🐛 fix(proxy): 修复 Nacos 隧道目标透传与握手取消

- 保留 Nacos 远端 Host、TLS SNI 与默认 8848 端口
- 规范化 HTTP、SOCKS5 与 SSH 代理组合路径
- 让停滞的 HTTP CONNECT 响应上下文取消并保持成功隧道可用

internal/proxy/proxy.go

@@ -295,6 +295,33 @@ func dialHTTPConnect(ctx context.Context, cfg connection.ProxyConfig, address st
 	if err != nil {
 		return nil, proxyWrapError("proxy.backend.error.http_connect_failed", map[string]any{"detail": err.Error()}, err)
 	}
+	if deadline, ok := ctx.Deadline(); ok {
+		if err := conn.SetDeadline(deadline); err != nil {
+			_ = conn.Close()
+			return nil, proxyWrapError("proxy.backend.error.http_connect_failed", map[string]any{"detail": err.Error()}, err)
+		}
+	}
+
+	stopContextWatch := make(chan struct{})
+	contextWatchDone := make(chan struct{})
+	go func() {
+		defer close(contextWatchDone)
+		select {
+		case <-ctx.Done():
+			// Closing is required for cancellation without a deadline and
+			// immediately unblocks both CONNECT writes and response reads.
+			_ = conn.Close()
+		case <-stopContextWatch:
+		}
+	}()
+	var stopContextWatchOnce sync.Once
+	stopWatchingContext := func() {
+		stopContextWatchOnce.Do(func() {
+			close(stopContextWatch)
+			<-contextWatchDone
+		})
+	}
+	defer stopWatchingContext()
 
 	connectReq := &http.Request{
 		Method: http.MethodConnect,
@@ -307,21 +334,39 @@ func dialHTTPConnect(ctx context.Context, cfg connection.ProxyConfig, address st
 		connectReq.Header.Set("Proxy-Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(raw)))
 	}
 	if err := connectReq.Write(conn); err != nil {
+		stopWatchingContext()
 		_ = conn.Close()
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return nil, ctxErr
+		}
 		return nil, proxyWrapError("proxy.backend.error.http_connect_write_failed", map[string]any{"detail": err.Error()}, err)
 	}
 
 	reader := bufio.NewReader(conn)
 	resp, err := http.ReadResponse(reader, connectReq)
 	if err != nil {
+		stopWatchingContext()
 		_ = conn.Close()
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return nil, ctxErr
+		}
 		return nil, proxyWrapError("proxy.backend.error.http_connect_read_failed", map[string]any{"detail": err.Error()}, err)
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
+		stopWatchingContext()
 		_ = conn.Close()
 		return nil, proxyTextError("proxy.backend.error.http_connect_status_failed", map[string]any{"status": strings.TrimSpace(resp.Status)})
 	}
+	stopWatchingContext()
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		_ = conn.Close()
+		return nil, ctxErr
+	}
+	if err := conn.SetDeadline(time.Time{}); err != nil {
+		_ = conn.Close()
+		return nil, proxyWrapError("proxy.backend.error.http_connect_failed", map[string]any{"detail": err.Error()}, err)
+	}
 
 	if reader.Buffered() == 0 {
 		return conn, nil

internal/proxy/proxy_test.go

@@ -1,9 +1,17 @@
 package proxy
 
 import (
+	"bufio"
 	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
 	"strings"
 	"testing"
+	"time"
+
 	"GoNavi-Wails/internal/connection"
 	"GoNavi-Wails/shared/i18n"
 )
@@ -44,7 +52,6 @@ func TestForwarderCacheKeyIncludesCredentialFingerprint(t *testing.T) {
 	}
 }
 
-
 func TestNormalizeConfigUsesCurrentLanguageForValidationErrors(t *testing.T) {
 	SetBackendLanguage(i18n.LanguageEnUS)
 	t.Cleanup(func() {
@@ -84,3 +91,142 @@ func TestDialContextUsesCurrentLanguageForHTTPConnectWrapper(t *testing.T) {
 		t.Fatalf("expected localized HTTP proxy wrapper, got %q", err.Error())
 	}
 }
+
+func TestDialContextCancelsStalledHTTPConnectHandshake(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer listener.Close()
+
+	accepted := make(chan net.Conn, 1)
+	serverClosed := make(chan struct{})
+	go func() {
+		conn, acceptErr := listener.Accept()
+		if acceptErr != nil {
+			close(serverClosed)
+			return
+		}
+		accepted <- conn
+		defer close(serverClosed)
+		defer conn.Close()
+		// Consume the CONNECT request but deliberately never send a response.
+		_, _ = io.Copy(io.Discard, conn)
+	}()
+
+	_, portText, err := net.SplitHostPort(listener.Addr().String())
+	if err != nil {
+		t.Fatalf("split proxy address: %v", err)
+	}
+	port, err := strconv.Atoi(portText)
+	if err != nil {
+		t.Fatalf("parse proxy port: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 80*time.Millisecond)
+	defer cancel()
+	result := make(chan error, 1)
+	go func() {
+		conn, dialErr := DialContext(ctx, connection.ProxyConfig{
+			Type: "http",
+			Host: "127.0.0.1",
+			Port: port,
+		}, "tcp", "example.com:443")
+		if conn != nil {
+			_ = conn.Close()
+		}
+		result <- dialErr
+	}()
+
+	proxyConn := <-accepted
+	select {
+	case dialErr := <-result:
+		if !errors.Is(dialErr, context.DeadlineExceeded) {
+			t.Fatalf("DialContext error = %v, want context deadline exceeded", dialErr)
+		}
+	case <-time.After(750 * time.Millisecond):
+		_ = proxyConn.Close()
+		<-result
+		t.Fatal("DialContext remained blocked after its context deadline")
+	}
+
+	select {
+	case <-serverClosed:
+	case <-time.After(750 * time.Millisecond):
+		_ = proxyConn.Close()
+		t.Fatal("stalled HTTP proxy socket remained open after cancellation")
+	}
+}
+
+func TestDialContextKeepsSuccessfulHTTPConnectTunnelOpen(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer listener.Close()
+
+	serverResult := make(chan error, 1)
+	go func() {
+		conn, acceptErr := listener.Accept()
+		if acceptErr != nil {
+			serverResult <- acceptErr
+			return
+		}
+		defer conn.Close()
+		request, readErr := http.ReadRequest(bufio.NewReader(conn))
+		if readErr != nil {
+			serverResult <- readErr
+			return
+		}
+		_ = request.Body.Close()
+		if _, writeErr := io.WriteString(conn, "HTTP/1.1 200 Connection Established\r\n\r\n"); writeErr != nil {
+			serverResult <- writeErr
+			return
+		}
+		var payload [4]byte
+		if _, readErr = io.ReadFull(conn, payload[:]); readErr != nil {
+			serverResult <- readErr
+			return
+		}
+		if string(payload[:]) != "ping" {
+			serverResult <- errors.New("unexpected tunnel payload")
+			return
+		}
+		_, writeErr := io.WriteString(conn, "pong")
+		serverResult <- writeErr
+	}()
+
+	_, portText, err := net.SplitHostPort(listener.Addr().String())
+	if err != nil {
+		t.Fatalf("split proxy address: %v", err)
+	}
+	port, err := strconv.Atoi(portText)
+	if err != nil {
+		t.Fatalf("parse proxy port: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := DialContext(ctx, connection.ProxyConfig{
+		Type: "http",
+		Host: "127.0.0.1",
+		Port: port,
+	}, "tcp", "example.com:443")
+	if err != nil {
+		t.Fatalf("DialContext: %v", err)
+	}
+	defer conn.Close()
+	if _, err = io.WriteString(conn, "ping"); err != nil {
+		t.Fatalf("write tunnel: %v", err)
+	}
+	var response [4]byte
+	if _, err = io.ReadFull(conn, response[:]); err != nil {
+		t.Fatalf("read tunnel: %v", err)
+	}
+	if string(response[:]) != "pong" {
+		t.Fatalf("tunnel response = %q, want pong", response)
+	}
+	if err = <-serverResult; err != nil {
+		t.Fatalf("proxy server: %v", err)
+	}
+}