* mutated by the call thread only. If is accessed by background connect threads.
   */
  private val tcpConnectsInFlight = CopyOnWriteArrayList<Plan>()

  /**
   * Results are posted here as they occur. The find job is done when either one plan completes
   * successfully or all plans fail.
   */
  private val connectResults = taskRunner.backend.decorate(LinkedBlockingDeque<ConnectResult>())

    taskRunner.lock.withLock {
      // If the queue is already idle, that's easy.
      if (activeTask == null && futureTasks.isEmpty()) {
        return CountDownLatch(0)
      }

      // If there's an existing AwaitIdleTask, use it. This is necessary when the executor is
      // shutdown but still busy as we can't enqueue in that case.
      val existingTask = activeTask
      if (existingTask is AwaitIdleTask) {

      result.add(Challenge(schemeName, emptyMap()))
      return
    }

    var eqCount = skipAll('='.code.toByte())
    val commaSuffixed = skipCommasAndWhitespace()

    // It's a token68 because there isn't a value after it.
    if (!commaPrefixed && (commaSuffixed || exhausted())) {
      result.add(
        Challenge(
          schemeName,

  private fun buildServerSslSocketFactory(): SSLSocketFactory {
    // The test uses JDK default SSL Context instead of the Platform provided one
    // as Conscrypt seems to have some differences, we only want to test client side here.
    return try {
      val keyManager =
        newKeyManager(
          null,
          serverCert,
          serverIntermediateCa.certificate,
        )
      val trustManager =

    operator fun get(name: String): String? = commonGet(name)

    fun build(): Headers = commonBuild()
  }

  companion object {
    /**
     * Returns headers for the alternating header names and values. There must be an even number of
     * arguments, and they must alternate between header names and values.
     */
    @JvmStatic
    @JvmName("of")

   * response code is 407 proxy unauthorized, this returns the "Proxy-Authenticate" challenges.
   * Otherwise this returns an empty list of challenges.
   *
   * If a challenge uses the `token68` variant instead of auth params, there is exactly one
   * auth param in the challenge at key null. Invalid headers and challenges are ignored.
   * No semantic validation is done, for example that `Basic` auth must have a `realm`

    assertThat(in2.read()).isEqualTo(-1)
    assertThat(server.takeRequest().sequenceNumber).isEqualTo(0)
    assertThat(server.takeRequest().sequenceNumber).isEqualTo(0)
  }

  @Disabled("Not actually failing where expected")
  @Test
  fun disconnectAtStart() {
    server.enqueue(
      MockResponse()
        .setSocketPolicy(SocketPolicy.DISCONNECT_AT_START),
    )

## Version 1.5.2

_2014-03-17_

 * Fix bug where deleting a file that was absent from the `HttpResponseCache`
   caused an IOException.
 * Fix bug in HTTP/2 where our HPACK decoder wasn't emitting entries in
   certain eviction scenarios, leading to dropped response headers.

## Version 1.5.1

_2014-03-11_

 * Fix 1.5.0 regression where connections should not have been recycled.

 *
 * **Not all cipher suites are supported on all platforms.** As newer cipher suites are created (for
 * stronger privacy, better performance, etc.) they will be adopted by the platform and then exposed
 * here. Cipher suites that are not available on either Android (through API level 24) or Java
 * (through JDK 9) are omitted for brevity.
 *
 * See [Android SSLEngine][sslengine] which lists the cipher suites supported by Android.
 *

    could use new flow control capacity before acknowledging it, causing strict HTTP/2 servers to
    fail the call.

 *  Fix: Recover gracefully when a coalesced connection immediately goes unhealthy.

## Version 3.14.2

_2019-05-19_

 *  Fix: Lock in a route when recovering from an HTTP/2 connection error. We had a bug where two