further proxy fixes

native-host/https-proxy.js

@@ -29,7 +29,6 @@ function debugLog(...args) {
 let proxyServer = null;
 let proxyPort = null;
 let proxyCertsDirOrCA = null; // saved so restart() can regenerate the cert
-const proxyConnections = new Set(); // track live sockets so stop() can force-close them
 /** Resolver: hostname -> { host, port } or port number (then host defaults to 127.0.0.1) or null */
 let getBackendForHostname = null;
 
@@ -99,11 +98,6 @@ function start(port, certsDirOrCA, callback, baseDomains) {
     proxyServer = https.createServer(opts, onRequest);
     // Forward WebSocket upgrade requests to the backend tunnel
     proxyServer.on('upgrade', onUpgrade);
-    // Track live connections so stop() can force-close them for instant restart
-    proxyServer.on('connection', (socket) => {
-      proxyConnections.add(socket);
-      socket.once('close', () => proxyConnections.delete(socket));
-    });
   } catch (err) {
     if (process.stderr) process.stderr.write('[https-proxy] createServer threw: ' + err.message + '\n');
     done(err);
@@ -332,11 +326,17 @@ function stop(callback) {
   const s = proxyServer;
   proxyServer = null;
   proxyPort = null;
-  // Destroy all live connections so s.close() completes immediately
-  for (const socket of proxyConnections) {
+  // Destroy the raw TCP connections tracked by bare-tcp's internal _connections
+  // set. This is necessary because bare-tcp's _closeMaybe() only fires the
+  // 'close' event once _connections is empty — destroying only the TLS-wrapped
+  // sockets (which we no longer track) would leave the raw sockets open and
+  // s.close() would never call its callback.
+  const rawConns = s._connections;
+  if (rawConns && typeof rawConns[Symbol.iterator] === 'function') {
+    for (const socket of rawConns) {
       try { socket.destroy(); } catch (_) {}
     }
-  proxyConnections.clear();
+  }
   s.close(() => {
     if (callback) callback();
   });