fix: honor NO_PROXY, support http proxy, trim proxy env vars

Author: LouisClt

pnpm-lock.yaml

@@ -26,6 +26,10 @@ vi.mock("@smithy/node-http-handler", () => ({
 	NodeHttpHandler: vi.fn(),
 }))
 
+vi.mock("http-proxy-agent", () => ({
+	HttpProxyAgent: vi.fn(),
+}))
+
 vi.mock("https-proxy-agent", () => ({
 	HttpsProxyAgent: vi.fn(),
 }))
@@ -60,13 +64,15 @@ import {
 import type { Anthropic } from "@anthropic-ai/sdk"
 import { getSystemProxyUrl } from "../../../utils/networkProxy"
 import { NodeHttpHandler } from "@smithy/node-http-handler"
+import { HttpProxyAgent } from "http-proxy-agent"
 import { HttpsProxyAgent } from "https-proxy-agent"
 
 // Get access to the mocked functions
 const mockConverseStreamCommand = vi.mocked(ConverseStreamCommand)
 const mockBedrockRuntimeClient = vi.mocked(BedrockRuntimeClient)
 const mockGetSystemProxyUrl = vi.mocked(getSystemProxyUrl)
 const mockNodeHttpHandler = vi.mocked(NodeHttpHandler)
+const mockHttpProxyAgent = vi.mocked(HttpProxyAgent)
 const mockHttpsProxyAgent = vi.mocked(HttpsProxyAgent)
 
 describe("AwsBedrockHandler", () => {
@@ -141,7 +147,7 @@ describe("AwsBedrockHandler", () => {
 			mockGetSystemProxyUrl.mockReturnValue(undefined)
 		})
 
-		it("should configure NodeHttpHandler with HttpsProxyAgent when proxy URL is set", () => {
+		it("should configure NodeHttpHandler with HttpProxyAgent and HttpsProxyAgent when proxy URL is set", () => {
 			mockGetSystemProxyUrl.mockReturnValue("http://proxy.corp.local:3128")
 
 			new AwsBedrockHandler({
@@ -151,13 +157,20 @@ describe("AwsBedrockHandler", () => {
 				awsRegion: "us-east-1",
 			})
 
+			// Verify both proxy agents were created with the correct URL
+			expect(mockHttpProxyAgent).toHaveBeenCalledWith("http://proxy.corp.local:3128")
 			expect(mockHttpsProxyAgent).toHaveBeenCalledWith("http://proxy.corp.local:3128")
+
+			// Verify NodeHttpHandler was created with both agents
 			expect(mockNodeHttpHandler).toHaveBeenCalledWith(
 				expect.objectContaining({
+					httpAgent: expect.anything(),
 					httpsAgent: expect.anything(),
 					requestTimeout: 0,
 				}),
 			)
+
+			// Verify requestHandler was set on BedrockRuntimeClient config
 			expect(mockBedrockRuntimeClient).toHaveBeenLastCalledWith(
 				expect.objectContaining({ requestHandler: expect.anything() }),
 			)
@@ -192,6 +205,30 @@ describe("AwsBedrockHandler", () => {
 				}),
 			)
 		})
+
+		it("should pass a custom endpoint to getSystemProxyUrl for NO_PROXY matching", () => {
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+				awsBedrockEndpoint: "https://bedrock.vpce.internal",
+				awsBedrockEndpointEnabled: true,
+			})
+
+			expect(mockGetSystemProxyUrl).toHaveBeenCalledWith("https://bedrock.vpce.internal")
+		})
+
+		it("should pass undefined to getSystemProxyUrl when no custom endpoint is set", () => {
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+			})
+
+			expect(mockGetSystemProxyUrl).toHaveBeenCalledWith(undefined)
+		})
 	})
 
 	describe("region mapping and cross-region inference", () => {

src/api/providers/__tests__/bedrock.spec.ts

@@ -14,6 +14,7 @@ import { NodeHttpHandler } from "@smithy/node-http-handler"
 import OpenAI from "openai"
 import { fromIni } from "@aws-sdk/credential-providers"
 import { Anthropic } from "@anthropic-ai/sdk"
+import { HttpProxyAgent } from "http-proxy-agent"
 import { HttpsProxyAgent } from "https-proxy-agent"
 
 import {
@@ -298,11 +299,19 @@ export class AwsBedrockHandler extends BaseProvider implements SingleCompletionH
 		}
 
 		// When a corporate proxy is configured, Node resolves DNS locally before tunneling,
-		// causing ENOTFOUND for endpoints that only the proxy can reach. HttpsProxyAgent
-		// uses CONNECT tunneling so the proxy handles DNS resolution instead.
-		const proxyUrl = getSystemProxyUrl()
+		// causing ENOTFOUND for endpoints that only the proxy can reach. HttpProxyAgent and
+		// HttpsProxyAgent use CONNECT tunneling so the proxy handles DNS resolution instead.
+		//
+		// A custom endpoint (e.g. a VPC endpoint) is passed so NO_PROXY can bypass the proxy
+		// for directly-reachable hosts. For the default managed endpoint we don't reconstruct
+		// the hostname (the AWS SDK resolves it internally, and it varies by partition), so the
+		// proxy always applies there.
+		const proxyUrl = getSystemProxyUrl(
+			typeof clientConfig.endpoint === "string" ? clientConfig.endpoint : undefined,
+		)
 		if (proxyUrl) {
 			clientConfig.requestHandler = new NodeHttpHandler({
+				httpAgent: new HttpProxyAgent(proxyUrl),
 				httpsAgent: new HttpsProxyAgent(proxyUrl),
 				requestTimeout: 0,
 			})

src/api/providers/bedrock.ts

@@ -487,6 +487,7 @@
 		"get-folder-size": "^5.0.0",
 		"global-agent": "^3.0.0",
 		"google-auth-library": "^10.2.0",
+		"http-proxy-agent": "^7.0.0",
 		"https-proxy-agent": "^7.0.0",
 		"gray-matter": "^4.0.3",
 		"i18next": "^25.0.0",

src/package.json

@@ -308,11 +308,15 @@ describe("networkProxy", () => {
 
 	describe("getSystemProxyUrl", () => {
 		beforeEach(() => {
-			// Clear env vars before each test
+			vi.clearAllMocks()
+			// Clear all proxy env vars and VS Code setting before each test
 			delete process.env.HTTPS_PROXY
 			delete process.env.https_proxy
 			delete process.env.HTTP_PROXY
 			delete process.env.http_proxy
+			delete process.env.NO_PROXY
+			delete process.env.no_proxy
+			mockConfig.get.mockReturnValue(undefined)
 		})
 
 		it("should return proxy from HTTPS_PROXY env var", () => {
@@ -368,5 +372,101 @@ describe("networkProxy", () => {
 			const result = getSystemProxyUrl()
 			expect(result).toBe("http://env-proxy:3128")
 		})
+
+		it("should trim whitespace from env var proxy values", () => {
+			process.env.HTTPS_PROXY = "  http://proxy.corp:3128  "
+			const result = getSystemProxyUrl()
+			expect(result).toBe("http://proxy.corp:3128")
+		})
+
+		it("should reject whitespace-only proxy values", () => {
+			process.env.HTTPS_PROXY = "   "
+			const result = getSystemProxyUrl()
+			expect(result).toBeUndefined()
+		})
+
+		it("should skip empty env var and try next fallback", () => {
+			process.env.HTTP_PROXY = "  http://http-proxy:3128  "
+			const result = getSystemProxyUrl()
+			expect(result).toBe("http://http-proxy:3128")
+		})
+
+		it("should use VS Code setting when all env vars are empty", () => {
+			mockConfig.get.mockReturnValue("  http://vscode-proxy:8080  ")
+			const result = getSystemProxyUrl()
+			expect(result).toBe("http://vscode-proxy:8080")
+		})
+
+		describe("NO_PROXY handling", () => {
+			it("should bypass proxy when NO_PROXY exactly matches the target host", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = "bedrock.vpce.internal"
+				const result = getSystemProxyUrl("https://bedrock.vpce.internal")
+				expect(result).toBeUndefined()
+			})
+
+			it("should bypass proxy when NO_PROXY is a domain suffix of the target host", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = "amazonaws.com"
+				const result = getSystemProxyUrl("https://bedrock-runtime.us-east-1.amazonaws.com")
+				expect(result).toBeUndefined()
+			})
+
+			it("should bypass proxy for all hosts when NO_PROXY is '*'", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = "*"
+				const result = getSystemProxyUrl("https://bedrock-runtime.us-east-1.amazonaws.com")
+				expect(result).toBeUndefined()
+			})
+
+			it("should use the proxy when NO_PROXY does not match the target host", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = "example.com"
+				const result = getSystemProxyUrl("https://bedrock-runtime.us-east-1.amazonaws.com")
+				expect(result).toBe("http://proxy.corp:3128")
+			})
+
+			it("should handle leading dot and trailing port in NO_PROXY entries", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = ".amazonaws.com:443"
+				const result = getSystemProxyUrl("https://bedrock-runtime.us-east-1.amazonaws.com")
+				expect(result).toBeUndefined()
+			})
+
+			it("should match one entry out of a comma-separated NO_PROXY list", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = "example.com, amazonaws.com, other.net"
+				const result = getSystemProxyUrl("https://bedrock-runtime.us-east-1.amazonaws.com")
+				expect(result).toBeUndefined()
+			})
+
+			it("should use the proxy when no entry in a comma-separated NO_PROXY list matches", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = "example.com, foo.net, other.org"
+				const result = getSystemProxyUrl("https://bedrock-runtime.us-east-1.amazonaws.com")
+				expect(result).toBe("http://proxy.corp:3128")
+			})
+
+			it("should also bypass the VS Code proxy when NO_PROXY matches", () => {
+				process.env.NO_PROXY = "amazonaws.com"
+				mockConfig.get.mockReturnValue("http://vscode-proxy:8080")
+				const result = getSystemProxyUrl("https://bedrock-runtime.us-east-1.amazonaws.com")
+				expect(result).toBeUndefined()
+			})
+
+			it("should ignore NO_PROXY when no target URL is provided", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = "*"
+				const result = getSystemProxyUrl()
+				expect(result).toBe("http://proxy.corp:3128")
+			})
+
+			it("should not bypass when target URL is malformed", () => {
+				process.env.HTTPS_PROXY = "http://proxy.corp:3128"
+				process.env.NO_PROXY = "amazonaws.com"
+				const result = getSystemProxyUrl("not-a-valid-url")
+				expect(result).toBe("http://proxy.corp:3128")
+			})
+		})
 	})
 })

src/utils/__tests__/networkProxy.spec.ts

@@ -346,17 +346,66 @@ export function isDebugMode(): boolean {
 	return extensionContext.extensionMode === vscode.ExtensionMode.Development
 }
 
+/**
+ * Determine whether a target URL should bypass the proxy based on NO_PROXY / no_proxy.
+ *
+ * Follows the widely-used convention (curl, proxy-from-env):
+ * - `NO_PROXY=*` bypasses the proxy for every host.
+ * - Entries are comma-separated host suffixes; an optional leading `.` or `*.` and a
+ *   trailing `:port` are ignored. A target matches when its hostname equals an entry
+ *   or ends with `.<entry>` (so `amazonaws.com` covers `bedrock-runtime.us-east-1.amazonaws.com`).
+ * - Matching is case-insensitive.
+ */
+function isNoProxyHost(targetUrl: string): boolean {
+	const noProxy = (process.env.NO_PROXY || process.env.no_proxy || "").trim()
+	if (!noProxy) return false
+	if (noProxy === "*") return true
+
+	let hostname: string
+	try {
+		hostname = new URL(targetUrl).hostname.toLowerCase()
+	} catch {
+		return false
+	}
+	if (!hostname) return false
+
+	return noProxy
+		.split(",")
+		.map((entry) => entry.trim().toLowerCase())
+		.filter(Boolean)
+		.some((entry) => {
+			// Normalize a leading wildcard/dot and a trailing port: "*.example.com:443" -> "example.com"
+			const suffix = entry.replace(/^\*?\./, "").replace(/:\d+$/, "")
+			if (!suffix) return false
+			return hostname === suffix || hostname.endsWith(`.${suffix}`)
+		})
+}
+
 /**
  * Get the proxy URL from environment variables or VS Code settings.
  * Works in all extension modes (production and debug).
+ *
+ * When `targetUrl` is provided and its host is covered by NO_PROXY / no_proxy, this
+ * returns undefined so the caller connects directly — honoring the user's intent to
+ * bypass the proxy for e.g. a directly-reachable VPC or AWS endpoint.
+ *
+ * @param targetUrl Optional URL of the request destination, used for NO_PROXY matching.
+ * @returns The proxy URL, or undefined if no proxy applies or only whitespace is set.
  */
-export function getSystemProxyUrl(): string | undefined {
-	// Standard proxy environment variables (HTTPS takes precedence over HTTP)
+export function getSystemProxyUrl(targetUrl?: string): string | undefined {
+	// If the destination is covered by NO_PROXY, connect directly regardless of proxy source.
+	if (targetUrl && isNoProxyHost(targetUrl)) {
+		return undefined
+	}
+
+	// Standard proxy environment variables (HTTPS takes precedence over HTTP).
+	// Trim to reject whitespace-only values which would be invalid for HttpsProxyAgent.
 	const fromEnv =
-		process.env.HTTPS_PROXY ||
-		process.env.https_proxy ||
-		process.env.HTTP_PROXY ||
-		process.env.http_proxy
+		process.env.HTTPS_PROXY?.trim() ||
+		process.env.https_proxy?.trim() ||
+		process.env.HTTP_PROXY?.trim() ||
+		process.env.http_proxy?.trim()
+
 	if (fromEnv) return fromEnv
 
 	// Fall back to VS Code's http.proxy setting