fix(config): honor an explicit proxy for no_proxy providers like mimo (#3635)#3714
Merged
Conversation
The built-in mimo presets carry no_proxy=true so their domestic endpoint stays off an auto-detected (GFW-circumvention) system proxy. But that bypass was applied in every mode, so behind a mandatory corporate proxy (proxy_mode = "custom") mimo tried a direct connection the firewall blocks — making mimo unusable on enterprise networks (#3635). Apply the provider-level no_proxy bypass only for auto/env proxies. An explicit custom proxy means "route everything through this", so honor it for every provider; a custom-proxy user who still wants a host direct uses network.no_proxy. Closes #3635
The release golangci-lint binary CI runs flags SA5011 on guarded t.Fatal derefs in backfill_test.go and migrate_test.go (same cache-masked false positive as #3706); this PR touches the config package so a cold lint run surfaces them. Guard with else-if; no behavior change.
esengine
added a commit
that referenced
this pull request
Jun 9, 2026
The pinned golangci-lint binary's staticcheck reports SA5011 (possible nil
pointer dereference) on `if x == nil { t.Fatal(...) }`-guarded derefs in tests
— it doesn't model t.Fatal as terminating. The same code is clean under a
locally-built golangci-lint, and the finding is masked by the action cache
until a go.sum change cold-busts it, so it surfaces per-package and has failed
lint on otherwise-correct PRs (handled ad hoc in #3706, #3714).
Scope a test-only SA5011 exclusion so it stops blocking PRs while SA5011 keeps
guarding production code.
Co-authored-by: reasonix <reasonix@deepseek.com>
SuMuxi66
pushed a commit
to SuMuxi66/DeepSeek-Reasonix
that referenced
this pull request
Jun 10, 2026
…esengine#3635) (esengine#3714) * fix(config): honor an explicit proxy for no_proxy providers (mimo) The built-in mimo presets carry no_proxy=true so their domestic endpoint stays off an auto-detected (GFW-circumvention) system proxy. But that bypass was applied in every mode, so behind a mandatory corporate proxy (proxy_mode = "custom") mimo tried a direct connection the firewall blocks — making mimo unusable on enterprise networks (esengine#3635). Apply the provider-level no_proxy bypass only for auto/env proxies. An explicit custom proxy means "route everything through this", so honor it for every provider; a custom-proxy user who still wants a host direct uses network.no_proxy. Closes esengine#3635 * test(config): structurally guard nil-deref (staticcheck SA5011) The release golangci-lint binary CI runs flags SA5011 on guarded t.Fatal derefs in backfill_test.go and migrate_test.go (same cache-masked false positive as esengine#3706); this PR touches the config package so a cold lint run surfaces them. Guard with else-if; no behavior change. --------- Co-authored-by: reasonix <reasonix@deepseek.com>
SuMuxi66
pushed a commit
to SuMuxi66/DeepSeek-Reasonix
that referenced
this pull request
Jun 10, 2026
…ne#3715) The pinned golangci-lint binary's staticcheck reports SA5011 (possible nil pointer dereference) on `if x == nil { t.Fatal(...) }`-guarded derefs in tests — it doesn't model t.Fatal as terminating. The same code is clean under a locally-built golangci-lint, and the finding is masked by the action cache until a go.sum change cold-busts it, so it surfaces per-package and has failed lint on otherwise-correct PRs (handled ad hoc in esengine#3706, esengine#3714). Scope a test-only SA5011 exclusion so it stops blocking PRs while SA5011 keeps guarding production code. Co-authored-by: reasonix <reasonix@deepseek.com>
dorokuma
pushed a commit
to dorokuma/DeepSeek-Reasonix
that referenced
this pull request
Jun 10, 2026
…esengine#3635) (esengine#3714) * fix(config): honor an explicit proxy for no_proxy providers (mimo) The built-in mimo presets carry no_proxy=true so their domestic endpoint stays off an auto-detected (GFW-circumvention) system proxy. But that bypass was applied in every mode, so behind a mandatory corporate proxy (proxy_mode = "custom") mimo tried a direct connection the firewall blocks — making mimo unusable on enterprise networks (esengine#3635). Apply the provider-level no_proxy bypass only for auto/env proxies. An explicit custom proxy means "route everything through this", so honor it for every provider; a custom-proxy user who still wants a host direct uses network.no_proxy. Closes esengine#3635 * test(config): structurally guard nil-deref (staticcheck SA5011) The release golangci-lint binary CI runs flags SA5011 on guarded t.Fatal derefs in backfill_test.go and migrate_test.go (same cache-masked false positive as esengine#3706); this PR touches the config package so a cold lint run surfaces them. Guard with else-if; no behavior change. --------- Co-authored-by: reasonix <reasonix@deepseek.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug (#3635)
On an enterprise network where all egress must go through a corporate proxy, the
mimomodels are unreachable. Root cause (config.go:directProxyHosts): the built-in mimo presets setno_proxy=true, whose host (token-plan-cn.xiaomimimo.com) is added to the proxy'sDirectHostsand always bypasses the proxy — so behind a mandatory proxy, mimo attempts a direct connection the firewall blocks.no_proxy=trueis right for an auto-detected system proxy (typically a GFW-circumvention proxy not meant for domestic endpoints), but wrong for an explicitly configured one.Fix
Apply the provider-level
no_proxybypass only forauto/envproxy modes. Whenproxy_mode = "custom"the user is saying "route everything through this proxy", so honor it for every provider (including mimo). A custom-proxy user who still wants a specific host direct usesnetwork.no_proxy(which is honored for custom proxies).Test plan
internal/config: existingTestDirectProxyHostsFromNoProxyProvidersstill passes (auto mode keeps mimo direct); newTestExplicitProxyOverridesProviderNoProxyasserts custom mode does NOT force mimo direct.go test ./internal/configgreen; vet + golangci-lint (0 issues) + gofmt clean.Closes #3635