3.30.2

changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2025-03-10 - 3.30.2 - fix(classes.portproxy.ts)
+Adjust TLS keep-alive timeout to refresh certificate context.
+
+- Modified TLS keep-alive timeout for connections to 8 hours to refresh certificate context.
+- Updated timeout log messages for clarity on TLS certificate refresh.
+
+## 2025-03-10 - 3.30.1 - fix(PortProxy)
+Improve TLS keep-alive management and fix whitespace formatting
+
+- Implemented better handling for TLS keep-alive connections after sleep or long inactivity.
+- Reformatted whitespace for better readability and consistency.
+
+## 2025-03-08 - 3.30.0 - feat(PortProxy)
+Add advanced TLS keep-alive handling and system sleep detection
+
+- Implemented system sleep detection to maintain keep-alive connections.
+- Enhanced TLS keep-alive connections with extended timeout and sleep detection mechanisms.
+- Introduced automatic TLS state refresh after system wake-up to prevent connection drops.
+
 ## 2025-03-07 - 3.29.3 - fix(core)
 Fix functional errors in the proxy setup and enhance pnpm configuration
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "3.29.3",
+  "version": "3.30.2",
   "private": false,
   "description": "A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.",
   "main": "dist_ts/index.js",

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '3.29.3',
+  version: '3.30.2',
   description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.'
 }

ts/classes.portproxy.ts

@@ -10,7 +10,7 @@ export interface IDomainConfig {
   portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
   // Allow domain-specific timeout override
   connectionTimeout?: number; // Connection timeout override (ms)
-  
+
   // New properties for NetworkProxy integration
   useNetworkProxy?: boolean; // When true, forwards TLS connections to NetworkProxy
   networkProxyIndex?: number; // Optional index to specify which NetworkProxy to use (defaults to 0)
@@ -54,12 +54,12 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   // Rate limiting and security
   maxConnectionsPerIP?: number; // Maximum simultaneous connections from a single IP
   connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP
-  
+
   // Enhanced keep-alive settings
   keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
   keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
   extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms)
-  
+
   // New property for NetworkProxy integration
   networkProxies?: NetworkProxy[]; // Array of NetworkProxy instances to use for TLS termination
 }
@@ -90,16 +90,20 @@ interface IConnectionRecord {
   tlsHandshakeComplete: boolean; // Whether the TLS handshake is complete
   hasReceivedInitialData: boolean; // Whether initial data has been received
   domainConfig?: IDomainConfig; // Associated domain config for this connection
-  
+
   // Keep-alive tracking
   hasKeepAlive: boolean; // Whether keep-alive is enabled for this connection
   inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued
   incomingTerminationReason?: string | null; // Reason for incoming termination
   outgoingTerminationReason?: string | null; // Reason for outgoing termination
-  
+
   // New field for NetworkProxy tracking
   usingNetworkProxy?: boolean; // Whether this connection is using a NetworkProxy
   networkProxyIndex?: number; // Which NetworkProxy instance is being used
+
+  // Sleep detection fields
+  possibleSystemSleep?: boolean; // Flag to indicate a possible system sleep was detected
+  lastSleepDetection?: number; // Timestamp of the last sleep detection
 }
 
 /**
@@ -348,7 +352,7 @@ export class PortProxy {
   // Connection tracking by IP for rate limiting
   private connectionsByIP: Map<string, Set<string>> = new Map();
   private connectionRateByIP: Map<string, number[]> = new Map();
-  
+
   // New property to store NetworkProxy instances
   private networkProxies: NetworkProxy[] = [];
 
@@ -375,8 +379,8 @@ export class PortProxy {
 
       // Feature flags
       disableInactivityCheck: settingsArg.disableInactivityCheck || false,
-      enableKeepAliveProbes: settingsArg.enableKeepAliveProbes !== undefined 
-        ? settingsArg.enableKeepAliveProbes : true, // Enable by default
+      enableKeepAliveProbes:
+        settingsArg.enableKeepAliveProbes !== undefined ? settingsArg.enableKeepAliveProbes : true, // Enable by default
       enableDetailedLogging: settingsArg.enableDetailedLogging || false,
       enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
       enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false, // Disable randomization by default
@@ -384,13 +388,13 @@ export class PortProxy {
       // Rate limiting defaults
       maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100, // 100 connections per IP
       connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300, // 300 per minute
-      
+
       // Enhanced keep-alive settings
       keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended', // Extended by default
       keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6, // 6x normal inactivity timeout
       extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days
     };
-    
+
     // Store NetworkProxy instances if provided
     this.networkProxies = settingsArg.networkProxies || [];
   }
@@ -413,58 +417,66 @@ export class PortProxy {
     serverName?: string
   ): void {
     // Determine which NetworkProxy to use
-    const proxyIndex = domainConfig.networkProxyIndex !== undefined 
-      ? domainConfig.networkProxyIndex
-      : 0;
-      
+    const proxyIndex =
+      domainConfig.networkProxyIndex !== undefined ? domainConfig.networkProxyIndex : 0;
+
     // Validate the NetworkProxy index
     if (proxyIndex < 0 || proxyIndex >= this.networkProxies.length) {
-      console.log(`[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`);
+      console.log(
+        `[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`
+      );
       // Fall back to direct connection
-      return this.setupDirectConnection(connectionId, socket, record, domainConfig, serverName, initialData);
+      return this.setupDirectConnection(
+        connectionId,
+        socket,
+        record,
+        domainConfig,
+        serverName,
+        initialData
+      );
     }
-    
+
     const networkProxy = this.networkProxies[proxyIndex];
     const proxyPort = networkProxy.getListeningPort();
     const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
-    
+
     if (this.settings.enableDetailedLogging) {
       console.log(
         `[${connectionId}] Forwarding TLS connection to NetworkProxy[${proxyIndex}] at ${proxyHost}:${proxyPort}`
       );
     }
-    
+
     // Create a connection to the NetworkProxy
     const proxySocket = plugins.net.connect({
       host: proxyHost,
-      port: proxyPort
+      port: proxyPort,
     });
-    
+
     // Store the outgoing socket in the record
     record.outgoing = proxySocket;
     record.outgoingStartTime = Date.now();
     record.usingNetworkProxy = true;
     record.networkProxyIndex = proxyIndex;
-    
+
     // Set up error handlers
     proxySocket.on('error', (err) => {
       console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
       this.cleanupConnection(record, 'network_proxy_connect_error');
     });
-    
+
     // Handle connection to NetworkProxy
     proxySocket.on('connect', () => {
       if (this.settings.enableDetailedLogging) {
         console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
       }
-      
+
       // First send the initial data that contains the TLS ClientHello
       proxySocket.write(initialData);
-      
+
       // Now set up bidirectional piping between client and NetworkProxy
       socket.pipe(proxySocket);
       proxySocket.pipe(socket);
-      
+
       // Setup cleanup handlers
       proxySocket.on('close', () => {
         if (this.settings.enableDetailedLogging) {
@@ -472,18 +484,37 @@ export class PortProxy {
         }
         this.cleanupConnection(record, 'network_proxy_closed');
       });
-      
+
       socket.on('close', () => {
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Client connection closed after forwarding to NetworkProxy`);
+          console.log(
+            `[${connectionId}] Client connection closed after forwarding to NetworkProxy`
+          );
         }
         this.cleanupConnection(record, 'client_closed');
       });
-      
+
       // Update activity on data transfer
-      socket.on('data', () => this.updateActivity(record));
+      socket.on('data', (chunk: Buffer) => {
+        this.updateActivity(record);
+
+        // Check for potential TLS renegotiation or reconnection packets
+        if (chunk.length > 0 && chunk[0] === 22) {
+          // ContentType.handshake
+          if (this.settings.enableDetailedLogging) {
+            console.log(
+              `[${connectionId}] Detected potential TLS handshake data while connected to NetworkProxy`
+            );
+          }
+
+          // Let the NetworkProxy handle the TLS renegotiation
+          // Just update the activity timestamp to prevent timeouts
+          record.lastActivity = Date.now();
+        }
+      });
+
       proxySocket.on('data', () => this.updateActivity(record));
-      
+
       if (this.settings.enableDetailedLogging) {
         console.log(
           `[${connectionId}] TLS connection successfully forwarded to NetworkProxy[${proxyIndex}]`
@@ -491,7 +522,7 @@ export class PortProxy {
       }
     });
   }
-  
+
   /**
    * Sets up a direct connection to the target (original behavior)
    * This is used when NetworkProxy isn't configured or as a fallback
@@ -568,11 +599,11 @@ export class PortProxy {
 
     // Apply socket optimizations
     targetSocket.setNoDelay(this.settings.noDelay);
-    
+
     // Apply keep-alive settings to the outgoing connection as well
     if (this.settings.keepAlive) {
       targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
-      
+
       // Apply enhanced TCP keep-alive options if enabled
       if (this.settings.enableKeepAliveProbes) {
         try {
@@ -585,7 +616,9 @@ export class PortProxy {
         } catch (err) {
           // Ignore errors - these are optional enhancements
           if (this.settings.enableDetailedLogging) {
-            console.log(`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`);
+            console.log(
+              `[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`
+            );
           }
         }
       }
@@ -642,19 +675,21 @@ export class PortProxy {
       // For keep-alive connections, just log a warning instead of closing
       if (record.hasKeepAlive) {
         console.log(
-          `[${connectionId}] Timeout event on incoming keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+          `[${connectionId}] Timeout event on incoming keep-alive connection from ${
+            record.remoteIP
+          } after ${plugins.prettyMs(
             this.settings.socketTimeout || 3600000
           )}. Connection preserved.`
         );
         // Don't close the connection - just log
         return;
       }
-      
+
       // For non-keep-alive connections, proceed with normal cleanup
       console.log(
-        `[${connectionId}] Timeout on incoming side from ${record.remoteIP} after ${plugins.prettyMs(
-          this.settings.socketTimeout || 3600000
-        )}`
+        `[${connectionId}] Timeout on incoming side from ${
+          record.remoteIP
+        } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
       );
       if (record.incomingTerminationReason === null) {
         record.incomingTerminationReason = 'timeout';
@@ -667,19 +702,21 @@ export class PortProxy {
       // For keep-alive connections, just log a warning instead of closing
       if (record.hasKeepAlive) {
         console.log(
-          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${
+            record.remoteIP
+          } after ${plugins.prettyMs(
             this.settings.socketTimeout || 3600000
           )}. Connection preserved.`
         );
         // Don't close the connection - just log
         return;
       }
-      
+
       // For non-keep-alive connections, proceed with normal cleanup
       console.log(
-        `[${connectionId}] Timeout on outgoing side from ${record.remoteIP} after ${plugins.prettyMs(
-          this.settings.socketTimeout || 3600000
-        )}`
+        `[${connectionId}] Timeout on outgoing side from ${
+          record.remoteIP
+        } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
       );
       if (record.outgoingTerminationReason === null) {
         record.outgoingTerminationReason = 'timeout';
@@ -693,9 +730,11 @@ export class PortProxy {
       // Disable timeouts completely for immortal connections
       socket.setTimeout(0);
       targetSocket.setTimeout(0);
-      
+
       if (this.settings.enableDetailedLogging) {
-        console.log(`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`);
+        console.log(
+          `[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`
+        );
       }
     } else {
       // Set normal timeouts for other connections
@@ -725,9 +764,7 @@ export class PortProxy {
         const combinedData = Buffer.concat(record.pendingData);
         targetSocket.write(combinedData, (err) => {
           if (err) {
-            console.log(
-              `[${connectionId}] Error writing pending data to target: ${err.message}`
-            );
+            console.log(`[${connectionId}] Error writing pending data to target: ${err.message}`);
             return this.initiateCleanupOnce(record, 'write_error');
           }
 
@@ -746,7 +783,9 @@ export class PortProxy {
                     ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
                     : ''
                 }` +
-                ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+                ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+                  record.hasKeepAlive ? 'Yes' : 'No'
+                }`
             );
           } else {
             console.log(
@@ -777,7 +816,9 @@ export class PortProxy {
                   ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
                   : ''
               }` +
-              ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+              ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+                record.hasKeepAlive ? 'Yes' : 'No'
+              }`
           );
         } else {
           console.log(
@@ -827,52 +868,91 @@ export class PortProxy {
       if (record.cleanupTimer) {
         clearTimeout(record.cleanupTimer);
       }
-      
+
       // For immortal keep-alive connections, skip setting a timeout completely
       if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`);
+          console.log(
+            `[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`
+          );
         }
         // No cleanup timer for immortal connections
-      } 
-      // For extended keep-alive connections, use extended timeout
-      else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
-        const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
-        const safeTimeout = ensureSafeTimeout(extendedTimeout);
-        
+      }
+      // For TLS keep-alive connections, use a moderately extended timeout
+      // but not too long to prevent certificate issues
+      else if (record.hasKeepAlive && record.isTLS) {
+        // Use a shorter timeout for TLS connections to ensure certificate contexts are refreshed periodically
+        // This prevents issues with stale certificates in browser tabs that have been idle for a long time
+        const tlsKeepAliveTimeout = 8 * 60 * 60 * 1000; // 8 hours for TLS keep-alive - reduced from 14 days
+        const safeTimeout = ensureSafeTimeout(tlsKeepAliveTimeout);
+
         record.cleanupTimer = setTimeout(() => {
           console.log(
-            `[${connectionId}] Keep-alive connection from ${record.remoteIP} exceeded extended lifetime (${plugins.prettyMs(
-              extendedTimeout
-            )}), forcing cleanup.`
+            `[${connectionId}] TLS keep-alive connection from ${
+              record.remoteIP
+            } exceeded max lifetime (${plugins.prettyMs(
+              tlsKeepAliveTimeout
+            )}), forcing cleanup to refresh certificate context.`
           );
-          this.initiateCleanupOnce(record, 'extended_lifetime');
+          this.initiateCleanupOnce(record, 'tls_certificate_refresh');
         }, safeTimeout);
-        
+
         // Make sure timeout doesn't keep the process alive
         if (record.cleanupTimer.unref) {
           record.cleanupTimer.unref();
         }
-        
+
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(extendedTimeout)}`);
+          console.log(
+            `[${connectionId}] TLS keep-alive connection with certificate refresh protection, lifetime: ${plugins.prettyMs(
+              tlsKeepAliveTimeout
+            )}`
+          );
+        }
+      }
+      // For extended keep-alive connections, use extended timeout
+      else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
+        const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
+        const safeTimeout = ensureSafeTimeout(extendedTimeout);
+
+        record.cleanupTimer = setTimeout(() => {
+          console.log(
+            `[${connectionId}] Keep-alive connection from ${
+              record.remoteIP
+            } exceeded extended lifetime (${plugins.prettyMs(extendedTimeout)}), forcing cleanup.`
+          );
+          this.initiateCleanupOnce(record, 'extended_lifetime');
+        }, safeTimeout);
+
+        // Make sure timeout doesn't keep the process alive
+        if (record.cleanupTimer.unref) {
+          record.cleanupTimer.unref();
+        }
+
+        if (this.settings.enableDetailedLogging) {
+          console.log(
+            `[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(
+              extendedTimeout
+            )}`
+          );
         }
       }
       // For standard connections, use normal timeout
       else {
         // Use domain-specific timeout if available, otherwise use default
-        const connectionTimeout = record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
+        const connectionTimeout =
+          record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
         const safeTimeout = ensureSafeTimeout(connectionTimeout);
-        
+
         record.cleanupTimer = setTimeout(() => {
           console.log(
-            `[${connectionId}] Connection from ${record.remoteIP} exceeded max lifetime (${plugins.prettyMs(
-              connectionTimeout
-            )}), forcing cleanup.`
+            `[${connectionId}] Connection from ${
+              record.remoteIP
+            } exceeded max lifetime (${plugins.prettyMs(connectionTimeout)}), forcing cleanup.`
           );
           this.initiateCleanupOnce(record, 'connection_timeout');
         }, safeTimeout);
-        
+
         // Make sure timeout doesn't keep the process alive
         if (record.cleanupTimer.unref) {
           record.cleanupTimer.unref();
@@ -950,6 +1030,100 @@ export class PortProxy {
     this.terminationStats[side][reason] = (this.terminationStats[side][reason] || 0) + 1;
   }
 
+  /**
+   * Update connection activity timestamp with sleep detection
+   */
+  private updateActivity(record: IConnectionRecord): void {
+    // Get the current time
+    const now = Date.now();
+
+    // Check if there was a large time gap that suggests system sleep
+    if (record.lastActivity > 0) {
+      const timeDiff = now - record.lastActivity;
+
+      // If time difference is very large (> 30 minutes) and this is a keep-alive connection,
+      // this might indicate system sleep rather than just inactivity
+      if (timeDiff > 30 * 60 * 1000 && record.hasKeepAlive) {
+        if (this.settings.enableDetailedLogging) {
+          console.log(
+            `[${record.id}] Detected possible system sleep for ${plugins.prettyMs(timeDiff)}. ` +
+              `Handling keep-alive connection after long inactivity.`
+          );
+        }
+
+        // For TLS keep-alive connections after sleep/long inactivity, force close
+        // to make browser establish a new connection with fresh certificate context
+        if (record.isTLS && record.tlsHandshakeComplete) {
+          if (timeDiff > 4 * 60 * 60 * 1000) {
+            // If inactive for more than 4 hours
+            console.log(
+              `[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
+                `Closing to force new connection with fresh certificate.`
+            );
+            return this.initiateCleanupOnce(record, 'certificate_refresh_needed');
+          } else {
+            // For shorter inactivity periods, try to refresh the TLS state
+            this.refreshTlsStateAfterSleep(record);
+          }
+        }
+
+        // Mark that we detected sleep
+        record.possibleSystemSleep = true;
+        record.lastSleepDetection = now;
+      }
+    }
+
+    // Update the activity timestamp
+    record.lastActivity = now;
+
+    // Clear any inactivity warning
+    if (record.inactivityWarningIssued) {
+      record.inactivityWarningIssued = false;
+    }
+  }
+
+  /**
+   * Refresh TLS state after sleep detection
+   */
+  private refreshTlsStateAfterSleep(record: IConnectionRecord): void {
+    // Skip if we're using a NetworkProxy as it handles its own TLS state
+    if (record.usingNetworkProxy) {
+      return;
+    }
+
+    try {
+      // For outgoing connections that might need to be refreshed
+      if (record.outgoing && !record.outgoing.destroyed) {
+        // Check how long this connection has been established
+        const connectionAge = Date.now() - record.incomingStartTime;
+        const hourInMs = 60 * 60 * 1000;
+
+        // For TLS browser connections that are very old, it's better to force a new connection
+        // rather than trying to refresh the state, to avoid certificate issues
+        if (record.isTLS && record.hasKeepAlive && connectionAge > 12 * hourInMs) {
+          console.log(
+            `[${record.id}] Long-lived TLS connection (${plugins.prettyMs(connectionAge)}). ` +
+              `Closing to ensure proper certificate handling on browser reconnect.`
+          );
+          return this.initiateCleanupOnce(record, 'certificate_context_refresh');
+        }
+
+        // For newer connections, try to send a refresh packet
+        record.outgoing.write(Buffer.alloc(0));
+
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${record.id}] Sent refresh packet after sleep detection`);
+        }
+      }
+    } catch (err) {
+      console.log(`[${record.id}] Error refreshing TLS state: ${err}`);
+
+      // If we hit an error, it's likely the connection is already broken
+      // Force cleanup to ensure browser reconnects cleanly
+      return this.initiateCleanupOnce(record, 'tls_refresh_error');
+    }
+  }
+
   /**
    * Cleans up a connection record.
    * Destroys both incoming and outgoing sockets, clears timers, and removes the record.
@@ -1047,7 +1221,9 @@ export class PortProxy {
             ` Duration: ${plugins.prettyMs(
               duration
             )}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
-            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` +
+            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+              record.hasKeepAlive ? 'Yes' : 'No'
+            }` +
             `${record.usingNetworkProxy ? `, NetworkProxy: ${record.networkProxyIndex}` : ''}`
         );
       } else {
@@ -1058,18 +1234,6 @@ export class PortProxy {
     }
   }
 
-  /**
-   * Update connection activity timestamp
-   */
-  private updateActivity(record: IConnectionRecord): void {
-    record.lastActivity = Date.now();
-    
-    // Clear any inactivity warning
-    if (record.inactivityWarningIssued) {
-      record.inactivityWarningIssued = false;
-    }
-  }
-
   /**
    * Get target IP with round-robin support
    */
@@ -1082,7 +1246,7 @@ export class PortProxy {
     }
     return this.settings.targetIP!;
   }
-  
+
   /**
    * Initiates cleanup once for a connection
    */
@@ -1090,12 +1254,15 @@ export class PortProxy {
     if (this.settings.enableDetailedLogging) {
       console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`);
     }
-    
-    if (record.incomingTerminationReason === null || record.incomingTerminationReason === undefined) {
+
+    if (
+      record.incomingTerminationReason === null ||
+      record.incomingTerminationReason === undefined
+    ) {
       record.incomingTerminationReason = reason;
       this.incrementTerminationStat('incoming', reason);
     }
-    
+
     this.cleanupConnection(record, reason);
   }
 
@@ -1219,7 +1386,7 @@ export class PortProxy {
 
       // Apply socket optimizations
       socket.setNoDelay(this.settings.noDelay);
-      
+
       // Create a unique connection ID and record
       const connectionId = generateConnectionId();
       const connectionRecord: IConnectionRecord = {
@@ -1243,16 +1410,19 @@ export class PortProxy {
         hasKeepAlive: false, // Will set to true if keep-alive is applied
         incomingTerminationReason: null,
         outgoingTerminationReason: null,
-        
+
         // Initialize NetworkProxy tracking fields
-        usingNetworkProxy: false
+        usingNetworkProxy: false,
+
+        // Initialize sleep detection fields
+        possibleSystemSleep: false,
       };
-      
+
       // Apply keep-alive settings if enabled
       if (this.settings.keepAlive) {
         socket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
         connectionRecord.hasKeepAlive = true; // Mark connection as having keep-alive
-        
+
         // Apply enhanced TCP keep-alive options if enabled
         if (this.settings.enableKeepAliveProbes) {
           try {
@@ -1266,7 +1436,9 @@ export class PortProxy {
           } catch (err) {
             // Ignore errors - these are optional enhancements
             if (this.settings.enableDetailedLogging) {
-              console.log(`[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`);
+              console.log(
+                `[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`
+              );
             }
           }
         }
@@ -1279,8 +1451,8 @@ export class PortProxy {
       if (this.settings.enableDetailedLogging) {
         console.log(
           `[${connectionId}] New connection from ${remoteIP} on port ${localPort}. ` +
-          `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
-          `Active connections: ${this.connectionRecords.size}`
+            `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
+            `Active connections: ${this.connectionRecords.size}`
         );
       } else {
         console.log(
@@ -1418,12 +1590,12 @@ export class PortProxy {
               )}`
             );
           }
-          
+
           // Check if we should forward this to a NetworkProxy
           if (
-            isTlsHandshakeDetected && 
-            domainConfig.useNetworkProxy === true && 
-            initialChunk && 
+            isTlsHandshakeDetected &&
+            domainConfig.useNetworkProxy === true &&
+            initialChunk &&
             this.networkProxies.length > 0
           ) {
             return this.forwardToNetworkProxy(
@@ -1661,11 +1833,11 @@ export class PortProxy {
         } else {
           nonTlsConnections++;
         }
-        
+
         if (record.hasKeepAlive) {
           keepAliveConnections++;
         }
-        
+
         if (record.usingNetworkProxy) {
           networkProxyConnections++;
         }
@@ -1706,35 +1878,80 @@ export class PortProxy {
         }
 
         // Skip inactivity check if disabled or for immortal keep-alive connections
-        if (!this.settings.disableInactivityCheck && 
-            !(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')) {
-          
+        if (
+          !this.settings.disableInactivityCheck &&
+          !(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')
+        ) {
           const inactivityTime = now - record.lastActivity;
-          
+
+          // Special handling for TLS keep-alive connections
+          if (
+            record.hasKeepAlive &&
+            record.isTLS &&
+            inactivityTime > this.settings.inactivityTimeout! / 2
+          ) {
+            // For TLS keep-alive connections that are getting stale, try to refresh before closing
+            if (!record.inactivityWarningIssued) {
+              console.log(
+                `[${id}] TLS keep-alive connection from ${
+                  record.remoteIP
+                } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                  `Attempting to preserve connection.`
+              );
+
+              // Set warning flag but give a much longer grace period for TLS connections
+              record.inactivityWarningIssued = true;
+
+              // For TLS connections, extend the last activity time considerably
+              // This gives browsers more time to re-establish the connection properly
+              record.lastActivity = now - this.settings.inactivityTimeout! / 3;
+
+              // Try to stimulate the connection with a probe packet
+              if (record.outgoing && !record.outgoing.destroyed) {
+                try {
+                  // For TLS connections, send a proper TLS heartbeat-like packet
+                  // This is just a small empty buffer that won't affect the TLS session
+                  record.outgoing.write(Buffer.alloc(0));
+
+                  if (this.settings.enableDetailedLogging) {
+                    console.log(`[${id}] Sent TLS keep-alive probe packet`);
+                  }
+                } catch (err) {
+                  console.log(`[${id}] Error sending TLS probe packet: ${err}`);
+                }
+              }
+
+              // Don't proceed to the normal inactivity check logic
+              continue;
+            }
+          }
+
           // Use extended timeout for extended-treatment keep-alive connections
           let effectiveTimeout = this.settings.inactivityTimeout!;
           if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
             const multiplier = this.settings.keepAliveInactivityMultiplier || 6;
             effectiveTimeout = effectiveTimeout * multiplier;
           }
-          
+
           if (inactivityTime > effectiveTimeout && !record.connectionClosed) {
             // For keep-alive connections, issue a warning first
             if (record.hasKeepAlive && !record.inactivityWarningIssued) {
               console.log(
-                `[${id}] Warning: Keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
-                `Will close in 10 minutes if no activity.`
+                `[${id}] Warning: Keep-alive connection from ${
+                  record.remoteIP
+                } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                  `Will close in 10 minutes if no activity.`
               );
-              
+
               // Set warning flag and add grace period
               record.inactivityWarningIssued = true;
               record.lastActivity = now - (effectiveTimeout - 600000);
-              
+
               // Try to stimulate activity with a probe packet
               if (record.outgoing && !record.outgoing.destroyed) {
                 try {
                   record.outgoing.write(Buffer.alloc(0));
-                  
+
                   if (this.settings.enableDetailedLogging) {
                     console.log(`[${id}] Sent probe packet to test keep-alive connection`);
                   }
@@ -1743,18 +1960,48 @@ export class PortProxy {
                 }
               }
             } else {
-              // For non-keep-alive or after warning, close the connection
-              console.log(
-                `[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
-                `for ${plugins.prettyMs(inactivityTime)}.` +
-                (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
-              );
-              this.cleanupConnection(record, 'inactivity');
+              // MODIFIED: For TLS connections, be more lenient before closing
+              // For TLS browser connections, we need to handle certificate context properly
+              if (record.isTLS && record.hasKeepAlive) {
+                // For very long inactivity, it's better to close the connection
+                // so the browser establishes a new one with a fresh certificate context
+                if (inactivityTime > 6 * 60 * 60 * 1000) {
+                  // 6 hours
+                  console.log(
+                    `[${id}] TLS keep-alive connection from ${
+                      record.remoteIP
+                    } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                      `Closing to ensure proper certificate handling on browser reconnect.`
+                  );
+                  this.cleanupConnection(record, 'tls_certificate_refresh');
+                } else {
+                  // For shorter inactivity periods, add grace period
+                  console.log(
+                    `[${id}] TLS keep-alive connection from ${
+                      record.remoteIP
+                    } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                      `Adding extra grace period.`
+                  );
+
+                  // Give additional time for browsers to reconnect properly
+                  record.lastActivity = now - effectiveTimeout / 2;
+                }
+              } else {
+                // For non-keep-alive or after warning, close the connection
+                console.log(
+                  `[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
+                    `for ${plugins.prettyMs(inactivityTime)}.` +
+                    (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
+                );
+                this.cleanupConnection(record, 'inactivity');
+              }
             }
           } else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) {
             // If activity detected after warning, clear the warning
             if (this.settings.enableDetailedLogging) {
-              console.log(`[${id}] Connection activity detected after inactivity warning, resetting warning`);
+              console.log(
+                `[${id}] Connection activity detected after inactivity warning, resetting warning`
+              );
             }
             record.inactivityWarningIssued = false;
           }
@@ -1903,4 +2150,4 @@ export class PortProxy {
 
     console.log('PortProxy shutdown complete.');
   }
-}
+}