fix(security): honor all outbound proxy variables

Author: YourName

docs-site/src/content/docs/reference/configuration.md

@@ -82,8 +82,8 @@ transport. Without an outbound proxy, opencodex resolves the provider hostname o
 only to that validated address. HTTPS keeps the original hostname for Host, SNI, and certificate
 verification; certificate verification cannot be disabled by provider config.
 
-When `HTTP_PROXY` or `HTTPS_PROXY` applies, these two operations keep Bun's native fetch so existing
-proxy behavior is not silently bypassed. URL/literal checks still run. Successful local DNS answers
+When `HTTP_PROXY`, `HTTPS_PROXY`, or `ALL_PROXY` applies, these two operations keep Bun's native fetch
+so existing proxy behavior is not silently bypassed. URL/literal checks still run. Successful local DNS answers
 are classified, but a local DNS failure is allowed through because proxy-only networks commonly
 delegate name resolution to the proxy. The proxy chooses the final route, DNS answer, and peer, so
 opencodex logs that this path cannot pin or verify the proxy-selected peer. This is an explicit
@@ -94,6 +94,8 @@ Private/local provider destinations require both `allowPrivateNetwork: true` and
 automatically. A LAN provider such as `192.168.1.50` must be added explicitly; otherwise connection
 tests and model discovery reject it with an actionable message instead of sending it to the proxy.
 Metadata and link-local destinations remain blocked even when `allowPrivateNetwork` is enabled.
+The safety guard accepts exact hosts, domain suffixes, optional ports, bracketed IPv6, and `*` in
+`NO_PROXY`; it does not interpret CIDR entries, so list each private provider host or address explicitly.
 
 Both direct and proxied diagnostic paths reject redirects and report a credential-stripped target;
 configure the final provider URL directly. Ordinary provider requests, streaming responses, and

src/cli/doctor.ts

@@ -13,6 +13,7 @@ import { dirname, join } from "node:path";
 import { getConfigDir, getConfigPath, readConfigDiagnostics, readPid, readRuntimePort, resolveEnvValue } from "../config";
 import { gracefulStopHost } from "../lib/process-control";
 import { maskAccountId } from "../lib/privacy";
+import { PROXY_ENV_KEYS, proxyEnvPresent } from "../lib/proxy-env";
 import { configuredAdminToken } from "../lib/admin-secrets";
 import { readCodexTokens } from "../codex/auth-collision";
 import { collectOrcaCodexHomeDiagnostic, resolveCodexHomeDir as resolveCodexHomeDirImpl, isWslRuntime, listWslWindowsCodexHomes, wslAutomountRoot, type CodexHomeDeps } from "../codex/home";
@@ -285,17 +286,15 @@ export function collectWslDualInstall(deps: WslDualInstallDeps = {}): WslDualIns
   };
 }
 
-const PROXY_KEYS = ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY"] as const;
-
 export type ProxyEnvRow = { key: string; present: boolean };
 export type EnvMap = Record<string, string | undefined>;
 
 /** Report only presence/absence of proxy env vars - never the value (it may
  * embed credentials). Checks both upper- and lower-case forms. */
 export function collectProxyEnv(env: EnvMap = process.env): ProxyEnvRow[] {
-  return PROXY_KEYS.map(key => ({
+  return PROXY_ENV_KEYS.map(key => ({
     key,
-    present: !!(env[key]?.trim() || env[key.toLowerCase()]?.trim()),
+    present: proxyEnvPresent(key, env),
   }));
 }
 

src/lib/provider-outbound.ts

@@ -6,6 +6,7 @@ import {
   resolvePublicAddresses,
 } from "./destination-policy";
 import { pinnedHttpGet } from "./pinned-http";
+import { outboundProxyConfigured } from "./proxy-env";
 import { publicProviderBaseUrl } from "./provider-url";
 
 type ProviderGetInit = Omit<RequestInit, "body" | "method" | "redirect">;
@@ -25,11 +26,8 @@ function pickPinnedAddress(addresses: Array<{ address: string; family: number }>
   return addresses.find(address => address.family === 4) ?? addresses[0]!;
 }
 
-function configuredProxyFor(url: URL): boolean {
-  const values = url.protocol === "https:"
-    ? [process.env.HTTPS_PROXY, process.env.https_proxy]
-    : [process.env.HTTP_PROXY, process.env.http_proxy];
-  return values.some(value => Boolean(value?.trim()));
+function configuredProxyFor(): boolean {
+  return outboundProxyConfigured();
 }
 
 function normalizeProxyHostname(hostname: string): string {
@@ -111,6 +109,9 @@ export async function providerOutboundGet(
   dependencies: ProviderOutboundDependencies = {},
 ): Promise<Response> {
   if (provider.fetch) {
+    // A caller-owned executor cannot be peer-pinned here. This branch keeps literal/config
+    // checks and redirect blocking, but does not provide the resolved-address guarantees of
+    // the built-in transport. Main-request migration must define that executor contract first.
     const assessment = assessUrlDestination(url);
     if (assessment?.kind === "metadata" || assessment?.kind === "link-local" || assessment?.kind === "unspecified") {
       throw new ProviderOutboundPolicyError(`provider URL targets ${assessment.detail}`);
@@ -125,7 +126,7 @@ export async function providerOutboundGet(
     return provider.fetch(url, { ...init, method: "GET", redirect: "manual" });
   }
   const parsed = new URL(url);
-  const proxyConfigured = configuredProxyFor(parsed);
+  const proxyConfigured = configuredProxyFor();
   const resolveAddresses = dependencies.resolveAddresses ?? resolvePublicAddresses;
   const pinnedGet = dependencies.pinnedGet ?? pinnedHttpGet;
   let resolved: Awaited<ReturnType<typeof resolvePublicAddresses>>;

src/lib/proxy-env.ts

@@ -0,0 +1,18 @@
+export const OUTBOUND_PROXY_ENV_KEYS = ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY"] as const;
+export const PROXY_ENV_KEYS = [...OUTBOUND_PROXY_ENV_KEYS, "NO_PROXY"] as const;
+
+export type ProxyEnvKey = typeof PROXY_ENV_KEYS[number];
+export type ProxyEnvMap = Record<string, string | undefined>;
+
+export function proxyEnvPresent(
+  key: ProxyEnvKey,
+  env: ProxyEnvMap = process.env,
+): boolean {
+  return Boolean(env[key]?.trim() || env[key.toLowerCase()]?.trim());
+}
+
+export function outboundProxyConfigured(
+  env: ProxyEnvMap = process.env,
+): boolean {
+  return OUTBOUND_PROXY_ENV_KEYS.some(key => proxyEnvPresent(key, env));
+}

structure/04_transports-and-sidecars.md

@@ -4,14 +4,17 @@
 
 Provider connection tests and live model discovery share the GET-only provider outbound wrapper.
 Direct HTTP(S) resolves once and pins the validated address; HTTPS preserves the original Host/SNI
-and always verifies certificates. Proxy-configured requests stay on Bun fetch so HTTP(S)_PROXY and
-NO_PROXY semantics remain authoritative. The wrapper classifies successful local DNS answers, but
+and always verifies certificates. Proxy-configured requests stay on Bun fetch so HTTP(S)_PROXY,
+ALL_PROXY, and NO_PROXY semantics remain authoritative. The wrapper classifies successful local DNS answers, but
 only a typed DNS-resolution failure degrades to proxy resolution; every literal, metadata, and
 resolved-address policy error still rejects. Proxy mode logs once that the proxy-selected peer
 cannot be pinned. Private destinations additionally require allowPrivateNetwork plus NO_PROXY.
 
 Both paths reject redirects and expose only credential-stripped final-address guidance. This phase
 does not cover ordinary requests, streaming, retries, or per-hop redirect review on those paths.
+Caller-owned `provider.fetch` executors are also deferred: they receive literal/config checks and
+redirect blocking, but cannot inherit DNS classification or peer pinning without a verified-peer
+executor contract. Main-request migration must not treat that branch as fixed-transport equivalent.
 
 ## Responses HTTP/SSE
 

tests/fixtures/provider-outbound-e2e.ts

@@ -3,18 +3,12 @@ import type { AddressInfo } from "node:net";
 import { saveConfig } from "../../src/config";
 import { fetchProviderModels } from "../../src/codex/catalog/provider-fetch";
 import { providerOutboundGet } from "../../src/lib/provider-outbound";
+import { PROXY_ENV_KEYS } from "../../src/lib/proxy-env";
 import { handleManagementAPI } from "../../src/server/management-api";
 import type { OcxConfig } from "../../src/types";
 import { ManagementRequest as Request } from "../helpers/management-auth";
 
-const proxyKeys = [
-  "HTTP_PROXY",
-  "HTTPS_PROXY",
-  "ALL_PROXY",
-  "http_proxy",
-  "https_proxy",
-  "all_proxy",
-] as const;
+const proxyKeys = PROXY_ENV_KEYS.flatMap(key => [key, key.toLowerCase()]);
 
 async function listen(server: ReturnType<typeof createServer>): Promise<number> {
   await new Promise<void>((resolve, reject) => {
@@ -95,6 +89,15 @@ try {
     models: [],
   }, 0);
 
+  for (const key of proxyKeys) delete process.env[key];
+  process.env.ALL_PROXY = proxyUrl;
+  const allProxyResponse = await providerOutboundGet(
+    "all-proxy",
+    { baseUrl: "http://all-proxy-only.invalid/v1", allowPrivateNetwork: false },
+    "http://all-proxy-only.invalid/v1/models",
+  );
+  const allProxy = { status: allProxyResponse.status, body: await allProxyResponse.text() };
+
   const localConfig = {
     port: 0,
     hostname: "127.0.0.1",
@@ -108,6 +111,8 @@ try {
       },
     },
   } as OcxConfig;
+  process.env.NO_PROXY = "localhost,127.0.0.1,::1,[::1]";
+  process.env.no_proxy = "localhost,127.0.0.1,::1,[::1]";
   const managementNoProxy = await probe(localConfig, "local");
 
   for (const key of proxyKeys) delete process.env[key];
@@ -122,6 +127,7 @@ try {
 
   console.log(JSON.stringify({
     outbound,
+    allProxy,
     managementProxy,
     proxyModels: proxyModels.map(model => model.id),
     managementNoProxy,

tests/provider-outbound.test.ts

@@ -3,8 +3,9 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ProviderOutboundDependencies } from "../src/lib/provider-outbound";
+import { PROXY_ENV_KEYS } from "../src/lib/proxy-env";
 
-const proxyKeys = ["HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy"] as const;
+const proxyKeys = PROXY_ENV_KEYS.flatMap(key => [key, key.toLowerCase()]);
 const originalProxyEnv = Object.fromEntries(proxyKeys.map(key => [key, process.env[key]]));
 
 afterEach(() => {
@@ -162,8 +163,12 @@ describe("provider outbound GET transport", () => {
         new Response(child.stderr).text(),
         child.exited,
       ]);
+      if (exitCode !== 0) {
+        throw new Error(`provider outbound fixture exited ${exitCode}: ${stderr.trim()}`);
+      }
       const result = JSON.parse(stdout.trim()) as {
         outbound: { status: number; body: string };
+        allProxy: { status: number; body: string };
         managementProxy: Record<string, unknown>;
         proxyModels: string[];
         managementNoProxy: Record<string, unknown>;
@@ -173,11 +178,14 @@ describe("provider outbound GET transport", () => {
         providerRequests: string[];
       };
 
-      expect(exitCode).toBe(0);
       expect(result.outbound).toEqual({
           status: 200,
           body: '{"data":[{"id":"proxied-model"}]}',
       });
+      expect(result.allProxy).toEqual({
+        status: 200,
+        body: '{"data":[{"id":"proxied-model"}]}',
+      });
       expect(result.managementProxy.ok).toBe(false);
       expect(String(result.managementProxy.error)).toContain("returned 302 redirect");
       expect(String(result.managementProxy.error)).toContain("http://final.example/v1/models");
@@ -191,6 +199,7 @@ describe("provider outbound GET transport", () => {
         "http://proxy-only.invalid/v1/models",
         "http://connection-proxy.invalid/v1/models",
         "http://proxy-models.invalid/v1/models",
+        "http://all-proxy-only.invalid/v1/models",
       ]);
       expect(result.providerRequests).toEqual(["/v1/models", "/v1/models", "/v1/models"]);
       expect(stderr).toContain("cannot be pinned locally");

tests/subagent-fallback-handle-responses.test.ts

@@ -296,29 +296,29 @@ describe("subagent fallback without primary auth cooldown failure", () => {
     expect(response.status).not.toBe(429);
   });
 
-  test("final-route auth failure does not leave a primary probe lease", async () => {
+  test("final-route direct auth failure does not acquire a pool probe lease", async () => {
     const now = 1_800_000_000_000;
     Date.now = () => now;
     installPoolCredential("pool-a", "pool_acc", now);
     const cfg: OcxConfig = {
       port: 0,
-      defaultProvider: "openai",
+      defaultProvider: "xai",
       activeCodexAccountId: "pool-a",
       autoSwitchThreshold: 80,
-      subagentModelFallback: ["openai-direct/gpt-5.5"],
+      subagentModelFallback: ["gpt-5.5"],
       providers: {
         openai: {
-          adapter: "openai-responses",
-          baseUrl: "https://chatgpt.com/backend-api/codex",
-          authMode: "forward",
-          codexAccountMode: "pool",
-        },
-        "openai-direct": {
           adapter: "openai-responses",
           baseUrl: "https://chatgpt.com/backend-api/codex",
           authMode: "forward",
           codexAccountMode: "direct",
         },
+        xai: {
+          adapter: "openai-chat",
+          baseUrl: "https://api.x.ai/v1",
+          authMode: "key",
+          apiKey: "xai-test",
+        },
       },
       codexAccounts: [
         { id: "main", email: "main@example.test", isMain: true },
@@ -328,8 +328,16 @@ describe("subagent fallback without primary auth cooldown failure", () => {
     updateAccountQuota("pool-a", 95, undefined, 20);
     const resetAt = Math.floor((now + 4 * 24 * 60 * 60_000) / 1000);
     recordCodexUpstreamOutcome(cfg, "pool-a", 429, { resetAt, now });
+    const { noteSubagentModelFailure } = await import("../src/codex/subagent-model-fallback");
+    noteSubagentModelFailure("xai/grok-4.5", "429", cfg);
 
-    // Omit authorization so direct-mode final auth fails — primary never leased.
+    let fetchCalls = 0;
+    globalThis.fetch = (async () => {
+      fetchCalls += 1;
+      throw new Error("must not dispatch");
+    }) as typeof fetch;
+
+    // Omit authorization so the canonical Direct final route fails before dispatch.
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -338,7 +346,7 @@ describe("subagent fallback without primary auth cooldown failure", () => {
           "x-openai-subagent": "collab_spawn",
         },
         body: JSON.stringify({
-          model: "gpt-5.6-sol",
+          model: "xai/grok-4.5",
           input: readableAgentInput(),
           stream: false,
         }),
@@ -348,6 +356,7 @@ describe("subagent fallback without primary auth cooldown failure", () => {
     );
 
     expect(response.status).toBe(401);
+    expect(fetchCalls).toBe(0);
     expect(getCodexUpstreamHealth("pool-a")?.probeLeaseId).toBeUndefined();
   });
 });