Summary

Make the DeepSeek direct-route default opt-out so corporate-firewall users can route api.deepseek.com through their proxy. Closes #1497.

The bug

DEFAULT_NO_PROXY in src/net/proxy.ts hardcoded api.deepseek.com + *.deepseek.com alongside loopback. The SelectiveProxyDispatcher therefore always routed those hosts through undici.Agent() direct, bypassing HTTPS_PROXY. Corporate networks that block direct egress saw ConnectTimeoutError → getBalance() returned null → reasonix doctor reported api reach … /user/balance returned null — auth failed or network blocked with no escape hatch (--no-proxy doesn't help; it just skips proxy install entirely, and Node's bare fetch ignores HTTPS_PROXY).

The fix

Split the defaults:

• LOOPBACK_NO_PROXY (localhost, 127.0.0.1, ::1) — non-negotiable; dashboard, MCP stdio sidecar HTTP probes, and doctor reachability checks all need this.
• DEEPSEEK_NO_PROXY (api.deepseek.com, *.deepseek.com) — opt-out via either knob:
  • Config: proxy.bypassDeepSeekDirect: false in ~/.reasonix/config.json
  • Env: REASONIX_PROXY_DEEPSEEK_DIRECT=0 (also accepts false / no / off; truthy values are 1 / true / yes / on)

Env wins over config when explicitly set; unrecognized env values fall through to config. Default behaviour preserves the original clash/v2ray US-exit-IP-403 fix that put the bypass there in the first place — no behaviour change for users who don't set either knob.

reasonix doctor's proxy routing probe row already prints api.deepseek.com → direct | via proxy, and now reflects the override correctly without any extra detail string.

Why two knobs

Corporate users typically can't ergonomically edit ~/.reasonix/config.json from their workstation (config sync, profile management, etc.) but they own their shell env vars. The env knob is the actual escape hatch; the config knob is for persistent setups.

Scope check — any other places with the same problem?

The bypass machinery is a single chokepoint: SelectiveProxyDispatcher set as undici's global dispatcher. Every fetch() in the codebase (DeepSeek client, web tools, MCP HTTP probes, doctor, dashboard, balance API) flows through it. Searched for other hardcoded "must route direct" hosts:

• src/qq/bot.ts (bots.qq.com, api.sgroup.qq.com, sandbox.api.sgroup.qq.com) — uses the global dispatcher, no separate bypass list. ✓
• src/index/semantic/embedding.ts Ollama localhost — covered by loopback bypass which stays mandatory. ✓
• metaso.cn / tavily.com / searxng — only appear in i18n error strings, no routing override. ✓
• docs/configuration.html, docs/src/hero.jsx — describe target URLs, don't claim NO_PROXY is non-optional. No edits needed. ✓

One anti-pattern, one fix.

Test Plan

• npx vitest run tests/proxy.test.ts — 47 tests pass, including:
  • resolveBypassDeepSeekDirect env precedence + all boolean parse forms
  • resolveNoProxy({...}, { bypassDeepSeekDirect: false }) drops DeepSeek but keeps loopback
  • REASONIX_PROXY_DEEPSEEK_DIRECT=0 drops DeepSeek at install time
  • env wins over config when both are set
• npx vitest run tests/config.test.ts — 73 tests pass, including new proxy.bypassDeepSeekDirect config load + typeguard against non-bool values
• npx vitest run tests/doctor-json.test.ts — 5 pass
• npx vitest run tests/comment-policy.test.ts — 9 pass
• npx tsc --noEmit — clean
• npx biome check on touched files — clean
• npm run verify — full suite green via pre-push hook