Observe Go's CONNECT Status in OnProxyConnectResponse

transport := http.DefaultTransport.(*http.Transport).Clone()
transport.Proxy = http.ProxyURL(proxyURL)
transport.OnProxyConnectResponse = func(
    _ context.Context,
    _ *url.URL,
    _ *http.Request,
    response *http.Response,
) error {
    observeConnect(response.StatusCode, response.Header.Get("X-Proxy-Region"))
    return nil
}
client := &http.Client{Transport: transport}

Use context, net/http and net/url; the standard-default type assertion assumes that transport remains installed. proxyURL is parsed, and observeConnect must be concurrency-safe. For permitted public HTTPS probes, the HTTP proxy list supplies candidates for that proxy URL.

The callback runs before checking CONNECT for successful 200, so it can observe 407 too. Nil continues normal checking and does not accept a rejected tunnel; an error fails the request.

X-Proxy-Region is a provider-defined example. Read status/headers here and leave body/socket ownership with Transport, which then handles destination TLS.

This observes new tunnel setup, not every request. A reused connection has no new CONNECT response, and the website response has separate headers.