fix: unmask SOCKS5 E2E curl failures in CI and assert response content

The minimal E2E in ci.yml was masking curl/SOCKS forwarding failures
with '|| true' and piping through 'head', so tunnel failures were
silently ignored and CI always reported success.

Changes:
- Remove '|| true' from the curl/SOCKS5 forwarding test
- Capture curl exit code and fail CI if non-zero
- Assert HTTP 200 status code from the response
- Assert response body contains expected HTTP server content
- Use cross-platform 'sed' instead of 'head -n -1' (BSD/macOS)
- Also unmask the HTTP target health check
- Preserve existing cross-platform cleanup trap and helpers

.github/workflows/ci.yml

@@ -226,7 +226,14 @@ jobs:
           sleep 1
 
           # Verify target is up
-          curl -sf "http://127.0.0.1:$TARGET_PORT/" > /dev/null || true
+          set +e
+          curl -sf "http://127.0.0.1:$TARGET_PORT/" > /dev/null
+          TARGET_CHECK=$?
+          set -e
+          if [ "$TARGET_CHECK" -ne 0 ]; then
+            echo "ERROR: HTTP target on port $TARGET_PORT is not responding"
+            exit 1
+          fi
 
           # 3. Start listener (background)
           $RUN listen \
@@ -249,8 +256,38 @@ jobs:
           CONNECTOR_PID=$!
           sleep 3
 
-          # 5. Test SOCKS5 forwarding
+          # 5. Test SOCKS5 forwarding through the tunnel
-          RESULT=$(curl -sf --proxy "socks5h://127.0.0.1:$SOCKS_PORT" "http://127.0.0.1:$TARGET_PORT/" 2>&1 | head -5 || true)
+          # Do NOT mask failures with || true - CI must fail if tunnel does not forward traffic
-          echo "E2E response: $RESULT"
+          set +e
+          RESPONSE=$(curl -s -w "\n%{http_code}" --proxy "socks5h://127.0.0.1:$SOCKS_PORT" "http://127.0.0.1:$TARGET_PORT/")
+          CURL_EXIT=$?
+          set -e
+
+          if [ "$CURL_EXIT" -ne 0 ]; then
+            echo "ERROR: curl through SOCKS5 proxy failed with exit code $CURL_EXIT"
+            echo "Response: $RESPONSE"
+            exit 1
+          fi
+
+          # Extract HTTP status code (last line) and response body
+          # Note: head -n -1 is not portable (fails on macOS BSD), use sed instead
+          HTTP_STATUS=$(echo "$RESPONSE" | tail -n 1)
+          RESPONSE_BODY=$(echo "$RESPONSE" | sed '$ d')
+
+          echo "E2E HTTP status: $HTTP_STATUS"
+          echo "E2E response preview: ${RESPONSE_BODY:0:200}"
+
+          # Assert HTTP 200
+          if [ "$HTTP_STATUS" != "200" ]; then
+            echo "ERROR: Expected HTTP 200, got $HTTP_STATUS"
+            exit 1
+          fi
+
+          # Assert response contains expected content from Python http.server
+          if ! echo "$RESPONSE_BODY" | grep -qi "directory listing\|<html"; then
+            echo "ERROR: Response content does not match expected HTTP server output"
+            echo "Body preview: ${RESPONSE_BODY:0:500}"
+            exit 1
+          fi
 
           echo "E2E test passed on ${{ matrix.os }}"