Feat/proxy support#337
Conversation
🦋 Changeset detectedLatest commit: bb1c554 The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4c083ff53a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Undici's EnvHttpProxyAgent ignores uppercase NO_PROXY when both cases exist, so our explicit override must match that precedence. Otherwise hosts listed in lowercase no_proxy are still proxied. Add regression tests for the mixed-case scenario.
The interactive login flow in auth.ts was passing raw global fetch to fetchOpenPlatformModels, bypassing the proxy-aware default. In proxy-only environments the initial key verification would fail even though later refresh paths work. Make fetchOpenPlatformModels' fetchImpl parameter optional so callers that omit it (or pass undefined) automatically get getProxyFetch().
6.21.0 is in the affected range for GHSA-cxrh-j4jr-qwg3. Because the new proxy helper imports undici on LLM/OAuth paths and clients can be pointed at custom URLs, users would inherit known vulnerabilities unnecessarily.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bb1c554e45
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| specifier: 6.21.0 | ||
| version: 6.21.0 |
There was a problem hiding this comment.
The lockfile importer still records undici as specifier: 6.21.0/version: 6.21.0 even though the corresponding packages/kosong/package.json entry now declares ^6.21.2 (and the same mismatch exists for packages/oauth). In the CI/frozen-lockfile context, pnpm treats a lockfile that is out of sync with the manifest as an install failure, and if installed from this lockfile it also keeps resolving the older 6.21.0 release instead of the patched range; please regenerate pnpm-lock.yaml after the package.json change.
Useful? React with 👍 / 👎.
| process.env['https_proxy']; | ||
|
|
||
| if (!hasProxy) { | ||
| proxyFetch = fetch; |
There was a problem hiding this comment.
When no proxy variables are set, this caches whichever globalThis.fetch is present on the first call and reuses it forever. Existing OAuth tests and SDK consumers stub or replace globalThis.fetch per call/test; after the first request, later requests in the same process still go through the stale stub instead of the current global fetch, whereas the old direct fetch(...) path always honored the replacement. Return fetch directly in the no-proxy branch (or use the same dynamic-global delegation as the proxy wrapper), and mirror the fix in packages/kosong/src/proxy.ts.
Useful? React with 👍 / 👎.
1 participant
Related Issue
Resolve #104 #203
Problem
no proxy support
What changed
Support
HTTP_PROXY,HTTPS_PROXY, andNO_PROXYfor LLM and OAuth requests.undici'sEnvHttpProxyAgentwhen proxy env vars are set; otherwise uses globalfetchwith no overhead.NO_PROXYdefaults tolocalhost,127.0.0.1when not set.Why:
undiciis already a dependency in bothkosongandoauth, so this adds proxy support without new dependencies. The helper is duplicated across the two packages (they don't depend on each other) with cross-reference comments to keep them in sync.Checklist
gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.