Fix bedrock DNS resolution when behind a corporate proxy (#906)

* Fix bedrock DNS resolution when behind a corporate proxy

When behind a corporate proxy, Node.js resolves DNS locally before contacting
the proxy. If the proxy is the only path to the endpoint, the request fails
with ENOTFOUND.

HttpsProxyAgent uses CONNECT tunneling so the proxy handles DNS resolution.
Configure NodeHttpHandler with HttpsProxyAgent when a system proxy is detected.

* test: add coverage for getSystemProxyUrl function

* fix: honor NO_PROXY, support http proxy, trim proxy env vars

Author: LouisClt

.changeset/itchy-moles-thank.md

@@ -0,0 +1,5 @@
+---
+"zoo-code": patch
+---
+
+Fix bedrock DNS resolution when behind corporate proxy

pnpm-lock.yaml

@@ -18,6 +18,22 @@ vi.mock("@aws-sdk/credential-providers", () => {
 	return { fromIni: mockFromIni }
 })
 
+vi.mock("../../../utils/networkProxy", () => ({
+	getSystemProxyUrl: vi.fn().mockReturnValue(undefined),
+}))
+
+vi.mock("@smithy/node-http-handler", () => ({
+	NodeHttpHandler: vi.fn(),
+}))
+
+vi.mock("http-proxy-agent", () => ({
+	HttpProxyAgent: vi.fn(),
+}))
+
+vi.mock("https-proxy-agent", () => ({
+	HttpsProxyAgent: vi.fn(),
+}))
+
 // Mock BedrockRuntimeClient and ConverseStreamCommand
 vi.mock("@aws-sdk/client-bedrock-runtime", () => {
 	const mockSend = vi.fn().mockResolvedValue({
@@ -46,10 +62,18 @@ import {
 } from "@roo-code/types"
 
 import type { Anthropic } from "@anthropic-ai/sdk"
+import { getSystemProxyUrl } from "../../../utils/networkProxy"
+import { NodeHttpHandler } from "@smithy/node-http-handler"
+import { HttpProxyAgent } from "http-proxy-agent"
+import { HttpsProxyAgent } from "https-proxy-agent"
 
 // Get access to the mocked functions
 const mockConverseStreamCommand = vi.mocked(ConverseStreamCommand)
 const mockBedrockRuntimeClient = vi.mocked(BedrockRuntimeClient)
+const mockGetSystemProxyUrl = vi.mocked(getSystemProxyUrl)
+const mockNodeHttpHandler = vi.mocked(NodeHttpHandler)
+const mockHttpProxyAgent = vi.mocked(HttpProxyAgent)
+const mockHttpsProxyAgent = vi.mocked(HttpsProxyAgent)
 
 describe("AwsBedrockHandler", () => {
 	let handler: AwsBedrockHandler
@@ -118,6 +142,95 @@ describe("AwsBedrockHandler", () => {
 		})
 	})
 
+	describe("proxy configuration", () => {
+		afterEach(() => {
+			mockGetSystemProxyUrl.mockReturnValue(undefined)
+		})
+
+		it("should configure NodeHttpHandler with HttpProxyAgent and HttpsProxyAgent when proxy URL is set", () => {
+			mockGetSystemProxyUrl.mockReturnValue("http://proxy.corp.local:3128")
+
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+			})
+
+			// Verify both proxy agents were created with the correct URL
+			expect(mockHttpProxyAgent).toHaveBeenCalledWith("http://proxy.corp.local:3128")
+			expect(mockHttpsProxyAgent).toHaveBeenCalledWith("http://proxy.corp.local:3128")
+
+			// Verify NodeHttpHandler was created with both agents
+			expect(mockNodeHttpHandler).toHaveBeenCalledWith(
+				expect.objectContaining({
+					httpAgent: expect.anything(),
+					httpsAgent: expect.anything(),
+					requestTimeout: 0,
+				}),
+			)
+
+			// Verify requestHandler was set on BedrockRuntimeClient config
+			expect(mockBedrockRuntimeClient).toHaveBeenLastCalledWith(
+				expect.objectContaining({ requestHandler: expect.anything() }),
+			)
+		})
+
+		it("should not create a proxy requestHandler when no proxy is configured", () => {
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+			})
+
+			expect(mockNodeHttpHandler).not.toHaveBeenCalled()
+			expect(mockBedrockRuntimeClient.mock.lastCall?.[0]?.requestHandler).toBeUndefined()
+		})
+
+		it("should apply proxy for API key authentication", () => {
+			mockGetSystemProxyUrl.mockReturnValue("http://proxy.corp.local:3128")
+
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsUseApiKey: true,
+				awsApiKey: "test-api-key",
+				awsRegion: "us-east-1",
+			})
+
+			expect(mockNodeHttpHandler).toHaveBeenCalledWith(
+				expect.objectContaining({
+					httpsAgent: expect.anything(),
+					requestTimeout: 0,
+				}),
+			)
+		})
+
+		it("should pass a custom endpoint to getSystemProxyUrl for NO_PROXY matching", () => {
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+				awsBedrockEndpoint: "https://bedrock.vpce.internal",
+				awsBedrockEndpointEnabled: true,
+			})
+
+			expect(mockGetSystemProxyUrl).toHaveBeenCalledWith("https://bedrock.vpce.internal")
+		})
+
+		it("should pass undefined to getSystemProxyUrl when no custom endpoint is set", () => {
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+			})
+
+			expect(mockGetSystemProxyUrl).toHaveBeenCalledWith(undefined)
+		})
+	})
+
 	describe("region mapping and cross-region inference", () => {
 		describe("getPrefixForRegion", () => {
 			it("should return correct prefix for US regions", () => {

src/api/providers/__tests__/bedrock.spec.ts

@@ -10,9 +10,12 @@ import {
 	ToolConfiguration,
 	ToolChoice,
 } from "@aws-sdk/client-bedrock-runtime"
+import { NodeHttpHandler } from "@smithy/node-http-handler"
 import OpenAI from "openai"
 import { fromIni } from "@aws-sdk/credential-providers"
 import { Anthropic } from "@anthropic-ai/sdk"
+import { HttpProxyAgent } from "http-proxy-agent"
+import { HttpsProxyAgent } from "https-proxy-agent"
 
 import {
 	type ModelInfo,
@@ -44,6 +47,7 @@ import { convertToBedrockConverseMessages as sharedConverter } from "../transfor
 import { getModelParams } from "../transform/model-params"
 import { shouldUseReasoningBudget } from "../../shared/api"
 import { normalizeToolSchema } from "../../utils/json-schema"
+import { getSystemProxyUrl } from "../../utils/networkProxy"
 import type { SingleCompletionHandler, ApiHandlerCreateMessageMetadata, CompletePromptOptions } from "../index"
 
 /************************************************************************************
@@ -294,6 +298,25 @@ export class AwsBedrockHandler extends BaseProvider implements SingleCompletionH
 			}
 		}
 
+		// When a corporate proxy is configured, Node resolves DNS locally before tunneling,
+		// causing ENOTFOUND for endpoints that only the proxy can reach. HttpProxyAgent and
+		// HttpsProxyAgent use CONNECT tunneling so the proxy handles DNS resolution instead.
+		//
+		// A custom endpoint (e.g. a VPC endpoint) is passed so NO_PROXY can bypass the proxy
+		// for directly-reachable hosts. For the default managed endpoint we don't reconstruct
+		// the hostname (the AWS SDK resolves it internally, and it varies by partition), so the
+		// proxy always applies there.
+		const proxyUrl = getSystemProxyUrl(
+			typeof clientConfig.endpoint === "string" ? clientConfig.endpoint : undefined,
+		)
+		if (proxyUrl) {
+			clientConfig.requestHandler = new NodeHttpHandler({
+				httpAgent: new HttpProxyAgent(proxyUrl),
+				httpsAgent: new HttpsProxyAgent(proxyUrl),
+				requestTimeout: 0,
+			})
+		}
+
 		this.client = new BedrockRuntimeClient(clientConfig)
 	}
 

src/api/providers/bedrock.ts

@@ -461,6 +461,7 @@
 		"@anthropic-ai/vertex-sdk": "^0.19.0",
 		"@aws-sdk/client-bedrock-runtime": "^3.922.0",
 		"@aws-sdk/credential-providers": "^3.922.0",
+		"@smithy/node-http-handler": "^4.0.0",
 		"@google/genai": "^1.29.1",
 		"@lmstudio/sdk": "^1.1.1",
 		"@mistralai/mistralai": "^1.9.18",
@@ -486,6 +487,8 @@
 		"get-folder-size": "^5.0.0",
 		"global-agent": "^3.0.0",
 		"google-auth-library": "^10.2.0",
+		"http-proxy-agent": "^7.0.0",
+		"https-proxy-agent": "^7.0.0",
 		"gray-matter": "^4.0.3",
 		"i18next": "^25.0.0",
 		"ignore": "^7.0.3",