gastownhall/beads · warning

authenticated proxy data port %d is not accepting connection

Error message

authenticated proxy data port %d is not accepting connections

What it means

readAndDial raises this when the pidfile identity is fully authenticated (the proxy answered its authenticated control-port Identify handshake and all fields matched) but its recorded data port refuses TCP connections within identityProbeTimeout. The proxy is logically the right one but is not actually serving, so it is classified adoptionIdentityMismatch rather than adopted.

Source

Thrown at internal/storage/dbproxy/proxy/endpoint.go:640

		reply.RootID != pf.RootID ||
		reply.PID != pf.Pid ||
		reply.Birth != pf.Birth ||
		reply.DataPort != pf.Port ||
		reply.ControlPort != pf.ControlPort ||
		reply.UpstreamID != pf.UpstreamID {
		return adoptionResult{
			status:  adoptionIdentityMismatch,
			pidfile: pf,
			err:     errors.New("authenticated proxy identity does not match its pidfile or workspace"),
		}
	}

	ep := Endpoint{Host: "127.0.0.1", Port: pf.Port}
	if !probePort(ep, identityProbeTimeout) {
		return adoptionResult{
			status:  adoptionIdentityMismatch,
			pidfile: pf,
			err:     fmt.Errorf("authenticated proxy data port %d is not accepting connections", pf.Port),
		}
	}
	return adoptionResult{status: adoptionAdopted, endpoint: ep, pidfile: pf}
}

func probePort(ep Endpoint, timeout time.Duration) bool {
	conn, err := net.DialTimeout("tcp", ep.Address(), timeout)
	if err != nil {
		return false
	}
	_ = conn.Close()
	return true
}

func isMalformedPIDFileError(err error) bool {
	var syntaxErr *json.SyntaxError
	var typeErr *json.UnmarshalTypeError
	return errors.As(err, &syntaxErr) || errors.As(err, &typeErr)

View on GitHub (pinned to 71377f2769)

Solutions

1. Retry after a moment — a proxy in graceful shutdown will be replaced by a fresh spawn on the next bd command
2. Verify the data port is bound: ss -ltnp | grep <port> or netstat -ano on Windows
3. Check local firewall/VPN rules for loopback TCP on that port
4. If persistent, kill the stale proxy process (pid from pidfile) and let bd quarantine the record and spawn a new proxy

Example fix

// before
if !probePort(ep, identityProbeTimeout) {
    return adoptionResult{status: adoptionIdentityMismatch, err: fmt.Errorf("authenticated proxy data port %d is not accepting connections", pf.Port)}
}
// after (caller retries once before treating as mismatch)
if !probePort(ep, identityProbeTimeout) {
    time.Sleep(200 * time.Millisecond)
    if !probePort(ep, identityProbeTimeout) {
        return adoptionResult{status: adoptionIdentityMismatch, err: fmt.Errorf("authenticated proxy data port %d is not accepting connections", pf.Port)}
    }
}

// before relying on an adopted endpoint
ep := Endpoint{Host: "127.0.0.1", Port: pf.Port}
if !probePort(ep, 500*time.Millisecond) {
    return errors.New("proxy data port not accepting; refusing to adopt")
}

discovery := readAndDial(root)
if discovery.status == adoptionIdentityMismatch {
    if pe, ok := discovery.err.(*portProbeError); ok && pe.retryable() {
        time.Sleep(250 * time.Millisecond)
        discovery = readAndDial(root)
    }
}

When it happens

Trigger: After a successful identity.Identify on the control port, probePort({127.0.0.1, pf.Port}) fails — net.DialTimeout cannot connect to the proxy's data port within the probe timeout.

Common situations: Proxy is mid-shutdown (control handler alive, listener already closed); firewall/VPN blocking the data port but not the control port; port hijacked by another process that answered control? — no, here control matched so most likely the data listener just closed or is momentarily saturated; very short timeouts under heavy load.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• --proxied-server-port must be between 1 and 65535, got %d
• ensureProxiedServerConfig: pick free port: %w
• ExternalDoltConfig: Port %d out of range [1, 65535]
• allocating ephemeral port: %w
• identity: dial control listener: %w

AI-assisted analysis of gastownhall/beads@71377f2769 (2026-08-30). Data as JSON: /api/errors/992e7edc28523b75. Report an issue: GitHub.