fix: pass proxy-aware fetchFn to media understanding providers#27093
fix: pass proxy-aware fetchFn to media understanding providers#27093steipete merged 3 commits intoopenclaw:mainfrom
Conversation
|
@greptile please review this PR. |
Greptile SummaryThis PR adds proxy support for media understanding API calls (audio transcription and video description) by passing proxy-aware fetch functions to providers. Key Changes
Implementation Details
Test CoverageAdded 10 new tests covering proxy fetch creation, environment variable resolution, error handling, and integration with audio/video providers. Confidence Score: 5/5
Last reviewed commit: 53bd6d4 |
56692b2 to
344259d
Compare
Move makeProxyFetch to src/infra/net/proxy-fetch.ts and add resolveProxyFetchFromEnv which reads standard proxy env vars (HTTPS_PROXY, HTTP_PROXY, and lowercase variants) and returns a proxy-aware fetch via undici's EnvHttpProxyAgent. Telegram re-exports from the shared location to avoid duplication.
runProviderEntry now calls resolveProxyFetchFromEnv() and passes the result as fetchFn to transcribeAudio/describeVideo, so media provider API calls respect HTTPS_PROXY/HTTP_PROXY behind corporate proxies.
344259d to
8b15600
Compare
🔒 Aisle Security AnalysisWe found 1 potential security issue(s) in this PR:
1. 🔵 Potential proxy credential leakage via logging raw EnvHttpProxyAgent error message
Description
If the proxy environment variable contains credentials (e.g.
Vulnerable code: logWarn(
`Proxy env var set but agent creation failed — falling back to direct fetch: ${err instanceof Error ? err.message : String(err)}`,
);RecommendationAvoid logging raw error strings that may include secrets/credentials. Instead:
Example (sanitize proxy URL credentials + safer error formatting): import { formatErrorMessage } from "../infra/errors.js"; // or similar helper
function redactProxyUrl(raw: string): string {
try {
const u = new URL(raw);
if (u.username || u.password) {
u.username = "***";
u.password = "***";
}
return u.toString();
} catch {
return "<invalid-proxy-url>";
}
}
// ...
} catch (err) {
logWarn(
`Proxy env var set but agent creation failed (proxy=${redactProxyUrl(proxyUrl)}): ${formatErrorMessage(err)}`,
);
return undefined;
}Also consider adding a redaction rule for Analyzed PR: #27093 at commit Last updated on: 2026-03-01T23:58:57Z |
|
Addressed the aisle security findings: Finding 1 (fail-open proxy resolution): Valid — added a Finding 2 (env proxy exposing API keys): This is the intended behavior of the PR — |
Summary
runProviderEntryinrunner.entries.tsnever passedfetchFntotranscribeAudio()/describeVideo(). Node's built-infetch(undici) ignoresHTTPS_PROXY/HTTP_PROXY, so all media provider API calls bypass configured proxies.resolveProxyFetchFromEnv()reads standard proxy env vars and returns a proxy-aware fetch via undici'sEnvHttpProxyAgent(respectsNO_PROXY).runProviderEntrynow passes this asfetchFnto audio and video provider calls.Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
User-visible / Behavior Changes
Media understanding API calls (audio transcription via OpenAI/Deepgram/Mistral, video description) now honor
HTTPS_PROXY,HTTP_PROXY,https_proxy,http_proxyenvironment variables.NO_PROXY/no_proxyexclusions are respected via undici'sEnvHttpProxyAgent.Security Impact (required)
resolvePinnedHostnameWithPolicy) still runs before any fetch, blocking private-IP targets. When no proxy env vars are set, behavior is identical to before (returnsundefined, providers fall back toglobalThis.fetch).Repro + Verification
Environment
Steps
HTTPS_PROXY=http://your-proxy:8080in the gateway environmentExpected
Actual
Evidence
10 new tests:
proxy-fetch.test.ts(7): makeProxyFetch dispatcher wiring, env var resolution (all 4 variants + precedence), empty env = undefined, malformed URL = graceful undefinedrunner.proxy.test.ts(3): audio provider receives fetchFn when proxy is set, video provider receives fetchFn, no fetchFn when no proxy env varsHuman Verification (required)
Compatibility / Migration
Failure Recovery (if this breaks)
HTTPS_PROXY, etc.) to restore previous behaviorsrc/media-understanding/runner.entries.ts(remove fetchFn passthrough)Risks and Mitigations