v25.11.2

changelog.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 2026-03-15 - 25.11.2 - fix(rustproxy-http)
+avoid reusing HTTP/1 senders during streaming responses and relax HTTP/2 keep-alive timeouts
+
+- Stop returning HTTP/1 senders to the connection pool before upstream response bodies finish streaming to prevent unsafe reuse on active connections.
+- Increase HTTP/2 keep-alive timeout from 5 seconds to 30 seconds in proxy connection builders to better support longer-lived backend streams.
+- Improves reliability for large streaming payloads and backend fallback request handling.
+
+## 2026-03-15 - 25.11.1 - fix(rustproxy-http)
+keep connection idle tracking alive during streaming and tune HTTP/2 connection lifetimes
+
+- Propagate connection activity tracking through HTTP/1, HTTP/2, and WebSocket forwarding so active request and response body streams do not trigger the idle watchdog.
+- Update CountingBody to refresh connection activity timestamps while data frames are polled during uploads and downloads.
+- Increase pooled HTTP/2 max age and set explicit HTTP/2 connection window sizes to improve long-lived streaming behavior.
+
+## 2026-03-15 - 25.11.0 - feat(rustproxy-http)
+add HTTP/2 Extended CONNECT WebSocket proxy support
+
+- Enable HTTP/2 CONNECT protocol support on the Hyper auto connection builder
+- Detect WebSocket requests for both HTTP/1 Upgrade and HTTP/2 Extended CONNECT flows
+- Translate HTTP/2 WebSocket requests to an HTTP/1.1 backend handshake and return RFC-compliant client responses
+
 ## 2026-03-12 - 25.10.7 - fix(rustproxy-http)
 remove Host header from HTTP/2 upstream requests while preserving it for HTTP/1 retries
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "25.10.7",
+  "version": "25.11.2",
   "private": false,
   "description": "A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",

rust/crates/rustproxy-http/src/connection_pool.rs

@@ -20,7 +20,7 @@ const IDLE_TIMEOUT: Duration = Duration::from_secs(90);
 const EVICTION_INTERVAL: Duration = Duration::from_secs(30);
 /// Maximum age for pooled HTTP/2 connections before proactive eviction.
 /// Prevents staleness from backends that close idle connections (e.g. nginx GOAWAY).
-const MAX_H2_AGE: Duration = Duration::from_secs(120);
+const MAX_H2_AGE: Duration = Duration::from_secs(300);
 
 /// Identifies a unique backend endpoint.
 #[derive(Clone, Debug, Hash, Eq, PartialEq)]

rust/crates/rustproxy-http/src/counting_body.rs

@@ -25,6 +25,11 @@ pub struct CountingBody<B> {
     direction: Direction,
     /// Whether we've already reported the bytes (to avoid double-reporting on drop).
     reported: bool,
+    /// Optional connection-level activity tracker. When set, poll_frame updates this
+    /// to keep the idle watchdog alive during active body streaming (uploads/downloads).
+    connection_activity: Option<Arc<AtomicU64>>,
+    /// Start instant for computing elapsed ms for connection_activity.
+    activity_start: Option<std::time::Instant>,
 }
 
 /// Which direction the bytes flow.
@@ -53,9 +58,20 @@ impl<B> CountingBody<B> {
             source_ip,
             direction,
             reported: false,
+            connection_activity: None,
+            activity_start: None,
         }
     }
 
+    /// Set the connection-level activity tracker. When set, each data frame
+    /// updates this timestamp to prevent the idle watchdog from killing the
+    /// connection during active body streaming.
+    pub fn with_connection_activity(mut self, activity: Arc<AtomicU64>, start: std::time::Instant) -> Self {
+        self.connection_activity = Some(activity);
+        self.activity_start = Some(start);
+        self
+    }
+
     /// Report accumulated bytes to the metrics collector.
     fn report(&mut self) {
         if self.reported {
@@ -103,6 +119,10 @@ where
             Poll::Ready(Some(Ok(frame))) => {
                 if let Some(data) = frame.data_ref() {
                     this.counted_bytes.fetch_add(data.len() as u64, Ordering::Relaxed);
+                    // Keep the connection-level idle watchdog alive during body streaming
+                    if let (Some(activity), Some(start)) = (&this.connection_activity, &this.activity_start) {
+                        activity.store(start.elapsed().as_millis() as u64, Ordering::Relaxed);
+                    }
                 }
                 Poll::Ready(Some(Ok(frame)))
             }

rust/crates/rustproxy-http/src/proxy_service.rs

@@ -33,6 +33,14 @@ use crate::request_filter::RequestFilter;
 use crate::response_filter::ResponseFilter;
 use crate::upstream_selector::UpstreamSelector;
 
+/// Per-connection context for keeping the idle watchdog alive during body streaming.
+/// Passed through the forwarding chain so CountingBody can update the timestamp.
+#[derive(Clone)]
+struct ConnActivity {
+    last_activity: Arc<AtomicU64>,
+    start: std::time::Instant,
+}
+
 /// Default upstream connect timeout (30 seconds).
 const DEFAULT_CONNECT_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
 
@@ -294,8 +302,9 @@ impl HttpProxyService {
             let cn = cancel_inner.clone();
             let la = Arc::clone(&la_inner);
             let st = start;
+            let ca = ConnActivity { last_activity: Arc::clone(&la_inner), start };
             async move {
-                let result = svc.handle_request(req, peer, port, cn).await;
+                let result = svc.handle_request(req, peer, port, cn, ca).await;
                 // Mark request end — update activity timestamp before guard drops
                 la.store(st.elapsed().as_millis() as u64, Ordering::Relaxed);
                 drop(req_guard); // Explicitly drop to decrement active_requests
@@ -304,8 +313,13 @@ impl HttpProxyService {
         });
 
         // Auto-detect h1 vs h2 based on ALPN / connection preface.
-        // serve_connection_with_upgrades supports h1 Upgrade (WebSocket) and h2 CONNECT.
-        let builder = hyper_util::server::conn::auto::Builder::new(hyper_util::rt::TokioExecutor::new());
+        // serve_connection_with_upgrades supports h1 Upgrade (WebSocket) and h2 Extended CONNECT (RFC 8441).
+        let mut builder = hyper_util::server::conn::auto::Builder::new(hyper_util::rt::TokioExecutor::new());
+        // Configure H2 server settings: Extended CONNECT for WebSocket + flow control tuning
+        builder.http2()
+            .enable_connect_protocol()
+            .initial_stream_window_size(2 * 1024 * 1024)        // 2MB per stream (vs default 64KB)
+            .initial_connection_window_size(8 * 1024 * 1024);   // 8MB per client connection
         let conn = builder.serve_connection_with_upgrades(io, service);
         // Pin on the heap — auto::UpgradeableConnection is !Unpin
         let mut conn = Box::pin(conn);
@@ -365,6 +379,7 @@ impl HttpProxyService {
         peer_addr: std::net::SocketAddr,
         port: u16,
         cancel: CancellationToken,
+        conn_activity: ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let host = req.headers()
             .get("host")
@@ -482,16 +497,23 @@ impl HttpProxyService {
         let domain_str = host.as_deref().unwrap_or("-");
         self.upstream_selector.connection_started(&upstream_key);
 
-        // Check for WebSocket upgrade
-        let is_websocket = req.headers()
+        // Check for WebSocket upgrade: H1 (Upgrade header) or H2 Extended CONNECT (RFC 8441)
+        let is_h1_websocket = req.headers()
             .get("upgrade")
             .and_then(|v| v.to_str().ok())
             .map(|v| v.eq_ignore_ascii_case("websocket"))
             .unwrap_or(false);
 
-        if is_websocket {
+        let is_h2_websocket = req.method() == hyper::Method::CONNECT
+            && req.extensions()
+                .get::<hyper::ext::Protocol>()
+                .map(|p| p.as_str().eq_ignore_ascii_case("websocket"))
+                .unwrap_or(false);
+
+        if is_h1_websocket || is_h2_websocket {
             let result = self.handle_websocket_upgrade(
-                req, peer_addr, &upstream, route_match.route, route_id, &upstream_key, cancel, &ip_str,
+                req, peer_addr, &upstream, route_match.route, route_id, &upstream_key, cancel, &ip_str, is_h2_websocket,
+                if is_h2_websocket { Some(conn_activity.clone()) } else { None },
             ).await;
             // Note: for WebSocket, connection_ended is called inside
             // the spawned tunnel task when the connection closes.
@@ -632,7 +654,7 @@ impl HttpProxyService {
                     self.metrics.set_backend_protocol(&upstream_key, "h2");
                     let result = self.forward_h2_pooled(
                         sender, parts, body, upstream_headers, &upstream_path,
-                        route_match.route, route_id, &ip_str, &pool_key, domain_str,
+                        route_match.route, route_id, &ip_str, &pool_key, domain_str, &conn_activity,
                     ).await;
                     self.upstream_selector.connection_ended(&upstream_key);
                     return result;
@@ -771,19 +793,19 @@ impl HttpProxyService {
                 self.forward_h2_with_fallback(
                     io, parts, body, upstream_headers, &upstream_path,
                     &upstream, route_match.route, route_id, &ip_str, &final_pool_key,
-                    host.clone(), domain_str,
+                    host.clone(), domain_str, &conn_activity,
                 ).await
             } else {
                 // Explicit H2 mode: hard-fail on handshake error (preserved behavior)
                 self.forward_h2(
                     io, parts, body, upstream_headers, &upstream_path,
-                    &upstream, route_match.route, route_id, &ip_str, &final_pool_key, domain_str,
+                    &upstream, route_match.route, route_id, &ip_str, &final_pool_key, domain_str, &conn_activity,
                 ).await
             }
         } else {
             self.forward_h1(
                 io, parts, body, upstream_headers, &upstream_path,
-                &upstream, route_match.route, route_id, &ip_str, &final_pool_key, domain_str,
+                &upstream, route_match.route, route_id, &ip_str, &final_pool_key, domain_str, &conn_activity,
             ).await
         };
         self.upstream_selector.connection_ended(&upstream_key);
@@ -806,6 +828,7 @@ impl HttpProxyService {
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
         domain: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
 
@@ -814,7 +837,7 @@ impl HttpProxyService {
             self.metrics.backend_pool_hit(&backend_key);
             return self.forward_h1_with_sender(
                 pooled_sender, parts, body, upstream_headers, upstream_path,
-                route, route_id, source_ip, pool_key, domain,
+                route, route_id, source_ip, pool_key, domain, conn_activity,
             ).await;
         }
 
@@ -837,7 +860,7 @@ impl HttpProxyService {
             }
         });
 
-        self.forward_h1_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, pool_key, domain).await
+        self.forward_h1_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, pool_key, domain, conn_activity).await
     }
 
     /// Common H1 forwarding logic used by both fresh and pooled paths.
@@ -853,6 +876,7 @@ impl HttpProxyService {
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
         domain: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         // Always use HTTP/1.1 for h1 backend connections (h2 incoming requests have version HTTP/2.0)
         let mut upstream_req = Request::builder()
@@ -871,7 +895,7 @@ impl HttpProxyService {
             route_id.map(|s| s.to_string()),
             Some(source_ip.to_string()),
             Direction::In,
-        );
+        ).with_connection_activity(Arc::clone(&conn_activity.last_activity), conn_activity.start);
         let boxed_body: BoxBody<Bytes, hyper::Error> = BoxBody::new(counting_req_body);
 
         let upstream_req = upstream_req.body(boxed_body).unwrap();
@@ -886,10 +910,17 @@ impl HttpProxyService {
             }
         };
 
-        // Return sender to pool (body streams lazily, sender is reusable once response head is received)
-        self.connection_pool.checkin_h1(pool_key.clone(), sender);
+        // Note: we do NOT return the sender to the pool here because the response body
+        // hasn't been fully streamed yet. Pooling a sender while its response body is still
+        // in-flight risks another request being dispatched on the same connection if is_ready()
+        // momentarily returns true between chunks. The sender is dropped after this scope,
+        // and the backend connection remains alive via the spawned conn driver task until
+        // the response body finishes streaming.
+        // For small/empty responses, the sender could theoretically be reused, but the safety
+        // of large streaming responses (e.g. 352MB Docker layers) takes priority.
+        drop(sender);
 
-        self.build_streaming_response(upstream_response, route, route_id, source_ip).await
+        self.build_streaming_response(upstream_response, route, route_id, source_ip, conn_activity).await
     }
 
     /// Forward request to backend via HTTP/2 with body streaming (fresh connection).
@@ -907,6 +938,7 @@ impl HttpProxyService {
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
         domain: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
         let exec = hyper_util::rt::TokioExecutor::new();
@@ -914,9 +946,9 @@ impl HttpProxyService {
         h2_builder
             .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
-            .keep_alive_timeout(std::time::Duration::from_secs(5))
-            .adaptive_window(true)
-            .initial_stream_window_size(2 * 1024 * 1024);
+            .keep_alive_timeout(std::time::Duration::from_secs(30))
+            .initial_stream_window_size(2 * 1024 * 1024)
+            .initial_connection_window_size(16 * 1024 * 1024);
         let (sender, conn): (
             hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
             hyper::client::conn::http2::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>, hyper_util::rt::TokioExecutor>,
@@ -942,7 +974,7 @@ impl HttpProxyService {
 
         // Clone sender for potential pool registration; register only after first request succeeds
         let sender_for_pool = sender.clone();
-        let result = self.forward_h2_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, Some(pool_key), domain).await;
+        let result = self.forward_h2_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, Some(pool_key), domain, conn_activity).await;
         if matches!(&result, Ok(ref resp) if resp.status() != StatusCode::BAD_GATEWAY) {
             self.connection_pool.register_h2(pool_key.clone(), sender_for_pool);
         }
@@ -964,6 +996,7 @@ impl HttpProxyService {
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
         domain: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         // Save retry state for bodyless requests (cheap: Method is an enum, HeaderMap clones Arc-backed Bytes)
         let retry_state = if body.is_end_stream() {
@@ -974,7 +1007,7 @@ impl HttpProxyService {
 
         let result = self.forward_h2_with_sender(
             sender, parts, body, upstream_headers, upstream_path,
-            route, route_id, source_ip, Some(pool_key), domain,
+            route, route_id, source_ip, Some(pool_key), domain, conn_activity,
         ).await;
 
         // If the request failed (502) and we can retry with an empty body, do so
@@ -985,7 +1018,7 @@ impl HttpProxyService {
                     "Stale pooled H2 sender, retrying with fresh connection");
                 return self.retry_h2_with_fresh_connection(
                     method, headers, upstream_path,
-                    pool_key, route, route_id, source_ip, domain,
+                    pool_key, route, route_id, source_ip, domain, conn_activity,
                 ).await;
             }
         }
@@ -1004,6 +1037,7 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         domain: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
 
@@ -1055,9 +1089,9 @@ impl HttpProxyService {
         h2_builder
             .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
-            .keep_alive_timeout(std::time::Duration::from_secs(5))
-            .adaptive_window(true)
-            .initial_stream_window_size(2 * 1024 * 1024);
+            .keep_alive_timeout(std::time::Duration::from_secs(30))
+            .initial_stream_window_size(2 * 1024 * 1024)
+            .initial_connection_window_size(16 * 1024 * 1024);
         let (mut sender, conn): (
             hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
             hyper::client::conn::http2::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>, hyper_util::rt::TokioExecutor>,
@@ -1108,7 +1142,7 @@ impl HttpProxyService {
             Ok(resp) => {
                 // Register in pool only after request succeeds
                 self.connection_pool.register_h2(pool_key.clone(), sender);
-                let result = self.build_streaming_response(resp, route, route_id, source_ip).await;
+                let result = self.build_streaming_response(resp, route, route_id, source_ip, conn_activity).await;
                 // Close the fresh backend connection (opened above)
                 self.metrics.backend_connection_closed(&backend_key);
                 result
@@ -1144,15 +1178,16 @@ impl HttpProxyService {
         pool_key: &crate::connection_pool::PoolKey,
         requested_host: Option<String>,
         domain: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let exec = hyper_util::rt::TokioExecutor::new();
         let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
         h2_builder
             .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
-            .keep_alive_timeout(std::time::Duration::from_secs(5))
-            .adaptive_window(true)
-            .initial_stream_window_size(2 * 1024 * 1024);
+            .keep_alive_timeout(std::time::Duration::from_secs(30))
+            .initial_stream_window_size(2 * 1024 * 1024)
+            .initial_connection_window_size(16 * 1024 * 1024);
         let handshake_result = tokio::time::timeout(
             self.connect_timeout,
             h2_builder.handshake(io),
@@ -1188,7 +1223,7 @@ impl HttpProxyService {
                         let fallback_io = TokioIo::new(fallback_backend);
                         let result = self.forward_h1(
                             fallback_io, parts, body, upstream_headers, upstream_path,
-                            upstream, route, route_id, source_ip, &h1_pool_key, domain,
+                            upstream, route, route_id, source_ip, &h1_pool_key, domain, conn_activity,
                         ).await;
                         self.metrics.backend_connection_closed(&bk);
                         result
@@ -1236,7 +1271,7 @@ impl HttpProxyService {
                     route_id.map(|s| s.to_string()),
                     Some(source_ip.to_string()),
                     Direction::In,
-                );
+                ).with_connection_activity(Arc::clone(&conn_activity.last_activity), conn_activity.start);
                 let boxed_body: BoxBody<Bytes, hyper::Error> = BoxBody::new(counting_req_body);
                 let upstream_req = upstream_req.body(boxed_body).unwrap();
 
@@ -1244,7 +1279,7 @@ impl HttpProxyService {
                     Ok(upstream_response) => {
                         // H2 works! Register sender in pool for multiplexed reuse
                         self.connection_pool.register_h2(pool_key.clone(), sender);
-                        self.build_streaming_response(upstream_response, route, route_id, source_ip).await
+                        self.build_streaming_response(upstream_response, route, route_id, source_ip, conn_activity).await
                     }
                     Err(e) => {
                         // H2 request failed — backend advertises h2 via ALPN but doesn't
@@ -1277,7 +1312,7 @@ impl HttpProxyService {
                                     let fallback_io = TokioIo::new(fallback_backend);
                                     let result = self.forward_h1_empty_body(
                                         fallback_io, method, headers, upstream_path,
-                                        route, route_id, source_ip, &h1_pool_key, domain,
+                                        route, route_id, source_ip, &h1_pool_key, domain, conn_activity,
                                     ).await;
                                     // Close the reconnected backend connection (opened in reconnect_backend)
                                     self.metrics.backend_connection_closed(&bk);
@@ -1326,7 +1361,7 @@ impl HttpProxyService {
                         let fallback_io = TokioIo::new(fallback_backend);
                         let result = self.forward_h1(
                             fallback_io, parts, body, upstream_headers, upstream_path,
-                            upstream, route, route_id, source_ip, &h1_pool_key, domain,
+                            upstream, route, route_id, source_ip, &h1_pool_key, domain, conn_activity,
                         ).await;
                         // Close the reconnected backend connection (opened in reconnect_backend)
                         self.metrics.backend_connection_closed(&bk);
@@ -1353,6 +1388,7 @@ impl HttpProxyService {
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
         domain: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
         let (mut sender, conn): (
@@ -1396,10 +1432,10 @@ impl HttpProxyService {
             }
         };
 
-        // Return sender to pool for keep-alive reuse
-        self.connection_pool.checkin_h1(pool_key.clone(), sender);
+        // Don't pool the sender while response body is still streaming (same safety as forward_h1_with_sender)
+        drop(sender);
 
-        self.build_streaming_response(upstream_response, route, route_id, source_ip).await
+        self.build_streaming_response(upstream_response, route, route_id, source_ip, conn_activity).await
     }
 
     /// Reconnect to a backend (used for H2→H1 fallback).
@@ -1470,6 +1506,7 @@ impl HttpProxyService {
         source_ip: &str,
         pool_key: Option<&crate::connection_pool::PoolKey>,
         domain: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         // Build absolute URI for H2 pseudo-headers (:scheme, :authority)
         // Use the requested domain as authority (not backend address) so :authority matches Host header
@@ -1498,7 +1535,7 @@ impl HttpProxyService {
             route_id.map(|s| s.to_string()),
             Some(source_ip.to_string()),
             Direction::In,
-        );
+        ).with_connection_activity(Arc::clone(&conn_activity.last_activity), conn_activity.start);
         let boxed_body: BoxBody<Bytes, hyper::Error> = BoxBody::new(counting_req_body);
 
         let upstream_req = upstream_req.body(boxed_body).unwrap();
@@ -1519,7 +1556,7 @@ impl HttpProxyService {
             }
         };
 
-        self.build_streaming_response(upstream_response, route, route_id, source_ip).await
+        self.build_streaming_response(upstream_response, route, route_id, source_ip, conn_activity).await
     }
 
     /// Build the client-facing response from an upstream response, streaming the body.
@@ -1532,6 +1569,7 @@ impl HttpProxyService {
         route: &rustproxy_config::RouteConfig,
         route_id: Option<&str>,
         source_ip: &str,
+        conn_activity: &ConnActivity,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let (resp_parts, resp_body) = upstream_response.into_parts();
 
@@ -1552,14 +1590,14 @@ impl HttpProxyService {
             route_id.map(|s| s.to_string()),
             Some(source_ip.to_string()),
             Direction::Out,
-        );
+        ).with_connection_activity(Arc::clone(&conn_activity.last_activity), conn_activity.start);
 
         let body: BoxBody<Bytes, hyper::Error> = BoxBody::new(counting_body);
 
         Ok(response.body(body).unwrap())
     }
 
-    /// Handle a WebSocket upgrade request.
+    /// Handle a WebSocket upgrade request (H1 Upgrade or H2 Extended CONNECT per RFC 8441).
     async fn handle_websocket_upgrade(
         &self,
         req: Request<Incoming>,
@@ -1570,6 +1608,8 @@ impl HttpProxyService {
         upstream_key: &str,
         cancel: CancellationToken,
         source_ip: &str,
+        is_h2: bool,
+        conn_activity: Option<ConnActivity>,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         use tokio::io::{AsyncReadExt, AsyncWriteExt};
 
@@ -1655,9 +1695,11 @@ impl HttpProxyService {
 
         let (parts, _body) = req.into_parts();
 
+        // H2 Extended CONNECT uses method=CONNECT, but the H1.1 backend expects GET
+        let backend_method = if is_h2 { "GET" } else { parts.method.as_str() };
         let mut raw_request = format!(
             "{} {} HTTP/1.1\r\n",
-            parts.method, upstream_path
+            backend_method, upstream_path
         );
 
         // Copy all original headers (preserving the client's Host header).
@@ -1685,6 +1727,23 @@ impl HttpProxyService {
             }
         }
 
+        // H2 Extended CONNECT doesn't carry H1 WebSocket handshake headers;
+        // inject them so the H1.1 backend can complete the upgrade.
+        if is_h2 {
+            if !parts.headers.contains_key("upgrade") {
+                raw_request.push_str("upgrade: websocket\r\n");
+            }
+            if !parts.headers.contains_key("connection") {
+                raw_request.push_str("connection: Upgrade\r\n");
+            }
+            if !parts.headers.contains_key("sec-websocket-version") {
+                raw_request.push_str("sec-websocket-version: 13\r\n");
+            }
+            if !parts.headers.contains_key("sec-websocket-key") {
+                raw_request.push_str("sec-websocket-key: dGhlIHNhbXBsZSBub25jZQ==\r\n");
+            }
+        }
+
         // Add standard reverse-proxy headers (X-Forwarded-*)
         {
             let original_host = parts.headers.get("host")
@@ -1787,8 +1846,12 @@ impl HttpProxyService {
             ));
         }
 
-        let mut client_resp = Response::builder()
-            .status(StatusCode::SWITCHING_PROTOCOLS);
+        // H1: 101 Switching Protocols; H2: 200 OK (RFC 8441 — hyper requires 2xx for Extended CONNECT upgrade)
+        let mut client_resp = if is_h2 {
+            Response::builder().status(StatusCode::OK)
+        } else {
+            Response::builder().status(StatusCode::SWITCHING_PROTOCOLS)
+        };
 
         if let Some(resp_headers) = client_resp.headers_mut() {
             for line in response_str.lines().skip(1) {
@@ -1799,6 +1862,17 @@ impl HttpProxyService {
                 if let Some((name, value)) = line.split_once(':') {
                     let name = name.trim();
                     let value = value.trim();
+                    // Skip hop-by-hop headers for H2 (forbidden by RFC 9113 §8.2.2)
+                    if is_h2 {
+                        let name_lower = name.to_lowercase();
+                        if name_lower == "upgrade" || name_lower == "connection"
+                            || name_lower == "sec-websocket-accept"
+                            || name_lower == "transfer-encoding"
+                            || name_lower == "keep-alive"
+                        {
+                            continue;
+                        }
+                    }
                     if let Ok(header_name) = hyper::header::HeaderName::from_bytes(name.as_bytes()) {
                         if let Ok(header_value) = hyper::header::HeaderValue::from_str(value) {
                             resp_headers.insert(header_name, header_value);
@@ -1839,6 +1913,11 @@ impl HttpProxyService {
             let last_activity = Arc::new(AtomicU64::new(0));
             let start = std::time::Instant::now();
 
+            // For H2 WebSocket: also update the connection-level activity tracker
+            // to prevent the idle watchdog from killing the H2 connection
+            let conn_act_c2u = conn_activity.as_ref().map(|ca| (Arc::clone(&ca.last_activity), ca.start));
+            let conn_act_u2c = conn_activity.as_ref().map(|ca| (Arc::clone(&ca.last_activity), ca.start));
+
             let la1 = Arc::clone(&last_activity);
             let c2u = tokio::spawn(async move {
                 let mut buf = vec![0u8; 65536];
@@ -1853,6 +1932,9 @@ impl HttpProxyService {
                     }
                     total += n as u64;
                     la1.store(start.elapsed().as_millis() as u64, Ordering::Relaxed);
+                    if let Some((ref ca, ca_start)) = conn_act_c2u {
+                        ca.store(ca_start.elapsed().as_millis() as u64, Ordering::Relaxed);
+                    }
                 }
                 let _ = uw.shutdown().await;
                 total
@@ -1872,6 +1954,9 @@ impl HttpProxyService {
                     }
                     total += n as u64;
                     la2.store(start.elapsed().as_millis() as u64, Ordering::Relaxed);
+                    if let Some((ref ca, ca_start)) = conn_act_u2c {
+                        ca.store(ca_start.elapsed().as_millis() as u64, Ordering::Relaxed);
+                    }
                 }
                 let _ = cw.shutdown().await;
                 total

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '25.10.7',
+  version: '25.11.2',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }