Preserve dispatcherPolicy when auto-selecting trusted proxy mode

When hasProxyEnvConfigured() is true, this line unconditionally sets mode: "trusted_env_proxy" unless the caller passes an explicit mode. In the postJsonRequest/postTranscriptionRequest path, callers can supply dispatcherPolicy (from resolveProviderHttpRequestConfig), but fetchWithSsrFGuard prioritizes trusted-env mode and builds an EnvHttpProxyAgent, which bypasses explicit-proxy/direct policy details (for example custom proxy URL, proxyTls, or target connect options). That means provider-specific proxy/TLS transport settings are silently ignored whenever proxy env vars are present, which can break enterprise proxy/mTLS configurations.

Useful? React with 👍 / 👎.

Addressed in 8c2c861. The decision now lives in a documented shouldAutoUpgradeToTrustedEnvProxy helper: when a caller passes an explicit dispatcherPolicy, the helper returns false and we do not override with TRUSTED_ENV_PROXY mode. Enterprise proxy/mTLS configs (custom proxy URL, proxyTls, connect options) now flow through unchanged. Added a test case ("does not auto-upgrade when caller passes explicit dispatcherPolicy") that asserts both mode is unset and the original dispatcherPolicy is forwarded intact.

Gate trusted proxy auto-upgrade on HTTP proxy vars only

resolvedMode now switches to "trusted_env_proxy" whenever hasProxyEnvConfigured() is true, but that helper treats ALL_PROXY/all_proxy as configured. In this repo, EnvHttpProxyAgent-style resolution explicitly ignores ALL_PROXY, so a process with only ALL_PROXY set will still be auto-upgraded here, skip strict SSRF hostname checks, and then make a direct request instead of using a real HTTP proxy. This is a behavioral and security regression introduced by the new auto-upgrade path; the mode switch should be gated by HTTP(S)-proxy detection (e.g. hasEnvHttpProxyConfigured) rather than any proxy env key.

Useful? React with 👍 / 👎.

Addressed in 8c2c861. Swapped from hasProxyEnvConfigured() to hasEnvHttpProxyConfigured(protocol), which only checks HTTP_PROXY/HTTPS_PROXY (and lowercase variants) — matching undici EnvHttpProxyAgent's own resolution that ignores ALL_PROXY. The protocol is now derived from the target URL at the decision site so https and http callers key on the right env vars. Added a test case ("does not auto-upgrade when only ALL_PROXY is configured") asserting no mode is set when the HTTP(S) gate returns false. ALL_PROXY-only environments now fall through to strict SSRF mode instead of being silently upgraded past the hostname-check path.

Avoid trusted-proxy mode when NO_PROXY can bypass egress

The new resolvedMode default unconditionally switches provider requests into trusted_env_proxy whenever any proxy env var exists, but fetchWithSsrFGuard skips resolvePinnedHostnameWithPolicy in that mode (src/infra/net/fetch-guard.ts), and EnvHttpProxyAgent can still make direct connections for NO_PROXY matches (noted in src/infra/net/proxy-fetch.ts). In environments with HTTP_PROXY plus NO_PROXY entries (including common localhost exclusions or NO_PROXY=*), these requests are auto-upgraded here and can bypass SSRF/private-network checks that strict mode previously enforced.

Useful? React with 👍 / 👎.

Addressed in 8c2c861. Added matchesNoProxy() to src/infra/net/proxy-env.ts that mirrors undici EnvHttpProxyAgent semantics: wildcard *, exact hostname, leading-dot / subdomain-suffix, optional :port, IPv6 in bracket form, case-insensitive, comma-separated list. Undici does not export its own matcher, so this is a self-contained reimplementation kept in sync with undici/lib/dispatcher/env-http-proxy-agent.js. The shouldAutoUpgradeToTrustedEnvProxy helper calls it with the target URL and returns false on a match — so HTTP_PROXY + NO_PROXY=localhost (or NO_PROXY=*) environments now keep strict SSRF + pinned-DNS for the exempt targets instead of bypassing them. 15 new matchesNoProxy test cases in proxy-env.test.ts plus a new shared.test.ts case ("does not auto-upgrade when target URL matches NO_PROXY").

Split NO_PROXY entries on whitespace and commas

Fresh evidence: the new matchesNoProxy gate now uses raw.split(","), but EnvHttpProxyAgent tokenizes NO_PROXY with both commas and whitespace. With values like NO_PROXY="localhost *.corp.internal", this parser misses *.corp.internal, shouldAutoUpgradeToTrustedEnvProxy enables trusted_env_proxy, and requests to those hosts can go direct via NO_PROXY while fetchWithSsrFGuard skips pinned-DNS checks in trusted mode.

Useful? React with 👍 / 👎.

Addressed in 4756cdc. matchesNoProxy now splits on /[,\s]/ to mirror undici EnvHttpProxyAgent#parseNoProxy exactly — both commas and whitespace (space, tab, newline) are valid delimiters, and empty entries from runs of delimiters are filtered by the existing if (!entry) continue guard. Values like NO_PROXY="localhost *.corp.internal" and NO_PROXY="a, b\tc" now tokenize correctly.

New test coverage in proxy-env.test.ts:

• "parses whitespace-separated list (undici tokenizes on [,\s])"
• "parses mixed comma-and-whitespace list"
• "tab and newline act as delimiters"

Normalize *. NO_PROXY host patterns before matching

Fresh evidence: the new matcher only removes a leading . (entryHost.startsWith(".")), so valid EnvHttpProxyAgent patterns like *.example.com never match. In environments that rely on wildcard NO_PROXY exclusions, the media helper will still auto-upgrade to trusted_env_proxy; those wildcard-matched hosts may bypass the proxy directly, and trusted mode then bypasses the strict hostname pinning path.

Useful? React with 👍 / 👎.

Addressed in 4756cdc. Entry normalization is now entryHost.replace(/^\*?\./, ""), mirroring undici EnvHttpProxyAgent#parseNoProxy line-for-line. Both .example.com and *.example.com normalize to example.com and flow through the existing exact + subdomain-suffix match logic. This matches undici's own quirk that a *.example.com entry also bypasses the bare domain example.com (since the normalization drops the wildcard-plus-dot prefix before comparison) — documented inline in the jsdoc so future maintainers don't accidentally tighten it to subdomain-only and drift away from upstream.

New test coverage in proxy-env.test.ts:

• "matches subdomain via *. wildcard normalization" — *.example.com → foo.example.com
• "wildcard *.example.com matches bare example.com (undici normalizes to base domain)"
• "*. wildcard respects port" — *.corp.internal:8443
• "*. wildcard does not match unrelated suffix" — negative case against *.example.com vs api.example.org

Re-evaluate NO_PROXY for redirect targets

Auto-upgrading to trusted_env_proxy is decided once from the initial URL, but fetchWithSsrFGuard applies that mode across the entire redirect chain. In environments with HTTP(S)_PROXY plus NO_PROXY entries (for example localhost/internal hosts), an initial public URL can be upgraded here and then redirect to a NO_PROXY host; EnvHttpProxyAgent will connect directly for that hop while trusted mode skips resolvePinnedHostnameWithPolicy, so SSRF/private-network checks are bypassed on the redirected target. This is a regression from strict default behavior and should be gated per-hop (or disable trusted mode when a redirect target matches NO_PROXY).

Useful? React with 👍 / 👎.