deepseek-harness/packages/util/http-proxy/tests/policy.spec.ts

import { describe, expect, it } from 'vitest'
import { createLaunchEnvironmentSnapshot } from '@deepseek-ai/dsh-launch-environment'
import {
  bypassesProxy,
  isLoopbackHost,
  proxyForUrl,
  resolveProxyPolicy,
  DIRECT_POLICY,
} from '../src/policy.ts'

const PROXY = 'http://127.0.0.1:7897'
const OTHER = 'http://127.0.0.1:8080'

function env(values: Record<string, string>): ReturnType<typeof createLaunchEnvironmentSnapshot> {
  return createLaunchEnvironmentSnapshot([{ source: 'process', values }])
}

/** Windows folds environment names, so a case distinction cannot be expressed there at all. */
const FOLDS_ENV_CASE = process.platform === 'win32'

describe('loopback routing', () => {
  const proxied = { httpProxy: PROXY, httpsProxy: PROXY, noProxy: '', source: 'env' } as const

  // The published bypass list carries four literal entries for the consumers that read an
  // environment. Matching only those left the rest of `127.0.0.0/8` — including the resolver stub
  // at `127.0.0.53` — routed through a proxy that could then reach it on the caller's behalf.
  it.each([
    '127.0.0.1', '127.0.0.2', '127.0.0.53', '127.255.255.254',
    'localhost', 'app.localhost', '[::1]', '[::ffff:127.0.0.1]', '0.0.0.0',
  ])('never routes %s through a proxy', (host) => {
    expect(proxyForUrl(proxied, new URL(`http://${host}:8080/`))).toBeUndefined()
  })

  it.each(['128.0.0.1', '10.0.0.5', '[::ffff:10.0.0.1]', 'notlocalhost', 'example.com'])(
    'still routes %s, which is not this machine',
    (host) => {
      expect(proxyForUrl(proxied, new URL(`http://${host}:8080/`))).toBe(PROXY)
    },
  )

  it('rejects an out-of-range octet rather than reading it as loopback', () => {
    expect(isLoopbackHost('127.999.1.1')).toBe(false)
    expect(isLoopbackHost('1270.0.0.1')).toBe(false)
  })

  it('reads an IPv4-mapped address in either spelling', () => {
    // A URL normalizes the dotted tail into hex groups, but a caller reading a bypass list or a
    // configuration value has the dotted form in hand, and both name the same address.
    expect(isLoopbackHost('::ffff:127.0.0.1')).toBe(true)
    expect(isLoopbackHost('::ffff:7f00:1')).toBe(true)
    expect(isLoopbackHost('::ffff:10.0.0.1')).toBe(false)
    expect(isLoopbackHost('::ffff:a00:1')).toBe(false)
  })
})

describe('resolveProxyPolicy', () => {
  it('resolves nothing when the environment carries no proxy', () => {
    const { policy, diagnostics } = resolveProxyPolicy(env({}))
    expect(policy).toEqual(DIRECT_POLICY)
    expect(diagnostics).toEqual([])
  })

  it('reads both schemes and merges loopback into the bypass list', () => {
    const { policy } = resolveProxyPolicy(env({ HTTP_PROXY: PROXY, HTTPS_PROXY: OTHER, NO_PROXY: 'example.com' }))
    expect(policy.httpProxy).toBe(PROXY)
    expect(policy.httpsProxy).toBe(OTHER)
    expect(policy.noProxy).toBe('example.com,localhost,127.0.0.1,::1,[::1]')
    expect(policy.source).toBe('env')
  })

  it('prefers the lowercase name, matching undici', () => {
    const { policy } = resolveProxyPolicy(env({ http_proxy: PROXY, HTTP_PROXY: OTHER }))
    // Windows has no such preference to express: the launch snapshot folds names, so the two
    // spellings are one variable there and the later entry is simply the value. Asserted rather
    // than skipped, so a change to that folding fails here instead of passing unnoticed.
    expect(policy.httpProxy).toBe(FOLDS_ENV_CASE ? OTHER : PROXY)
  })

  it('treats a blank lowercase value as unset instead of letting it shadow the uppercase one', () => {
    const { policy } = resolveProxyPolicy(env({ http_proxy: '   ', HTTP_PROXY: PROXY }))
    expect(policy.httpProxy).toBe(PROXY)
  })

  it('leaves http direct when only the https variable is set', () => {
    // The reverse of the HTTP-only case: the fallback runs one way, so naming only HTTPS proxies
    // that scheme alone and every `http:` request stays direct.
    const { policy } = resolveProxyPolicy(env({ HTTPS_PROXY: PROXY }))
    expect(policy.httpProxy).toBeUndefined()
    expect(policy.httpsProxy).toBe(PROXY)
    expect(proxyForUrl(policy, new URL('http://example.com/'))).toBeUndefined()
    expect(proxyForUrl(policy, new URL('https://example.com/'))).toBe(PROXY)
  })

  it('backs both schemes with ALL_PROXY, which neither Node nor undici reads', () => {
    const { policy } = resolveProxyPolicy(env({ ALL_PROXY: PROXY }))
    expect(policy.httpProxy).toBe(PROXY)
    expect(policy.httpsProxy).toBe(PROXY)
  })

  it('lets a scheme-specific value outrank ALL_PROXY', () => {
    const { policy } = resolveProxyPolicy(env({ ALL_PROXY: PROXY, HTTPS_PROXY: OTHER }))
    expect(policy.httpProxy).toBe(PROXY)
    expect(policy.httpsProxy).toBe(OTHER)
  })

  it('falls HTTPS back to the HTTP proxy last, so the dispatcher and proxyForUrl agree', () => {
    const { policy } = resolveProxyPolicy(env({ HTTP_PROXY: PROXY }))
    expect(policy.httpsProxy).toBe(PROXY)
  })

  it('keeps a bypass list of * unchanged', () => {
    const { policy } = resolveProxyPolicy(env({ HTTP_PROXY: PROXY, NO_PROXY: '*' }))
    expect(policy.noProxy).toBe('*')
  })

  it('does not repeat a loopback entry the user already listed', () => {
    const { policy } = resolveProxyPolicy(env({ HTTP_PROXY: PROXY, NO_PROXY: 'localhost, 127.0.0.1' }))
    expect(policy.noProxy).toBe('localhost,127.0.0.1,::1,[::1]')
  })

  it('keeps a scheme direct when its own value was refused, rather than falling back', () => {
    const { policy, diagnostics } = resolveProxyPolicy(env({ HTTPS_PROXY: 'socks5://127.0.0.1:1080', HTTP_PROXY: PROXY }))
    expect(policy.httpProxy).toBe(PROXY)
    // The diagnostic says HTTPS connects directly; the route must agree rather than borrowing the
    // HTTP proxy the user never named for HTTPS.
    expect(policy.httpsProxy).toBeUndefined()
    expect(proxyForUrl(policy, new URL('https://example.com/'))).toBeUndefined()
    expect(diagnostics[0]?.message).toMatch(/connecting directly for that scheme/)
  })

  it('keeps a scheme direct when its own value was malformed, past ALL_PROXY too', () => {
    const { policy } = resolveProxyPolicy(env({ HTTPS_PROXY: 'not a url', ALL_PROXY: PROXY }))
    expect(policy.httpProxy).toBe(PROXY)
    expect(policy.httpsProxy).toBeUndefined()
  })

  it('reports a SOCKS proxy instead of silently ignoring it', () => {
    const { policy, diagnostics } = resolveProxyPolicy(env({ HTTP_PROXY: 'socks5://127.0.0.1:7890' }))
    expect(policy).toEqual(DIRECT_POLICY)
    expect(diagnostics).toHaveLength(1)
    expect(diagnostics[0]?.kind).toBe('socks')
    expect(diagnostics[0]?.message).toMatch(/SOCKS proxy, which is not supported/)
  })

  it('reports an unparseable proxy URL', () => {
    const { policy, diagnostics } = resolveProxyPolicy(env({ HTTP_PROXY: 'not a url' }))
    expect(policy).toEqual(DIRECT_POLICY)
    expect(diagnostics[0]?.kind).toBe('invalid')
    // The origin names the spelling resolution asked for, which on a folded environment is the
    // lowercase one it tries first — the same variable the user set, reported in the other case.
    expect(diagnostics[0]?.origin).toBe(FOLDS_ENV_CASE ? 'http_proxy' : 'HTTP_PROXY')
  })

  it('reports a proxy URL whose scheme is neither http(s) nor SOCKS', () => {
    const { diagnostics } = resolveProxyPolicy(env({ HTTP_PROXY: 'ftp://proxy.example' }))
    expect(diagnostics[0]?.message).toMatch(/unsupported ftp:\/\/ scheme/)
  })

})

describe('bypassesProxy', () => {
  const cases: [string, string, boolean][] = [
    ['example.com', 'http://example.com/a', true],
    ['example.com', 'http://sub.example.com/a', true],
    ['example.com', 'http://notexample.com/a', false],
    ['.example.com', 'http://sub.example.com/a', true],
    ['*.example.com', 'http://sub.example.com/a', true],
    ['example.com', 'http://example.com./a', true],
    ['*', 'http://anything.example/a', true],
    ['example.com:8080', 'http://example.com:8080/a', true],
    ['example.com:8080', 'http://example.com:9090/a', false],
    ['example.com:80', 'http://example.com/a', true],
    ['example.com:443', 'https://example.com/a', true],
    ['EXAMPLE.com', 'http://example.COM/a', true],
    ['localhost', 'http://localhost:3000/a', true],
    ['127.0.0.1', 'http://127.0.0.1:7777/a', true],
  ]
  it.each(cases)('bypass %j against %j is %s', (noProxy, url, expected) => {
    expect(bypassesProxy(noProxy, new URL(url))).toBe(expected)
  })

  it('bypasses a bare IPv6 loopback, which undici reads as host ":" port "1"', () => {
    expect(bypassesProxy('::1', new URL('http://[::1]:3000/a'))).toBe(true)
  })

  it('bypasses the bracketed IPv6 form as well', () => {
    expect(bypassesProxy('[::1]', new URL('http://[::1]/a'))).toBe(true)
  })

  it('honors a port on a bracketed IPv6 entry', () => {
    expect(bypassesProxy('[::1]:3000', new URL('http://[::1]:3000/a'))).toBe(true)
    expect(bypassesProxy('[::1]:3000', new URL('http://[::1]:4000/a'))).toBe(false)
  })

  it('does not match CIDR notation, so an OS bypass list must be rewritten as suffixes', () => {
    expect(bypassesProxy('10.0.0.0/8', new URL('http://10.1.2.3/a'))).toBe(false)
  })

  it('skips blank and bracket-only entries', () => {
    expect(bypassesProxy(' , , [ , .', new URL('http://example.com/a'))).toBe(false)
  })
})

describe('proxyForUrl', () => {
  const { policy } = resolveProxyPolicy(env({ HTTP_PROXY: PROXY, HTTPS_PROXY: OTHER, NO_PROXY: 'direct.example' }))

  it('routes http through the http proxy', () => {
    expect(proxyForUrl(policy, new URL('http://example.com/'))).toBe(PROXY)
  })

  it('routes https through the https proxy', () => {
    expect(proxyForUrl(policy, new URL('https://example.com/'))).toBe(OTHER)
  })

  it('returns nothing for a bypassed host', () => {
    expect(proxyForUrl(policy, new URL('https://direct.example/'))).toBeUndefined()
  })

  it('returns nothing for loopback, which is always bypassed', () => {
    expect(proxyForUrl(policy, new URL('http://127.0.0.1:9000/'))).toBeUndefined()
  })

  it('returns nothing for a non-http scheme', () => {
    expect(proxyForUrl(policy, new URL('ws://example.com/'))).toBeUndefined()
  })

  it('returns nothing under a direct policy', () => {
    expect(proxyForUrl(DIRECT_POLICY, new URL('https://example.com/'))).toBeUndefined()
  })
})