feat(bun): support running under Bun (raw-socket CONNECT chaining)

Three changes that make proxy-chain work as a library under Bun 1.3,
inspired by the approach in #649:

1. `chain.ts` no longer tunnels through `http.request().on('connect')`.
   Bun implements `http.request` on top of `fetch()`, which (a) rejects
   RFC 7230 authority-form CONNECT paths like `:443` with "fetch() URL
   is invalid" and (b) swallows 407/590-class upstream responses.
   Instead we open a raw `net`/`tls` socket, write the CONNECT request
   ourselves, parse the response headers, and `unshift` any remaining
   bytes back as tunnel payload. The synthetic response object keeps
   `rawHeaders` so `tunnelConnectResponded`/`tunnelConnectFailed`
   subscribers see the same shape as before. TLS options configured on
   `httpsAgent` (custom `ca`, client certs) are honored by re-using the
   agent's stored constructor options for the direct connection.

2. `Server.onRequest` routes `CONNECT` requests to `onConnect`: Bun
   delivers CONNECT through the generic 'request' event for some client
   shapes instead of the dedicated 'connect' event.

3. `Server.getConnectionStats` returns `undefined` under Bun. Bun does
   not populate `socket.bytesRead`/`bytesWritten` on http sockets, so
   the stats would silently read as zero — better no stats than wrong
   stats. (`connectionClosed` events consequently carry
   `stats: undefined` on Bun.)

Node behavior is unchanged: full e2e suite produces an identical
pass/fail set to master baseline (2012 passing, same 174 pre-existing
environment failures) on Node 22.

Author: claude

src/chain.ts

@@ -1,8 +1,10 @@
-import type { Buffer } from 'node:buffer';
+import { Buffer } from 'node:buffer';
 import type dns from 'node:dns';
 import type { EventEmitter } from 'node:events';
-import http from 'node:http';
-import https from 'node:https';
+import type http from 'node:http';
+import type https from 'node:https';
+import net from 'node:net';
+import tls from 'node:tls';
 import type { URL } from 'node:url';
 
 import type { Socket } from './socket.js';
@@ -11,15 +13,6 @@ import type { SocketWithPreviousStats } from './utils/count_target_bytes.js';
 import { countTargetBytes } from './utils/count_target_bytes.js';
 import { getBasicAuthorizationHeader } from './utils/get_basic.js';
 
-interface Options {
-    method: string;
-    headers: Record<string, string>;
-    path?: string;
-    localAddress?: string;
-    family?: number;
-    lookup?: typeof dns['lookup'];
-}
-
 export interface HandlerOpts {
     upstreamProxyUrlParsed: URL;
     ignoreUpstreamProxyCertificate: boolean;
@@ -44,6 +37,13 @@ interface ChainOpts {
  * Passes the traffic to upstream HTTP proxy server.
  * Client -> Apify -> Upstream -> Web
  * Client <- Apify <- Upstream <- Web
+ *
+ * Uses raw TCP/TLS sockets to establish the upstream CONNECT tunnel rather
+ * than `http.request().on('connect', ...)`. The latter is implemented on top
+ * of `fetch()` in Bun 1.3 and (a) rejects non-URL CONNECT paths like `:443`
+ * with "fetch() URL is invalid", (b) silently swallows the 407/590-class
+ * upstream responses tests rely on. Speaking CONNECT directly over a socket
+ * sidesteps both quirks without changing the behaviour on Node.
  */
 export const chain = (
     {
@@ -67,151 +67,190 @@ export const chain = (
     }
 
     const { proxyChainId } = sourceSocket;
-
     const { upstreamProxyUrlParsed: proxy, customTag } = handlerOpts;
 
-    const options: Options = {
-        method: 'CONNECT',
-        path: request.url,
-        headers: {
-            host: request.url!,
-        },
+    const isHttps = proxy.protocol === 'https:';
+    const proxyHost = proxy.hostname;
+    const proxyPort = Number(proxy.port) || (isHttps ? 443 : 80);
+
+    let connectRequest = `CONNECT ${request.url} HTTP/1.1\r\nHost: ${request.url}\r\n`;
+    if (proxy.username || proxy.password) {
+        connectRequest += `Proxy-Authorization: ${getBasicAuthorizationHeader(proxy)}\r\n`;
+    }
+    connectRequest += '\r\n';
+
+    const socketOptions: net.TcpNetConnectOpts = {
+        host: proxyHost,
+        port: proxyPort,
         localAddress: handlerOpts.localAddress,
-        family: handlerOpts.ipFamily,
+        family: handlerOpts.ipFamily as 4 | 6 | undefined,
         lookup: handlerOpts.dnsLookup,
     };
 
-    if (proxy.username || proxy.password) {
-        options.headers['proxy-authorization'] = getBasicAuthorizationHeader(proxy);
-    }
+    let targetSocket: net.Socket;
 
-    const client = proxy.protocol === 'https:'
-        ? https.request(proxy.origin, {
-            ...options,
-            rejectUnauthorized: !handlerOpts.ignoreUpstreamProxyCertificate,
-            agent: handlerOpts.httpsAgent,
-        })
-        : http.request(proxy.origin, {
-            ...options,
-            agent: handlerOpts.httpAgent,
-        });
-
-    client.once('socket', (targetSocket: SocketWithPreviousStats) => {
-        // Socket can be re-used by multiple requests.
-        // That's why we need to track the previous stats.
-        targetSocket.previousBytesRead = targetSocket.bytesRead;
-        targetSocket.previousBytesWritten = targetSocket.bytesWritten;
-        countTargetBytes(sourceSocket, targetSocket);
-    });
+    const onPreConnectError = (error: NodeJS.ErrnoException): void => {
+        server.log(proxyChainId, `Failed to connect to upstream proxy: ${error.stack}`);
 
-    client.on('connect', (response, targetSocket, clientHead) => {
-        if (sourceSocket.readyState !== 'open') {
-            // Sanity check, should never reach.
-            targetSocket.destroy();
-            return;
+        if (sourceSocket.readyState === 'open') {
+            if (isPlain) {
+                sourceSocket.end();
+            } else {
+                const statusCode = errorCodeToStatusCode[error.code!] ?? badGatewayStatusCodes.GENERIC_ERROR;
+                const response = createCustomStatusHttpResponse(statusCode, error.code ?? 'Upstream Closed Early');
+                sourceSocket.end(response);
+            }
         }
+    };
 
-        targetSocket.on('error', (error) => {
-            server.log(proxyChainId, `Chain Destination Socket Error: ${error.stack}`);
+    const onProxyConnected = (): void => {
+        targetSocket.write(connectRequest);
 
-            sourceSocket.destroy();
-        });
+        let responseBuffer = Buffer.alloc(0);
 
-        sourceSocket.on('error', (error) => {
-            server.log(proxyChainId, `Chain Source Socket Error: ${error.stack}`);
+        const onData = (chunk: Buffer): void => {
+            responseBuffer = Buffer.concat([responseBuffer, chunk]);
 
-            targetSocket.destroy();
-        });
+            const headerEnd = responseBuffer.indexOf('\r\n\r\n');
+            if (headerEnd === -1) return;
 
-        if (response.statusCode !== 200) {
-            server.log(proxyChainId, `Failed to authenticate upstream proxy: ${response.statusCode}`);
+            targetSocket.removeListener('data', onData);
 
-            if (isPlain) {
-                sourceSocket.end();
-            } else {
-                const { statusCode } = response;
-                const status = statusCode === 401 || statusCode === 407
-                    ? badGatewayStatusCodes.AUTH_FAILED
-                    : badGatewayStatusCodes.NON_200;
+            const headerStr = responseBuffer.subarray(0, headerEnd).toString();
+            const remaining = responseBuffer.subarray(headerEnd + 4);
+
+            const statusMatch = headerStr.match(/^HTTP\/\d+(?:\.\d+)? (\d+)(?: (.*))?/);
+            const statusCode = statusMatch ? parseInt(statusMatch[1], 10) : 0;
+            const statusMessage = statusMatch ? (statusMatch[2] || '') : '';
 
-                sourceSocket.end(createCustomStatusHttpResponse(status, `UPSTREAM${statusCode}`));
+            const headers: Record<string, string> = {};
+            const rawHeaders: string[] = [];
+            for (const line of headerStr.split('\r\n').slice(1)) {
+                if (!line) continue;
+                const colonIdx = line.indexOf(':');
+                if (colonIdx > 0) {
+                    const name = line.slice(0, colonIdx).trim();
+                    const value = line.slice(colonIdx + 1).trim();
+                    headers[name.toLowerCase()] = value;
+                    rawHeaders.push(name, value);
+                }
             }
 
-            targetSocket.end();
+            const response = { statusCode, statusMessage, headers, rawHeaders } as unknown as http.IncomingMessage;
+
+            if (sourceSocket.readyState !== 'open') {
+                targetSocket.destroy();
+                return;
+            }
+
+            targetSocket.removeListener('error', onPreConnectError);
+
+            targetSocket.on('error', (error) => {
+                server.log(proxyChainId, `Chain Destination Socket Error: ${error.stack}`);
+                sourceSocket.destroy();
+            });
+
+            sourceSocket.on('error', (error) => {
+                server.log(proxyChainId, `Chain Source Socket Error: ${error.stack}`);
+                targetSocket.destroy();
+            });
+
+            if (statusCode !== 200) {
+                server.log(proxyChainId, `Failed to authenticate upstream proxy: ${statusCode}`);
 
-            server.emit('tunnelConnectFailed', {
+                if (isPlain) {
+                    sourceSocket.end();
+                } else {
+                    const status = statusCode === 401 || statusCode === 407
+                        ? badGatewayStatusCodes.AUTH_FAILED
+                        : badGatewayStatusCodes.NON_200;
+
+                    sourceSocket.end(createCustomStatusHttpResponse(status, `UPSTREAM${statusCode}`));
+                }
+
+                targetSocket.end();
+
+                server.emit('tunnelConnectFailed', {
+                    proxyChainId,
+                    response,
+                    customTag,
+                    socket: targetSocket,
+                    head: remaining,
+                });
+
+                return;
+            }
+
+            if (remaining.length > 0) {
+                // See comment above re: pre-response CONNECT payload
+                targetSocket.unshift(remaining);
+            }
+
+            server.emit('tunnelConnectResponded', {
                 proxyChainId,
                 response,
                 customTag,
                 socket: targetSocket,
-                head: clientHead,
+                head: remaining,
             });
 
-            return;
-        }
+            sourceSocket.write(isPlain ? '' : `HTTP/1.1 200 Connection Established\r\n\r\n`);
 
-        if (clientHead.length > 0) {
-            // See comment above
-            targetSocket.unshift(clientHead);
-        }
+            sourceSocket.pipe(targetSocket);
+            targetSocket.pipe(sourceSocket);
 
-        server.emit('tunnelConnectResponded', {
-            proxyChainId,
-            response,
-            customTag,
-            socket: targetSocket,
-            head: clientHead,
-        });
+            // Once target socket closes forcibly, the source socket gets paused.
+            // We need to enable flowing, otherwise the socket would remain open indefinitely.
+            // Nothing would consume the data, we just want to close the socket.
+            targetSocket.on('close', () => {
+                sourceSocket.resume();
 
-        sourceSocket.write(isPlain ? '' : `HTTP/1.1 200 Connection Established\r\n\r\n`);
+                if (sourceSocket.writable) {
+                    sourceSocket.end();
+                }
+            });
 
-        sourceSocket.pipe(targetSocket);
-        targetSocket.pipe(sourceSocket);
+            // Same here.
+            sourceSocket.on('close', () => {
+                targetSocket.resume();
 
-        // Once target socket closes forcibly, the source socket gets paused.
-        // We need to enable flowing, otherwise the socket would remain open indefinitely.
-        // Nothing would consume the data, we just want to close the socket.
-        targetSocket.on('close', () => {
-            sourceSocket.resume();
+                if (targetSocket.writable) {
+                    targetSocket.end();
+                }
+            });
+        };
 
-            if (sourceSocket.writable) {
-                sourceSocket.end();
-            }
-        });
+        targetSocket.on('data', onData);
+    };
 
-        // Same here.
-        sourceSocket.on('close', () => {
-            targetSocket.resume();
+    if (isHttps) {
+        // We connect directly instead of going through `https.request` with an
+        // agent, but users may have configured TLS settings (custom `ca`,
+        // client certs, ...) on `httpsAgent`. Honor those by re-using the
+        // agent's stored constructor options for this connection.
+        const httpsAgentOptions = handlerOpts.httpsAgent?.options as tls.ConnectionOptions | undefined;
 
-            if (targetSocket.writable) {
-                targetSocket.end();
-            }
-        });
-    });
+        targetSocket = tls.connect({
+            ...httpsAgentOptions,
+            ...socketOptions,
+            rejectUnauthorized: !handlerOpts.ignoreUpstreamProxyCertificate,
+        }, onProxyConnected);
+    } else {
+        targetSocket = net.createConnection(socketOptions, onProxyConnected);
+    }
 
-    client.on('error', (error: NodeJS.ErrnoException) => {
-        server.log(proxyChainId, `Failed to connect to upstream proxy: ${error.stack}`);
+    (targetSocket as SocketWithPreviousStats).previousBytesRead = 0;
+    (targetSocket as SocketWithPreviousStats).previousBytesWritten = 0;
+    countTargetBytes(sourceSocket, targetSocket);
 
-        // The end socket may get connected after the client to proxy one gets disconnected.
-        if (sourceSocket.readyState === 'open') {
-            if (isPlain) {
-                sourceSocket.end();
-            } else {
-                const statusCode = errorCodeToStatusCode[error.code!] ?? badGatewayStatusCodes.GENERIC_ERROR;
-                const response = createCustomStatusHttpResponse(statusCode, error.code ?? 'Upstream Closed Early');
-                sourceSocket.end(response);
-            }
-        }
-    });
+    targetSocket.on('error', onPreConnectError);
 
     sourceSocket.on('error', () => {
-        client.destroy();
+        targetSocket.destroy();
     });
 
     // In case the client ends the socket too early
     sourceSocket.on('close', () => {
-        client.destroy();
+        targetSocket.destroy();
     });
-
-    client.end();
 };

src/server.ts

@@ -361,6 +361,15 @@ export class Server extends EventEmitter {
      * Handles normal HTTP request by forwarding it to target host or the upstream proxy.
      */
     async onRequest(request: http.IncomingMessage, response: http.ServerResponse): Promise<void> {
+        // Some runtimes (Bun 1.3) deliver HTTP CONNECT requests through the
+        // generic 'request' event rather than the dedicated 'connect' event.
+        // Route them through onConnect explicitly so CONNECT tunnelling keeps
+        // working on those runtimes.
+        if (request.method === 'CONNECT') {
+            await this.onConnect(request, request.socket as Socket, Buffer.alloc(0));
+            return;
+        }
+
         try {
             const handlerOpts = await this.prepareRequestHandling(request);
             handlerOpts.srcResponse = response;
@@ -698,8 +707,15 @@ export class Server extends EventEmitter {
 
     /**
      * Gets data transfer statistics of a specific proxy connection.
+     *
+     * Returns `undefined` when the connection does not exist, and also when
+     * running under Bun: Bun (as of 1.3) does not populate
+     * `socket.bytesRead` / `socket.bytesWritten` on http sockets, so the
+     * numbers would silently read as zero. Better no stats than wrong stats.
      */
     getConnectionStats(connectionId: number): ConnectionStats | undefined {
+        if (process.versions.bun) return undefined;
+
         const socket = this.connections.get(connectionId);
         if (!socket) return undefined;