[BUG]: proxy corrupts binary response bodies served as text/* (UTF-8 decode) #1263

varlock version

1.24.0 (standalone binary via install.sh)1.24.0 (standalone binary via install.sh

Steps to reproduce

1. .env.schema:

   # @proxyConfig={egress="strict"}
   # @proxy(domain="sum.golang.org")
   # ---
   X=1
   

2. Start the proxy:

   varlock proxy start --port 47995 --cert-dir ./certs --no-allow-reload -p ./

3. Compare a binary response fetched directly and through the proxy:

   curl -s https://sum.golang.org/tile/8/3/000.p/4 | wc -c                                    # 128
   curl -s -k --proxy http://127.0.0.1:47995 https://sum.golang.org/tile/8/3/000.p/4 | wc -c   # 226
   curl -s -k --proxy http://127.0.0.1:47995 https://sum.golang.org/tile/8/3/000.p/4 | xxd | head

The server sends this binary body with Content-Type: text/plain; charset=UTF-8. No secret is attached to the rule.

What is expected?

The response body arrives byte for byte (128 bytes), as it does for hosts without a rule.

What is actually happening?

The body arrives with 226 bytes: every invalid UTF-8 byte is replaced by U+FFFD (ef bf bd).

It looks like the body is decoded as UTF-8 text (probably for response scrubbing) and re-encoded.

Same result with --compressed and with a wildcard rule (*.org). In permissive mode, an unmatched host passes through unchanged (128 bytes).

Real-world effect: Go behind the proxy cannot verify modules against its checksum database (go get, go install pkg@version, toolchain switches fail with tile ... len=226, want 128).

System Info

- OS: Debian 13 (trixie)
- Architecture: x86_64
- Kernel: 6.12
- Varlock: 1.24.0 (standalone binary)

Any additional comments?

We run varlock as a per-user broker with egress="strict" in front of Claude Code's sandbox, so all of the agent's traffic goes through matched rules.

Suggestion: Scrub only bodies that are valid UTF-8 (or skip scrubbing when no secret was sent to that host – the docs say scrubbing is scoped to values a rule sends to the host), and otherwise pass the raw bytes through.