- Introduce TunnelSession that holds a single authenticated SendRequest
shared across all concurrent SOCKS5 streams via Arc<Mutex<>>
- Connector authenticates once on startup, then reuses the persistent
tunnel for all SOCKS5 CONNECT requests
- Listener /forward returns raw bytes (no HTTP parse/unparse overhead)
to preserve exact byte semantics for SOCKS5 TCP proxying
- Add stream counters (session-X) for logging and isolation tracking
- Add 5 new tests: sequential streams, concurrent streams with isolation,
stream counter increments, pre-auth rejection, and E2E concurrent SOCKS5
streams over a shared tunnel
- All 117 tests pass; E2E CLI validates 5 concurrent streams share one
persistent TLS connection (127.0.0.1:64216 in transcript)
Add HTTPS default tunnel endpoint and outbound connector using Rustls
with mTLS and an additional auth/session token.
- Add rustls, tokio-rustls, hyper, and related dependencies
- Implement TLS config builders (server/client) with cert validation
- Implement HTTPS tunnel listener with mTLS accept and auth handshake
- Implement HTTPS tunnel connector with server cert validation
- Add auth token loading from CLI value or file
- Add security gate state machine for tracking auth progression
- Fail closed for missing/invalid TLS config, cert mismatch, auth failures
- Port conflicts fail without fallback
- Reconnect revalidates all security gates
- 67 tests covering all validation assertions
