fix(proxy): answer only TRACE with 404 and reject credentialed URLs with 400

Node never hands CONNECT or TRACK to the request listener, so the catch-all
404 only reached TRACE, and it misreported credentialed URLs, which Fetch
also refuses, as 404.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: thymikee

packages/proxy/src/node-http.test.ts

@@ -56,6 +56,11 @@ test('a Host header that cannot form a URL is answered with 400 instead of a dro
   expect(served).toEqual({ seenUrl: null, status: 400 });
 });
 
+test('a URL carrying credentials is answered with 400 instead of a dropped socket', async () => {
+  const served = await serveThroughListener(new Socket(), 'user:secret@gateway.example.test');
+  expect(served).toEqual({ seenUrl: null, status: 400 });
+});
+
 test('a method Fetch refuses is answered with 404 instead of a dropped socket', async () => {
   const proxy: DaemonProxy = {
     instanceId: 'test',

packages/proxy/src/node-http.ts

@@ -22,20 +22,17 @@ async function serveProxyRequest(
   req: IncomingMessage,
   res: ServerResponse,
 ): Promise<void> {
+  // Fetch refuses TRACE. node:http rejects TRACK and routes CONNECT to the 'connect' event.
+  if (req.method === 'TRACE') {
+    endWithStatus(res, 404);
+    return;
+  }
   const url = requestUrl(req);
   if (!url) {
     endWithStatus(res, 400);
     return;
   }
-  let request: Request;
-  try {
-    request = toWebRequest(url, req, res);
-  } catch {
-    // Fetch refuses CONNECT, TRACE and TRACK; the daemon serves none of them.
-    endWithStatus(res, 404);
-    return;
-  }
-  const response = await proxy.handle(request);
+  const response = await proxy.handle(toWebRequest(url, req, res));
   res.statusCode = response.status;
   for (const [name, value] of response.headers) res.setHeader(name, value);
   if (!response.body) {
@@ -50,10 +47,12 @@ function endWithStatus(res: ServerResponse, status: number): void {
   res.end();
 }
 
-/** `null` when the Host header and path do not form a URL. */
+/** `null` when the Host header and path do not form a URL that Fetch accepts. */
 function requestUrl(req: IncomingMessage): URL | null {
   const scheme = req.socket instanceof TLSSocket ? 'https' : 'http';
-  return URL.parse(req.url ?? '/', `${scheme}://${req.headers.host ?? '127.0.0.1'}`);
+  const url = URL.parse(req.url ?? '/', `${scheme}://${req.headers.host ?? '127.0.0.1'}`);
+  if (!url || url.username || url.password) return null;
+  return url;
 }
 
 function toWebRequest(url: URL, req: IncomingMessage, res: ServerResponse): Request {