{"record":{"id":"2ef08bad99046bf2","repo":"xai-org/grok-build","slug":"proxy-connect-failed","errorCode":null,"errorMessage":"Proxy CONNECT failed: {}","messagePattern":"Proxy CONNECT failed: (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/agent/proxy.rs","lineNumber":170,"sourceCode":"\n    // 3. Send HTTP CONNECT.\n    let connect_req = format!(\n        \"CONNECT {target_host}:{target_port} HTTP/1.1\\r\\n\\\n         Host: {target_host}:{target_port}\\r\\n\\\n         \\r\\n\"\n    );\n    let (reader_half, mut writer_half) = stream.into_split();\n    writer_half.write_all(connect_req.as_bytes()).await?;\n    writer_half.flush().await?;\n\n    // 4. Read the status line from the proxy.\n    let mut reader = BufReader::new(reader_half);\n    let mut status_line = String::new();\n    reader.read_line(&mut status_line).await?;\n    debug!(status_line = %status_line.trim(), \"Proxy CONNECT response\");\n\n    if !status_line.starts_with(\"HTTP/1.1 200\") && !status_line.starts_with(\"HTTP/1.0 200\") {\n        anyhow::bail!(\"Proxy CONNECT failed: {}\", status_line.trim());\n    }\n\n    // Consume remaining response headers (until empty line).\n    loop {\n        let mut line = String::new();\n        reader.read_line(&mut line).await?;\n        if line.trim().is_empty() {\n            break;\n        }\n    }\n\n    // 5. Assert the BufReader's internal buffer is empty before reuniting.\n    // BufReader::read_line may have read ahead into its buffer. If extra\n    // bytes were consumed beyond the HTTP headers (e.g., from a proxy that\n    // eagerly forwards data or coalesced TCP segments), dropping them would\n    // corrupt the subsequent TLS handshake.\n    let remaining = reader.buffer();\n    if !remaining.is_empty() {","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/agent/proxy.rs#L152-L188","documentation":"open_connect_tunnel sends an HTTP CONNECT request through the configured proxy and requires the first response line to be HTTP/1.0 or HTTP/1.1 with status 200. Anything else (403, 407, 502, or a malformed line) is bailed as \"Proxy CONNECT failed: {status_line}\" — the proxy refused or could not establish the tunnel to the target host.","triggerScenarios":"Proxy responds to CONNECT with a non-200 status line — proxy auth required (407), target blocked by policy (403), proxy cannot reach the target (502/504), or a non-HTTP proxy endpoint replying with garbage.","commonSituations":"Missing proxy credentials (407 Proxy-Authentication-Required); corporate proxy ACLs blocking the relay host; pointing HTTPS_PROXY at a SOCKS proxy or plain HTTP port that doesn't support CONNECT; proxy outage.","solutions":["Read the status line in the message: 407 means add proxy credentials (e.g. http://user:pass@proxy:port in the proxy URL).","Confirm the proxy supports the CONNECT method and HTTPS tunneling (not SOCKS or plain-HTTP-only).","Ask network admin to allowlist the target relay host/port if the proxy returns 403.","Verify the proxy address/port in proxy environment variables or config are correct and reachable."],"exampleFix":"// before\nlet proxy = \"http://proxy.corp:3128\"; // 407: no creds\n// after\nlet proxy = \"http://user:password@proxy.corp:3128\";","handlingStrategy":"validation","validationCode":"// validate proxy config before connecting\nfn check_proxy(proxy_url: &str) -> Result<(), String> {\n    let u = url::Url::parse(proxy_url).map_err(|e| e.to_string())?;\n    if u.scheme() != \"http\" && u.scheme() != \"https\" {\n        return Err(format!(\"proxy scheme '{}' does not support CONNECT; use http(s)\", u.scheme()));\n    }\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":"match connect_via_proxy(target, &proxy).await {\n    Err(e) if e.to_string().starts_with(\"Proxy CONNECT failed\") => {\n        let status = extract_status(&e.to_string());\n        match status {\n            407 => return Err(anyhow!(\"proxy auth required: add user:pass to proxy URL\")),\n            403 => return Err(anyhow!(\"proxy blocks target host; request allowlisting\")),\n            _ => return Err(e),\n        }\n    }\n    other => other,\n}","preventionTips":["Use an HTTP(S) proxy that supports CONNECT — never point HTTPS_PROXY at a SOCKS proxy","Embed credentials in the proxy URL if the proxy requires authentication (407)","Ask network admins to allowlist relay hosts through corporate proxies","Test the tunnel early (curl -x proxy CONNECT) before deploying"],"tags":["proxy","connect-tunnel","network","https"],"backgroundTag":"proxy-connect-failed","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}