From d2ae9a84b63e73bd32d650eb25dc6b49c4d93780 Mon Sep 17 00:00:00 2001 From: Lstarsky0 <59827030+Lstarsky0@users.noreply.github.com> Date: Tue, 13 Oct 2026 21:03:28 +0800 Subject: [PATCH] test(tui): fifteen more loopback fixtures stay out of an ambient proxy #6971 fixed two tests whose NO_PROXY=* guard did not cover their 127.0.0.1 fixture: the proxy matcher applies `*` to host names only and checks an IP literal against the address entries alone. The same guard is in other tests. Behind a local proxy that forwards to loopback they still pass, which is why only two showed up there. Behind one that does not (HTTP_PROXY and HTTPS_PROXY pointing at a closed port, NO_PROXY=localhost,127.0.0.1,::1 in the environment) twenty tests fail on main that pass without the proxy variables. Each replaces a NO_PROXY that already exempted its fixture with one that does not. Fifteen of them now set `*,127.0.0.1`: the wildcard stays for host names and the fixture's address is added. The other five are in mcp/oauth.rs, which this change leaves alone. Two guards in mcp/http_client.rs also stay as they are; their tests pass behind the same proxy. Signed-off-by: Lstarsky0 <59827030+Lstarsky0@users.noreply.github.com> --- crates/tui/src/mcp/http_client.rs | 12 ++++++------ crates/tui/src/mcp/sse.rs | 4 ++-- crates/tui/src/mcp/tests.rs | 6 +++--- crates/tui/src/runtime_api/tests.rs | 4 ++-- crates/tui/src/tui/ui/tests.rs | 4 ++-- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/crates/tui/src/mcp/http_client.rs b/crates/tui/src/mcp/http_client.rs index d4ead66f45..dc96721503 100644 --- a/crates/tui/src/mcp/http_client.rs +++ b/crates/tui/src/mcp/http_client.rs @@ -836,7 +836,7 @@ mod tests { #[tokio::test] async fn loopback_mcp_credentials_keep_live_auth_and_protocol_framing() { let _env = crate::test_support::lock_test_env(); - let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); crate::tls::ensure_rustls_crypto_provider(); let _token = crate::test_support::EnvVarGuard::set("CODEWHALE_TEST_MCP_TLS_BEARER", "fixture-token"); @@ -880,7 +880,7 @@ mod tests { #[tokio::test] async fn oauth_form_credentials_refuse_http_redirect_before_destination_resolution() { let _env = crate::test_support::lock_test_env(); - let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); crate::tls::ensure_rustls_crypto_provider(); let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); let url = format!("http://{}/token", listener.local_addr().unwrap()); @@ -950,7 +950,7 @@ mod tests { #[tokio::test] async fn shared_guard_rechecks_same_origin_redirect_before_any_second_write() { let _env = crate::test_support::lock_test_env(); - let _proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); let url = format!("http://{}/mcp", listener.local_addr().unwrap()); let server = tokio::spawn(async move { @@ -1037,7 +1037,7 @@ mod tests { #[tokio::test] async fn operator_origin_remains_usable_but_does_not_authorize_private_redirects() { let _env = crate::test_support::lock_test_env(); - let _proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let destination = TcpListener::bind("127.0.0.1:0").await.unwrap(); for status in [301, 302, 303, 307, 308] { let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); @@ -1070,7 +1070,7 @@ mod tests { #[tokio::test] async fn redirect_stop_returns_response_without_following_even_same_origin() { let _env = crate::test_support::lock_test_env(); - let _proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); let addr = listener.local_addr().unwrap(); let url = format!("http://{addr}/token"); @@ -1409,7 +1409,7 @@ mod tests { #[tokio::test] async fn raw_oauth_execute_does_not_inherit_bound_mcp_credentials() { let _env = crate::test_support::lock_test_env(); - let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); crate::tls::ensure_rustls_crypto_provider(); let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); let origin = format!("http://{}", listener.local_addr().unwrap()); diff --git a/crates/tui/src/mcp/sse.rs b/crates/tui/src/mcp/sse.rs index 30f9cf66f8..2749a73b98 100644 --- a/crates/tui/src/mcp/sse.rs +++ b/crates/tui/src/mcp/sse.rs @@ -404,7 +404,7 @@ mod endpoint_tests { async fn event_stream_outlives_the_request_read_timeout() { use crate::mcp::McpTransport as _; let _env = crate::test_support::lock_test_env(); - let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); // A quiet stream for longer than read_timeout is healthy, not dead. let url = serve_sse_stream( vec![( @@ -427,7 +427,7 @@ mod endpoint_tests { async fn closed_event_stream_reads_as_dead() { use crate::mcp::McpTransport as _; let _env = crate::test_support::lock_test_env(); - let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let url = serve_sse_stream(Vec::new(), true).await; let transport = connect_with_read_timeout(url, Duration::from_secs(5)).await; let deadline = tokio::time::Instant::now() + Duration::from_secs(5); diff --git a/crates/tui/src/mcp/tests.rs b/crates/tui/src/mcp/tests.rs index 9c779273f8..ffcbabe503 100644 --- a/crates/tui/src/mcp/tests.rs +++ b/crates/tui/src/mcp/tests.rs @@ -6312,7 +6312,7 @@ async fn legacy_sse_closed_stream_reports_unknown_outcome_and_reconnects_without // tests do, so this server is always reached directly. let _env = crate::test_support::lock_test_env(); let _lock = lock_mcp_loopback_tests().await; - let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); let addr = listener.local_addr().unwrap(); let active_sse = Arc::new(Mutex::new(None::>>)); @@ -6512,7 +6512,7 @@ async fn fallback_sse_stream_closed_while_idle_reconnects_before_dispatch() { let _env = crate::test_support::lock_test_env(); let _lock = lock_mcp_loopback_tests().await; - let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); let addr = listener.local_addr().unwrap(); let active_sse = Arc::new(Mutex::new(None::>>)); @@ -6743,7 +6743,7 @@ async fn custom_headers_applied_to_get_preflight() { // The fixture client honors an operator-configured proxy; pin loopback // out of any ambient proxy so a concurrent proxy-configuring test can // never route this GET away from the fixture server. - let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _no_proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); let addr = listener.local_addr().unwrap(); // The test signals success by writing to this flag — the GET handler diff --git a/crates/tui/src/runtime_api/tests.rs b/crates/tui/src/runtime_api/tests.rs index 64a1046550..75705f64ce 100644 --- a/crates/tui/src/runtime_api/tests.rs +++ b/crates/tui/src/runtime_api/tests.rs @@ -4286,7 +4286,7 @@ async fn turn_operation_lookup_is_authenticated_read_only_and_survives_restart() let workspace = dir.path().join("workspace"); let token = "turn-lookup-local-fixture"; let _backend = EnvVarGuard::set("CODEWHALE_SECRET_BACKEND", "file"); - let _proxy = EnvVarGuard::set("NO_PROXY", "*"); + let _proxy = EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let (addr, manager, server) = spawn_test_server_with_root_token_mobile_workspace( root.clone(), sessions.clone(), @@ -19445,7 +19445,7 @@ async fn native_notification_replay_rechecks_requests_settled_during_the_read() let temp = tempfile::tempdir()?; let _home = EnvVarGuard::set("CODEWHALE_HOME", temp.path().join("home")); let _backend = EnvVarGuard::set("CODEWHALE_SECRET_BACKEND", "file"); - let _proxy = EnvVarGuard::set("NO_PROXY", "*"); + let _proxy = EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let path = temp.path().join("config.toml"); fs::write( &path, diff --git a/crates/tui/src/tui/ui/tests.rs b/crates/tui/src/tui/ui/tests.rs index a0c572737a..51d65faa0c 100644 --- a/crates/tui/src/tui/ui/tests.rs +++ b/crates/tui/src/tui/ui/tests.rs @@ -3176,7 +3176,7 @@ async fn mcp_login_stalled_discovery_is_cancellable_and_repeat_clicks_keep_one_o let temp = tempfile::tempdir().unwrap(); let _home = crate::test_support::EnvVarGuard::set("CODEWHALE_HOME", temp.path()); let _backend = crate::test_support::EnvVarGuard::set("CODEWHALE_SECRET_BACKEND", "file"); - let _proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*"); + let _proxy = crate::test_support::EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap(); let mut app = create_test_app(); app.workspace = temp.path().to_path_buf(); @@ -20230,7 +20230,7 @@ async fn redaction_confirmation_restores_history_before_first_local_provider_req let _lock = lock_test_env(); let temp = tempfile::tempdir().unwrap(); let _home = EnvVarGuard::set("CODEWHALE_HOME", temp.path()); - let _proxy = EnvVarGuard::set("NO_PROXY", "*"); + let _proxy = EnvVarGuard::set("NO_PROXY", "*,127.0.0.1"); let server = MockServer::builder() .body_print_limit(wiremock::BodyPrintLimit::Limited(0)) .start()