Replace http.request() with raw TCP/TLS sockets for CONNECT tunneling

[jancurn]

Summary

Refactors the upstream proxy CONNECT tunnel implementation to use raw TCP/TLS sockets instead of http.request() with the 'connect' event, making proxy-chain work as a library under Bun 1.3. Rebased onto latest master (pnpm migration, puppeteer 25).

Key Changes

• Chain handler refactoring (src/chain.ts): Replaced http.request() / https.request() with direct net.createConnection() and tls.connect() calls

  • Manually constructs and sends the CONNECT request as a raw HTTP string, and parses the CONNECT response headers itself
  • The synthetic response object keeps rawHeaders, so tunnelConnectResponded / tunnelConnectFailed subscribers see the same shape as before
  • TLS options configured on httpsAgent (custom ca, client certs, ...) are honored by re-using the agent's stored constructor options for the direct connection
  • Sidesteps two Bun 1.3 quirks: rejection of RFC 7230 authority-form CONNECT paths like :443 with "fetch() URL is invalid", and silent swallowing of 407/590-class upstream responses

• Server request routing (src/server.ts): onRequest routes CONNECT requests to onConnect() — Bun delivers CONNECT through the generic 'request' event for some client shapes instead of the dedicated 'connect' event

• Connection stats on Bun (src/server.ts): getConnectionStats() returns undefined under Bun. Bun does not populate socket.bytesRead/bytesWritten on http sockets, so the numbers would silently read as zero — better no stats than wrong stats. (connectionClosed events consequently carry stats: undefined on Bun.) An earlier revision of this PR tried to reimplement byte counting via passive 'data'/'pipe' listeners; that added per-connection listener overhead on all runtimes for little gain and was dropped in favor of this explicit guard.

• SSL certificate regeneration (test/e2e/ssl.crt, ssl.key): The previous self-signed test cert expired 2018-11-10. Node tolerated it (rejectUnauthorized: false), but Bun rejects expired certs strictly on the WebSocket path. New cert: sha256, SAN covers localhost, localhost-test, 127.0.0.1, ::1, valid until 2126.

Verification

• Node 22: full e2e suite produces an identical pass/fail set to the master baseline (2012 passing; the same 174 failures exist on pristine master in the same sandbox — puppeteer/IPv6 environment issues, not caused by this PR)
• Bun 1.3: unit tests and the compatible e2e subset pass; full-suite pass count improves, with the remainder blocked on upstream Bun http.request client bugs (tracked separately)

https://claude.ai/code/session_01Vn16UCyisJSwEaAoHLSNX6