Fix Vision SSL errors by not reading encrypted rawInput buffer

The issue occurs when switching to direct copy mode - Vision was incorrectly reading from rawInput buffer which contains ENCRYPTED outer TLS/Reality records and merging them with decrypted application data. This caused SSL protocol errors, especially with testpre where pre-established connections may have TLS session tickets or other post-handshake messages in rawInput.

The fix: Only read from input buffer (decrypted application data), skip rawInput (encrypted TLS records).

Fixes #4878

Co-authored-by: RPRX <[email protected]>

proxy/proxy.go

@@ -256,13 +256,13 @@ func (w *VisionReader) ReadMultiBuffer() (buf.MultiBuffer, error) {
 	}
 
 	if *switchToDirectCopy {
-		// XTLS Vision processes TLS-like conn's input and rawInput
+		// XTLS Vision processes TLS-like conn's input
+		// Only read from input (decrypted application data), not rawInput (encrypted TLS records)
 		if inputBuffer, err := buf.ReadFrom(w.input); err == nil && !inputBuffer.IsEmpty() {
 			buffer, _ = buf.MergeMulti(buffer, inputBuffer)
 		}
-		if rawInputBuffer, err := buf.ReadFrom(w.rawInput); err == nil && !rawInputBuffer.IsEmpty() {
-			buffer, _ = buf.MergeMulti(buffer, rawInputBuffer)
-		}
+		// Do not read from rawInput - it contains encrypted outer TLS records that would corrupt the stream
+		// Just clear the buffers to release memory
 		*w.input = bytes.Reader{} // release memory
 		w.input = nil
 		*w.rawInput = bytes.Buffer{} // release memory