{"record":{"id":"9b3f5e2ff7d745dc","repo":"openai/codex","slug":"invalid-network-proxy-attribution-frame","errorCode":null,"errorMessage":"invalid network proxy attribution frame","messagePattern":"invalid network proxy attribution frame","errorType":"exception","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/network-proxy/src/attribution.rs","lineNumber":88,"sourceCode":"        self.inner.serve(stream).await.map_err(Into::into)\n    }\n}\n\nasync fn read_attribution_token(stream: &mut TcpStream) -> Result<Option<String>, BoxError> {\n    let mut marker = [0_u8; 1];\n    let read = stream.stream.peek(&mut marker).await?;\n    if read == 0 {\n        return Err(io::Error::new(io::ErrorKind::UnexpectedEof, \"empty proxy connection\").into());\n    }\n    if marker[0] != ATTRIBUTION_FRAME_MAGIC[0] {\n        return Ok(None);\n    }\n\n    let token = tokio::time::timeout(ATTRIBUTION_FRAME_TIMEOUT, async {\n        let mut magic = [0_u8; ATTRIBUTION_FRAME_MAGIC.len()];\n        stream.read_exact(&mut magic).await?;\n        if &magic != ATTRIBUTION_FRAME_MAGIC {\n            return Err(io::Error::new(\n                io::ErrorKind::InvalidData,\n                \"invalid network proxy attribution frame\",\n            ));\n        }\n\n        let token_len = stream.read_u16().await? as usize;\n        if token_len == 0 || token_len > MAX_ATTRIBUTION_TOKEN_LEN {\n            return Err(io::Error::new(\n                io::ErrorKind::InvalidData,\n                \"invalid network proxy attribution token length\",\n            ));\n        }\n        let mut token = vec![0_u8; token_len];\n        stream.read_exact(&mut token).await?;\n        String::from_utf8(token).map_err(|_| {\n            io::Error::new(\n                io::ErrorKind::InvalidData,\n                \"network proxy attribution token is not UTF-8\",","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/network-proxy/src/attribution.rs#L70-L106","documentation":"The first byte on the connection was NUL -- the first byte of the 8-byte magic b\"\\0CDXPXY1\" -- so the ingress tried to read a full attribution frame, but the eight magic bytes did not match the constant. Rejected with io::ErrorKind::InvalidData. Meaning: the client speaks some other NUL-prefixed binary protocol, or wrote a corrupted, truncated, or wrong-version preface.","triggerScenarios":"A hand-rolled client writes a different magic (typo, stale constant, different protocol version); the preface write is split and the stream shifts; another binary protocol that happens to start with 0x00 is pointed at the ingress port.","commonSituations":"Reimplementing the frame format in another language instead of reusing write_attribution_frame; a magic-constant change between bridge and ingress builds (version skew); routing a non-codex NUL-first protocol to the proxy port.","solutions":["Stop hand-rolling the preface: call write_attribution_frame(writer, &token), which writes the exact magic constant.","Build the full frame (magic + length + token) in one buffer and write_all it once right after connect.","If builds are version-skewed, rebuild bridge and ingress from the same source so ATTRIBUTION_FRAME_MAGIC matches."],"exampleFix":"// before: hand-written magic with a typo\nwriter.write_all(b\"\\0CDXPXY2\")?; // wrong constant\n// after: use the shipped helper\ncodex_network_proxy::write_attribution_frame(&mut writer, &token)?;","handlingStrategy":"validation","validationCode":"// Do not hand-roll bytes; route every preface through the helper\nuse codex_network_proxy::write_attribution_frame;\nwrite_attribution_frame(&mut writer, &token)?; // writes the exact magic","typeGuard":null,"tryCatchPattern":"Match io::ErrorKind::InvalidData whose message contains 'invalid network proxy attribution frame': stop and inspect the client's preface bytes (wrong magic constant or version skew); retrying the same bytes will fail identically.","preventionTips":["Reuse write_attribution_frame instead of reimplementing the wire format.","Write the complete frame in one write_all after connect.","Rebuild bridge and ingress from the same revision so ATTRIBUTION_FRAME_MAGIC cannot drift."],"tags":["rust","codex","network-proxy","protocol","magic-bytes","invalid-data"],"backgroundTag":"protocol-magic-mismatch","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}