fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars by XXPermanentXX · Pull Request #50 · modelstudioai/cli

XXPermanentXX · 2026-06-12T06:25:17Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear usage error (Invalid proxy configuration: … + hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline)

tests/proxy.test.ts: env parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: spins up a local CONNECT proxy and targets a .invalid host (guaranteed unresolvable, no real network traffic). Verifies:
- with HTTPS_PROXY set, CLI traffic tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All 10 tests pass.

🤖 Generated with Claude Code

Node's built-in fetch (undici) ignores proxy environment variables, so bl bypassed VPN / corporate proxies and failed with ECONNRESET. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Values are trimmed and passed explicitly to work around undici reading env vars with `??`, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline: unit tests cover env parsing, and e2e tests drive a local CONNECT proxy against a .invalid host to verify traffic routes through the proxy, NO_PROXY is honored, and no dispatcher is installed when no proxy is configured. Fixes#35 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app list resolves a console credential before issuing any request, so in CI (no ~/.bailian/config.json, no credentials) it exited with an AUTH error before fetch ran — the proxy received zero CONNECTs and the "routes through proxy" assertions failed. Locally these passed only because a real config.json supplied a token. Inject a fake DASHSCOPE_ACCESS_TOKEN (highest-priority credential source) so the request is actually issued and intercepted by the local CONNECT proxy. The target stays a .invalid host, so still no real network traffic.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX · 2026-06-12T06:54:39Z

Superseded by #51, which rebuilds these changes cleanly on top of main (the history here got tangled). The proxy e2e test was also rewritten to test the proxy in isolation — it no longer drives app list and needs no credentials in CI.

XXPermanentXX · 2026-06-12T06:25:17Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear usage error (Invalid proxy configuration: … + hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline)

tests/proxy.test.ts: env parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: spins up a local CONNECT proxy and targets a .invalid host (guaranteed unresolvable, no real network traffic). Verifies:
- with HTTPS_PROXY set, CLI traffic tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All 10 tests pass.

🤖 Generated with Claude Code

Node's built-in fetch (undici) ignores proxy environment variables, so bl bypassed VPN / corporate proxies and failed with ECONNRESET. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Values are trimmed and passed explicitly to work around undici reading env vars with `??`, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline: unit tests cover env parsing, and e2e tests drive a local CONNECT proxy against a .invalid host to verify traffic routes through the proxy, NO_PROXY is honored, and no dispatcher is installed when no proxy is configured. Fixes#35 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app list resolves a console credential before issuing any request, so in CI (no ~/.bailian/config.json, no credentials) it exited with an AUTH error before fetch ran — the proxy received zero CONNECTs and the "routes through proxy" assertions failed. Locally these passed only because a real config.json supplied a token. Inject a fake DASHSCOPE_ACCESS_TOKEN (highest-priority credential source) so the request is actually issued and intercepted by the local CONNECT proxy. The target stays a .invalid host, so still no real network traffic.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX · 2026-06-12T06:54:39Z

Superseded by #51, which rebuilds these changes cleanly on top of main (the history here got tangled). The proxy e2e test was also rewritten to test the proxy in isolation — it no longer drives app list and needs no credentials in CI.

XXPermanentXX · 2026-06-12T06:25:17Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear usage error (Invalid proxy configuration: … + hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline)

tests/proxy.test.ts: env parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: spins up a local CONNECT proxy and targets a .invalid host (guaranteed unresolvable, no real network traffic). Verifies:
- with HTTPS_PROXY set, CLI traffic tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All 10 tests pass.

🤖 Generated with Claude Code

Node's built-in fetch (undici) ignores proxy environment variables, so bl bypassed VPN / corporate proxies and failed with ECONNRESET. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Values are trimmed and passed explicitly to work around undici reading env vars with `??`, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline: unit tests cover env parsing, and e2e tests drive a local CONNECT proxy against a .invalid host to verify traffic routes through the proxy, NO_PROXY is honored, and no dispatcher is installed when no proxy is configured. Fixes#35 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app list resolves a console credential before issuing any request, so in CI (no ~/.bailian/config.json, no credentials) it exited with an AUTH error before fetch ran — the proxy received zero CONNECTs and the "routes through proxy" assertions failed. Locally these passed only because a real config.json supplied a token. Inject a fake DASHSCOPE_ACCESS_TOKEN (highest-priority credential source) so the request is actually issued and intercepted by the local CONNECT proxy. The target stays a .invalid host, so still no real network traffic.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX · 2026-06-12T06:54:39Z

Superseded by #51, which rebuilds these changes cleanly on top of main (the history here got tangled). The proxy e2e test was also rewritten to test the proxy in isolation — it no longer drives app list and needs no credentials in CI.

XXPermanentXX · 2026-06-12T06:25:17Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear usage error (Invalid proxy configuration: … + hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline)

tests/proxy.test.ts: env parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: spins up a local CONNECT proxy and targets a .invalid host (guaranteed unresolvable, no real network traffic). Verifies:
- with HTTPS_PROXY set, CLI traffic tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All 10 tests pass.

🤖 Generated with Claude Code

Node's built-in fetch (undici) ignores proxy environment variables, so bl bypassed VPN / corporate proxies and failed with ECONNRESET. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Values are trimmed and passed explicitly to work around undici reading env vars with `??`, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline: unit tests cover env parsing, and e2e tests drive a local CONNECT proxy against a .invalid host to verify traffic routes through the proxy, NO_PROXY is honored, and no dispatcher is installed when no proxy is configured. Fixes#35 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app list resolves a console credential before issuing any request, so in CI (no ~/.bailian/config.json, no credentials) it exited with an AUTH error before fetch ran — the proxy received zero CONNECTs and the "routes through proxy" assertions failed. Locally these passed only because a real config.json supplied a token. Inject a fake DASHSCOPE_ACCESS_TOKEN (highest-priority credential source) so the request is actually issued and intercepted by the local CONNECT proxy. The target stays a .invalid host, so still no real network traffic.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX · 2026-06-12T06:54:39Z

Superseded by #51, which rebuilds these changes cleanly on top of main (the history here got tangled). The proxy e2e test was also rewritten to test the proxy in isolation — it no longer drives app list and needs no credentials in CI.

XXPermanentXX · 2026-06-12T06:25:17Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear usage error (Invalid proxy configuration: … + hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline)

tests/proxy.test.ts: env parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: spins up a local CONNECT proxy and targets a .invalid host (guaranteed unresolvable, no real network traffic). Verifies:
- with HTTPS_PROXY set, CLI traffic tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All 10 tests pass.

🤖 Generated with Claude Code

Node's built-in fetch (undici) ignores proxy environment variables, so bl bypassed VPN / corporate proxies and failed with ECONNRESET. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Values are trimmed and passed explicitly to work around undici reading env vars with `??`, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline: unit tests cover env parsing, and e2e tests drive a local CONNECT proxy against a .invalid host to verify traffic routes through the proxy, NO_PROXY is honored, and no dispatcher is installed when no proxy is configured. Fixes#35 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app list resolves a console credential before issuing any request, so in CI (no ~/.bailian/config.json, no credentials) it exited with an AUTH error before fetch ran — the proxy received zero CONNECTs and the "routes through proxy" assertions failed. Locally these passed only because a real config.json supplied a token. Inject a fake DASHSCOPE_ACCESS_TOKEN (highest-priority credential source) so the request is actually issued and intercepted by the local CONNECT proxy. The target stays a .invalid host, so still no real network traffic.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX · 2026-06-12T06:54:39Z

Superseded by #51, which rebuilds these changes cleanly on top of main (the history here got tangled). The proxy e2e test was also rewritten to test the proxy in isolation — it no longer drives app list and needs no credentials in CI.

XXPermanentXX · 2026-06-12T06:25:17Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear usage error (Invalid proxy configuration: … + hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline)

tests/proxy.test.ts: env parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: spins up a local CONNECT proxy and targets a .invalid host (guaranteed unresolvable, no real network traffic). Verifies:
- with HTTPS_PROXY set, CLI traffic tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All 10 tests pass.

🤖 Generated with Claude Code

Node's built-in fetch (undici) ignores proxy environment variables, so bl bypassed VPN / corporate proxies and failed with ECONNRESET. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Values are trimmed and passed explicitly to work around undici reading env vars with `??`, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline: unit tests cover env parsing, and e2e tests drive a local CONNECT proxy against a .invalid host to verify traffic routes through the proxy, NO_PROXY is honored, and no dispatcher is installed when no proxy is configured. Fixes#35 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app list resolves a console credential before issuing any request, so in CI (no ~/.bailian/config.json, no credentials) it exited with an AUTH error before fetch ran — the proxy received zero CONNECTs and the "routes through proxy" assertions failed. Locally these passed only because a real config.json supplied a token. Inject a fake DASHSCOPE_ACCESS_TOKEN (highest-priority credential source) so the request is actually issued and intercepted by the local CONNECT proxy. The target stays a .invalid host, so still no real network traffic.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX · 2026-06-12T06:54:39Z

Superseded by #51, which rebuilds these changes cleanly on top of main (the history here got tangled). The proxy e2e test was also rewritten to test the proxy in isolation — it no longer drives app list and needs no credentials in CI.

XXPermanentXX · 2026-06-12T06:25:17Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear usage error (Invalid proxy configuration: … + hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline)

tests/proxy.test.ts: env parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: spins up a local CONNECT proxy and targets a .invalid host (guaranteed unresolvable, no real network traffic). Verifies:
- with HTTPS_PROXY set, CLI traffic tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All 10 tests pass.

🤖 Generated with Claude Code

Node's built-in fetch (undici) ignores proxy environment variables, so bl bypassed VPN / corporate proxies and failed with ECONNRESET. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Values are trimmed and passed explicitly to work around undici reading env vars with `??`, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline: unit tests cover env parsing, and e2e tests drive a local CONNECT proxy against a .invalid host to verify traffic routes through the proxy, NO_PROXY is honored, and no dispatcher is installed when no proxy is configured. Fixes#35 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app list resolves a console credential before issuing any request, so in CI (no ~/.bailian/config.json, no credentials) it exited with an AUTH error before fetch ran — the proxy received zero CONNECTs and the "routes through proxy" assertions failed. Locally these passed only because a real config.json supplied a token. Inject a fake DASHSCOPE_ACCESS_TOKEN (highest-priority credential source) so the request is actually issued and intercepted by the local CONNECT proxy. The target stays a .invalid host, so still no real network traffic.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX · 2026-06-12T06:54:39Z

Superseded by #51, which rebuilds these changes cleanly on top of main (the history here got tangled). The proxy e2e test was also rewritten to test the proxy in isolation — it no longer drives app list and needs no credentials in CI.

XXPermanentXX · 2026-06-12T06:25:17Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear usage error (Invalid proxy configuration: … + hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline)

tests/proxy.test.ts: env parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: spins up a local CONNECT proxy and targets a .invalid host (guaranteed unresolvable, no real network traffic). Verifies:
- with HTTPS_PROXY set, CLI traffic tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All 10 tests pass.

🤖 Generated with Claude Code

Node's built-in fetch (undici) ignores proxy environment variables, so bl bypassed VPN / corporate proxies and failed with ECONNRESET. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Values are trimmed and passed explicitly to work around undici reading env vars with `??`, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline: unit tests cover env parsing, and e2e tests drive a local CONNECT proxy against a .invalid host to verify traffic routes through the proxy, NO_PROXY is honored, and no dispatcher is installed when no proxy is configured. Fixes#35 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app list resolves a console credential before issuing any request, so in CI (no ~/.bailian/config.json, no credentials) it exited with an AUTH error before fetch ran — the proxy received zero CONNECTs and the "routes through proxy" assertions failed. Locally these passed only because a real config.json supplied a token. Inject a fake DASHSCOPE_ACCESS_TOKEN (highest-priority credential source) so the request is actually issued and intercepted by the local CONNECT proxy. The target stays a .invalid host, so still no real network traffic.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX · 2026-06-12T06:54:39Z

Superseded by #51, which rebuilds these changes cleanly on top of main (the history here got tangled). The proxy e2e test was also rewritten to test the proxy in isolation — it no longer drives app list and needs no credentials in CI.

XXPermanentXXand others added 4 commits June 12, 2026 14:24

chore(release): bump version to 1.3.1
0b7d4fb

chore: update r2v e2e test prompt and remove stale scheduled-tasks lock
0706cae

XXPermanentXX force-pushed the fix/proxy-env-support branch from dab4d33 to 712eb96Compare June 12, 2026 06:36

XXPermanentXX added 2 commits June 12, 2026 14:37

test: use leaf image prompt in video-ref r2v e2e
fe2d36e
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
ec96ef4
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) #51
Merged

XXPermanentXX closed this Jun 12, 2026

XXPermanentXX deleted the fix/proxy-env-support branch June 12, 2026 08:07

XXPermanentXXand others added 4 commits June 12, 2026 14:24

chore(release): bump version to 1.3.1
0b7d4fb

chore: update r2v e2e test prompt and remove stale scheduled-tasks lock
0706cae

XXPermanentXX force-pushed the fix/proxy-env-support branch from dab4d33 to 712eb96Compare June 12, 2026 06:36

XXPermanentXX added 2 commits June 12, 2026 14:37

test: use leaf image prompt in video-ref r2v e2e
fe2d36e
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
ec96ef4
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) #51
Merged

XXPermanentXX closed this Jun 12, 2026

XXPermanentXX deleted the fix/proxy-env-support branch June 12, 2026 08:07

XXPermanentXXand others added 4 commits June 12, 2026 14:24

chore(release): bump version to 1.3.1
0b7d4fb

chore: update r2v e2e test prompt and remove stale scheduled-tasks lock
0706cae

XXPermanentXX force-pushed the fix/proxy-env-support branch from dab4d33 to 712eb96Compare June 12, 2026 06:36

XXPermanentXX added 2 commits June 12, 2026 14:37

test: use leaf image prompt in video-ref r2v e2e
fe2d36e
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
ec96ef4
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) #51
Merged

XXPermanentXX closed this Jun 12, 2026

XXPermanentXX deleted the fix/proxy-env-support branch June 12, 2026 08:07

XXPermanentXXand others added 4 commits June 12, 2026 14:24

chore(release): bump version to 1.3.1
0b7d4fb

chore: update r2v e2e test prompt and remove stale scheduled-tasks lock
0706cae

XXPermanentXX force-pushed the fix/proxy-env-support branch from dab4d33 to 712eb96Compare June 12, 2026 06:36

XXPermanentXX added 2 commits June 12, 2026 14:37

test: use leaf image prompt in video-ref r2v e2e
fe2d36e
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
ec96ef4
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) #51
Merged

XXPermanentXX closed this Jun 12, 2026

XXPermanentXX deleted the fix/proxy-env-support branch June 12, 2026 08:07

XXPermanentXXand others added 4 commits June 12, 2026 14:24

chore(release): bump version to 1.3.1
0b7d4fb

chore: update r2v e2e test prompt and remove stale scheduled-tasks lock
0706cae

XXPermanentXX force-pushed the fix/proxy-env-support branch from dab4d33 to 712eb96Compare June 12, 2026 06:36

XXPermanentXX added 2 commits June 12, 2026 14:37

test: use leaf image prompt in video-ref r2v e2e
fe2d36e
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
ec96ef4
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) #51
Merged

XXPermanentXX closed this Jun 12, 2026

XXPermanentXX deleted the fix/proxy-env-support branch June 12, 2026 08:07

XXPermanentXXand others added 4 commits June 12, 2026 14:24

chore(release): bump version to 1.3.1
0b7d4fb

chore: update r2v e2e test prompt and remove stale scheduled-tasks lock
0706cae

XXPermanentXX force-pushed the fix/proxy-env-support branch from dab4d33 to 712eb96Compare June 12, 2026 06:36

XXPermanentXX added 2 commits June 12, 2026 14:37

test: use leaf image prompt in video-ref r2v e2e
fe2d36e
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
ec96ef4
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) #51
Merged

XXPermanentXX closed this Jun 12, 2026

XXPermanentXX deleted the fix/proxy-env-support branch June 12, 2026 08:07

XXPermanentXXand others added 4 commits June 12, 2026 14:24

chore(release): bump version to 1.3.1
0b7d4fb

chore: update r2v e2e test prompt and remove stale scheduled-tasks lock
0706cae

XXPermanentXX force-pushed the fix/proxy-env-support branch from dab4d33 to 712eb96Compare June 12, 2026 06:36

XXPermanentXX added 2 commits June 12, 2026 14:37

test: use leaf image prompt in video-ref r2v e2e
fe2d36e
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
ec96ef4
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) #51
Merged

XXPermanentXX closed this Jun 12, 2026

XXPermanentXX deleted the fix/proxy-env-support branch June 12, 2026 08:07

XXPermanentXXand others added 4 commits June 12, 2026 14:24

chore(release): bump version to 1.3.1
0b7d4fb

chore: update r2v e2e test prompt and remove stale scheduled-tasks lock
0706cae

XXPermanentXX force-pushed the fix/proxy-env-support branch from dab4d33 to 712eb96Compare June 12, 2026 06:36

XXPermanentXX added 2 commits June 12, 2026 14:37

test: use leaf image prompt in video-ref r2v e2e
fe2d36e
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
ec96ef4
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) #51
Merged

XXPermanentXX closed this Jun 12, 2026

XXPermanentXX deleted the fix/proxy-env-support branch June 12, 2026 08:07

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline)

Uh oh!

XXPermanentXX commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline)

Uh oh!

XXPermanentXX commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline)

Uh oh!

XXPermanentXX commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline)

Uh oh!

XXPermanentXX commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline)

Uh oh!

XXPermanentXX commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels