fix(proxy): bound SOCKS5 TLS handshake lifetime

[lcxhh521]

Summary

• Give HTTPS-over-SOCKS5 its own absolute 30-second TLS handshake deadline after SOCKS CONNECT. Previously, the SOCKS timer was cleared before TLS setup and the response timer began only after TLS succeeded, leaving a stalled handshake dependent on caller cancellation.
• Clear the deadline and handshake listeners on success, failure, cancellation and premature close; preserve certificate verification and the caller's abort reason.
• Add five focused native Bun regression cases, register the new test in both layout maps, and document the transport deadline.

This is a narrow shared-transport reliability fix. It does not change Desktop UI, account or quota admission, automatic readiness/fallback, certificate trust, or system proxy settings. It does not implement or close #6381 or #5947.

Verification

The publication preflight found dev two unrelated commits ahead at a29cb3d; none of the six changed paths differ, and this draft retains the exact tested base below.

Validated on Linux with Bun 1.4.3 (c6da4a4d3), based on dev daf323d:

• bun test tests/lib/socks5-tls-lifecycle.test.ts tests/lib/socks5-upload-lifecycle.test.ts tests/test-layout.test.ts: 16 passed, zero failures. Tests ran from the repository root with the normal preload and disposable test homes.
• node_modules/.bin/tsc --noEmit: passed.
• node_modules/.bin/tsc --ignoreConfig --noEmit --strict --skipLibCheck --target ESNext --module ESNext --moduleResolution bundler --types bun-types tests/lib/socks5-tls-lifecycle.test.ts: passed.
• bun scripts/privacy-scan.ts: passed.
• bun scripts/structure-ssot.ts: passed.
• Docs Astro build: passed, 569 pages and 79,403 internal links checked.
• git diff --check: passed.
• Red-before evidence: the new stalled-TLS test fails against pristine source because no TLS deadline remains after ClientHello; it passes with the fix. The deadline is triggered deterministically only after the loopback peer actually receives TLS bytes.

An expanded raw-transport run also passed both SOCKS null-body cases but failed three unchanged pinned-HTTP cases: a 204 first-byte timeout and 205/200 responses returning 502. The 204 and 200 failures reproduce on pristine current dev before applying this patch; the 205 failure reproduces on pristine dev20cd561, and its test and pinned transport are unchanged between those bases. The underlying baseline failure remains unresolved.

The full suite and broad import-graph suite were not run: this isolated validation is limited to reviewed synthetic/loopback transport fixtures, and the broader graph includes live-provider/account paths. Full socks5-fetch.test.ts, cross-platform runs and CI remain outstanding. Focused results are not a full-suite or merge-readiness claim.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Keep this PR in draft pending maintainer/security review, required exact-head CI and completion of the repository's review-readiness checks. Certificate verification remains enabled; no authentication or proxy credential behavior is intentionally changed.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[lidge-jun]

Thanks @lcxhh521! This change landed on dev in #7065 (1edd55a), carried unchanged in its own commit with you credited in a Co-authored-by trailer. The fork PR never got the repository's main CI, so I carried it onto an upstream branch to run it. Closing this PR because the carry superseded it.