There were a few more issues:

• ChannelCredentials#_getConnectionOptions was returning a reference to a mutable object, which Subchannel#createSession was mutating. I changed both of those lines for defense in depth.

• In http_proxy.ts, getProxiedConnection was resolving the promise before trying to connect with TLS. That is simply incorrect, and was probably a merge error.

• Again in getProxiedConnection, tls.connect did not always get a servername option, which is required to set the SNI request in the TLS handshake. With that change, adding the original connectionOptions needs to be moved to the end so that the servername option from the grpc.ssl_target_name_override channel option takes precedence.

I tested this by successfully making a request to the prod interop server using TLS through an HTTP CONNECT proxy.