[abnegate]

The egress forward proxy forwarded upstream status lines and headers through res.writeHead with no error handling. Under Bun, the HTTP client parser accepts some status codes and reason phrases that the server-side writer then rejects (for example a status code below 100, or a non-ASCII reason phrase). That throw escaped the request callback and ended the process.

The same handlers await the host resolver. A rejected lookup became an unhandled rejection on both the plain-HTTP and CONNECT paths.

This change fails the affected connection instead: HTTP clients get 502 (or the socket is destroyed if headers were already sent), and CONNECT clients get 502 or a destroyed socket. An error listener is also attached to the upstream response stream.

Tests

Unit tests drive startEgressGuard through a local raw upstream and cover:

• a normal 200 still forwards
• a rejected status message or status code returns 502 without an uncaught exception
• a rejected resolver returns 502 on HTTP and CONNECT
• the guard still serves a later request after a rejected upstream response
• CONNECT still tunnels to a reachable host and returns 502 when the destination refuses

Verified locally with Bun 1.3.2 (the Dockerfile version): bun run lint, bun run check, bun run type-check, and bun test tests/unit.

  

[github-actions]

Docker Image Stats

Metric	Value
Image Size	494MB
Memory Usage	158.2MiB
Cold Start Time	1.02s
Screenshot Time	1.61s

_{Screenshot benchmark: Average of 3 runs on https://appwrite.io}

[abnegate]

@hansi-codes review

[hansi-codes]

🟢 Tier S · Ready to merge

The egress proxy now converts resolver failures and rejected upstream HTTP responses into controlled gateway failures, and handles stream/socket errors without letting request-handler exceptions escape. Unit tests exercise HTTP forwarding, malformed upstream status values, resolver failures, continued service, and CONNECT tunneling and refusal cases.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 2

File	Change
src/utils/egress.ts	Adds guarded HTTP and CONNECT error handling, including fallback responses and upstream response stream error handling.
tests/unit/egress.test.ts	Adds raw-socket unit coverage for normal forwarding, malformed upstream statuses, resolver failures, and CONNECT behavior.

---

_{Reviewed 267c7fb · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary