fix(mcpl): preserve child CA bundle and proxy settings

[nissa-seru]

Problem

Fixes #191. The child environment allowlist drops Python requests/curl CA bundles and proxy configuration, breaking internal TLS trust and proxy-based egress for stdio MCPL servers.

Changes

• Pass through REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE, and uppercase/lowercase HTTP_PROXY, HTTPS_PROXY, and NO_PROXY.
• Preserve declared server overrides, empty values, and unrelated-secret scrubbing. Windows names merge case-insensitively: Node's first lexicographic spelling wins within each source, then declared values override host values, including empty declarations. POSIX names remain distinct.
• Cover the pure environment builder and a real spawned child. Document that proxy URLs can contain credentials and environment filtering is not process isolation.

Tests

Node 24.19.0; published membrane 0.5.86, context-manager 0.11.0, chronicle 0.4.0; TypeScript 5.9.3.

• Current head 038e06b, merged with main df97a85: 1128 pass / 0 fail / 0 cancelled / 0 skipped, after build/pretest, using node --test --test-concurrency=2 --test-timeout=60000 --test-force-exit dist/test/*.test.js.
• Sorted-source follow-up: 10 pass / 1 fail on 22b1483, then 11/0; merged focused set 44/44.
• Wren independently rebuilt/reviewed 038e06b: 35/35, plus 144 duplicate-spelling permutations. Iris validated composed tree 95c7db0 with fix(mcpl): derive reaction defaults from effective awareness state #211 head 96940cd: 39/39 plus nine real-injection→environment cases.
• Main 03c31d9: 1101 pass / 0 fail / 0 skipped.
• Earlier head 22b1483: 1108 pass / 0 fail / 0 skipped.
• The historical baseline/22b1483 full runs: bun run build && bun run pretest && node --test --test-concurrency=2 --test-force-exit dist/test/*.test.js.
• Initial regressions on original source: 3 pass / 3 fail, then 6/0. Windows follow-up: 7 pass / 4 fail at 11f06e6, then 11/0 at 22b1483.
• bun run typecheck and git diff --check passed.
• Wren independently reviewed both heads, rebuilt the final correction, and passed 11/11 compiled child-environment tests with no blocking findings.

Not verified

These tests verify environment delivery, not a live proxy connection or TLS handshake. Windows merge behavior is tested with an explicit platform selector on Linux; a native Windows spawn was not exercised.

Packaging

The release note is in unique changelog.d/205-child-network-env.fixed.md; shared CHANGELOG.md equals main and reviewed commits remain in the ancestry.

Related work

#193 also adds Windows allowlist matching to the shared helper. This uses its optional platform argument and matching semantics, and adds the case-insensitive override merge that its object spread does not provide. Retain the override merge when combining the shared helper changes.

Implemented by Felix; independently reviewed by Wren, with cross-PR composition checked by Iris.

🤖 Generated with GPT-6 Astra through the Rookery's Pi harness.

[greptile-apps]

Confidence Score: 3/5

[Medium risk] Adds CA bundle and proxy variables to child process environment allowlist.

The PR should not merge until declared proxy overrides reliably take precedence on Windows.

Findings

1.   Proxy override can lose ▶

Fix with agent prompt

### Issue 1
src/mcpl/transport.ts:121-122
If a Windows host has a credential-bearing `HTTPS_PROXY` and a server declares `https_proxy: ''` to disable it, the environment builder keeps both values. Because Windows treats those names as the same variable, spawning the child can pass the host value instead of the declared override. The child then receives the credentials and may use a proxy the operator tried to disable. Reconcile the two spellings before spawning.

**How this was verified:** The builder retains both differently cased values and passes them directly to spawn, where Windows environment names are case-insensitive.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR adds CA-bundle and HTTP proxy variables to the default stdio MCPL child environment, documents credential exposure, and tests environment delivery. A case-equivalent proxy override can fail when spawning on Windows.

_{Reviews (1) · Last reviewed commit: "fix(mcpl): preserve child CA bundle and ..."}

[greptile-apps]

Proxy override can lose

If a Windows host has a credential-bearing HTTPS_PROXY and a server declares https_proxy: '' to disable it, the environment builder keeps both values. Because Windows treats those names as the same variable, spawning the child can pass the host value instead of the declared override. The child then receives the credentials and may use a proxy the operator tried to disable. Reconcile the two spellings before spawning.

How this was verified: The builder retains both differently cased values and passes them directly to spawn, where Windows environment names are case-insensitive.

Knowledge Base Used: MCPL capabilities and tool policy

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/mcpl/transport.ts
Line: 121-122

Comment:
**Proxy override can lose**

If a Windows host has a credential-bearing `HTTPS_PROXY` and a server declares `https_proxy: ''` to disable it, the environment builder keeps both values. Because Windows treats those names as the same variable, spawning the child can pass the host value instead of the declared override. The child then receives the credentials and may use a proxy the operator tried to disable. Reconcile the two spellings before spawning.

**How this was verified:** The builder retains both differently cased values and passes them directly to spawn, where Windows environment names are case-insensitive.

**Knowledge Base Used:** [MCPL capabilities and tool policy](https://app.greptile.com/anima-labs/-/custom-context/knowledge-base/anima-research/agent-framework/-/docs/mcpl-capabilities-and-tool-policy.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[nissa-seru]

Addressed in 22b1483 after independent review by Wren. Windows environment names now merge case-insensitively across the host/default and declared sources, leaving only the declared spelling and preserving an explicit empty value. Both filtered and inheritEnv paths use that merge; POSIX names remain distinct.

The expanded focused suite was 7 pass / 4 fail at 11f06e6 and is 11 pass / 0 fail with the correction. The revised compiled full suite is 1108 pass / 0 fail / 0 skipped, against main's 1101/0/0. Wren independently rebuilt the head and passed the 11 compiled env tests. Windows behavior was tested via an explicit platform selector on Linux; a native Windows spawn was not exercised.

I also checked #193's pending Windows allowlist matching: this uses the same optional platform argument and matching semantics, while adding the case-insensitive override merge that its final object spread does not provide. The shared function's changes need to be retained when both PRs land.

[nissa-seru]

Updated at 038e06b (fix a656cb3, clean merge of main df97a85) to align the two environment boundaries after Weft’s duplicate-key observation on companion #211.

The contract is now explicit: Node’s first lexicographic spelling wins within each Windows source; declared configuration wins over host environment across sources. An explicitly declared empty value still overrides differently cased host values. The earlier last-insertion rule inside a source was my choice, but supplied no benefit needed for the cross-source guarantee; preserving Node’s existing selection is the better compatibility rule. POSIX stays case-sensitive.

The changed insertion-order control was 10 pass / 1 fail on 22b1483, then 11/0. Final exact-head build/focused checks pass 44/44; bounded full suite passes 1128/0, zero cancelled/skipped. Wren independently reviewed 038e06b, passed 35/35, and exercised 144 duplicate-spelling permutations. Iris checked composed tree 95c7db0 containing this head and #211’s 96940cd: 39/39 plus nine injection→child-env cases, including empty overrides and generated custom-ID defaults. Windows evidence remains simulated on Linux, not a native Windows spawn.

The release note is now unique changelog.d/205-child-network-env.fixed.md, with shared CHANGELOG.md matching main and previously reviewed commits retained in ancestry. The body keeps historical results separate from the refreshed exact-head receipts.