update

ts/detection/detectors/http-detector.ts

@@ -49,11 +49,15 @@ export class HttpDetector implements IProtocolDetector {
       return null;
     }
     
+    // Check if we have complete headers first
+    const headersEnd = buffer.indexOf('\r\n\r\n');
+    const isComplete = headersEnd !== -1;
+    
     // Extract routing information
     const routing = RoutingExtractor.extract(buffer, 'http');
     
-    // If we don't need full headers, we can return early
-    if (quickResult.confidence >= 95 && !options?.extractFullHeaders) {
+    // If we don't need full headers and we have complete headers, we can return early
+    if (quickResult.confidence >= 95 && !options?.extractFullHeaders && isComplete) {
       return {
         protocol: 'http',
         connectionInfo: { 
@@ -66,10 +70,6 @@ export class HttpDetector implements IProtocolDetector {
       };
     }
     
-    // Check if we have complete headers
-    const headersEnd = buffer.indexOf('\r\n\r\n');
-    const isComplete = headersEnd !== -1;
-    
     return {
       protocol: 'http',
       connectionInfo: {

ts/detection/protocol-detector.ts

@@ -18,6 +18,7 @@ export class ProtocolDetector {
   private fragmentManager: DetectionFragmentManager;
   private tlsDetector: TlsDetector;
   private httpDetector: HttpDetector;
+  private connectionProtocols: Map<string, 'tls' | 'http'> = new Map();
   
   constructor() {
     this.fragmentManager = new DetectionFragmentManager();
@@ -122,14 +123,25 @@ export class ProtocolDetector {
     
     const connectionId = DetectionFragmentManager.createConnectionId(context);
     
-    // First peek to determine protocol type
-    if (this.tlsDetector.canHandle(buffer)) {
+    // Check if we already know the protocol for this connection
+    const knownProtocol = this.connectionProtocols.get(connectionId);
+    
+    if (knownProtocol === 'http') {
+      const result = this.httpDetector.detectWithContext(buffer, context, options);
+      if (result) {
+        if (result.isComplete) {
+          this.connectionProtocols.delete(connectionId);
+        }
+        return result;
+      }
+    } else if (knownProtocol === 'tls') {
       // Handle TLS with fragment accumulation
       const handler = this.fragmentManager.getHandler('tls');
       const fragmentResult = handler.addFragment(connectionId, buffer);
       
       if (fragmentResult.error) {
         handler.complete(connectionId);
+        this.connectionProtocols.delete(connectionId);
         return {
           protocol: 'unknown',
           connectionInfo: { protocol: 'unknown' },
@@ -141,15 +153,50 @@ export class ProtocolDetector {
       if (result) {
         if (result.isComplete) {
           handler.complete(connectionId);
+          this.connectionProtocols.delete(connectionId);
         }
         return result;
       }
     }
     
-    if (this.httpDetector.canHandle(buffer)) {
-      const result = this.httpDetector.detectWithContext(buffer, context, options);
-      if (result) {
-        return result;
+    // If we don't know the protocol yet, try to detect it
+    if (!knownProtocol) {
+      // First peek to determine protocol type
+      if (this.tlsDetector.canHandle(buffer)) {
+        this.connectionProtocols.set(connectionId, 'tls');
+        // Handle TLS with fragment accumulation
+        const handler = this.fragmentManager.getHandler('tls');
+        const fragmentResult = handler.addFragment(connectionId, buffer);
+        
+        if (fragmentResult.error) {
+          handler.complete(connectionId);
+          this.connectionProtocols.delete(connectionId);
+          return {
+            protocol: 'unknown',
+            connectionInfo: { protocol: 'unknown' },
+            isComplete: true
+          };
+        }
+        
+        const result = this.tlsDetector.detect(fragmentResult.buffer!, options);
+        if (result) {
+          if (result.isComplete) {
+            handler.complete(connectionId);
+            this.connectionProtocols.delete(connectionId);
+          }
+          return result;
+        }
+      }
+      
+      if (this.httpDetector.canHandle(buffer)) {
+        this.connectionProtocols.set(connectionId, 'http');
+        const result = this.httpDetector.detectWithContext(buffer, context, options);
+        if (result) {
+          if (result.isComplete) {
+            this.connectionProtocols.delete(connectionId);
+          }
+          return result;
+        }
       }
     }
     
@@ -208,6 +255,9 @@ export class ProtocolDetector {
     // Clean up both TLS and HTTP fragments for this connection
     instance.fragmentManager.getHandler('tls').complete(connectionId);
     instance.fragmentManager.getHandler('http').complete(connectionId);
+    
+    // Remove from connection protocols tracking
+    instance.connectionProtocols.delete(connectionId);
   }
   
   /**