = await listenEphemeral(proxy);
+    cleanups.push(px);
+
+    // Send a CONNECT with an empty target
+    const { statusCode, socket } = await sendConnect(px.port, ':443');
+    expect(statusCode).toBe(400);
+    socket.destroy();
+  });
+
+  test('upstream connection failure returns 502', async () => {
+    const proxy = createProxyServer();
+    const px = await listenEphemeral(proxy);
+    cleanups.push(px);
+
+    // Port 1 should be unreachable
+    const { statusCode, socket } = await sendConnect(px.port, '127.0.0.1:1');
+    expect(statusCode).toBe(502);
+    socket.destroy();
+  });
+
+  test('socket cleanup on client disconnect', async () => {
+    const echo = await listenTcpEcho();
+    cleanups.push(echo);
+
+    const proxy = createProxyServer();
+    const px = await listenEphemeral(proxy);
+    cleanups.push(px);
+
+    const { statusCode, socket } = await sendConnect(px.port, `127.0.0.1:${echo.port}`);
+    expect(statusCode).toBe(200);
+
+    // Destroy client side — upstream should clean up without crashing
+    socket.destroy();
+
+    // Give a moment for cleanup to propagate
+    await new Promise((r) => setTimeout(r, 50));
+  });
+});