{"record":{"id":"94b0df379e2ea3de","repo":"xai-org/grok-build","slug":"proxy-sent-unexpected-byte-s-after-connect-res","errorCode":null,"errorMessage":"Proxy sent {} unexpected byte(s) after CONNECT response headers","messagePattern":"Proxy sent (.+?) unexpected byte\\(s\\) after CONNECT response headers","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/agent/proxy.rs","lineNumber":189,"sourceCode":"    }\n\n    // Consume remaining response headers (until empty line).\n    loop {\n        let mut line = String::new();\n        reader.read_line(&mut line).await?;\n        if line.trim().is_empty() {\n            break;\n        }\n    }\n\n    // 5. Assert the BufReader's internal buffer is empty before reuniting.\n    // BufReader::read_line may have read ahead into its buffer. If extra\n    // bytes were consumed beyond the HTTP headers (e.g., from a proxy that\n    // eagerly forwards data or coalesced TCP segments), dropping them would\n    // corrupt the subsequent TLS handshake.\n    let remaining = reader.buffer();\n    if !remaining.is_empty() {\n        anyhow::bail!(\n            \"Proxy sent {} unexpected byte(s) after CONNECT response headers\",\n            remaining.len()\n        );\n    }\n\n    // 6. Reunite the split halves back into a TcpStream.\n    let stream = reader.into_inner().reunite(writer_half)?;\n    Ok(stream)\n}\n\nasync fn tls_wrap(\n    stream: TcpStream,\n    server_name: &str,\n) -> anyhow::Result<tokio_rustls::client::TlsStream<TcpStream>> {\n    let connector = tokio_rustls::TlsConnector::from(xai_grok_extra_ca::rustls_client_config());\n    let dns_name = rustls::pki_types::ServerName::try_from(server_name.to_string())\n        .map_err(|e| anyhow::anyhow!(\"Invalid TLS server name '{server_name}': {e}\"))?;\n","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/agent/proxy.rs#L171-L207","documentation":"After reading the CONNECT response headers with BufReader::read_line, the code checks reader.buffer() for read-ahead bytes. A well-behaved proxy sends nothing after the header-terminating blank line until TLS begins; leftover bytes would corrupt the subsequent TLS handshake, so the tunnel is aborted with this error.","triggerScenarios":"The proxy (or a middlebox) eagerly forwarded application data or coalesced TCP segments so that bytes beyond the CONNECT response headers were already consumed into the BufReader when the header parse finished.","commonSituations":"Non-standard or buggy intermediary proxies; TLS-terminating middleboxes that inject data; security appliances that pre-send a banner; misconfigured proxy software that pipelines responses.","solutions":["Bypass the problematic proxy/middlebox for this host (NO_PROXY or direct connection).","Upgrade or fix the proxy software — this behavior violates the CONNECT tunneling contract (RFC 7231).","Check for TLS-inspection/security appliances intercepting the tunnel and add an exemption.","As a workaround, use a different proxy or the non-proxy connection path."],"exampleFix":"// before\nHTTPS_PROXY=http://legacy-proxy:3128 grok agent ...\n// after\nNO_PROXY=relay.example.com grok agent ...  # bypass buggy proxy","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"match connect_via_proxy(target, &proxy).await {\n    Err(e) if e.to_string().contains(\"unexpected byte(s) after CONNECT\") => {\n        eprintln!(\"proxy misbehaves (read-ahead data); bypassing proxy\");\n        connect_direct(target).await // fall back to no-proxy path\n    }\n    other => other,\n}","preventionTips":["Bypass known-buggy proxies/middleboxes with NO_PROXY for relay hosts","Exempt relay traffic from TLS-inspection/security appliances that inject data","Upgrade proxy software that pipelines or pre-sends data after CONNECT responses","Provide a direct-connection fallback when proxy tunneling fails"],"tags":["proxy","connect-tunnel","tls","protocol-violation"],"backgroundTag":"proxy-tunnel-corrupted","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}