open-managed-agents 0.1.0

package/dist/src/control-plane/egress/proxy.js

@@ -0,0 +1,72 @@
+// Public egress-proxy surface (plan 0117a). OMA control-plane code imports the
+// vendored srt proxy stack ONLY through this module, never from ./vendor/
+// directly — so the vendored implementation stays behind a seam we can re-pin
+// (ADR 0016 §1) without touching call sites.
+//
+// NOT YET A COMPLETE EGRESS BOUNDARY. The proxy is vendored (0117a) with a safe
+// constructor and, as of 0117b, a default SSRF/private-IP deny (see below).
+// Still owed: egress policy + credential injection (0117c) and Docker
+// proxy-only-egress wiring (0117d). Until those land, `createEgressProxy` is a
+// building block, not the wired control-plane boundary.
+import { isIP } from "node:net";
+import { createHttpProxyServer, } from "./vendor/http-proxy.js";
+import { createPinnedLookup, isBlockedAddress } from "./ssrf.js";
+export { createMitmCA, disposeMitmCA, } from "./vendor/mitm-ca.js";
+export function createEgressProxy(options) {
+    if (typeof options.proxyAuthToken !== "string" ||
+        options.proxyAuthToken.trim() === "") {
+        throw new Error("createEgressProxy requires a non-empty proxyAuthToken — the vendored " +
+            "proxy is fail-open (any host process could reach it) without one.");
+    }
+    // Defensive against JS callers who bypass the Omit type. Both routes would
+    // move dials outside the pinned-lookup SSRF check, so reject them at runtime.
+    const raw = options;
+    if (raw.parentProxy !== undefined) {
+        throw new Error("createEgressProxy does not support parentProxy: upstream-proxy chaining " +
+            "is unused in OMA v1 and is not honored on the TLS-terminated leg.");
+    }
+    if (raw.getMitmSocketPath !== undefined) {
+        throw new Error("createEgressProxy does not support getMitmSocketPath: an external MITM " +
+            "unix-socket route bypasses the pinned-lookup SSRF check. OMA terminates " +
+            "TLS in-process via mitmCA.");
+    }
+    if (raw.lookup !== undefined) {
+        throw new Error("createEgressProxy does not accept a caller lookup: it would replace the " +
+            "SSRF-validating resolver. Use dangerouslyAllowPrivateAddressesForTest " +
+            "for loopback fixtures.");
+    }
+    // SSRF/private-IP deny by default (ADR 0016 §5), in two halves:
+    //
+    //   1. DNS names: unless the caller overrides `lookup`, every upstream dial
+    //      resolves through a validating lookup that denies private/loopback/
+    //      reserved targets and pins the vetted IP.
+    //   2. IP LITERALS: Node structurally skips the `lookup` hook when the host
+    //      is already a numeric literal (verified), so a literal like
+    //      `169.254.169.254` would bypass half 1 entirely. Both the CONNECT and
+    //      plain-HTTP handlers call `filter(port, host)` before dialing, so we
+    //      wrap the caller's filter to also deny blocked IP literals. This is the
+    //      literal half of the deny and covers every dial path.
+    const callerFilter = options.filter;
+    const guardedFilter = (port, host, socket) => {
+        const family = isIP(host);
+        if (family !== 0 && isBlockedAddress(host, family))
+            return false;
+        return callerFilter(port, host, socket);
+    };
+    // The pinned lookup is set AFTER spreading options so a caller cannot replace
+    // it. The only relaxation is the loud test flag, which turns off the private-IP
+    // half (loopback fixtures) — the literal filter-wrap still runs regardless.
+    const lookup = options.dangerouslyAllowPrivateAddressesForTest
+        ? createPinnedLookup({ allowAddress: () => true })
+        : createPinnedLookup();
+    const { dangerouslyAllowPrivateAddressesForTest: _omit, ...rest } = options;
+    return createHttpProxyServer({
+        ...rest,
+        filter: guardedFilter,
+        lookup,
+        // Opaque (uninspected) byte tunnels are an explicit per-host grant, never
+        // a fallback (ADR 0016 §3): the vendor default allows them, OMA denies
+        // unless the caller's hook (from the egress policy) says otherwise.
+        allowOpaqueTunnel: options.allowOpaqueTunnel ?? (() => false),
+    });
+}

package/dist/src/control-plane/egress/ssrf.js

@@ -0,0 +1,106 @@
+// SSRF / private-IP egress deny (plan 0117b, ADR 0016 §5).
+//
+// The vendored proxy allowlists a *hostname* and then dials that hostname, so
+// an allowlisted name that resolves to a private/loopback address — or that
+// flips via DNS rebinding between check and connect — would reach internal
+// services. The fix is connect-to-a-pinned-vetted-IP: resolve once, reject if
+// ANY resolved address is in a blocked range, and hand the vetted IP to the
+// socket so Node connects to exactly what we validated (no re-resolution, so no
+// TOCTOU). The hostname is preserved separately as TLS SNI/servername by the
+// caller. This is Node's idiomatic seam: `net`/`tls`/`https` all accept a
+// `lookup` option with the `dns.lookup` signature.
+import { lookup as dnsLookup } from "node:dns";
+import { BlockList, isIPv4 } from "node:net";
+// Ranges an egress target must never resolve into. Deny-by-listing the
+// dangerous space (RFC1918 + loopback + link-local + ULA + CGNAT + special-use)
+// rather than allow-listing public space, so a new reserved range fails closed
+// only if we miss it — hence the broad reserved/multicast entries too.
+function buildBlockList() {
+    const b = new BlockList();
+    // IPv4
+    b.addSubnet("0.0.0.0", 8, "ipv4"); // "this host"
+    b.addSubnet("10.0.0.0", 8, "ipv4"); // private
+    b.addSubnet("100.64.0.0", 10, "ipv4"); // CGNAT
+    b.addSubnet("127.0.0.0", 8, "ipv4"); // loopback
+    b.addSubnet("169.254.0.0", 16, "ipv4"); // link-local (incl. cloud metadata 169.254.169.254)
+    b.addSubnet("172.16.0.0", 12, "ipv4"); // private
+    b.addSubnet("192.0.0.0", 24, "ipv4"); // IETF protocol assignments
+    b.addSubnet("192.0.2.0", 24, "ipv4"); // TEST-NET-1
+    b.addSubnet("192.168.0.0", 16, "ipv4"); // private
+    b.addSubnet("198.18.0.0", 15, "ipv4"); // benchmarking
+    b.addSubnet("198.51.100.0", 24, "ipv4"); // TEST-NET-2
+    b.addSubnet("203.0.113.0", 24, "ipv4"); // TEST-NET-3
+    b.addSubnet("224.0.0.0", 4, "ipv4"); // multicast
+    b.addSubnet("240.0.0.0", 4, "ipv4"); // reserved + 255.255.255.255
+    // IPv6
+    b.addAddress("::", "ipv6"); // unspecified
+    b.addAddress("::1", "ipv6"); // loopback
+    b.addSubnet("fc00::", 7, "ipv6"); // unique local (ULA)
+    b.addSubnet("fe80::", 10, "ipv6"); // link-local
+    b.addSubnet("ff00::", 8, "ipv6"); // multicast
+    b.addSubnet("2001:db8::", 32, "ipv6"); // documentation
+    // Ranges that embed an IPv4 destination inside a global-scope IPv6 literal.
+    // A hostname resolving to one of these could reach a private IPv4 through a
+    // NAT64/6to4 gateway while the IPv6 address itself looks public. OMA does not
+    // egress via these transition mechanisms, so deny them outright (targets are
+    // reached over native dual-stack). If NAT64-only egress is ever needed, the
+    // enhancement is to decode the embedded IPv4 and run it through the IPv4
+    // rules instead of blanket-denying.
+    b.addSubnet("64:ff9b::", 96, "ipv6"); // NAT64 well-known prefix
+    b.addSubnet("64:ff9b:1::", 48, "ipv6"); // NAT64 local-use prefix
+    b.addSubnet("2002::", 16, "ipv6"); // 6to4
+    b.addSubnet("2001::", 32, "ipv6"); // Teredo
+    return b;
+}
+const BLOCK_LIST = buildBlockList();
+// An IPv4-mapped IPv6 address (::ffff:a.b.c.d) tunnels an IPv4 destination
+// through an IPv6 literal; check the embedded IPv4 against the IPv4 rules so a
+// mapped private address can't slip past the IPv6 checks.
+function mappedIpv4(address) {
+    const dotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(address);
+    if (dotted)
+        return dotted[1];
+    const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(address);
+    if (!hex)
+        return undefined;
+    const hi = Number.parseInt(hex[1], 16);
+    const lo = Number.parseInt(hex[2], 16);
+    return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`;
+}
+export function isBlockedAddress(address, family) {
+    const mapped = mappedIpv4(address);
+    if (mapped !== undefined)
+        return BLOCK_LIST.check(mapped, "ipv4");
+    return BLOCK_LIST.check(address, family === 6 ? "ipv6" : "ipv4");
+}
+// Returns a `dns.lookup`-compatible function that resolves the hostname,
+// rejects the whole request if ANY resolved address is blocked (so an attacker
+// mixing one public + one private A record cannot gamble on Node's choice), and
+// otherwise returns the vetted address(es) for Node to connect to directly.
+export function createPinnedLookup(opts = {}) {
+    return (hostname, options, callback) => {
+        dnsLookup(hostname, { all: true }, (err, addresses) => {
+            if (err) {
+                callback(err, "", 0);
+                return;
+            }
+            for (const a of addresses) {
+                if (opts.allowAddress?.(a.address, a.family))
+                    continue;
+                if (isBlockedAddress(a.address, a.family)) {
+                    callback(Object.assign(new Error(`egress denied: ${hostname} resolves to ${a.address}, a blocked (private/loopback/reserved) range`), { code: "EGRESS_SSRF_BLOCKED" }), "", 0);
+                    return;
+                }
+            }
+            const wantsAll = typeof options === "object" && options !== null && "all" in options
+                ? Boolean(options.all)
+                : false;
+            if (wantsAll) {
+                callback(null, addresses);
+                return;
+            }
+            const first = addresses[0];
+            callback(null, first.address, isIPv4(first.address) ? 4 : 6);
+        });
+    };
+}

package/dist/src/control-plane/egress/utils/debug.js

@@ -0,0 +1,14 @@
+// OMA vendor shim: replaces srt's utils/debug. The vendored proxy files import
+// `logForDebugging` from here, gated on SRT_DEBUG (kept so upstream call sites
+// need no edits). Routed through OMA's logger (0121 C1) so vendor messages get
+// the same scrubbing as everything else; `detail` (not `message`) because the
+// denylist redacts content-bearing keys and these are proxy-decision strings.
+import { log } from "../../logging.js";
+export function logForDebugging(message, options) {
+    if (!process.env.SRT_DEBUG)
+        return;
+    if (options?.level === "warn")
+        log.warn("egress_vendor_debug", { detail: message });
+    else
+        log.error("egress_vendor_debug", { detail: message });
+}

package/dist/src/control-plane/egress/vendor/http-proxy.js

@@ -0,0 +1,335 @@
+import { Agent, createServer } from 'node:http';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { connect } from 'node:net';
+import { URL } from 'node:url';
+import { logForDebugging } from "../utils/debug.js";
+import { decideAndRespond, } from "./request-filter.js";
+import { peekForClientHello, terminateAndForward, } from "./tls-terminate-proxy.js";
+import { connectViaParentProxy, dialDirect, openConnectTunnel, proxyAuthHeader, selectParentProxyUrl, shouldBypassParentProxy, stripBrackets, stripHopByHop, } from "./parent-proxy.js";
+export function createHttpProxyServer(options) {
+    const server = createServer();
+    const checkAuth = (got) => {
+        if (!options.proxyAuthToken)
+            return true;
+        const m = /^basic\s+([a-z0-9+/=]+)\s*$/i.exec(got ?? '');
+        if (!m)
+            return false;
+        const decoded = Buffer.from(m[1], 'base64').toString('utf8');
+        const sep = decoded.indexOf(':');
+        return sep > 0 && decoded.slice(sep + 1) === options.proxyAuthToken;
+    };
+    // Handle CONNECT requests for HTTPS traffic
+    server.on('connect', async (req, socket, head) => {
+        // Attach error handler immediately to prevent unhandled errors
+        socket.on('error', err => {
+            logForDebugging(`Client socket error: ${err.message}`, { level: 'error' });
+        });
+        // Track client liveness so we can abort the upstream dial if they bail.
+        let clientGone = false;
+        socket.once('close', () => {
+            clientGone = true;
+        });
+        try {
+            if (!checkAuth(req.headers['proxy-authorization'])) {
+                socket.end('HTTP/1.1 407 Proxy Authentication Required\r\n' +
+                    'Proxy-Authenticate: Basic realm="srt"\r\n\r\n');
+                return;
+            }
+            const target = parseConnectTarget(req.url);
+            if (!target) {
+                logForDebugging(`Invalid CONNECT request: ${req.url}`, {
+                    level: 'error',
+                });
+                socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+                return;
+            }
+            const { hostname, port } = target;
+            const allowed = await options.filter(port, hostname, socket);
+            if (!allowed) {
+                logForDebugging(`Connection blocked to ${hostname}:${port}`, {
+                    level: 'error',
+                });
+                socket.end('HTTP/1.1 403 Forbidden\r\n' +
+                    'Content-Type: text/plain\r\n' +
+                    'X-Proxy-Error: blocked-by-allowlist\r\n' +
+                    '\r\n' +
+                    'Connection blocked by network allowlist');
+                return;
+            }
+            // Decide upstream route:
+            //   in-process TLS termination
+            //   > external MITM unix socket
+            //   > parent HTTP proxy
+            //   > direct
+            // (tlsTerminate and mitmProxy are mutually exclusive at the config
+            // layer, so the first two never both apply.)
+            let wrote200 = false;
+            if (options.mitmCA &&
+                (options.shouldTerminateTLS?.(hostname, port) ?? true)) {
+                if (clientGone)
+                    return;
+                // We can only terminate TLS. CONNECT also carries non-TLS streams —
+                // notably SSH on Linux, where the sandbox's own GIT_SSH_COMMAND
+                // routes `ssh` through this proxy via `socat - PROXY:`. Send 200 so
+                // the client transmits its first bytes, sniff for a ClientHello, and
+                // only terminate if it is one. Non-TLS falls through to the opaque
+                // tunnel below — i.e. base-sandbox behaviour, hostname-allowlisted
+                // but not content-inspected (same as the SOCKS path).
+                socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+                wrote200 = true;
+                const peeked = await peekForClientHello(socket, head);
+                if (clientGone)
+                    return;
+                if (peeked.isTLS) {
+                    terminateAndForward(options.mitmCA, options.filterRequest, options.mutateHeaders, socket, peeked.head, 
+                    // OMA: thread the validating lookup to the terminated upstream leg.
+                    { hostname, port, upstreamCA: options.tlsTerminateUpstreamCA, lookup: options.lookup });
+                    return;
+                }
+                logForDebugging(`[tls-terminate] non-TLS bytes on CONNECT ${hostname}:${port}; opaque-tunnelling`);
+                head = peeked.head; // OMA: @types/node buffer-variance skew
+            }
+            else if (options.mitmCA) {
+                // Per-host termination opt-out: the policy exempts this host (mTLS
+                // upstream, cert-pinning client), so skip the MITM entirely and
+                // take the opaque tunnel below, exactly as if mitmCA were unset.
+                logForDebugging(`[tls-terminate] policy exempts ${hostname}:${port}; opaque-tunnelling`);
+            }
+            // OMA: single choke point for every route that reaches the opaque
+            // tunnel below (non-TLS bytes after the sniff, a shouldTerminateTLS
+            // opt-out, or no mitmCA). ADR 0016 §3: path policy and injection are
+            // guarantees only for terminated TLS, so an uninspected byte tunnel
+            // must be an explicit per-host grant, not a fallback a client can
+            // trigger by speaking non-TLS bytes.
+            if (options.allowOpaqueTunnel &&
+                !options.allowOpaqueTunnel(hostname, port)) {
+                logForDebugging(`[tls-terminate] opaque tunnel to ${hostname}:${port} denied by policy`, { level: 'error' });
+                if (wrote200)
+                    socket.destroy();
+                else
+                    socket.end('HTTP/1.1 403 Forbidden\r\n\r\n');
+                return;
+            }
+            const mitmSocketPath = options.getMitmSocketPath?.(hostname);
+            const parentUrl = !mitmSocketPath &&
+                options.parentProxy &&
+                !shouldBypassParentProxy(options.parentProxy, hostname)
+                ? selectParentProxyUrl(options.parentProxy, { isHttps: true })
+                : undefined;
+            let upstream;
+            try {
+                if (mitmSocketPath) {
+                    logForDebugging(`Routing CONNECT ${hostname}:${port} through MITM proxy at ${mitmSocketPath}`);
+                    upstream = await openConnectTunnel({
+                        dial: () => connect({ path: mitmSocketPath }),
+                        readyEvent: 'connect',
+                        destHost: hostname,
+                        destPort: port,
+                    });
+                }
+                else if (parentUrl) {
+                    upstream = await connectViaParentProxy(parentUrl, hostname, port);
+                }
+                else {
+                    upstream = await dialDirect(hostname, port, undefined, options.lookup); // OMA: validating lookup on the opaque-tunnel dial
+                }
+            }
+            catch (err) {
+                logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
+                    level: 'error',
+                });
+                // If we already sent 200 (mitmCA sniff path), an HTTP status line now
+                // would land inside the tunnel as payload. Just close.
+                if (wrote200)
+                    socket.destroy();
+                else
+                    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
+                return;
+            }
+            if (clientGone) {
+                upstream.on('error', () => { }); // swallow post-resolve errors
+                upstream.destroy();
+                return;
+            }
+            if (!wrote200) {
+                socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            }
+            // Forward any bytes the client sent in the same packet as the CONNECT
+            // (Node delivers these as the `head` buffer, not via the socket stream),
+            // plus anything the ClientHello sniff consumed when mitmCA is on.
+            if (head.length)
+                upstream.write(head);
+            upstream.pipe(socket);
+            socket.pipe(upstream);
+            upstream.on('error', err => {
+                logForDebugging(`CONNECT tunnel failed: ${err.message}`, {
+                    level: 'error',
+                });
+                socket.destroy();
+            });
+            socket.on('close', () => upstream.destroy());
+            upstream.on('close', () => socket.destroy());
+        }
+        catch (err) {
+            logForDebugging(`Error handling CONNECT: ${err}`, { level: 'error' });
+            socket.end('HTTP/1.1 500 Internal Server Error\r\n\r\n');
+        }
+    });
+    // Handle regular HTTP requests
+    server.on('request', async (req, res) => {
+        try {
+            if (!checkAuth(req.headers['proxy-authorization'])) {
+                res.writeHead(407, { 'Proxy-Authenticate': 'Basic realm="srt"' });
+                res.end();
+                return;
+            }
+            const url = new URL(req.url);
+            const hostname = stripBrackets(url.hostname);
+            const port = url.port
+                ? parseInt(url.port, 10)
+                : url.protocol === 'https:'
+                    ? 443
+                    : 80;
+            const allowed = await options.filter(port, hostname, req.socket);
+            if (!allowed) {
+                logForDebugging(`HTTP request blocked to ${hostname}:${port}`, {
+                    level: 'error',
+                });
+                res.writeHead(403, {
+                    'Content-Type': 'text/plain',
+                    'X-Proxy-Error': 'blocked-by-allowlist',
+                });
+                res.end('Connection blocked by network allowlist');
+                return;
+            }
+            // Client may have disconnected while we awaited the filter; bail now
+            // rather than dialing an upstream nobody will read from.
+            if (req.socket.destroyed)
+                return;
+            const fwdHeaders = { ...stripHopByHop(req.headers), host: url.host };
+            // OMA: same request context as the terminated path (ADR 0016 §6).
+            options.mutateHeadersPlaintext?.(fwdHeaders, hostname, {
+                method: req.method ?? 'GET',
+                path: `${url.pathname}${url.search}`,
+                port,
+            });
+            // Decide upstream route: MITM unix socket > parent HTTP proxy > direct.
+            const mitmSocketPath = options.getMitmSocketPath?.(hostname);
+            const parentUrl = !mitmSocketPath &&
+                options.parentProxy &&
+                !shouldBypassParentProxy(options.parentProxy, hostname)
+                ? selectParentProxyUrl(options.parentProxy, {
+                    isHttps: url.protocol === 'https:',
+                })
+                : undefined;
+            // Reconstruct the absolute URI from parsed components rather than
+            // forwarding the client's raw req.url. This ensures the upstream proxy
+            // sees exactly the host we allowlist-checked, closing URL-parser
+            // differential bypasses.
+            const absUrl = `${url.protocol}//${url.host}${url.pathname}${url.search}`;
+            // Per-request filter applies to plain HTTP too — otherwise a sandboxed
+            // client could bypass it by using http:// where the upstream serves it.
+            let body = req;
+            if (options.filterRequest) {
+                const ac = new AbortController();
+                res.once('close', () => ac.abort());
+                const out = await decideAndRespond(options.filterRequest, req, res, absUrl, ac.signal, { leg: 'plain' });
+                if (out === null)
+                    return;
+                body = out;
+            }
+            let proxyReq;
+            if (mitmSocketPath) {
+                logForDebugging(`Routing HTTP ${req.method} ${hostname}:${port} through MITM proxy at ${mitmSocketPath}`);
+                const mitmAgent = new Agent({
+                    // @ts-expect-error - socketPath is valid but not in types
+                    socketPath: mitmSocketPath,
+                });
+                proxyReq = httpRequest({
+                    agent: mitmAgent,
+                    path: absUrl,
+                    method: req.method,
+                    headers: fwdHeaders,
+                }, proxyRes => {
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
+                    proxyRes.pipe(res);
+                });
+            }
+            else if (parentUrl) {
+                const parentHost = stripBrackets(parentUrl.hostname);
+                const parentPort = Number(parentUrl.port) || (parentUrl.protocol === 'https:' ? 443 : 80);
+                const auth = proxyAuthHeader(parentUrl);
+                const requestFn = parentUrl.protocol === 'https:' ? httpsRequest : httpRequest;
+                proxyReq = requestFn({
+                    hostname: parentHost,
+                    port: parentPort,
+                    path: absUrl,
+                    method: req.method,
+                    headers: auth
+                        ? { ...fwdHeaders, 'proxy-authorization': auth }
+                        : fwdHeaders,
+                }, proxyRes => {
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
+                    proxyRes.pipe(res);
+                });
+            }
+            else {
+                const requestFn = url.protocol === 'https:' ? httpsRequest : httpRequest;
+                proxyReq = requestFn({
+                    hostname,
+                    port,
+                    path: url.pathname + url.search,
+                    method: req.method,
+                    headers: fwdHeaders,
+                    // OMA: validating lookup on the plain-HTTP direct dial too, so a
+                    // DNS name resolving to a private IP is denied here as well as on
+                    // the CONNECT/terminated paths.
+                    ...(options.lookup ? { lookup: options.lookup } : {}),
+                }, proxyRes => {
+                    res.writeHead(proxyRes.statusCode, stripHopByHop(proxyRes.headers));
+                    proxyRes.pipe(res);
+                });
+            }
+            proxyReq.on('error', err => {
+                logForDebugging(`Proxy request failed: ${err.message}`, {
+                    level: 'error',
+                });
+                if (!res.headersSent) {
+                    res.writeHead(502, { 'Content-Type': 'text/plain' });
+                    res.end('Bad Gateway');
+                }
+                else {
+                    res.destroy();
+                }
+            });
+            // Tear down the upstream request if the client goes away mid-flight.
+            res.on('close', () => proxyReq.destroy());
+            body.pipe(proxyReq);
+        }
+        catch (err) {
+            logForDebugging(`Error handling HTTP request: ${err}`, { level: 'error' });
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'text/plain' });
+                res.end('Internal Server Error');
+            }
+            else {
+                res.destroy();
+            }
+        }
+    });
+    return server;
+}
+/**
+ * Parse a CONNECT request-target into host + port. Handles both plain
+ * `host:port` and bracketed IPv6 `[::1]:port`.
+ */
+function parseConnectTarget(target) {
+    const m = /^\[([^\]]+)\]:(\d+)$/.exec(target) ?? /^([^:]+):(\d+)$/.exec(target);
+    if (!m)
+        return undefined;
+    const port = Number(m[2]);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return undefined;
+    return { hostname: m[1], port };
+}