[cppla]

Summary

• Sanitize upstream informational response headers before the cover reverse proxy forwards them, retaining ordinary Link hints and existing streaming/trace/writer behavior.
• Let H3 TCP CONNECT and CONNECT-UDP consume up to five nonterminal informational responses before checking the unchanged final signed proof. Reject excess hints without restarting the setup deadline or closing the shared intermediate body.
• Add real H1/H2/H3 cover regressions, exact helper boundaries, signed bootstrap/continuation and failure controls, and real successful TCP payload/half-close plus UDP echo/reuse coverage.
• Document source-build behavior separately from the existing v1.0.1 binaries.

Validation

• make check and full make race passed on the frozen ten-file change.
• Focused race checks repeated three times passed for helper units, listener/auth/limit/deadline/real-success paths, H3 cover, and existing Alt-Svc controls.
• Same frozen listener/cover tests against prior production reproduce the defects; H2 and no-hint positive controls still pass. Negative controls fail at the intended runtime oracles, not compilation.
• Offline Linux/arm64 isolated cached-image tests passed: complete cover package (14 top-level), 11 new tunnel tests repeated three times, and 23 existing controls. Actual executable names and RUN multisets checked; source/compiler/binary manifests unchanged, both owned containers removed. Linux tests are CGO-disabled, not race tests.
• Independent production/auth/oracle/lifecycle review found no required correction.

Boundaries

No dependencies, protocol, default timeout, version, release or tag changed. The H3 helper follows the pinned dependency's own complete-client response loop despite conflicting low-level method documentation; real multi-HEADERS tests protect dependency upgrades. This fixes specific compatibility and metadata filtering issues, not a claim of traffic equivalence or identification resistance. No large capture campaign or remote deployment was performed.

Exact head checks

Head 84e8d063d2a0725894364aabb84ec93bd95bcd48, first attempts all successful: CI (11 jobs), CodeQL, Linux netem integration. Container integration and OCI export, plus the netem suite, have explicit successful runtime logs. Automated review reported no findings; this is not human approval.

Merged main verification

Squash/main 9e2a617200e4c634d293da5524f49ae5abfc19d1 has the identical tested source tree. First push attempts all successful: CI (11 jobs), CodeQL, Linux netem integration. Main OCI/container and netem logs contain explicit successful runtime markers. The 13 focused informational-response tests repeated three times with race also passed after syncing main; all ten frozen task-file hashes and a clean checkout were rechecked.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation matches the pinned H3 client behavior and is covered by comprehensive regression tests.

Review effort: Balanced
Findings: None

What changed in this PR

Adds safe handling for informational HTTP responses across web-cover proxying and H3 tunnels.

Changes:

• Sanitizes forwarded 1xx response headers.
• Supports up to five nonterminal H3 informational responses.
• Adds comprehensive protocol, authentication, deadline, and reuse tests.

File	Description
internal/​cover/​handler.go	Filters informational response headers.
internal/​cover/​informational_response_test.go	Tests H1/H2 filtering and trace composition.
internal/​tunnel/​web_h3_response.go	Reads bounded H3 informational responses.
internal/​tunnel/​web_h3_response_test.go	Tests helper boundaries and failures.
internal/​tunnel/​web_h3_client.go	Uses final-response reader for TCP CONNECT.
internal/​tunnel/​web_udp.go	Uses final-response reader for CONNECT-UDP.
internal/​tunnel/​web_h3_informational_test.go	Tests authentication, limits, and deadlines.
internal/​tunnel/​web_h3_informational_success_test.go	Tests successful TCP/UDP traffic and reuse.
internal/​tunnel/​web_cover_informational_test.go	Tests H3 cover header filtering.
docs/​WEB_COVER.md	Documents source-build behavior and limits.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.